• password inurl:example.com is correct because the inurl: operator restricts results to pages where the specified term appears within the URL itself, while also matching the keyword “password” in the page content. This allows a penetration tester to identify pages whose URLs include the target domain string, which may indicate exposed directories, mirrored content, or improperly indexed resources.
• password inanchor:example.com is incorrect because it searches for pages where the anchor text contains the domain, not the URL itself.
• password site:example.com is incorrect because it limits results to pages hosted on the target domain, rather than identifying URLs containing the domain string.
• password link:example.com is incorrect because it identifies pages that link to the domain, not pages where the domain appears in the URL.

OBJ. 2.1

On-path attack is correct because the tester is actively intercepting and relaying communication between the client and server, allowing them to present altered certificates and influence the session, which can result in anomalies such as unexpected certificate details or language differences. Denial-of-service attack is incorrect because it would disrupt availability rather than allow continued communication. ARP poisoning is incorrect because it is a specific technique used to facilitate interception on a local network, but the broader attack being described is the interception and manipulation of traffic itself. Reflective DNS attack is incorrect because it is used for amplification in DDoS scenarios, not for intercepting and modifying encrypted web sessions. OBJ. 4.2

Data Exfiltration is correct because data exfiltration focuses on transferring sensitive information out of the compromised environment in a controlled and covert manner, often using techniques such as encrypted channels, staging, or covert protocols to avoid detection. Privilege Escalation is incorrect because it involves gaining higher-level permissions rather than extracting data. Persistence is incorrect because it ensures continued access to the system but does not involve removing sensitive information. Lateral Movement is incorrect because it involves moving to additional systems within the network rather than extracting data from the current compromised host. OBJ. 2.3

OBJ 4.4: Log tampering involves altering or deleting log files to remove traces of an attacker’s actions on a compromised system. Bill is manipulating the event logs to hide his activities. Shell escape is unrelated, unquoted service path injection is a different form of exploitation, and time stomping refers to altering file timestamps to obscure when a file was accessed or modified but wouldn't be as effective in this scenario. OBJ. 4.4

The scan was incomplete is correct because systems being offline during the scan window means they were not assessed, leading to gaps in coverage. The scan results are valid is incorrect because not all systems were evaluated. The scan identified false positives is incorrect because the issue is missing data, not incorrect findings. The findings are fully verified is incorrect because the scan did not assess all assets. OBJ. 3.2

Rainbow table is correct because a rainbow table attack uses precomputed hash values mapped to possible plaintext passwords, significantly reducing the time required to crack hashes such as NTLM. Instead of calculating each hash during the attack, the attacker compares captured hashes against the precomputed table. Dictionary is incorrect because it attempts likely passwords from a wordlist without relying on precomputed hash tables. Brute-force systematically attempts all possible combinations and computes hashes dynamically. Hybrid combines dictionary words with brute-force variations but still requires real-time hash computation rather than relying on precomputed tables. OBJ. 4.3

OBJ 5.2: The wmic command allows Jake to execute commands on a remote machine using WMI. This command initiates PowerShell on the target machine to execute a script, enabling lateral movement. psexec \\remotePC -u admin -p password cmd.exe /c "script.bat", uses PsExec, which is a valid alternative but not WMI-based. net use \\remotePC /user:admin password is incorrect because it’s a network share connection, not a command execution method. ssh admin@remotePC 'powershell.exe -ExecutionPolicy Bypass -File C:\\scripts\\payload.ps1' involves using SSH, which is less common in Windows environments for lateral movement. OBJ. 5.2

DNS zone transfer, also sometimes known by the inducing DNS query type AXFR, is a DNS transaction type. It is one of the many mechanisms available for administrators to replicate DNS databases across a set of DNS servers. DNS zone transfers are an active technique. Performing a whois query is a passive reconnaissance technique that performs a query of the databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system, but is also used for a wider range of other information. Performing DNS forward and reverse lookups is an active technique that allows the resolution of names to IP addresses and IP addresses to names. This can be conducted as a passive technique. Maltego is used for open-source intelligence and forensics. It focuses on providing a library for data discovery from open sources and visualizing that information in a graph format suitable for link analysis and data mining. It collects this information passively since it can acquire the information from whois lookup servers, a DNS lookup tool using public DNS servers, or even emails and hostnames one can acquire from theHarvester. OBJ. 2.2

This scenario demonstrates adding persistence to a Windows server using PowerShell. The command creates a new service with a specified binary path. This allows the system to maintain persistence by executing the associated program whenever the service runs.

The service name used in the example is arbitrary and can be changed to any value chosen by the penetration tester to help conceal their persistence mechanism. OBJ. 5.1

OBJ 2.2 - The correct tool is enum4linux. It is specifically designed to enumerate information from Windows systems, such as user accounts, shared resources, and password policies. tcpdump is used for packet capturing, Netcat is a network utility for reading from and writing to network connections, and traceroute is used for tracing the route packets take to a network host. OBJ. 2.2