1Which cryptographic technique involves adding a random string of characters to a password before hashing it to defend against rainbow table attacks?
A.Padding
B.Peppering
C.Salting
D.Stretching
Correct Answer: Salting
Explanation:
Salting involves appending a unique, random string (the salt) to the password before hashing: . This ensures that identical passwords have different hashes, rendering pre-computed rainbow tables ineffective.
Incorrect! Try again.
2In the context of Windows password cracking, why is the LM (LAN Manager) hash considered significantly weaker than NTLM?
A.It is salted by default.
B.It uses AES encryption.
C.It supports passwords up to 128 characters.
D.It splits the password into two 7-character chunks.
Correct Answer: It splits the password into two 7-character chunks.
Explanation:
The LM hash converts the password to uppercase, pads it to 14 characters, and splits it into two 7-character blocks. Each block is hashed separately, making it trivial to brute-force compared to hashing the full string.
Incorrect! Try again.
3What is the primary purpose of a 'Rainbow Table' in password cracking?
A.To encrypt passwords using a reversible algorithm.
B.To offer a time-memory trade-off for faster hash lookup.
C.To perform an online brute force attack.
D.To salt hashes automatically.
Correct Answer: To offer a time-memory trade-off for faster hash lookup.
Explanation:
Rainbow tables are pre-computed tables of hash chains used to reverse cryptographic hash functions. They trade storage space (memory) for reduced computational time when cracking hashes.
Incorrect! Try again.
4Which command is used in Linux to list all users currently on the system?
A.ls /home
B.cat /etc/passwd
C.net user
D.cat /etc/shadow
Correct Answer: cat /etc/passwd
Explanation:
The /etc/passwd file contains the list of system users and their attributes. While /etc/shadow contains passwords, it requires root privileges and is not the primary method just for listing user accounts.
Incorrect! Try again.
5During a system hacking engagement, an attacker gains access to a machine but has limited privileges. The attacker uses a kernel vulnerability to gain root access. What is this process called?
A.Lateral Movement
B.Pivoting
C.Vertical Privilege Escalation
D.Horizontal Privilege Escalation
Correct Answer: Vertical Privilege Escalation
Explanation:
Vertical Privilege Escalation (PrivEsc) is the act of moving from a lower-privileged user account to a higher-privileged one (e.g., User to Admin/Root) on the same system.
Incorrect! Try again.
6Which of the following is a specific type of attack where a hacker hides malicious code inside a legitimate file or program?
A.Wrappers/Binders
B.Steganography
C.Rootkit
D.Polymorphism
Correct Answer: Wrappers/Binders
Explanation:
Wrappers (or binders) are programs used to combine a malicious executable (payload) with a legitimate legitimate executable (carrier), such that both run when the user clicks the file.
Incorrect! Try again.
7In the context of Reverse Engineering, what is the function of a Disassembler?
A.It converts machine code into assembly language.
B.It converts high-level code to machine code.
C.It modifies the source code dynamically.
D.It executes the code step-by-step.
Correct Answer: It converts machine code into assembly language.
Explanation:
A disassembler translates binary machine code (0s and 1s) back into assembly language mnemonics (like MOV, JMP, POP) for analysis.
Incorrect! Try again.
8Which hexadecimal value represents the NOP (No Operation) instruction in x86 architecture, often used in buffer overflow exploits?
A.0x90
B.0x00
C.0xFF
D.0x80
Correct Answer: 0x90
Explanation:
The opcode 0x90 represents the NOP instruction on x86 processors. Attackers use a 'NOP Sled' to guide the execution flow towards their shellcode.
Incorrect! Try again.
9What is the primary characteristic of a Reverse Shell?
A.The victim machine initiates a connection back to the attacker's machine.
B.The attacker connects to the victim's listening port.
C.It only works over UDP.
D.It requires the victim to have a public IP address.
Correct Answer: The victim machine initiates a connection back to the attacker's machine.
Explanation:
In a reverse shell, the target system executes code that connects back to the attacker's listening port. This is often used to bypass firewalls that block incoming connections but allow outgoing traffic.
Incorrect! Try again.
10Which tool is commonly used to extract passwords and hashes from memory (LSASS) on a Windows system?
