Question 1

Which of the following JavaScript code snippets would be used to perform heap spraying in a browser exploit?

Options :

A : var spray = unescape("%u9090%u9090%u9090"); for (i=0; i<1000; i++) { memory[i] = spray; } allocates memory with NOP sleds for the heap spray.

B : var fill = "%u4141"; while (true) { fill = fill + fill; } infinitely allocates memory but does not perform a heap spray.

C : for (i=0; i<100000; i++) { document.write(spray); } incorrectly writes to the document instead of allocating memory on the heap.

D : var buffer = new Array(1000).join("A"); fills the buffer with data but is not performing a traditional heap spray.

Answer: A

Question 2

What type of wireless attack involves an attacker setting up a rogue access point to intercept and manipulate network traffic?

Options :

A : Jamming

B : bluejacking

C : evil Twin Attack

D : Man-in-the-Middle (MITM)

Answer: C

Question 3

What is the most effective method to automate the gathering of system configurations and service information during a reconnaissance phase?

Options :

A : Use a custom Bash script to manually fetch system logs and configurations upon user request.

B : Manually connect to each system using SSH and document the configuration and services.

C : eploy agents on network hosts that periodically send system information to a central server.

D : Script a series of Nmap scans with customized scripts that automatically parse and log the output.

Answer: D

Question 4

How can one use Kismet to identify weak encryption methods being used in nearby wireless networks?

Options :

A : Use the Kismet spectrum analysis tool to visually identify networks using outdated encryption standards.

B : Set Kismet to alert mode and manually inspect each network for the use of WEP or WPA encryption.

C : enable logging in Kismet and perform a manual analysis of packet captures to identify encryption protocols.

D : configure Kismet to log all detected networks and review the security settings of each for weak encryption.

Answer: D

Question 5

When performing a penetration test on a SOAP web service, which tool is specifically designed for automated scanning of SOAP services to identify vulnerabilities?

Options :

A : SOAP UI, as it can automatically create test cases and assertions to validate responses from the SOAP service.

B : urp Suite, with its capability to manually inspect and modify SOAP requests.

C : Postman, for sending customized requests to the SOAP service and observing the behavior.

D : Wireshark, to capture and analyze network traffic containing SOAP messages.

Answer: A

Free CPENT Mock Exam – Practice Online Confidently

Buying Options: