PenTest+ Exploits Quiz: Can You Break In?

1. What is a 'living off the land' attack?

Using legitimate system tools to conduct attacks

Attacking rural infrastructure

Exploiting outdated operating systems

Performing attacks without internet access

2. What does a successful exploit chain typically accomplish?

Multiple vulnerabilities chained to achieve complete system compromise

Simultaneous attacks on multiple servers

Encryption of all network traffic

Automatic system patching

3. Which exploitation technique involves replacing legitimate code with malicious code during transmission?

Man-in-the-Middle (MITM) attack

Brute force attack

Timing attack

Side-channel attack

4. What is a 'watering hole' attack?

Compromising a legitimate website to target specific user groups

Attacking water treatment facilities

Flooding a network with spam

Poisoning DNS cache servers

5. Which vulnerability type allows attackers to read arbitrary files from a web server?

Path Traversal / Directory Traversal

Race condition

Type confusion

Integer overflow

6. In exploitation, what is 'obfuscation' used for?

Hiding malicious code from detection systems

Increasing network speed

Improving database performance

Encrypting user passwords

7. What is the primary risk of insecure deserialization vulnerabilities?

Remote code execution through malicious objects

Loss of encryption keys

Network bandwidth degradation

User session timeouts

8. Which post-exploitation technique establishes persistent access to a compromised system?

Backdoor installation

Packet sniffing

Log deletion

Privilege discovery

9. What does CSRF (Cross-Site Request Forgery) exploit?

Trust in an authenticated user's browser session

Weak password policies

Unpatched software

Misconfigured SSL certificates

10. Which technique involves inserting code into a running process to alter its behavior?

Code injection

Port forwarding

Packet fragmentation

DNS poisoning

11. What is the primary goal of a SQL injection attack?

Bypass authentication and access unauthorized data

Crash the database server

Encrypt sensitive files

Steal user session cookies

12. Which attack involves overwhelming a service with traffic to make it unavailable?

Denial of Service (DoS)

Social engineering

Credential stuffing

API fuzzing

13. What is the purpose of a Remote Code Execution (RCE) exploit?

Execute arbitrary commands on a target system from a distance

Remotely backup system files

Monitor network bandwidth

Lock user accounts

14. Which vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users?

Cross-Site Scripting (XSS)

SQL Injection

CSRF

XXE

15. What does the term 'shellcode' refer to in exploitation?

Malicious code that spawns a command shell for attacker control

A script that scans for open ports

A type of firewall rule

Encrypted network traffic

16. Which of the following is a common payload delivery mechanism in exploitation?

Metasploit framework

Wireshark

Nmap

Hashcat

17. What is a zero-day exploit?

An attack that targets unknown vulnerabilities before patches exist

An exploit that only works on day zero of deployment

A vulnerability disclosed publicly for 24 hours

An attack that requires zero network connectivity

18. Which attack vector uses malicious email attachments or links to compromise a system?

Phishing

Brute force

Port scanning