A.Mimikatz
B.Nmap
C.Wireshark
D.John the Ripper
Correct Answer: Mimikatz
Explanation:
Mimikatz is a post-exploitation tool that dumps passwords, hashes, PINs, and Kerberos tickets from memory (specifically the Local Security Authority Subsystem Service - LSASS).
Incorrect! Try again.
11In Linux Privilege Escalation, what does the SUID bit allow?
A.It prevents the file from being deleted.
B.It allows the file to run automatically at startup.
C.It allows a user to execute a file with the permissions of the file owner.
D.It makes the file hidden.
Correct Answer: It allows a user to execute a file with the permissions of the file owner.
Explanation:
SUID (Set User ID) allows a file to be executed with the privileges of the owner (often root), rather than the user running it. If a vulnerable binary has the SUID bit set, it can lead to privilege escalation.
Incorrect! Try again.
12Which Windows command is used to manipulate file attributes to hide files as part of maintaining persistence?
A.attrib +h file.txt
B.chown hidden file.txt
C.chmod +h file.txt
D.hide file.txt
Correct Answer: attrib +h file.txt
Explanation:
The attrib command in Windows allows users to change file attributes. The +h flag sets the 'Hidden' attribute.
Incorrect! Try again.
13What is DLL Hijacking?
A.Decrypting a DLL file.
B.Injecting code into a running process.
C.Deleting system DLLs to cause a crash.
D.Replacing a legitimate DLL with a malicious one in a directory searched by the application.
Correct Answer: Replacing a legitimate DLL with a malicious one in a directory searched by the application.
Explanation:
DLL Hijacking exploits the search order used by Windows to load Dynamic Link Libraries. If an attacker places a malicious DLL in a directory searched before the system directory, the application loads the malicious code.
Incorrect! Try again.
14Which type of rootkit operates at the same privilege level as the Operating System kernel (Ring 0)?
A.Kernel-mode Rootkit
B.Application-level Rootkit
C.Library-level Rootkit
D.User-mode Rootkit
Correct Answer: Kernel-mode Rootkit
Explanation:
Kernel-mode rootkits run in Ring 0 (the highest privilege level). They can intercept system calls and manipulate kernel data structures, making them extremely difficult to detect and remove.
Incorrect! Try again.
15Which Python library is most frequently used for network interaction and crafting custom packets in scripting exploits?
A.Matplotlib
B.NumPy
C.Pandas
D.Scapy
Correct Answer: Scapy
Explanation:
Scapy is a powerful interactive packet manipulation program in Python. It is used to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more.
Incorrect! Try again.
16When analyzing exploit code, what is the purpose of the payload?
A.To find the vulnerability.
B.To crash the service.
C.To encrypt the connection.
D.The code that runs on the target system after exploitation.
Correct Answer: The code that runs on the target system after exploitation.
Explanation:
The payload is the actual malicious code (e.g., a reverse shell, a user creation script) that is executed once the vulnerability has been successfully exploited.
Incorrect! Try again.
17What is the specific vulnerability related to 'Unquoted Service Paths' in Windows?
A.Services that cannot be stopped.
B.Paths containing spaces not enclosed in quotes allow execution of arbitrary executables.
C.Services running without a password.
D.Services running as LocalSystem.
Correct Answer: Paths containing spaces not enclosed in quotes allow execution of arbitrary executables.
Explanation:
If a service path contains spaces (e.g., C:\Program Files\My Service\service.exe) and is unquoted, Windows might try to execute C:\Program.exe. Attackers can place a malicious executable named Program.exe to escalate privileges.
Incorrect! Try again.
18Which Linux command helps identify commands a user can run as another user (often root) without a password?
A.cat /etc/sudoers
B.sudo -l
C.su root
D.whoami
Correct Answer: sudo -l
Explanation:
The sudo -l command lists the allowed (and forbidden) commands for the invoking user on the current host, which is crucial for identifying misconfigurations for privilege escalation.
Incorrect! Try again.
19What does the technique Steganography entail?
A.Cracking passwords using GPU.
B.Flooding a server with requests.
C.Intercepting network traffic.
D.Hiding data within another file, such as an image or audio file.
Correct Answer: Hiding data within another file, such as an image or audio file.
Explanation:
Steganography is the art and science of hiding information by embedding messages within other, seemingly harmless messages or media (like modifying the Least Significant Bit of image pixels).
Incorrect! Try again.
