D332 Penetration Testing and Vulnerability Analysis - Set 4 - Part 2

Test your knowledge of technical writing concepts with these practice questions. Each question includes detailed explanations to help you understand the correct answers.

Question 21: What is known environment testing?

A test where the environment is kept hidden from the team

Testing where the penetration testing team is given all details of the network and applications

Testing conducted after deployment of a firewall

A test for vulnerabilities in cloud infrastructure

Question 22: What elements should be reviewed when determining the scope of the test?

Budget, compliance checklists, and user permissions

Test results, number of users, and firewall rules

Scope, in-scope assets, timeline, legal restrictions, and testing environment strategy

Backup policy, system logs, and encryption methods

Question 23: What is a Master Service Agreement (MSA)?

A document listing all software licenses used by the company

A contract that establishes guidelines for recurring business arrangements

A template for reporting vulnerabilities in cloud services

A method of encrypting sensitive client information

Question 24: What is a Statement of Work (SOW)?

A report on the findings of a penetration test

A document that defines the expectations and deliverables for a business arrangement

A manual for vulnerability scanning techniques

A guide to using encryption during penetration testing

Question 25: What is a Service-Level Agreement (SLA)?

A contract that outlines the levels of service and performance expected from a vendor

A list of encryption algorithms used for protecting client data

A contract that defines hardware specifications for cloud services

A methodology for testing network devices

Question 26: What is a DNS MX record used for?

To identify the mail server responsible for accepting email for a domain

To provide a backup server for website hosting

To authenticate users accessing a secure application

To detect malicious attempts at SQL injection

Question 27: What is the purpose of a DNS NS record?

To list authorized name servers for a domain

To block specific IP addresses from accessing the network

To monitor changes in network traffic

To display a domains certificate of authenticity

Question 28: What does a DNS TXT record do?

It provides human-readable information about a server or network

It secures the data sent between web applications

It monitors domain traffic to prevent DDoS attacks

It blocks malicious email senders from targeting a domain

Question 29: What tool is typically used in Linux to query DNS information?

Ping

Nslookup

Traceroute

Dig

Question 30: What is the purpose of a robots.txt file?

To block malicious actors from accessing specific parts of a website

To tell web crawlers which parts of a website they are allowed to access

To identify vulnerabilities in website authentication systems

To provide a site map for web traffic monitoring tools

Question 31: What is a SAN in a digital certificate?

The encryption algorithm used to sign the certificate

The Subject Alternative Name field that allows multiple domains or subdomains to be covered by a single certificate

The key used to verify DNS records

A unique identifier for the certificate authority

Question 32: What are Certificate Transparency (CT) logs?

Logs that track the usage of a certificate across different servers

Logs that record public certificates issued by certificate authorities

Logs that monitor vulnerabilities in web applications

Logs that store user session details during a penetration test

Question 33: How can the validity of a digital certificate be checked?

By using a public key hash algorithm

By checking the Certificate Revocation List (CRL) or using the Online Certificate Status Protocol (OCSP)

By manually inspecting the websites server logs

By scanning the certificate with a vulnerability scanner

Question 34: What is Metagoofil used for?

Scanning networks for vulnerabilities

Extracting metadata from public documents

Detecting malicious email attachments

Encrypting sensitive data during transmission

Question 35: What is FOCA?

A GUI-based tool for discovering metadata hidden in web and local documents

A vulnerability scanning tool for cloud applications

A firewall configuration tool

An intrusion detection system for large networks

Question 36: What is theHarvester?

A network penetration testing tool for identifying encryption vulnerabilities

An OSINT tool used for gathering information about domains, email addresses, and subdomains

A web application firewall used to prevent SQL injection

A vulnerability scanner for cloud infrastructure

Question 37: What is Recon-ng?

A CLI tool that gathers information like subdomains, employee names, and email addresses

A vulnerability scanner focused on web applications

A tool used to detect malware in email attachments

A GUI-based firewall management system

Question 38: What does Maltego do?

Analyzes vulnerabilities in cloud infrastructure

Gathers public data and presents it in node graphs for analysis

Conducts social engineering simulations to test user security awareness

Encrypts sensitive data during web application testing

Question 39: What is pretexting in social engineering?

Creating a fake website to trick users into entering their credentials

Using a fabricated scenario to manipulate someone into providing information

Phishing for sensitive information using malicious email attachments

Spoofing an IP address to redirect network traffic

Question 40: What is elicitation in social engineering?

A method to bypass firewalls

Acquiring data from the target, not about the target

Manipulating DNS records to redirect traffic

Gathering intelligence from phishing emails

Don't Want to Study?

Save Time on Studies, Spend More with Family & Friends! Pay-After-you-Pass!

Get Exam Support