Domain 6: Penetration Testing

GIAC Certified Enterprise Defender · 8 questions

• A penetration tester has been assigned to perform an external network penetration test with a defined scope of 203.0.113.0/28. Before beginning active scanning, what is the most critical pre-engagement step?
• During an nmap scan, a tester runs: nmap -sV -p 1-65535 --open -T4 203.0.113.5. The output shows port 8080/tcp open http Apache Tomcat/9.0.45. What vulnerability should the tester prioritize investigating based on this result?
• A penetration tester discovers a web application with the following URL: https://app.example.com/report?file=../../../etc/passwd. Testing this URL returns the contents of /etc/passwd. Which vulnerability class is this, and what is the appropriate next step in a black-box test?
• After gaining an initial foothold on a Linux system during a penetration test, a tester runs 'id' and receives 'uid=33(www-data)'. The tester wants to escalate to root. Which enumeration step is most likely to reveal a quick privilege escalation path?
• A penetration test report rates a finding as Critical (CVSS 9.8) for an unauthenticated RCE vulnerability in the client's VPN appliance. The client's security manager argues the risk is 'Low' because 'we've never been hacked before.' How should the penetration tester respond?
• During a vulnerability assessment, Nessus identifies a host as vulnerable to MS17-010 (EternalBlue). The rules of engagement for this engagement specify 'vulnerability assessment only — no exploitation.' What is the correct action?
• A network penetration tester successfully performs a man-in-the-middle attack on an internal network using ARP poisoning and captures NTLMv2 hashes. Which technique represents the correct next step to leverage this access?
• A security team wants to validate that their EDR solution would detect a common lateral movement technique (pass-the-hash). Which testing methodology is most appropriate?