Port numbers are used to keep track of different conversations crossing the network at the
same time. Both TCP and UDP use port (socket) numbers to pass information to the upper
layers. Port numbers have the assigned ranges.

Port numbers above 1024 are considered which one of the following?

John, the penetration tester in a pen test firm, was asked to find whether NTP services are
opened on the target network (10.0.0.7) using Nmap tool.

Which one of the following Nmap commands will he use to find it?

In the context of penetration testing, what does blue teaming mean?

Identify the port numbers used by POP3 and POP3S protocols.

The objective of social engineering pen testing is to test the strength of human factors in a
security chain within the organization. It is often used to raise the level of security awareness
among employees.

The tester should demonstrate extreme care and professionalism during a social
engineering pen test as it might involve legal issues such as violation of privacy and may
result in an embarrassing situation for the organization. Which of the following methods of
attempting social engineering is associated with bribing, handing out gifts, and becoming
involved in a personal relationship to befriend someone inside the company?

SQL injection attacks are becoming significantly more popular amongst hackers and there
has been an estimated 69 percent increase of this attack type. This exploit is used to great
effect by the hacking community since it is the primary way to steal sensitive data from web
applications. It takes advantage of non-validated input vulnerabilities to pass SQL
commands through a web application for execution by a backend database. The below
diagram shows how attackers launchedSQL injection attacks on web applications.

Which of the following can the attacker use to launch an SQL injection attack?

What threat categories should you use to prioritize vulnerabilities detected in the pen testing
report?

Which of the following has an offset field that specifies the length of the header and data?

Many security and compliance projects begin with a simple idea: assess the organization’s
risk, vulnerabilities, and breaches. Implementing an IT security risk assessment is critical to
the overall security posture of any organization. An effective security risk assessment can
prevent breaches and reduce the impact of realized breaches.

What is the formula to calculate risk?

Which of the following defines the details of services to be provided for the client’s
organization and the list of services required for performing the test in the organization?