OBJ 3.2 - Scan completeness refers to verifying that all the targeted IPs, ports, and services have been scanned, ensuring nothing was missed. It focuses on covering the full scope of the scan. OBJ. 3.2

A sophisticated adversary may discover the software's embedded key through reverse engineering the source code. This inadvertent key disclosure could then allow an attacker to abuse the API in ways other than intended. Key management would still be required, even if the key is embedded in the source code. Permission levels of a software-embedded key are still controlled like any other key. While the added inconvenience of installing new software on the client side every time the key is changed would be inconvenient, this option does not address the underlying security issues with embedding API keys into the source code. OBJ. 3.2

The command schtasks (Task Scheduler) can be used on a Windows 10 host to create and run a task at specified times or time intervals. In this scenario, the Task Scheduler is being used to create a task named “backdr” on the currently victimized host. This task will run the backdoor.bat script each time the task is run. The task will run once every 30 days (DAILY /mo 30). The task is being run with the SYSTEM account’s permissions (/ru).

The enable command configures the service to start automatically at boot, which is essential for persistence. The start command only runs the service for the current session, which means it stops on reboot. restart is useful if a service is already running and needs to be reloaded, but it doesn’t alter startup behavior. status simply shows the current state and does not change anything. OBJ. 5.1 

Reclassify the result is correct because the vulnerability does not apply due to backported patches, requiring adjustment of the finding. Escalate immediately is incorrect because the issue is not valid. Mark as confirmed is incorrect because it is not a true vulnerability. Ignore all similar findings is incorrect because each finding must be evaluated individually. OBJ. 3.2

The proper syntax for netcat (nc) is -l to signify listening and -p to specify the listening port. Then, the | character allows multiple commands to execute during a single command’s execution. Next, netcat sends the data to the given IP (192.168.1.76) over port 443. This is a common technique to bypass the firewall by sending traffic over port 443 (a secure SSL/TLS tunnel). OBJ. 4.1 

mimikatz is correct because it is specifically designed to extract credentials, including plaintext passwords and NTLM hashes, from LSASS memory, making it a primary tool for credential dumping during post-exploitation. ipconfig /all is incorrect because it displays network configuration details and does not interact with memory or credentials. net use is incorrect because it is used to manage network connections and shared resources, not to extract authentication data. dir /s is incorrect because it lists files and directories recursively and has no capability to access or dump credentials from memory. OBJ. 5.2

Connections between email addresses is correct because Maltego transforms are designed to correlate OSINT entities and visually display how identifiers such as email accounts, domains, and infrastructure are connected, which helps penetration testers map relationships for reconnaissance and targeting. Secure communication channels within a network is incorrect because Maltego does not analyze encrypted network traffic or internal communication paths. Timeline of website design changes is incorrect because historical web content analysis is typically performed using tools like the Wayback Machine. Signal strength of nearby wireless networks is incorrect because wireless signal profiling requires tools such as Kismet or InSSIDer rather than Maltego’s entity-mapping capabilities. OBJ. 2.4

OBJ 5.4: Preserving artifacts such as logs and screenshots is important for documentation and future reference by the client. These artifacts should be securely stored and handed over to the client, as they may be needed for compliance or incident response purposes. Deleting or publicly sharing these artifacts would be inappropriate and could lead to security or privacy concerns. OBJ. 5.4

Cross-reference the script output with updated security patches manually is correct because discrepancies between automated tools can occur due to superseded patches, cumulative updates, or differences in detection logic. Additionally, manually verifying patch installation against vendor advisories and current CVE remediation guidance ensures the script’s logic accurately reflects real-world patch states. Increasing execution speed does not resolve logical or data-validation discrepancies. Changing the Nessus report format does not affect vulnerability detection accuracy. Disabling Nessus and relying solely on the script is inappropriate because independent validation requires comparing multiple reliable sources rather than eliminating one. OBJ. 3.2