CAP Vulnerability Assessment & Penetration Testing 3 — Questions and Answers
Question 1: During a penetration test on a federal system, a tester successfully extracts password hashes from a domain controller. Which post-exploitation technique involves using these hashes without cracking them?
- Privilege Escalation
- Pass-the-Hash (Correct answer)
- Credential Stuffing
- Rainbow Table Attack
Correct answer: Pass-the-Hash
Pass-the-Hash allows attackers to authenticate using captured NTLM hashes directly without needing the plaintext password.
Question 2: What is the primary purpose of a Rules of Engagement (ROE) document in the context of federal penetration testing?
- To document all vulnerabilities found during testing
- To define the scope, constraints, and authorized actions for the assessment (Correct answer)
- To outline remediation steps for discovered vulnerabilities
- To establish the reporting format for test results
Correct answer: To define the scope, constraints, and authorized actions for the assessment
Rules of Engagement define what is in scope, what actions are permitted, and the boundaries testers must operate within during the assessment.
Question 3: A vulnerability assessment reveals that a system uses TLS 1.0 for encrypting data in transit. How should this finding be categorized under NIST guidelines?
- Informational finding with no risk
- Low vulnerability due to encryption being present
- High or Critical vulnerability due to known protocol weaknesses (Correct answer)
- Medium vulnerability requiring monitoring only
Correct answer: High or Critical vulnerability due to known protocol weaknesses
TLS 1.0 has known vulnerabilities like POODLE and BEAST and is deprecated by NIST, making it a high-severity finding requiring remediation.
Question 4: Which technique involves an attacker intercepting communication between two parties without their knowledge during a penetration test?
- DNS Poisoning
- Man-in-the-Middle (MitM) Attack (Correct answer)
- ARP Flooding
- Session Hijacking
Correct answer: Man-in-the-Middle (MitM) Attack
A Man-in-the-Middle attack involves secretly intercepting and potentially altering communications between two parties who believe they are communicating directly.
Question 5: In the CVSS scoring system, which metric group assesses the characteristics of a vulnerability that cannot be changed over time?
- Temporal Metrics
- Environmental Metrics
- Base Metrics (Correct answer)
- Supplemental Metrics
Correct answer: Base Metrics
CVSS Base Metrics represent the intrinsic characteristics of a vulnerability that are constant across all deployments and time.
Question 6: A penetration tester finds a misconfigured S3 bucket containing sensitive federal data. Under FISMA and the RMF, what must occur before this vulnerability can be formally accepted as residual risk?
- The ISSO must verbally approve the risk
- The Authorizing Official must formally accept the risk in writing (Correct answer)
- The system owner must submit a change request
- The penetration tester must remediate the issue directly
Correct answer: The Authorizing Official must formally accept the risk in writing
Under FISMA, the Authorizing Official must formally and explicitly accept residual risk in writing as part of the authorization decision.
Question 7: What is the key difference between an authenticated and unauthenticated vulnerability scan?
- Authenticated scans are faster because they skip network discovery
- Authenticated scans use valid credentials to assess vulnerabilities from an insider perspective (Correct answer)
- Unauthenticated scans provide more detailed results than authenticated scans
- Authenticated scans can only be run by system administrators
Correct answer: Authenticated scans use valid credentials to assess vulnerabilities from an insider perspective
Authenticated scans use valid credentials to log into systems, providing deeper visibility into configuration weaknesses and patch levels than external unauthenticated scans.
CAP Vulnerability Assessment & Penetration Testing 3
During a penetration test on a federal system, a tester successfully extracts password hashes from a domain controller.
Which post-exploitation technique involves using these hashes without cracking them?