Offensive PowerShell script library (PowerSploit) is correct because it is a dedicated collection of PowerShell modules (like Persistence and AntivirusBypass) designed to aid in post-exploitation and hiding one's tracks; Vulnerability archive utility (Searchsploit) is incorrect because it is a tool for searching the Exploit-DB database for local and remote exploits; LLMNR/NBT-NS relay tool (Responder) is incorrect because it is used for credential harvesting and man-in-the-middle attacks via protocol poisoning; and Post-exploitation C2 platform (Empire) is incorrect because while it leverages PowerShell, it is a complete Command-and-Control framework rather than just a standalone library of modular scripts. 

Switch to digital or physiological access systems is correct because electronic or biometric locks eliminate the physical keyway, rendering traditional lock-picking tools useless; Deploy multi-step login verification for workstations is incorrect because MFA secures the operating system and data, but does not stop an intruder from physically entering the room; Expand the CCTV coverage throughout the facility is incorrect because surveillance is a detective control that records the event rather than a preventive control that physically blocks the picking attempt; and Upgrade cryptographic standards for wireless traffic is incorrect because network encryption is irrelevant to the mechanical security of a physical door.

Harvesting email addresses and contact information is correct because %40 is the URL-encoded version of the @ symbol, and searching for @domain.com forces the search engine to look for email patterns; To map out all subdomains and web-hosted directories is incorrect because that would require the site: operator; This query is syntactically incorrect is incorrect because search engines recognize URL encoding and the @ symbol as a valid search parameter; and To find every webpage where the company name appears is incorrect because a standard search for the domain name without the @ prefix would be used for that purpose. 

Browser-side script injection (XSS) is correct because the tester is exploiting the application's failure to sanitize input that is reflected back to the browser, allowing for client-side code execution (like the pop-up box); Relational database query manipulation is incorrect because the attack targets the user's browser environment rather than the backend database; Operating system shell execution is incorrect because the payload is restricted to the browser and does not execute commands at the system level; and Unauthorized state-changing request (CSRF) is incorrect because the vulnerability involves executing malicious code rather than tricking a victim into performing an unwanted action on a trusted site.

Leverage standardized libraries and object-oriented packages is correct because Python libraries like Scapy, Requests, or Socket provide reliable, pre-tested functions that eliminate the need to write complex protocol logic from scratch; Use hard-coded global variables is incorrect because it creates rigid scripts that are difficult to adapt to different network environments; Manually craft low-level TCP/UDP packets is incorrect because it is highly inefficient, error-prone, and unnecessary for common networking tasks; and Copy-paste utility functions is incorrect because it violates the "Don't Repeat Yourself" (DRY) principle, making the code harder to maintain and update. 

Container image and filesystem scanner (Grype) is correct because it is a specialized utility designed to find CVEs within container images and disk structures; Network login cracker (Hydra) is incorrect because it is used for automated password-guessing against network protocols; Wireless auditing suite (Aircrack-ng) is incorrect because its purpose is to monitor and attack 802.11 wireless networks; and Full-scale network vulnerability manager (OpenVAS) is incorrect because while it scans for flaws, it targets active network services and hosts rather than performing static analysis of container image layers. 

Dynamic code instrumentation engine (Frida) is correct because it allows researchers to inject scripts into running processes to intercept API calls and modify application logic in real-time; All-in-one mobile security framework (MobSF) is incorrect because it is a high-level automated testing platform that may use instrumentation but is not the core engine itself; Graphical network protocol analyzer (Wireshark) is incorrect because it is used for inspecting network traffic rather than modifying internal application execution; and Command-line packet capture utility (tcpdump) is incorrect because its function is limited to capturing and filtering raw network packets.

Reclassify the finding as a false positive is correct because the scanner's alert was based on inaccurate data (the banner) rather than an actual existing flaw; Validate the risk as a critical-level vulnerability is incorrect because the service is actually secure and the alert is misleading; Report the discrepancy to executive management is incorrect because false positives are part of the standard technical review process and do not require high-level escalation; and Attempt to weaponize and launch an exploit is incorrect because it is a waste of time to exploit a vulnerability that has been confirmed not to exist.

Dictionary-based attack is correct because the logs show a predefined list of common words and patterns being tested against a single targeted account; Credential reuse (Stuffing) is incorrect because that involves using leaked username/password pairs from other platforms; Multi-account password spraying is incorrect because that technique attempts one common password across many different users to avoid detection; and Exhaustive character brute-force is incorrect because it attempts every possible mathematical combination of characters rather than a list of likely words.

Registry auto-run key is correct because the command adds a value to the Run hive, which Windows checks during login to launch specific applications; Remote PowerShell management (WinRM) is incorrect because that protocol is used for remote command execution, not for setting up local boot-time persistence; Background system service is incorrect because that would require using the sc command or PowerShell to register the script as a managed service; and Scheduled execution trigger is incorrect because that technique utilizes the Task Scheduler (schtasks) to run a file based on time or system events.