OBJ 3.1 - In ICS environments, the availability of the system is the most critical security priority. These systems often control vital industrial processes, and any downtime can have severe consequences, including safety hazards and financial losses. While confidentiality and integrity are important, availability is paramount to ensure that the industrial processes remain uninterrupted. OBJ. 3.1

MX is correct because Mail Exchange records identify the mail servers responsible for receiving email on behalf of a domain, allowing a penetration tester to map the organization’s email infrastructure and potentially target those systems during phishing, mail relay testing, or SMTP-based attacks. SRV is incorrect because SRV records identify host and port information for specific services such as VoIP or messaging but are not used to designate mail servers. TXT is incorrect because TXT records store arbitrary text data commonly used for verification services and email authentication mechanisms such as SPF or DKIM but do not specify the mail servers that receive messages. NS is incorrect because Name Server records identify the authoritative DNS servers responsible for a domain’s DNS zone rather than the systems responsible for handling inbound email traffic. OBJ. 2.1

Use || is correct because the || operator in Bash performs a logical OR, meaning the condition evaluates to true if either HTTP or HTTPS is detected, which satisfies the requirement to log the host when at least one web service is available. Use && is incorrect because it requires both services to be running simultaneously, which does not meet the stated objective. Use ! is incorrect because it negates a condition rather than combining two service checks. Use == is incorrect because it is a comparison operator used to test equality and does not logically combine two separate conditional checks. OBJ. 2.3

Add the malicious domain name to your content filter and web proxy's block list is correct because blocking the domain at the web proxy or content filtering layer prevents internal users from resolving or reaching the phishing site, stopping the penetration tester’s credential-harvesting page even if a user clicks the link. Enable TLS on your organization's mail server is incorrect because TLS only encrypts email transmission and does not prevent users from accessing malicious websites linked within emails. Block the IP address of the malicious domain in your firewall's ACL is incorrect because attackers can quickly change the domain’s DNS records to point to a different IP address, bypassing the block. Forward this phishing email to all employees with a warning not to click on the embedded links is incorrect because redistributing the phishing message could inadvertently cause more users to click the malicious link and does not technically prevent access to the domain. OBJ. 1.5

TruffleHog is correct because it scans repositories and commit history to identify secrets such as API keys. Wireshark is incorrect because it analyzes network traffic. Nmap is incorrect because it performs network scanning. Nikto is incorrect because it scans web servers. OBJ. 3.1

OBJ 4.3 Henry's method involves using one or a few passwords across many accounts, which is indicative of a password spraying attack. Mask attacks are tailored based on character patterns; credential stuffing uses known credentials against many accounts; and dictionary attacks try all words in a list against a single account. OBJ. 4.3

OBJ 4.7 - Reviewing WPAD settings and testing a simulated proxy in a controlled environment allows an evaluation of WPAD-related risks without disrupting live systems. Deploying a rogue access point focuses on capturing user traffic, which is unrelated to WPAD. Attempting to brute-force proxy server credentials targets the proxy directly but does not address the vulnerabilities of WPAD. Monitoring proxy traffic examines real-time behavior but does not effectively assess misconfigurations in the WPAD protocol. OBJ. 4.7

OBJ 3.2 - This is a false positive because the scan flagged a vulnerability that does not actually exist, as the server is up to date. A true positive would indicate an actual outdated version​. OBJ. 3.2 

OBJ 5.2: The correct answer is Responder, a tool commonly used to create SMB relay attacks. It can capture and relay authentication requests, allowing the attacker to impersonate legitimate users and move laterally within the network. Nmap is primarily a network scanning tool, Hydra is used for brute-forcing credentials, and John the Ripper is a password-cracking tool, none of which are typically involved in relay creation for lateral movement. OBJ. 5.2

Base64 is correct because the string contains only valid Base64 characters and includes padding (= or ==), which is commonly used to encode binary or text data into an ASCII-safe format for transmission or obfuscation. ASCII is incorrect because it represents plain text characters directly and would not produce an encoded string with padding. XML is incorrect because it is a markup language, not an encoding scheme for data transformation. Hex is incorrect because hexadecimal encoding uses characters 0–9 and A–F, whereas the given string contains a broader character set consistent with Base64 encoding. OBJ. 4.1