Chained exploit is correct because the script automates multiple attack steps in sequence, including command execution, file creation, FTP transfer, and establishing a shell, demonstrating the combination of multiple techniques into a single coordinated attack to achieve full compromise. Buffer overflow exploit is incorrect because it involves overwriting memory boundaries to execute arbitrary code and is not indicated by the scripted command chaining shown. SQL injection exploit is incorrect because it targets database queries through input manipulation, which is unrelated to executing system commands and transferring files via FTP and Netcat. Denial of Service exploit is incorrect because it focuses on disrupting availability rather than executing commands, transferring tools, and establishing persistent access as shown in the script. OBJ. 4.2

OBJ 2.4 - Using credentials from one machine to access others within the network is known as lateral movement. This post-exploitation activity involves moving from one compromised system to another to gain further access and control. Privilege escalation focuses on increasing access levels, persistence ensures ongoing access, and pivoting typically refers to using one compromised system as a launch point to attack other systems. OBJ. 2.4

Attrition attacks employ brute-force methods to compromise, degrade, or destroy systems, networks, or services. An impersonation attack occurs when the attacker gains control of an employee's account and uses it to convince other employees to perform fraudulent actions. Improper usage occurs when an employee or other authorized user utilizes the systems or networks not as intended or designed. The loss or theft of equipment usually relates to a smartphone, tablet, or laptop being lost or stolen, and then the data on it becomes compromised. OBJ. 4.3

Brute force occurs within 11,000 combinations is correct because WPS PIN authentication validates the first and second halves of the eight-digit PIN separately, reducing the effective keyspace from 100 million possibilities to approximately 11,000 attempts, making brute-force attacks highly feasible if lockout protections are not enforced. Utilizes a 40-bit encryption key is incorrect because that weakness is associated with WEP, not WPS. Utilizes a 24-bit initialization vector is incorrect because that vulnerability is also related to WEP’s IV reuse issue rather than WPS PIN authentication. Utilizes TKIP to secure the authentication handshake is incorrect because TKIP is associated with WPA/WPA2 security mechanisms and does not describe the core weakness of WPS PIN validation logic. OBJ. 4.7

OBJ 5.2: impacket-smbclient is part of the Impacket suite, which allows Tyler to interact with Windows systems using SMB (Server Message Block) protocol, enabling him to perform tasks like file transfers and command execution. netcat -lvp 4444 is used to listen for incoming connections, sshuttle -r user@host 0/0 is for setting up a VPN-like connection over SSH, and scp is used for secure file copying. OBJ. 5.2

password site:example.com is correct because the site: operator restricts search results to a specific domain, allowing the penetration tester to identify pages hosted on example.com that contain the word “password,” which could reveal sensitive information during OSINT reconnaissance.

password inurl:example.com is incorrect because the inurl: operator searches for pages whose URLs contain the specified term and would not restrict the results strictly to the target domain’s content.

password inanchor:example.com is incorrect because the inanchor: operator searches for pages where the anchor text contains the specified term rather than returning pages hosted on the target domain containing the keyword.

password link:example.com is incorrect because the link: operator returns pages that link to the target site rather than pages hosted directly on the domain containing the keyword.

OBJ. 2.1

OBJ 2.4 - The Subdomain Finder module in SpiderFoot is designed to discover subdomains associated with a domain, which can reveal parts of the infrastructure that might be vulnerable or misconfigured. The DNS Resolver is more about resolving domain names, Whois provides registration information, and Port Scanner focuses on open ports. OBJ. 2.4

To obtain older website information, you can use a standard cache search or a website archive. A standard cache search will produce a recent view of the website, but if the document you need has been removed for a long time this will be ineffective. Website archives like archive.org (home of the Wayback Machine) create cached and archived copies of billions of web pages going back decades. A network sniffer to capture API requests and responses is a form of active reconnaissance but it would not be useful in finding a specific webpage like the press release in this scenario. Conducting a website crawl can find hidden documents that are not indexed by search engines, but it will not find a document that has been removed or taken offline. OBJ. 2.1

Eavesdropping is correct because the attacker is passively intercepting and capturing data transmitted between two NFC devices without modifying or disrupting the communication. Jamming is incorrect because it involves actively interfering with or disrupting the communication channel rather than silently capturing transmitted data. Phishing is incorrect because it is a social engineering attack designed to trick users into revealing information through deceptive communication. Bluejacking is incorrect because it involves sending unsolicited messages over Bluetooth connections, not intercepting NFC-based communications. OBJ. 4.9

tcpdump -i eth0 "tcp port 80 and tcp[32:4] = 0x47455420" is correct because it filters traffic on TCP port 80 and matches the hexadecimal representation of the string "GET " at the correct offset within the TCP payload, allowing precise capture of HTTP GET requests. tcpdump -i eth0 "tcp port 80 and tcp contains 'GET'" is incorrect because tcpdump does not support a contains operator in this context and the syntax is invalid. tcpdump -i eth0 "port 80 and host GET" is incorrect because GET is not a valid host identifier and does not filter based on payload content. tcpdump -i eth0 "tcp[32:4] == GET" is incorrect because tcpdump requires hexadecimal byte comparisons rather than string literals for payload filtering. OBJ. 4.9