pentest+ Intermediate Practice Exam: Medium Difficulty 2025

A penetration tester is preparing to assess a client’s production e-commerce environment. The client is concerned about availability and wants all potentially disruptive testing pre-approved. Which approach BEST aligns with these requirements while still allowing meaningful testing?

During scoping, a client requests a test of an application hosted in a multi-tenant cloud environment. The tester needs to ensure activities do not impact other tenants and remain legally authorized. What is the MOST appropriate action before testing begins?

A tester is performing internal discovery. Several hosts block ICMP, and a standard ping sweep shows few results. Which technique is MOST likely to accurately identify live hosts while minimizing noise?

A vulnerability scan flags numerous hosts as vulnerable to a high-severity RCE. The tester suspects false positives because the service banners appear inconsistent. What is the BEST next step to validate the finding while maintaining a safe approach?

A web application login form appears to be vulnerable to SQL injection. The tester wants to extract data but also avoid triggering account lockouts and WAF rate limits. Which approach is MOST appropriate?

During an internal test, the tester obtains a low-privilege domain user credential and identifies that several servers allow WinRM. The goal is to gain administrative access with minimal detection. Which is the BEST next step?

A tester captures NTLMv2 challenge-response hashes on an internal network segment. The engagement prohibits offline password cracking due to time constraints, but allows active authentication testing within defined limits. What is the MOST appropriate way to leverage the capture?

A tester gains access to a Linux web server using a limited service account. The tester needs to quickly determine whether privilege escalation is feasible without installing new tools. Which action is BEST?

After completing an engagement, the tester must deliver a report that executives can understand while still enabling the technical team to remediate. Which report structure BEST meets this need?

A tester is reviewing a small Python utility used by an internal team to fetch URLs and store responses. The code uses string concatenation to build shell commands like: os.system("curl " + url). The tool runs as a privileged scheduled task. What is the MOST significant issue and BEST mitigation?