Penetration Tester

Sample question 1

You are a penetration tester finishing an assessment of Brightleaf Retail's customer portal, where you found that the product search field is vulnerable to SQL injection that lets an unauthenticated user extract the full customer accounts table, including names, hashed passwords, and loyalty-program balances. You are drafting the vulnerability entry for the final report, which both Brightleaf's engineering team and its CISO will read before the readout meeting. Which write-up should you produce?

1. A.A description of the flaw and affected endpoint, the complete set of real customer records recovered during testing pasted in as proof, a severity rating that weighs both technical exploitability and the sensitivity of what was exposed, and a remediation recommendation scoped to Brightleaf's actual query-handling code.
2. B.A description of the flaw and affected endpoint, a redacted or representative example of the extracted data rather than the full record set, a standard published severity score for the SQL injection vulnerability class applied without adjustment for what this instance actually exposed, and a remediation recommendation scoped to Brightleaf's actual query-handling code.
3. C.A description of the flaw and affected endpoint, a redacted or representative example of the extracted data rather than the full record set, a severity rating that weighs both technical exploitability and the sensitivity of what was exposed, and a generic remediation recommendation covering SQL injection prevention in general rather than Brightleaf's specific query-handling code.
4. D.A description of the flaw and affected endpoint, a redacted or representative example of the extracted data rather than the full record set, a severity rating that weighs both technical exploitability and the sensitivity of what was exposed, and a remediation recommendation scoped to Brightleaf's actual query-handling code.

Sample question 2

During an internal network penetration test in 2026, you obtain a Meterpreter session on a jump host inside a client's DMZ segment. The jump host's local firewall blocks all outbound TCP except HTTPS to the corporate web proxy, which requires NTLM authentication, and the client's rules of engagement prohibit any changes to firewall configuration for the duration of the test. Your scope includes an internal subnet, 10.20.0.0/24, that is reachable only through this jump host, and you still need to run further enumeration and exploitation tools against hosts on that subnet as if you were local to it. Which technique should you use to reach 10.20.0.0/24 and run additional tools against hosts there?

1. A.Open a reverse SSH tunnel on port 22 outbound from the jump host to your attack machine, then forward traffic for the 10.20.0.0/24 subnet through that new tunnel.
2. B.Run Responder on the jump host's local segment to capture NTLM hashes broadcast by hosts on 10.20.0.0/24, then relay the captured hashes directly to targets on that same subnet.
3. C.Add a route through the Meterpreter session's routing module, start a SOCKS proxy on that session, and run your tools through a SOCKS-aware proxy wrapper to reach 10.20.0.0/24.
4. D.Ask the client to open a temporary firewall rule allowing direct RDP access from your attack machine to every host on 10.20.0.0/24 for the remainder of the test window.

Sample question 3

A penetration tester is engaged by a mid-size insurance company that has deployed a generative AI chatbot to handle policyholder inquiries. The chatbot calls an API into the claims database to look up policy status for the person it is chatting with. While testing the chatbot, the tester finds that carefully crafted prompts can manipulate it into revealing claims data belonging to other policyholders, and that the API credential the chatbot uses grants read access to the entire claims table rather than being scoped to one policyholder at a time. Leadership asks the tester to recommend a remediation approach before the next release. Which recommendation should the tester make?

1. A.Scope the chatbot's database credential so each session can only query the authenticated policyholder's own records, add input and output filtering for cross-account references, and log anomalous query patterns for review.
2. B.Deploy an output-screening layer that scans every chatbot response for policy numbers and personal identifiers belonging to anyone other than the authenticated policyholder and redacts them before delivery, treating the screen as the release gate for the next version.
3. C.Rewrite the system prompt to instruct the model never to disclose another policyholder's information, verify the fix with a short manual test, and revisit the issue at the next quarterly security review.
4. D.Strengthen session authentication so only verified policyholders can reach the chatbot, and add per-session rate limits on claims-database queries to make bulk extraction of records impractical before the next release.