OBJ 4.4: A plaintext attack involves analyzing the ciphertext with the goal of uncovering the original plaintext message. This is commonly done in an attempt to break encryption, especially when the attacker has some knowledge of the plaintext. The other options do not involve decrypting or analyzing encrypted communications in this manner. OBJ. 4.4

Domain Search is correct because Hunter.io’s Domain Search feature enumerates publicly associated email addresses for a given domain and identifies the most common email pattern used by the organization, enabling a penetration tester to predict additional valid addresses for phishing simulation. Chrome Extension is incorrect because it provides browser-based convenience but does not independently analyze domain-wide patterns. Email Verifier is incorrect because it validates a single email address rather than identifying the organizational naming convention. Bulk Email Finder is incorrect because it is used to look up multiple known names at once, not to determine the underlying email structure pattern for the domain. OBJ. 2.4

OBJ 1.1: The Statement of Work (also called a Scope of Work) is a formal document stating what activities will and will not be performed during a penetration test. The SOW is a document that defines the expectations for a specific business arrangement, including the assessment's size and scope, a list of the assessment's objectives, and a list of deliverables for the assessment. A master service agreement, or MSA, is a contract reached between parties, in which the parties agree to most of the terms that will govern future transactions or future agreements. The MSA is used when a pentester will be on retainer for a multi-year contract, and an individual SOW will be issued for each assessment to define the individual scopes for each one. A non-disclosure agreement (NDA) is a legal contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes but wish to restrict access. A service level agreement (SLA) is a contract that outlines the detailed terms under which a service is provided, including reasons the contract may be terminated. OBJ. 1.1 

Changing hidden form values is correct because the attacker manipulated client-side parameters, such as hidden fields in an HTTP request, to alter the price before submission, exploiting improper server-side validation and allowing unauthorized modification of transaction data without triggering database or IDS alerts. SQL injection is incorrect because it involves injecting malicious SQL queries to manipulate or extract data from the database, which would typically leave evidence or impact the database directly. Cross-site scripting is incorrect because it involves injecting malicious scripts into web pages to affect other users’ browsers, not modifying transaction values in transit. Buffer overflow attack is incorrect because it exploits memory handling vulnerabilities in applications and is unrelated to manipulating client-side input fields in web transactions. OBJ. 4.5

Image and artifact tampering is correct because the scenario describes unauthorized modifications to software components within the build and deployment pipeline, specifically container images, which have been altered to include malicious code that executes when deployed. Logging information exposure is incorrect because it involves sensitive data being revealed in logs rather than modification of software artifacts. Third-party integrations is incorrect because it refers to risks introduced through external services or APIs, not compromised internal build artifacts. Resource misconfiguration is incorrect because it involves improper configuration of infrastructure components rather than the integrity compromise of software images or deployment artifacts. OBJ. 4.6

A compensating control is correct because compensating controls are implemented when a vulnerability cannot be fully remediated due to technical or business constraints, allowing the organization to reduce the likelihood or impact of exploitation by introducing alternative safeguards such as network restrictions, monitoring, or segmentation. A policy is incorrect because policies define organizational rules or intent but do not directly mitigate the technical risk posed by an exploitable vulnerability. Access requirements is incorrect because while restricting access may be part of a mitigation strategy, it represents a specific implementation rather than the broader concept of compensating controls used when full remediation is not possible. An engineering tradeoff is incorrect because it describes a design decision balancing competing priorities rather than a security control implemented to mitigate an existing vulnerability. OBJ. 1.5

Personalization is turned off is correct because the pws=0 parameter disables personalized search results that would normally be influenced by the tester’s browsing history or prior search behavior. Returns only Microsoft Excel spreadsheets is correct because the filetype:xls operator limits results to files with the Microsoft Excel spreadsheet format, which may contain sensitive operational data such as password lists or configuration exports. Returns only files hosted at diontraining.com is correct because the site:diontraining.com operator restricts the results to resources indexed from the specified domain. All search filters are deactivated is incorrect because filter=p disables directory filtering, not all filters. Excludes Microsoft Excel spreadsheets is incorrect because excluding spreadsheets would require the -filetype:xls operator. Find sites related to diontraining.com is incorrect because related site discovery would require the related: operator, which is not present in the query. OBJ. 2.1

The exposed secret is correct because hardcoded credentials present an immediate and severe risk, especially before deployment. The documentation issue is incorrect because it is not a vulnerability. The log file contents is incorrect because it is lower severity. The vulnerable library is incorrect because it is less critical than exposed credentials. OBJ. 3.1

Metadata exploitation is correct because the tester is querying an exposed instance metadata service to retrieve sensitive information such as IAM roles and temporary credentials, which is a common cloud attack vector when metadata endpoints are improperly secured. SQL injection is incorrect because it involves manipulating database queries through user input fields and is unrelated to querying instance metadata services. Container escape is incorrect because it refers to breaking out of a containerized environment to access the host system, which is not described in this scenario. Cross-site scripting is incorrect because it involves injecting client-side scripts into web applications, not accessing backend cloud metadata services. OBJ. 4.6

SQLmap is an open-source tool used to detect and exploit SQL injection vulnerabilities. This tool is included by default within Kali Linux. Dirbuster, Kismet, and theHarvester are not tools for conducting SQL vulnerability scans. Dirbuster is a brute force tool included with Kali Linux that is used to discover directories and file names on web and application servers. Kismet is an 802.11 Layer 2 wireless network detector, sniffer, and intrusion detection system included with Kali Linux that monitors wireless activity, identifies device types, and captures raw packets for later analysis. theHarvester is an open-source intelligence (OSINT) tool that gathers information such as email addresses, subdomains, hostnames, open ports, and banners from publicly available sources. OBJ. 4.5