1. A process of testing an application or software product in an operating state is called _______________.

A) SAST (Static Application Security Testing)
B) DAST (Dynamic Application Security Testing)
C) Fuzzing
D) Directory Traversal



2. Which of the following is a Mobile Security Framework that can perform web API testing and dynamic static analysis?

A) Network Spoofing
B) Metasploit framework
C) APKX Framework
D) Drozer



3. Multiple vulnerabilities are identified during a penetration test. Select the finding that would be most likely to merit an escalation contact, outside of standard meetings with the organization-provided point of contact.

A) A remote code execution vulnerability that is identified and for which exploit code is publicly available in a web app exposed to the internet
B) A web app with XSS used in the company intranet
C) A malicious link in an e-mail that was clicked and sent as part of phishing campaign
D) A directory traversal flaw existing in a company web application that allows unauthorized users to view the contents of directories outside the scope of the web app on the server



4. A wide variety of security testing and administration tasks are handled by using which one of the following utilities?

A) NETCAT
B) NCAT
C) Proxy Chains
D) SAST



5. An attack that can be done by shoulder surfing, social engineering, and dumpster diving is called ___________________.

A) Non-Electronic Attacks
B) Active Online Attacks
C) Passive Online Attacks
D) Man-in-the-Middle Attack