You are conducting a penetration test against a company and you would like to know a
personal email address of John, a crucial employee. What is the fastest, cheapest way to
find out John’s email address.

Which of the following is an ARP cache poisoning technique aimed at network switches?

Which of the following documents helps in creating a confidential relationship between the
pen tester and client to protect critical and confidential information or trade secrets?

TCP/IP model is a framework for the Internet Protocol suite of computer network protocols
that defines the communication in an IP-based network. It provides end-to-end connectivity
specifying how data should be formatted, addressed, transmitted, routed and received at the
destination. This functionality has been organized into four abstraction layers which are used
to sort all related protocols according to the scope of networking involved.

Which of the following TCP/IP layers selects the best path through the network for packets to travel?

Amazon, an IT based company, conducts a survey on the usage of the Internet. They found
that company employees spend most of the time at work surfing the web for their personal
use and for inappropriate web site viewing. Management decide to block all such web sites
using URL filtering software.

How can employees continue to see the blocked websites?

Internet Control Message Protocol (ICMP) messages occur in many situations, such as
whenever a datagram cannot reach the destination or the gateway does not have the
buffering capacity to forward a datagram. Each ICMP message contains three fields: type,
code, and checksum. Different types of Internet Control Message Protocols (ICMPs) are
identified by a type and code field.

Which of the following ICMP messages will be generated if the destination port is not reachable?

To locate the firewall, SYN packet is crafted using Hping or any other packet crafter and sent
to the firewall. If ICMP unreachable type 13 message (which is an admin prohibited packet)
with a source IP address of the access control device is received, then it means which of the
following type of firewall is in place?

An automated electronic mail message from a mail system which indicates that the user
does not exist on that server is called as?

Which of the following reports provides a summary of the complete pen testing process, its
outcomes, and recommendations?

Fuzz testing or fuzzing is a software/application testing technique used to discover coding
errors and security loopholes in software, operating systems, or networks by inputting
massive amounts of random data, called fuzz, to the system in an attempt to make it crash.
Fuzzers work best for problems that can cause a program to crash, such as buffer overflow,
cross-site scripting, denial of service attacks, format bugs, and SQL injection. Fuzzer helps
to generate and submit a large number of inputs supplied to the application for testing it
against the inputs. This will help us to identify the SQL inputs that generate malicious output.
Suppose a pen tester knows the underlying structure of the database used by the application
(i.e., name, number of columns, etc.) that she is testing. Which of the following fuzz testing

she will perform where she can supply specific data to the application to discover
vulnerabilities?