D332 Penetration Testing and Vulnerability Analysis - Set 2 - Part 2

Test your knowledge of technical writing concepts with these practice questions. Each question includes detailed explanations to help you understand the correct answers.

Question 21: What is the "unknown environment" test strategy?

A method of testing where the team has no prior knowledge of the system

A testing strategy for cloud-based systems only

Testing that focuses on gathering metadata from files

Testing with complete access to source code

Question 22: Explain the "partially known environment" test strategy:

Testing where the team has no knowledge of the system

Testing conducted with limited information, such as code or internal functionality

Testing without source code but with access to physical systems

A test conducted only after vulnerabilities are fixed

Question 23: What are the three types of environment testing strategies?

Cloud, external, and internal testing

Black box, white box, and gray box testing

Known, unknown, and partially known environment testing

Web, mobile, and API testing

Question 24: What should be discussed with stakeholders when determining the test scope?

Scope of assets and excluded elements

Only the budget of the test

Details of previous vulnerabilities found

Social engineering policies

Question 25: What is an MSA (Master Service Agreement)?

A document that sets the terms of a particular project

A contract that outlines ongoing business relationship guidelines between two parties

A method for ensuring compliance with PCI DSS

A type of firewall setting for PenTest teams

Question 26: What is a SOW (Statement of Work)?

A detailed document outlining specific expectations for a business arrangement

A type of security assessment for internal assets

A test conducted in the post-compromise phase

A method for configuring DNS servers

Question 27: What is an SLA (Service-Level Agreement)?

A type of cybersecurity standard

A contract outlining the terms of a service, including performance metrics and penalties

A methodology for penetration testing web applications

An audit performed after every test

Question 28: What are DNS records like MX, NS, TXT, and SRV used for?

To track server vulnerabilities

For storing malicious code

To provide critical information about domain services like mail servers and text data

To test vulnerability scans on DNS servers

Question 29: What is nslookup?

A tool for performing vulnerability assessments

A command-line tool to query domain records in DNS

A tool for scanning networks for open ports

A type of firewall configuration

Question 30: What is Dig used for?

A tool for mapping internal network devices

A tool for performing reverse DNS lookups and resolving IP addresses to domain names

A vulnerability scanner

A tool for collecting metadata

Question 31: What is a robots.txt file used for?

To restrict access to specific web pages for search engine bots

To encrypt files stored on a web server

To provide server-side encryption for email communications

To detect SQL injection attempts on web forms

Question 32: What is the Subject Alternative Name (SAN) in a digital certificate?

A mechanism for encoding web traffic

A feature that lists multiple subdomains or domain names in the same certificate

A type of encryption used for securing email communications

A protocol used for securing network traffic

Question 33: What is the Certification Revocation List (CRL)?

A list of subdomains included in a certificate

A list of certificates that are no longer valid and should not be trusted

A protocol for securing network communications

A command used for generating new digital certificates

Question 34: What is OCSP used for in the context of certificates?

A tool for automating certificate renewals

A protocol for verifying the status of a certificate

A command for generating new certificates

A method for encoding email communications

Question 35: What does Metagoofil do?

It is a vulnerability scanner for web applications

It extracts metadata from public documents related to a target organization

It encrypts emails to ensure secure communication

It scans firewalls to detect configuration flaws

Question 36: What is FOCA?

A vulnerability scanning tool for networks

A tool used to discover metadata in documents and identify additional domains associated with an IP

A firewall testing tool for enterprise networks

A penetration testing tool for social engineering

Question 37: What does theHarvester do?

A tool for extracting email addresses, subdomains, and employee names from public sources

A vulnerability scanning tool for web applications

A method for encrypting email communications

A program used to generate digital certificates

Question 38: What is Maltego?

A tool for cracking encryption algorithms

A GUI-based OSINT tool that creates graphical visualizations of connections between data points

A web application firewall configuration tool

A program used for creating digital certificates

Question 39: What is pretexting?

A method of creating fake login pages to steal credentials

A social engineering technique where the attacker lies or tells a half-truth to trick the target into revealing sensitive information

A way to intercept email communications between users

A tool used to test the strength of encryption protocols

Question 40: What is elicitation?

The process of encrypting data before transmission

A technique used to acquire data from a target by posing as a trusted individual

A method for decoding encrypted traffic

A tool used to extract data from a compromised machine

Don't Want to Study?

Save Time on Studies, Spend More with Family & Friends! Pay-After-you-Pass!

Get Exam Support