iTi Pentest

Question 1

Q1. How is authentication different from authorization?

Accepted Answer

Authent is verify an identity; authoriz is verifying access to a resource

Question 2

MOB Q6. What is the primary purpose of code obfuscation in Android application security?

Accepted Answer

B. To make the code harder to understand and reverse-engineer

Question 3

Q6. Which port is used by the FTP service?

Accepted Answer

C. 21

Question 4

Q11. characteristic of Reflected XSS?

Accepted Answer

D. The malicious script comes from the current HTTP request.

Question 5

MOB Q11. What type of data should NOT be stored in SharedPreferences in Android?

Accepted Answer

D. User clear password

Question 6

MOB Q13. What is the function of the Android logcat tool?

Accepted Answer

B. Read system logs

Question 7

Q11. What is a common technique used in Windows privilege escalation?

Accepted Answer

C. Abuse of unquoted service paths

Question 8

MOB Q1. A tool used to hook methods in the Android application during runtime

Accepted Answer

Frida

Question 9

Q26. What is Command Injection in web applications?

Accepted Answer

Inject system-level commands through unsanitize input to execute on server

Question 10

Q4. In the context of the CIA triad, what does integrity ensure?

Accepted Answer

B. Information is accurate and has not been tampered with.

Question 11

Q12. Which of the following could help identify potential privilege escalation paths in a Windows domain?

Accepted Answer

C. BloodHound

Question 12

NTW Q1. What is password brute forcing?

Accepted Answer

C. Trying all possible passwords for a single account

Question 13

Q3. Which port does the SSH service typically run on?

Accepted Answer

B. 22

Question 14

Q3. A file that includes components of app, including activities, services, broadcast receivers, and content providers

Accepted Answer

B. AndroidManifest

Question 15

Q8. Which Kerberos attack allows offline cracking of service account passwords?

Accepted Answer

A. Kerberoasting

Question 16

Q22. What does an LFI (Local File Inclusion) vulnerability allow an attacker to do?

Accepted Answer

B. Include and execute local files on the server via user input.

Question 17

Q20. What is a file upload attack?

Accepted Answer

D. where an attacker uploads malicious file to gain access or execute code

Question 18

Q13. In DOM-based XSS, where does the vulnerability reside?

Accepted Answer

D. In the client-side JavaScript code.

Question 19

MOB Q9. What is the default file extension for an iOS application package?

Accepted Answer

C. .ipa

Question 20

Q3. How does symmetric encryption differ from asymmetric encryption?

Accepted Answer

C. Sym uses same key for encryp &decryp; asym uses a public &private key

Question 21

Q5. Which of the following is a common risk when FTP allows anonymous login?

Accepted Answer

C. Unauthorized users can access and upload files

Question 22

Q10. What is Nmap primarily used for?

Accepted Answer

B. Network scanning and host discovery

Question 23

Q2. What is the primary difference between hashing and encryption?

Accepted Answer

C.Hashing is one-way and irreversible; encryption is two-way and reversible

Question 24

Q14. What is the purpose of the HttpOnly attribute in a cookie?

Accepted Answer

C. To restrict cookie access from client-side scripts.

Question 25

Q27. What is a Business Logic Vulnerability?

Accepted Answer

Target app workflow by exploit flaw in how apps handle expected proccess

Question 26

Q24. What does the SameSite cookie attribute help prevent?

Accepted Answer

D. Cross-site reQ1uest forgery (CSRF)

Question 27

Q12. What distinguishes Stored XSS from other types of XSS?

Accepted Answer

C. The malicious script comes from the website's database.

Question 28

Q16. Which tool is commonly used to automate the exploitation of SQ1L injection vulnerabilities?

Accepted Answer

D. SQ1lmap

Question 29

MOB Q12. In Android, which file typically contains sensitive API keys and tokens?

Accepted Answer

C. res/values/strings.xml

Question 30

Q2. Security mechanism used to prevent runtime attacks, such as Frida, by monitoring app behavior & enforcing security

Accepted Answer

B. Runtime Application Self-Protection (RASP)

Question 31

MOB Q8. Which tool is primarily used to decompile Android APK files?

Accepted Answer

C. Apktool

Question 32

Q5. In the CIA triad, what does confidentiality protect?

Accepted Answer

C.Data is accessed only by authorized individuals.

Question 33

MOB Q14. What is the main purpose of reverse engineering a mobile app?

Accepted Answer

C. To understand app logic and identify vulnerabilities

Question 34

Q7. Which protocol is primarily used for authentication in Active Directory environments?

Accepted Answer

B. Kerberos

Question 35

MOB Q7. Which tool is used to run built-in Frida scripts for dynamic analysis and runtime manipulation of iOS apps?

Accepted Answer

B. Objection

Question 36

Q18. What is the purpose of CORS (Cross-Origin Resource Sharing)?

Accepted Answer

B. To control which domains can access resources on a server.

Question 37

MOB Q5. A tool that is used to interact with device or emulator

Accepted Answer

C. ADB

Question 38

Q17. What does a CSRF (Cross-Site ReQ1uest Forgery) attack involve?

Accepted Answer

B. Forcing a victim to submit a reQ1uest they did not intend to make.

Question 39

Q9. Which of the following is a widely used cryptographic hashing algorithm?

Accepted Answer

C. SHA-256

Question 40

Q25. What is the risk of an open redirect vulnerability?

Accepted Answer

C. Redirects users to a malicious site using a trusted domain.

Question 41

Q7. Where are cookies primarily stored?

Accepted Answer

B. Client-side (browser) storage

Question 42

Q9. Which tool is commonly used in network penetration testing and supports automation with scripts and modules?

Accepted Answer

D. Metasploit

Question 43

Q8. Where is session data usually stored?

Accepted Answer

A. On the server-side

Question 44

Q6. What is the key difference between cookies and sessions in web applications?

Accepted Answer

A. Cookies are stored on client-side; sessions are stored on server-side

Question 45

Q4. Which tool can be used to brute force SSH login credentials?

Accepted Answer

C. Hydra

Question 46

Q10. Which of the following is a common symmetric encryption algorithm?

Accepted Answer

C. AES

Question 47

MOB Q10. Which of the following is used to intercept and modify HTTPS traffic on mobile apps?

Accepted Answer

C. Burp Suite

Question 48

Q19. What is an IDOR (Insecure Direct Object Reference) vulnerability?

Accepted Answer

a user can access objects,resources by modify URLs,parameters with no auth

Question 49

Q23. What makes a web application vulnerable to Clickjacking?

Accepted Answer

B. Not implementing X-Frame-Options headers.

Question 50

Q4. SSL Pinning is used to secure communications between a web server and the mobile application

Accepted Answer

True

Question 51

Q2. What is password spraying?

Accepted Answer

B. Trying one common password against many accounts

Question 52

Q21. Which of the following are important checks for secure file uploads?

Accepted Answer

D. All of the above

Question 53

Q15. What does the Secure flag in a cookie do?

Accepted Answer

D. Ensures the cookie is only sent over HTTPS.

iTi Pentest

Questions 53

iTi Pentest

Questions 53