Replay attack is correct because it involves capturing a legitimate authentication exchange and retransmitting it later to impersonate the original client, allowing the attacker to gain unauthorized access without needing to decrypt or crack the credentials. Relay attack is incorrect because it involves intercepting and forwarding communications between two parties in real time rather than storing and retransmitting previously captured data. Downgrade attack is incorrect because it forces a system to use weaker encryption or protocols, such as older SSL/TLS versions, rather than reusing captured authentication traffic. Fragmentation attack is incorrect because it targets weaknesses in packet handling, such as WEP fragmentation, to recover encryption material and does not rely on retransmitting previously captured authentication exchanges. OBJ. 4.2

OBJ 1.1: Penetration testers must be careful to conduct their activities within the boundaries of the negotiated contract and scoping documents. If the penetration tester conducts activities outside of the authorized scope, they could be fined or their company could have fees levied against it. Even worse, depending on the local, state, and country laws in the location where they are operating, the penetration tester could have criminal charges issued against them for unlawful hacking. The initial contract would not be voided by the company since a contract cannot be unilaterally voided by a single party of the contract. OBJ. 1.1

OBJ 1.1: Any organization that processes a credit card will be required to work with their credit card processor instead of working directly with the card issuers (Visa and Mastercard). Conducting notification to your bank or credit card processor is one of the first steps in the incident response effort for a breach of this type of data. Typically, law enforcement does not have to be notified of a data breach at a commercial organization. OBJ. 1.1

True positive is correct because the scanner accurately identified a vulnerability that truly exists on the target system, and manual validation confirmed the finding. False positive is incorrect because that would indicate the scanner reported a vulnerability that does not actually exist. False negative is incorrect because it would mean the scanner failed to detect a real vulnerability. True negative is incorrect because it would indicate the system is secure and correctly reported as having no vulnerabilities, which is not the case here. OBJ. 3.2

Supply chain attack is correct because the attacker inserted malicious code during the software build and distribution process, allowing the compromise to propagate through trusted update mechanisms into production systems where it enabled remote access. Workload runtime attack is incorrect because it involves exploiting vulnerabilities in actively running applications or containers rather than compromising the build or delivery pipeline. Social engineering is incorrect because it relies on manipulating individuals to gain access or information, which is not indicated in this scenario. Container escape is incorrect because it involves breaking out of a containerized environment to access the host system, which is unrelated to introducing malicious code during the build process. OBJ. 4.6

OBJ 1.1: The learning management system (LMS) is a web application, therefore the source IP of the attacking workstation needs to be added to the web application firewall’s allow list to prevent it from being blocked. Adding a source IP address to the allow list will exclude it from ACL rules and other signatures. This prevents an active device, like a web application firewall (WAF), layer 4 firewall, or an intrusion protection system (IPS) from blocking the penetration tester during the assessment. By having your IP added to the allow list, you can focus your time and efforts on finding vulnerabilities with the servers themselves instead of trying to break through a compensating control like a WAF or IPS. OBJ. 1.1

An SSL stripping attack, also known as an HTTP downgrade attack, forces the client to communicate with the web server in plain text (unencrypted) over HTTP instead of HTTPS. Both SSL downgrade and SSL stripping attacks are used to force the victim into using a weaker encryption mechanism (SSL downgrade to SSL-based HTTPS) or no encryption (SSL stripping to HTTP) for its web traffic. OBJ. 4.7

InSSIDer is correct because it provides a visual analysis of wireless networks, including signal strength and channel usage, which is useful for identifying interference and planning rogue AP placement. Aircrack-ng is incorrect because it is primarily used for attacking wireless encryption rather than passive analysis. Wireshark is incorrect because it captures packet-level data but does not provide structured channel visualization. tcpdump is incorrect because it captures traffic but lacks wireless-specific analysis features. OBJ. 2.4

OBJ 2.4 - Maltego excels at creating visual graphs that display the connections and relationships between various entities, such as IP addresses, domains, and email addresses. This visual approach makes it easier to understand the target’s network and identify potential points of interest. OBJ. 2.4 

Wireshark is correct because it provides deep packet inspection, session reconstruction, and detailed protocol analysis in a graphical interface. tcpdump is incorrect because it captures packets but offers limited analysis capabilities. Netcat is incorrect because it is used for network communication. Nmap is incorrect because it performs scanning rather than packet inspection. OBJ. 2.4