Question 1

During a red team assessment, you discover credentials belonging to a third-party vendor while scanning a misconfigured internal share. You are unsure whether accessing the vendor’s systems is within scope. What is the most appropriate action?

Options :

A : Attempt access to validate the credentials.

B : Notify your team lead or point of contact immediately.

C : Log the finding in your report and proceed with testing.

D : Contact the vendor directly to ask for permission.

Answer: B

Question 2

Which protocol is most likely to reveal internal hostnames during DNS enumeration?

Options :

A : SMTP

B : HTTP

C : DNS

D : FTP

Answer: C

Question 3

You're conducting an internal assessment and notice a service on port 80. You use nc to connect and receive the banner: Server: Apache/2.4.38 (Debian).What should you do next?

Options :

A : Check Shodan for the public IP

B : Run DNS zone transfer

C : Search for known vulnerabilities in Apache 2.4.38

D : Perform a reverse DNS lookup

Answer: C

Question 4

Which field in Exploit-DB provides essential insight into whether an exploit is applicable to your target?

Options :

A : Description

B : Author

C : Platform

D : Verified status

Answer: D

Question 5

Your report is being reviewed by a CISO who is not technical. What reporting approach should you use to effectively communicate the findings?

Options :

A : Include all terminal output and Metasploit commands

B : Use business-impact language and prioritized summaries

C : Use business-impact language and prioritized summaries

D : Write the report in passive voice for professionalism

Answer: B