Question 1

Which of the following best represents a legal consideration for penetration testers in most jurisdictions?

Options :

A : The right to exploit any vulnerability found

B : Client data ownership post-engagement

C : Automatic immunity from legal prosecution

D : The requirement for written authorization

Answer: D

Question 2

Which of the following is not typically associated with passive information gathering?

Options :

A : DNS zone transfer

B : WHOIS lookup

C : Google Dorking

D : LinkedIn OSINT

Answer: A

Question 3

Which of the following tools does NOT support direct CVE-based vulnerability matching?

Options :

A : Nuclei

B : Nessus

C : Nikto

D : OpenVAS

Answer: C

Question 4

After getting initial access, you use netstat -ano and spot a suspicious service listening on port 5985. What service is this and how can it help?

Options :

A : RDP – Used for screen sharing

B : DNS – Internal name resolution

C : SMB – File sharing

D : WinRM – Can allow remote code execution via PS Remoting

Answer: D

Question 5

During a bug bounty assessment, you find a reflected XSS payload works only when clicking from an internal page and fails in direct request. What is likely protecting it?

Options :

A : HTTP-only cookie

B : CSRF token

C : Referer header validation

D : Content Security Policy

Answer: C