20Which Metasploit payload executes a payload within the memory of the compromised process without writing to the disk?
A.Meterpreter
B.Command Shell
C.Bind Shell
D.VNC Inject
Correct Answer: Meterpreter
Explanation:
Meterpreter is an advanced, dynamically extensible payload that uses in-memory DLL injection. It resides entirely in memory and writes nothing to the disk, helping avoid antivirus detection.
Incorrect! Try again.
21In a brute-force attack, if the password length is and the character set size is , what is the complexity of the attack?
A.
B.
C.
D.
Correct Answer:
Explanation:
The total number of possible combinations for a password of length using a character set of size is calculated as ( times), which is .
Incorrect! Try again.
22Which registry key is commonly targeted for maintaining persistence on Windows so that malware runs on user login?
The Run and RunOnce registry keys define programs that execute automatically when a user logs in. Attackers add entries here to ensure their malware survives reboots.
Incorrect! Try again.
23What is NTFS Data Hiding using Alternate Data Streams (ADS)?
A.Hiding a file inside another file's metadata stream on NTFS filesystems.
B.Moving files to a hidden partition.
C.Deleting the file allocation table.
D.Encrypting the hard drive.
Correct Answer: Hiding a file inside another file's metadata stream on NTFS filesystems.
Explanation:
NTFS ADS allows data to be stored in hidden streams attached to a file. For example, notepad file.txt:secret.exe can hide an executable behind a text file.
Incorrect! Try again.
24Which of the following tools is a popular open-source reverse engineering framework developed by the NSA?
A.Ghidra
B.OllyDbg
C.Radare2
D.IDA Pro
Correct Answer: Ghidra
Explanation:
Ghidra is a software reverse engineering (SRE) suite of tools developed by the NSA, featuring a disassembler and a decompiler.
Incorrect! Try again.
25What is Dirty COW (CVE-2016-5195)?
A.A Windows SMB exploit.
B.A Linux kernel privilege escalation vulnerability.
C.A method for SQL injection.
D.A password cracking tool.
Correct Answer: A Linux kernel privilege escalation vulnerability.
Explanation:
Dirty COW is a famous privilege escalation vulnerability in the Linux Kernel aimed at the Copy-On-Write (COW) mechanism, allowing an unprivileged user to write to read-only files (like /etc/passwd).
Incorrect! Try again.
26In the context of scripting for pen-testing, what is Bash primarily used for?
A.Developing web applications.
B.Reverse engineering binaries.
C.Windows kernel exploitation.
D.Automating tasks in Unix/Linux environments.
Correct Answer: Automating tasks in Unix/Linux environments.
Explanation:
Bash (Bourne Again SHell) is the default command-line interpreter for most Linux distributions and is heavily used to script and automate sequences of commands.
Incorrect! Try again.
27Which attack involves capturing the NTLM hash of a user and using it to authenticate without cracking the password?
A.Golden Ticket
B.Dictionary Attack
C.Brute Force
D.Pass the Hash
Correct Answer: Pass the Hash
Explanation:
Pass the Hash (PtH) allows an attacker to authenticate to a remote server or service using the underlying NTLM hash of a user's password instead of the plaintext password.
Incorrect! Try again.
28What is the purpose of timestomping in post-exploitation?
A.Crashing the system time service.
B.Slowing down the CPU to evade detection.
C.Modifying file timestamps (access, modify, create) to hide malicious activity.
Timestomping involves changing the 'Modified', 'Accessed', and 'Created' timestamps of malicious files to match system files, making them harder to spot during forensic analysis.
Incorrect! Try again.
29Which command allows you to view the currently loaded modules and their memory addresses in a Windows debugging environment like OllyDbg?
A.Call Stack
B.Memory Map
C.Executable Modules
D.CPU Registers
Correct Answer: Executable Modules
Explanation:
Viewing Executable Modules allows a reverse engineer to see which DLLs are loaded and their base addresses, which is crucial for bypassing ASLR (Address Space Layout Randomization).
Incorrect! Try again.
30What does the command chmod 4755 filename do in Linux?
A.Sets the file to read-only.
B.Deletes the file.
C.Hides the file.
D.Sets the SUID bit on the file.
Correct Answer: Sets the SUID bit on the file.
Explanation:
The '4' in 4755 represents the SUID (Set User ID) bit. This permission setting allows the file to be executed with the permissions of the owner.
