A load balancer is used to ensure network hosts receive a response to a request in a timely manner by redirecting requests across several servers. Due to this, load balancers may inadvertently misdirect probes or attacks to a different server than the penetration tester initially targeted. Wireless access points, intrusion detection systems, and network sniffers are passive devices and do not redirect inbound traffic from a penetration tester. OBJ. 2.2

OBJ 1.1: A Scope of Work (SOW) for a penetration test normally contains the list of excluded hosts. This ensures that the penetration tester does not affect hosts, workstations, or servers outside the assessment scope. The timing of the scan and the maintenance windows are usually found in the rules of engagement (ROE). The executive summary report contents are usually not identified in any of the scoping documents, only the requirement of whether such a report is to be delivered at the end of the assessment. OBJ. 1.1

Account enumeration is correct because the tester is identifying valid usernames based on differences in authentication responses. Service discovery is incorrect because it identifies running services. OS fingerprinting is incorrect because it determines operating system characteristics. Protocol enumeration is incorrect because it identifies supported communication protocols rather than user accounts. OBJ. 2.2

Ping sweep is correct because it quickly identifies live hosts on a network with minimal overhead before deeper enumeration begins. Full TCP connect scan is incorrect because it is slower and more intrusive. Service version detection is incorrect because it requires additional probing after hosts are identified. Directory brute forcing is incorrect because it targets web applications, not network hosts. OBJ. 2.2

nmap -sT 192.168.1.1-254 is correct because a TCP connect scan (-sT) does not require raw socket privileges and uses the operating system’s networking stack to establish full TCP connections, making it reliable and suitable for scripted automation across a subnet. nmap -A 192.168.1.1-254 is incorrect because it enables aggressive scanning features such as OS detection and version enumeration, which increases scan time and is not focused on quick TCP port identification. nmap -O 192.168.1.1-254 is incorrect because it is used for operating system detection rather than scanning for open ports. nmap -sU 192.168.1.1-254 is incorrect because it performs a UDP scan, which is slower and not aligned with the requirement to quickly identify open TCP ports. OBJ. 4.10

It pinpoints the physical location of access points is correct because analyzing RSSI values while moving through the environment allows the tester to triangulate and physically locate the source of a wireless signal, which is critical when identifying rogue access points inside a facility. It decrypts the traffic from access points is incorrect because decryption requires key material and specialized attacks, not signal strength measurement. It identifies the SSID of hidden networks is incorrect because hidden SSIDs require packet capture of association traffic rather than simple signal strength analysis. It automatically blocks unauthorized access points is incorrect because detection tools do not inherently perform enforcement or mitigation actions. OBJ. 3.1

OBJ 1.5: The Microsoft Endpoint Configuration Manager (MECM) provides remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software inventory. In an Azure environment, you can also use the Update Compliance tool to monitor your device's Windows updates, Windows Defender anti-virus status, and the up-to-date patching status across all of your Windows 10 workstations. In previous Windows versions, you could use the Microsoft Baseline Analyzer (MSBA), but that is no longer supported when Windows 10 was introduced. A PowerShell script may be a reasonable option, but it would take a knowledgeable analyst to create the script and scan the network, whereas using SCCM is easier and quicker. Manually checking the Update History or registry of each system could also work, but that is very time-consuming and inefficient, especially if Ryan is supporting a large network. OBJ. 1.5

Directory traversal is correct because the log entries contain patterns such as ../ within the requested paths, which are commonly used to navigate outside the web root directory and access restricted files or scripts. This technique allows attackers to bypass normal directory restrictions and potentially retrieve sensitive system files or execute unauthorized code. SQL injection is incorrect because there are no database query manipulations or SQL syntax present in the requests. XML injection is incorrect because the logs do not show any XML payloads or structure manipulation. Password spraying is incorrect because there is no evidence of authentication attempts across multiple accounts using a common password. OBJ. 4.5

Whaling is correct because it specifically targets senior executives or high-profile individuals such as CEOs, CFOs, and board members using highly tailored messaging to exploit their authority or access to financial systems. Spear phishing is incorrect because although it involves targeted emails, it does not specifically focus on executive-level victims and can apply to any selected group. Phishing is incorrect because it typically involves broad, untargeted campaigns sent to large groups of recipients. Vishing is incorrect because it involves voice-based social engineering conducted over telephone or VoIP rather than email-based targeting of executives. OBJ. 4.8

OBJ 4.3: Agatha's successful password spraying attack indicates that the company has weak password policies, allowing common passwords to be used across multiple accounts. Misconfigured firewalls, vulnerable web applications, and insufficient network segmentation are not directly related to the weakness exploited by password spraying. OBJ. 4.3