Advanced Penetration Testing and Threat Hunting

1. What is "LOLBAS" in offensive security?

• A. A type of malware
• B. Living Off the Land Binaries, Scripts and Libraries — legitimate Windows tools used for malicious purposes ✓
• C. A penetration testing framework
• D. A threat intelligence database

💡 LOLBAS documents legitimate Windows binaries (certutil, regsvr32, mshta) that can be abused for downloading, executing, or persisting malware.

2. What is "Golden Ticket attack" in Active Directory?

• A. A social engineering attack
• B. Forging a Kerberos TGT using the KRBTGT hash to gain unlimited access to any resource in the domain ✓
• C. A type of phishing
• D. A credential stuffing attack

💡 A Golden Ticket forges a Kerberos Ticket Granting Ticket using the KRBTGT account hash, granting persistent, nearly unlimited domain access.

3. What is "DAST" in application security testing?

• A. Dynamic Analysis Security Testing — testing a running application from the outside by simulating attacks ✓
• B. Static code analysis
• C. A type of penetration testing tool
• D. A vulnerability scanner only

💡 DAST (Dynamic Application Security Testing) tests running applications by simulating attacks from outside, finding runtime vulnerabilities like XSS and SQLi.

4. What is "OSINT" in cybersecurity?

• A. Open Source Intelligence — collecting information from publicly available sources ✓
• B. A type of penetration testing tool
• C. A network scanning technique
• D. An intrusion detection system

💡 OSINT (Open Source Intelligence) gathers information about targets from publicly available sources — websites, social media, DNS records, job postings.

5. What is "purple teaming"?

• A. A mixed security team
• B. A collaborative exercise where red and blue teams work together, sharing knowledge to improve detection and response ✓
• C. A type of red team operation
• D. A compliance exercise

💡 Purple teaming combines red team attack simulations with blue team defensive responses, with both teams collaborating to maximize security improvements.

6. What is "IOC" in threat intelligence?

• A. Internet Operations Control
• B. Indicator of Compromise — evidence that a system has been compromised (malicious IPs, hashes, domains) ✓
• C. Input/Output Control
• D. Incident Operations Center

💡 IOCs are forensic artifacts indicating a system breach — file hashes, malicious IPs, domains, registry keys, and behavioral patterns of known malware.

7. What is "pivoting" in penetration testing?

• A. Rotating attack tools
• B. Using a compromised system as a relay to attack other systems in a network that were previously inaccessible ✓
• C. A type of lateral movement only
• D. A network scanning technique

💡 Pivoting uses a compromised host as a springboard to reach other network segments or systems that attackers could not directly access.

8. What is "CVSS" score used for?

• A. Measuring network bandwidth
• B. Common Vulnerability Scoring System — a standardized framework for rating the severity of security vulnerabilities ✓
• C. A type of risk assessment
• D. A penetration test metric

💡 CVSS provides a numerical score (0-10) rating vulnerability severity based on exploitability, impact, and environmental factors.

9. What is the "MITRE ATT&CK framework"?

• A. A physical attack framework
• B. A knowledge base of adversary tactics, techniques, and procedures based on real-world observations ✓
• C. A vulnerability scoring system
• D. A penetration testing methodology

💡 MITRE ATT&CK documents real adversary behaviors across the attack lifecycle, helping defenders detect, investigate, and respond to threats.

10. What is "CVE" in vulnerability management?

• A. Common Vulnerability Exposure
• B. Common Vulnerabilities and Exposures — a standardized database of publicly known cybersecurity vulnerabilities ✓
• C. A type of security patch
• D. Certified Vulnerability Expert

💡 CVE provides unique identifiers for publicly disclosed vulnerabilities, enabling consistent reference across security tools and advisories.

11. What is "beacon" in red team operations?

• A. A network signal device
• B. Malware implant that periodically contacts C2 infrastructure at irregular intervals to receive commands ✓
• C. A type of persistent backdoor only
• D. A network monitoring tool

💡 Beacons are implants calling home to C2 servers at randomized intervals to evade detection, requesting tasks and returning stolen data.

12. What is "DLL hijacking"?

• A. Hacking dynamic link libraries
• B. Exploiting how applications search for DLLs by placing a malicious DLL in a location searched before the legitimate one ✓
• C. A type of code injection
• D. A registry attack

💡 DLL hijacking places a malicious DLL in a directory searched before the legitimate path, causing applications to load and execute attacker code.

13. What is "threat hunting"?

• A. Looking for antivirus updates
• B. Proactively searching through networks and systems to detect hidden threats that automated tools missed ✓
• C. A type of penetration testing
• D. Waiting for alerts to trigger

💡 Threat hunting proactively searches for evidence of threats not detected by automated systems, using hypothesis-driven investigation of attacker behaviors.

14. What is "assume breach" security model?

• A. Assuming no breach will happen
• B. Operating under the assumption that attackers are already inside the network, focusing on detection and containment ✓
• C. A type of zero trust
• D. A penetration testing approach

💡 Assume breach accepts that perimeter defenses will fail and focuses security efforts on detection, lateral movement prevention, and rapid response.

15. What is "TTPs" in the context of threat actors?

• A. Technical Testing Procedures
• B. Tactics, Techniques, and Procedures — describing how threat actors conduct their attacks ✓
• C. Threat Tracking Programs
• D. Technical Threat Profiles

💡 TTPs describe the behavior of threat actors at increasing levels of detail — tactics (goals), techniques (methods), procedures (specific implementations).

16. What is "SSRF" used for in penetration testing?

• A. Server-side script running
• B. Pivoting to internal network resources by making the vulnerable server perform requests on the attacker's behalf ✓
• C. A type of XSS
• D. A SQL injection technique

💡 SSRF is used to access internal services, cloud metadata endpoints (AWS IMDSv1), and internal APIs that are otherwise inaccessible from outside.

17. What is "Active Directory enumeration"?

• A. Setting up Active Directory
• B. Systematically collecting information about AD objects (users, groups, computers, GPOs) to plan attacks ✓
• C. A type of network scanning
• D. A password attack

💡 AD enumeration gathers information about domain structure, trust relationships, privileged accounts, and GPOs to identify attack paths.

18. What is "privilege escalation"?

• A. Getting a promotion
• B. Exploiting vulnerabilities or misconfigurations to gain higher privileges than originally granted ✓
• C. A type of lateral movement
• D. A social engineering technique

💡 Privilege escalation exploits vulnerabilities to gain elevated permissions — vertical (user to admin) or horizontal (accessing another user's resources).

19. What is "Active Directory certificate services" (ADCS) attack?

• A. A certificate renewal process
• B. Exploiting misconfigured certificate templates in ADCS to escalate privileges or forge authentication certificates ✓
• C. A type of Kerberos attack
• D. A PKI management process

💡 ADCS misconfigurations (ESC1-ESC8 attack paths) allow attackers to request certificates enabling domain privilege escalation or persistence.

20. What is "red team" vs "blue team" in cybersecurity?

• A. Two competing hacking groups
• B. Red team attacks (offensive); blue team defends (defensive) in security exercises ✓
• C. A type of penetration test
• D. A security compliance framework

💡 Red teams simulate real attackers using offensive techniques. Blue teams defend, detect, and respond. Purple teams combine both perspectives.