Packet crafting is correct because the tester is manually constructing customized packets with specific flags, payloads, and header values to test how security controls like firewalls and IDS respond, which is a hallmark of crafting packets for evasion and analysis purposes. Packet injection is incorrect because it involves inserting packets into an existing data stream rather than creating highly customized packets from scratch for testing. Packet filtering is incorrect because it refers to the process of allowing or blocking traffic based on rules, which is performed by defensive systems, not the tester. Packet sniffing is incorrect because it involves passively capturing network traffic rather than actively generating modified packets to test security controls. OBJ. 4.2

Send a text message with a malicious link to the organization's executives is correct because smishing is a form of phishing conducted via SMS text messaging, and delivering a malicious link through text directly tests mobile-based social engineering susceptibility. Send targeted emails with a malicious attachment to the sales team is incorrect because that describes an email-based phishing or spear phishing attack rather than SMS messaging. Call the CTO's assistant using a pretext to gather information about their schedule is incorrect because that scenario describes pretexting conducted via voice communication rather than a text-based attack. Send a targeted email with a malicious attachment to the organization's CEO is incorrect because that represents whaling or spear phishing delivered through email, not smishing. OBJ. 4.8

OBJ 4.2 - VLAN hopping is the act of illegally moving from one VLAN to another. A VLAN (virtual LAN) is a logical grouping of switch ports extending across any number of switches on an Ethernet network. One of the most common VLAN hopping methods is to overflow the MAC table on a vulnerable switch. When this occurs, the switch defaults to operating as a hub and repeats all frames being received through all of its ports. This "fail open" method ensures the network can continue to operate, but it is a security risk that can be exploited by the penetration tester. OBJ. 4.2 

DeepScan is an example of a static code analysis tool. It examines source code or bytecode without executing it, using techniques like data-flow analysis to identify potential issues such as security flaws or logic errors. Fuzzing is a dynamic analysis technique that tests a running program by feeding it invalid or random inputs to discover crashes, memory leaks, or unexpected behavior. A decompiler is a tool used in static analysis. It converts compiled executable code back into a higher-level source code format for review. It does not require the program to be executed. Fault injection is a dynamic analysis method used to simulate errors in a running system to observe its behavior and resilience. OBJ. 3.1

False negative is correct because the scanner failed to detect an existing vulnerability. True positive is incorrect because no vulnerability was reported. False positive is incorrect because the issue does exist. Informational is incorrect because the vulnerability is real and impactful. OBJ. 3.2

Search engine analysis is correct because the tester uses advanced search operators to locate sensitive information indexed by search engines without interacting with the target directly. Packet crafting is incorrect because it involves creating custom network packets. Web crawling is incorrect because it requires direct interaction with the target site. DNS enumeration is incorrect because it focuses on domain records rather than indexed files. OBJ. 2.1

OBJ 4.8 - A business email compromise (BEC) is a form of elicitation where the attacker impersonates a high-level executive or directly takes over their email account. The attacker then sends an email to elicit personnel to take action on their behalf. In this example, the attacker is impersonating the company's CEO by sending an email to the financial personnel requesting they send a money transfer for what appears to be a legitimate service. This example also uses the urgency and authority motivation factors to convince the employee to take action. OBJ. 4.8

Pentesters rarely need to modify log files, and it should not be conducted after an assessment/engagement has occurred. When an assessment is complete, the pentester should remove any shells, tester-created credentials, or tools from the victimized hosts to ensure an attacker does not utilize them against the organization, too. OBJ. 5.4

Transforms is correct because transforms are Maltego’s core automation mechanism that queries data sources and generates new linked entities based on an existing node, enabling scalable discovery of related infrastructure and user-associated artifacts during OSINT. Scripting Console is incorrect because it is used for custom scripting and interaction rather than executing predefined automated discovery queries. Graph View is incorrect because it visualizes results but does not perform automated data collection. Entity formatting is incorrect because it controls how entities are displayed rather than expanding investigative scope through external data enrichment. OBJ. 2.4

InSSIDer is correct because it passively identifies wireless networks, signal strength, and channel usage without actively interacting with them. Aircrack-ng is incorrect because it is used for attacking and cracking wireless security. Wireshark is incorrect because it focuses on packet-level analysis rather than structured wireless discovery. tcpdump is incorrect because it captures traffic but does not provide detailed wireless network mapping. OBJ. 2.4