Incorrect! Try again.
31Which tool is primarily designed for performing online password attacks against network services (FTP, SSH, Telnet)?
A.Ophcrack
B.John the Ripper
C.Hashcat
D.Hydra
Correct Answer: Hydra
Explanation:
Hydra is a parallelized login cracker which supports numerous protocols to attack network services (online attacks), whereas John the Ripper and Hashcat are primarily for offline hash cracking.
Incorrect! Try again.
32In a Buffer Overflow attack, the attacker attempts to overwrite the EIP register. What does EIP stand for?
A.Extended Internal Process
B.Extended Instruction Pointer
C.Extended Index Pointer
D.Extended Immediate Pointer
Correct Answer: Extended Instruction Pointer
Explanation:
EIP (Extended Instruction Pointer) is a register in x86 architecture that contains the memory address of the next instruction to be executed. Controlling EIP means controlling the execution flow.
Incorrect! Try again.
33Which of the following is a method of covering tracks on a Windows system?
A.Using wevtutil cl to clear event logs.
B.Creating a new user.
C.Running ipconfig.
D.Running whoami.
Correct Answer: Using wevtutil cl to clear event logs.
Explanation:
wevtutil is a Windows tool to retrieve information about event logs and publishers. The cl (clear-log) command is used to clear specific event logs (e.g., Security, System) to hide evidence.
Incorrect! Try again.
34What is the primary function of a Keylogger?
A.To record every keystroke made by the user.
B.To log network traffic.
C.To encrypt user files.
D.To log into the system automatically.
Correct Answer: To record every keystroke made by the user.
Explanation:
Keyloggers are surveillance software (or hardware) that has the capability to record every keystroke made on a computer to steal passwords and sensitive data.
Incorrect! Try again.
35Which Windows feature can be exploited by pressing the SHIFT key 5 times?
A.Mouse Keys
B.Filter Keys
C.Toggle Keys
D.Sticky Keys
Correct Answer: Sticky Keys
Explanation:
The Sticky Keys feature is activated by pressing SHIFT 5 times. Attackers can replace sethc.exe (Sticky Keys binary) with cmd.exe to gain a SYSTEM shell at the login screen.
Incorrect! Try again.
36What is the purpose of Pivoting in penetration testing?
A.Rotating the screen display.
B.Changing the password frequently.
C.Using a compromised system to attack other systems in the same network.
D.Switching from Linux to Windows.
Correct Answer: Using a compromised system to attack other systems in the same network.
Explanation:
Pivoting (or island hopping) is the technique of using an instance (compromised host) to be able to move around inside a network and access systems that would otherwise be inaccessible from outside.
Incorrect! Try again.
37Which PowerShell command is used to download a file from a remote server?
A.wget
B.Download-File
C.Invoke-WebRequest
D.Get-File
Correct Answer: Invoke-WebRequest
Explanation:
Invoke-WebRequest (often aliased as iwr or wget in PowerShell) is the standard cmdlet used to send HTTP/HTTPS requests and download content from the web.
Incorrect! Try again.
38Which component of the Metasploit Framework stores information about targets, loot, and collected data?
A.msfconsole
B.msfvenom
C.Meterpreter
D.The Database (PostgreSQL)
Correct Answer: The Database (PostgreSQL)
Explanation:
Metasploit uses a PostgreSQL database to store results from scans, compromised hosts, looted credentials, and other data gathered during the penetration test.
Incorrect! Try again.
39What distinguishes Static Analysis from Dynamic Analysis in malware analysis?
A.Static analysis runs the code; dynamic analysis does not.
B.Static analysis examines code without execution; dynamic analysis observes code behavior during execution.
C.Static analysis is for Linux; dynamic analysis is for Windows.
Correct Answer: Static analysis examines code without execution; dynamic analysis observes code behavior during execution.
Explanation:
Static analysis involves looking at the code structure, strings, and headers without running it. Dynamic analysis involves running the malware in a sandbox/VM to observe its behavior (network connections, file changes).
Incorrect! Try again.
40Which script allows an attacker to automate the search for privilege escalation vectors on a Linux system?
A.PowerView
B.WinPEAS
C.BloodHound
D.LinPEAS
Correct Answer: LinPEAS
Explanation:
LinPEAS (Linux Privilege Escalation Awesome Script) is a script that searches for possible paths to escalate privileges on Linux/Unix hosts.
