A penetration tester is running a vulnerability scan on a company's network. The scan identifies an open port with a high-severity vulnerability linked to outdated software. What is the most appropriate next step for the tester?

• A. Perform a brute-force attack on the service running on the open port
• B. Research the vulnerability and determine if it has a publicly available exploit
• C. Execute a denial-of-service (DoS) attack on the open port
• D. Ignore the vulnerability and focus on finding more vulnerabilities

A security consultant is conducting an authorized assessment for a healthcare billing provider in Phoenix, Arizona. While monitoring internal traffic, he observes an authenticated employee interacting with a sensitive web-based management portal over TCP.
During the session, the consultant carefully crafts and injects packets into the ongoing communication stream.
Shortly afterward, the legitimate user experiences irregular responses from the application, and the server begins processing commands originating from the consultant's injected traffic as though they were part of the established session.
The technique does not involve credential guessing or forcing the user to reauthenticate. Instead, it targets the communication channel already in progress.
From a network-level perspective, what type of session hijacking technique is being demonstrated?

• A. UDP Hijacking
• B. Blind Hijacking
• C. TCP/IP Hijacking
• D. RST Hijacking

While conducting a red team exercise at a corporate office in San Diego, California, you observe employees working in an open-plan area. By discreetly watching their screens and hand movements as they log into internal systems, you are able to capture several usernames and partial passwords without touching any devices or interacting with the staff. Which social engineering technique does this scenario best illustrate?

• A. Tailgating
• B. Dumpster Diving
• C. Shoulder Surfing
• D. Impersonation

A security analyst is tasked with gathering detailed information about an organization ' s network infrastructure without making any direct contact that could be logged or trigger alarms. Which method should the analyst use to obtain this information covertly?

• A. Examine leaked documents or data dumps related to the organization
• B. Use network mapping tools to scan the organization ' s IP range
• C. Initiate social engineering attacks to elicit information from employees
• D. Perform a DNS brute-force attack to discover subdomains

A penetration tester is assessing a web application that does not properly sanitize user input in the search field. The tester suspects the application is vulnerable to a SQL injection attack. Which approach should the tester take to confirm the vulnerability?

• A. Perform a brute-force attack on the login page to identify weak passwords
• B. Use directory traversal in the search field to access sensitive files on the server
• C. Inject JavaScript into the search field to perform a Cross-Site Scripting (XSS) attack
• D. Input a SQL query such as 1 OR 1=1 - into the search field to check for SQL injection