Advanced Penetration Testing and Threat Hunting

1. What is "SSRF" used for in penetration testing?

• A. Server-side script running
• B. Pivoting to internal network resources by making the vulnerable server perform requests on the attacker's behalf ✓
• C. A type of XSS
• D. A SQL injection technique

💡 SSRF is used to access internal services, cloud metadata endpoints (AWS IMDSv1), and internal APIs that are otherwise inaccessible from outside.

2. What is "red team" vs "blue team" in cybersecurity?

• A. Two competing hacking groups
• B. Red team attacks (offensive); blue team defends (defensive) in security exercises ✓
• C. A type of penetration test
• D. A security compliance framework

💡 Red teams simulate real attackers using offensive techniques. Blue teams defend, detect, and respond. Purple teams combine both perspectives.

3. What is "CVSS" score used for?

• A. Measuring network bandwidth
• B. Common Vulnerability Scoring System — a standardized framework for rating the severity of security vulnerabilities ✓
• C. A type of risk assessment
• D. A penetration test metric

💡 CVSS provides a numerical score (0-10) rating vulnerability severity based on exploitability, impact, and environmental factors.

4. What is "Golden Ticket attack" in Active Directory?

• A. A social engineering attack
• B. Forging a Kerberos TGT using the KRBTGT hash to gain unlimited access to any resource in the domain ✓
• C. A type of phishing
• D. A credential stuffing attack

💡 A Golden Ticket forges a Kerberos Ticket Granting Ticket using the KRBTGT account hash, granting persistent, nearly unlimited domain access.

5. What is "IOC" in threat intelligence?

• A. Internet Operations Control
• B. Indicator of Compromise — evidence that a system has been compromised (malicious IPs, hashes, domains) ✓
• C. Input/Output Control
• D. Incident Operations Center

💡 IOCs are forensic artifacts indicating a system breach — file hashes, malicious IPs, domains, registry keys, and behavioral patterns of known malware.

6. What is "TTPs" in the context of threat actors?

• A. Technical Testing Procedures
• B. Tactics, Techniques, and Procedures — describing how threat actors conduct their attacks ✓
• C. Threat Tracking Programs
• D. Technical Threat Profiles

💡 TTPs describe the behavior of threat actors at increasing levels of detail — tactics (goals), techniques (methods), procedures (specific implementations).

7. What is "pivoting" in penetration testing?

• A. Rotating attack tools
• B. Using a compromised system as a relay to attack other systems in a network that were previously inaccessible ✓
• C. A type of lateral movement only
• D. A network scanning technique

💡 Pivoting uses a compromised host as a springboard to reach other network segments or systems that attackers could not directly access.

8. What is "Active Directory enumeration"?

• A. Setting up Active Directory
• B. Systematically collecting information about AD objects (users, groups, computers, GPOs) to plan attacks ✓
• C. A type of network scanning
• D. A password attack

💡 AD enumeration gathers information about domain structure, trust relationships, privileged accounts, and GPOs to identify attack paths.

9. What is "DLL hijacking"?

• A. Hacking dynamic link libraries
• B. Exploiting how applications search for DLLs by placing a malicious DLL in a location searched before the legitimate one ✓
• C. A type of code injection
• D. A registry attack

💡 DLL hijacking places a malicious DLL in a directory searched before the legitimate path, causing applications to load and execute attacker code.

10. What is "purple teaming"?

• A. A mixed security team
• B. A collaborative exercise where red and blue teams work together, sharing knowledge to improve detection and response ✓
• C. A type of red team operation
• D. A compliance exercise

💡 Purple teaming combines red team attack simulations with blue team defensive responses, with both teams collaborating to maximize security improvements.

11. What is "privilege escalation"?

• A. Getting a promotion
• B. Exploiting vulnerabilities or misconfigurations to gain higher privileges than originally granted ✓
• C. A type of lateral movement
• D. A social engineering technique

💡 Privilege escalation exploits vulnerabilities to gain elevated permissions — vertical (user to admin) or horizontal (accessing another user's resources).

12. What is "beacon" in red team operations?

• A. A network signal device
• B. Malware implant that periodically contacts C2 infrastructure at irregular intervals to receive commands ✓
• C. A type of persistent backdoor only
• D. A network monitoring tool

💡 Beacons are implants calling home to C2 servers at randomized intervals to evade detection, requesting tasks and returning stolen data.

13. What is "DAST" in application security testing?

• A. Dynamic Analysis Security Testing — testing a running application from the outside by simulating attacks ✓
• B. Static code analysis
• C. A type of penetration testing tool
• D. A vulnerability scanner only

💡 DAST (Dynamic Application Security Testing) tests running applications by simulating attacks from outside, finding runtime vulnerabilities like XSS and SQLi.

14. What is "threat hunting"?

• A. Looking for antivirus updates
• B. Proactively searching through networks and systems to detect hidden threats that automated tools missed ✓
• C. A type of penetration testing
• D. Waiting for alerts to trigger

💡 Threat hunting proactively searches for evidence of threats not detected by automated systems, using hypothesis-driven investigation of attacker behaviors.

15. What is "assume breach" security model?

• A. Assuming no breach will happen
• B. Operating under the assumption that attackers are already inside the network, focusing on detection and containment ✓
• C. A type of zero trust
• D. A penetration testing approach

💡 Assume breach accepts that perimeter defenses will fail and focuses security efforts on detection, lateral movement prevention, and rapid response.

16. What is "LOLBAS" in offensive security?

• A. A type of malware
• B. Living Off the Land Binaries, Scripts and Libraries — legitimate Windows tools used for malicious purposes ✓
• C. A penetration testing framework
• D. A threat intelligence database

💡 LOLBAS documents legitimate Windows binaries (certutil, regsvr32, mshta) that can be abused for downloading, executing, or persisting malware.

17. What is the "MITRE ATT&CK framework"?

• A. A physical attack framework
• B. A knowledge base of adversary tactics, techniques, and procedures based on real-world observations ✓
• C. A vulnerability scoring system
• D. A penetration testing methodology

💡 MITRE ATT&CK documents real adversary behaviors across the attack lifecycle, helping defenders detect, investigate, and respond to threats.

18. What is "CVE" in vulnerability management?

• A. Common Vulnerability Exposure
• B. Common Vulnerabilities and Exposures — a standardized database of publicly known cybersecurity vulnerabilities ✓
• C. A type of security patch
• D. Certified Vulnerability Expert

💡 CVE provides unique identifiers for publicly disclosed vulnerabilities, enabling consistent reference across security tools and advisories.

19. What is "OSINT" in cybersecurity?

• A. Open Source Intelligence — collecting information from publicly available sources ✓
• B. A type of penetration testing tool
• C. A network scanning technique
• D. An intrusion detection system

💡 OSINT (Open Source Intelligence) gathers information about targets from publicly available sources — websites, social media, DNS records, job postings.

20. What is "Active Directory certificate services" (ADCS) attack?

• A. A certificate renewal process
• B. Exploiting misconfigured certificate templates in ADCS to escalate privileges or forge authentication certificates ✓
• C. A type of Kerberos attack
• D. A PKI management process

💡 ADCS misconfigurations (ESC1-ESC8 attack paths) allow attackers to request certificates enabling domain privilege escalation or persistence.