OBJ 4.6: Pacu is an open-source AWS exploitation framework designed for testing the security of AWS environments, including identifying and exploiting IAM misconfigurations. ScoutSuite is used for multi-cloud security auditing, CloudSploit scans for security risks in cloud infrastructure, and Prowler is an AWS security best practices assessment tool. While these tools are related to cloud security, Pacu is specifically designed for exploitation in penetration tests. OBJ. 4.6 

OBJ 4.2: Hydra is a popular tool used for brute-force attacks, particularly against services like SSH. In this scenario, Barry should configure Hydra to perform a dictionary attack using a wordlist, which is a common method to attempt to guess passwords. Hydra does not exploit vulnerabilities, is not intended for denial-of-service attacks, and is not a tool for on-path attacks; but for password guessing through brute-force methods. OBJ. 4.2

Bluejacking is correct because it involves sending unsolicited messages or data to Bluetooth-enabled devices, exploiting weaknesses in Bluetooth configurations such as discoverable mode to interact with or potentially compromise paired devices. Smurfing is incorrect because it is a distributed denial-of-service attack that uses spoofed ICMP echo requests and is unrelated to Bluetooth exploitation. Multiplexing is incorrect because it refers to combining multiple signals over a shared medium and is not an attack technique. Zero-day attack is incorrect because it refers to exploiting an unknown or unpatched vulnerability rather than specifically targeting Bluetooth-based communication weaknesses. OBJ. 4.9

Side-channel attack is correct because the tester is attempting to infer sensitive information by observing physical characteristics of shared resources, such as CPU cache timing and execution patterns, which is the defining behavior of side-channel analysis in multi-tenant environments. On-path attack is incorrect because it involves intercepting or modifying communications between systems rather than analyzing shared hardware characteristics. Cross-site scripting is incorrect because it targets client-side execution through injected scripts in web applications, not hardware-level data leakage. Resource exhaustion is incorrect because it focuses on consuming system resources to degrade availability rather than extracting sensitive information through indirect observation. OBJ. 4.6

Most wireless networks utilize end-to-end encryption, whereas wired networks do not. Physical accessibility is another major difference between wireless and wired networks since wireless networks can be accessed from a distance using powerful antennas. Authentication, MAC filtering, and network access control (NAC) can be implemented equally on wired and wireless networks. Port security is only applicable to wired networks. OBJ. 2.1

Encapsulate logic in a function is correct because it allows reuse of code, reduces duplication, and improves maintainability. Replace variables with static values is incorrect because it reduces flexibility. Add additional output statements is incorrect because it increases verbosity without improving structure. Convert output to text files is incorrect because it does not address code duplication. OBJ. 2.3

https://www.example.com/admin/password-policy.html is correct because the inurl: operator returns pages whose URL contains the specified string. Since the query specifies inurl:example.com, the returned result must contain that exact string in the URL, and the page content must also contain the keyword password. https://www.othersite.org/password-reset is incorrect because the URL does not contain the string example.com. https://www.passworddumps.com/example is incorrect because the URL contains example but not example.com, which is required by the search operator. https://www.sample.com/example/password-guide is incorrect because the URL also lacks the exact string example.com. OBJ. 2.1

HTTP is correct because it transmits data, including authentication credentials, in plaintext without encryption, allowing an attacker using a network sniffer on the same network (such as a rogue AP) to capture usernames and passwords during transmission. DNS is incorrect because it is used for domain name resolution and does not transmit login credentials in a way that would expose passwords during typical usage. TFTP is incorrect because it is a simple file transfer protocol that lacks authentication but is not commonly used for webmail login sessions where credentials would be captured in this scenario. SSL is incorrect because it provides encryption for data in transit, protecting credentials from being captured in plaintext, which contradicts the scenario where credentials were successfully intercepted. OBJ. 4.3

Write the DNS lookup code within a class and call it when needed is correct because encapsulating DNS lookup functionality within a class promotes modular design, reduces duplication, and allows the method to be reused across multiple enumeration workflows, improving maintainability and scalability of the reconnaissance tool. Hard-code the DNS lookup multiple times and Repeat the DNS lookup code at every necessary step are incorrect because they violate modular design principles and increase the risk of errors or inconsistent behavior. Use the print statement each time is incorrect because print only outputs information and does not perform DNS resolution logic. OBJ. 2.3

Installing security turnstiles that allow only one person through at a time is correct because turnstiles enforce a physical one-person-per-authentication mechanism, preventing additional individuals from entering behind an authorized user and therefore directly mitigating tailgating attempts during a physical penetration test. Placing security guards at entry points to check badges manually is incorrect because this control relies on human vigilance and can be bypassed if the guard is distracted or fails to notice someone closely following an authorized individual. Using facial recognition systems to authenticate users is incorrect because although it verifies identity, it does not inherently prevent a second person from entering immediately behind an authenticated user. Requiring employees to complete security awareness training is incorrect because training improves awareness but does not provide a physical barrier capable of stopping a determined tester from tailgating into a restricted area. OBJ. 3.3