Incorrect! Try again.
41What is a Logic Bomb?
A.Malware that explodes the hardware.
B.A DoS attack tool.
C.Code intentionally inserted into a software system that sets off a malicious function when specified conditions are met.
D.A script that brute forces logical ports.
Correct Answer: Code intentionally inserted into a software system that sets off a malicious function when specified conditions are met.
Explanation:
A logic bomb is a piece of code that lies dormant until a specific condition occurs (e.g., a specific date, or a user being removed from the payroll system), at which point it executes a malicious payload.
Incorrect! Try again.
42In the context of enumerating assets, what information does SNMP (Simple Network Management Protocol) primarily provide if misconfigured (public community string)?
A.Encrypted passwords.
B.Web application source code.
C.Network statistics, system information, and user accounts.
D.Firewall rules.
Correct Answer: Network statistics, system information, and user accounts.
Explanation:
SNMP is used for managing devices. If the community string is guessed (like 'public'), attackers can enumerate system uptime, running processes, installed software, and user accounts.
Incorrect! Try again.
43Which type of shellcode is typically used when the target system is behind a firewall that blocks incoming connections?
A.Null TCP
B.Reverse TCP
C.Loopback TCP
D.Bind TCP
Correct Answer: Reverse TCP
Explanation:
A Reverse TCP payload makes the target connect back to the attacker. Since firewalls usually allow outbound traffic, this is the preferred method for bypassing incoming traffic restrictions.
Incorrect! Try again.
44What is the SAM file in Windows?
A.Secure Access Module
B.System Access Method
C.System Admin Manager
D.Security Account Manager
Correct Answer: Security Account Manager
Explanation:
The SAM (Security Account Manager) is a database file in Windows operating systems that stores user passwords (in hashed format).
Incorrect! Try again.
45Which of the following describes a Dictionary Attack?
A.Using a rainbow table.
B.Using a pre-defined list of likely passwords.
C.Capturing the handshake and decrypting it.
D.Trying every possible combination of characters.
Correct Answer: Using a pre-defined list of likely passwords.
Explanation:
A dictionary attack uses a wordlist (dictionary) of common passwords. It is faster than brute force but will fail if the password is complex and not in the list.
Incorrect! Try again.
46When creating a persistent backdoor using Windows Scheduled Tasks, which command is used?
A.taskmgr
B.at (deprecated)
C.cron
D.schtasks
Correct Answer: schtasks
Explanation:
schtasks.exe is the command-line tool used to create, delete, query, change, run, and end scheduled tasks on a local or remote computer.
Incorrect! Try again.
47What is the main purpose of Ruby in the context of the Metasploit Framework?
A.It is used for database management.
B.It is the language used to write Metasploit modules.
C.It is used for network scanning only.
D.It is the GUI framework.
Correct Answer: It is the language used to write Metasploit modules.
Explanation:
The Metasploit Framework is written primarily in Ruby. Exploit modules, auxiliary modules, and payloads are typically developed using Ruby.
Incorrect! Try again.
48Which vulnerability allows an attacker to escalate privileges by exploiting a program that runs with higher privileges but insecurely loads libraries from the current directory?
A.SQL Injection
B.DLL Hijacking
C.XSS
D.Buffer Overflow
Correct Answer: DLL Hijacking
Explanation:
DLL Hijacking occurs when a trusted application loads a malicious DLL from the current directory (or other locations in the path) because the application did not specify the full path to the system DLL.
Incorrect! Try again.
49What does the Sticky Bit do on a directory in Linux?
A.It keeps files in memory.
B.It shares files with everyone.
C.It prevents users from deleting files they do not own.
D.It makes files executable.
Correct Answer: It prevents users from deleting files they do not own.
Explanation:
The Sticky Bit (t) is commonly used on shared directories like /tmp. It ensures that only the file's owner, the directory's owner, or root can rename or delete the file.
Incorrect! Try again.
50Which tool allows for the creation of custom wordlists based on the content of a target website?
A.Wireshark
B.Netcat
C.CeWL
D.Nmap
Correct Answer: CeWL
Explanation:
CeWL (Custom Word List generator) is a Ruby app that crawls a given URL to a specified depth and returns a list of words, which can then be used as a dictionary for password cracking.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →