WGU D484 Task 1 Practice Questions: Complete
Penetration Testing Report Exam Prep Bank with
Verified Explanations (GUARANTEED PASS)
INTRODUCTION
Master your cybersecurity assessments with this high-yield,
comprehensive exam preparation bank featuring verified multi-choice
questions with explicit rationales. Designed specifically for students
tackling network architecture audits, compliance mapping, and
penetration testing frameworks, this study guide simplifies complex
defense metrics into accessible learning points. Secure your academic
success or build a premium study resource with these expert-verified
questions.
Question 1
An enterprise network administrator notices unauthorized VLAN hopping
attacks within the company switches. Which of the following configuration
changes is the most effective mitigation strategy against this exploit?
A. Implementing strict dynamic NAT mapping rules across the core
firewalls.
B. Disabling Dynamic Trunking Protocol (DTP) and moving unused ports to
an isolated VLAN.
,C. Enforcing AES-256 encryption protocol keys on all active layer-2 switch
loops.
D. Configuring port-security with sticky MAC address properties on trunk
links.
VERIFIED ANSWER: B
EXPLANATION: VLAN hopping relies heavily on Dynamic Trunking
Protocol (DTP) spoofing or double-tagging. By disabling DTP (forcing
ports to stay non-negotiable) and moving all unused ports away
from the default native VLAN (VLAN 1) into an isolated, non-routed
VLAN, an attacker cannot automatically establish a trunk link to
intercept inter-VLAN traffic routing streams.
Question 2
During an internal penetration testing engagement at Western View
Hospital, an analyst needs to quietly capture authentication strings over
an unencrypted local segment without triggering endpoint protection
alerts. Which technique is most appropriate?
A. Executing an aggressive Nmap TCP Connect scan against the core
domain controller.
B. Running a passive network packet sniffing utility like Wireshark via a
configured TAP or SPAN port.
C. Directing the Social Engineering Toolkit (SET) to brute-force local
administrative assets.
,D. Spawning an interactive reverse shell on the endpoint using uncompiled
PowerShell scripts.
VERIFIED ANSWER: B
EXPLANATION: Passive network sniffing via a network TAP (Test
Access Point) or SPAN (Switched Port Analyzer) port generates
zero traffic on the wire. This makes it virtually invisible to host-
based endpoint detection and response (EDR) systems while
allowing the analyst to successfully view clear-text protocols (e.g.,
HTTP, FTP, SMTP) containing active credentials or PHI data.
Question 3
A security engineering team wants to restrict external network
reconnaissance. The external firewall rules must prevent threat actors
from mapping internal topologies using ICMP time-exceeded messages.
Which packet parameter should be closely monitored?
A. Time-to-Live (TTL) expiration limits.
B. Fragment Offset header values.
C. Window Size scaling adjustments.
D. Sequence Number predictability rates.
VERIFIED ANSWER: A
EXPLANATION: Tools like Traceroute map networks by sending
packets with sequentially increasing Time-to-Live (TTL) values. When
a router receives a packet with a TTL of 1, it drops the packet and
, sends back an ICMP Type 11 (Time Exceeded) message. Restricting or
blocking these outbound error responses disrupts external topology
mapping.
Question 4
While conducting an external penetration test against a corporate target,
you run an Nmap scan using the -sV flag. What is the explicit technical
objective of utilizing this specific command switch?
A. Forcing the scanner to run an active operating system fingerprinting
routine.
B. Instructing the engine to determine the exact software version names
running on open ports.
C. Executing a fast, non-blocking SYN stealth scan over common ports.
D. Automating vulnerability exploitation scripts from the integrated Nmap
Scripting Engine.
VERIFIED ANSWER: B
EXPLANATION: The -sV flag in Nmap activates service version
detection. It works by communicating with open ports and
comparing the returned banners against a signature database to
pinpoint the exact application version, which helps testers find
known exploits.
Question 5
Penetration Testing Report Exam Prep Bank with
Verified Explanations (GUARANTEED PASS)
INTRODUCTION
Master your cybersecurity assessments with this high-yield,
comprehensive exam preparation bank featuring verified multi-choice
questions with explicit rationales. Designed specifically for students
tackling network architecture audits, compliance mapping, and
penetration testing frameworks, this study guide simplifies complex
defense metrics into accessible learning points. Secure your academic
success or build a premium study resource with these expert-verified
questions.
Question 1
An enterprise network administrator notices unauthorized VLAN hopping
attacks within the company switches. Which of the following configuration
changes is the most effective mitigation strategy against this exploit?
A. Implementing strict dynamic NAT mapping rules across the core
firewalls.
B. Disabling Dynamic Trunking Protocol (DTP) and moving unused ports to
an isolated VLAN.
,C. Enforcing AES-256 encryption protocol keys on all active layer-2 switch
loops.
D. Configuring port-security with sticky MAC address properties on trunk
links.
VERIFIED ANSWER: B
EXPLANATION: VLAN hopping relies heavily on Dynamic Trunking
Protocol (DTP) spoofing or double-tagging. By disabling DTP (forcing
ports to stay non-negotiable) and moving all unused ports away
from the default native VLAN (VLAN 1) into an isolated, non-routed
VLAN, an attacker cannot automatically establish a trunk link to
intercept inter-VLAN traffic routing streams.
Question 2
During an internal penetration testing engagement at Western View
Hospital, an analyst needs to quietly capture authentication strings over
an unencrypted local segment without triggering endpoint protection
alerts. Which technique is most appropriate?
A. Executing an aggressive Nmap TCP Connect scan against the core
domain controller.
B. Running a passive network packet sniffing utility like Wireshark via a
configured TAP or SPAN port.
C. Directing the Social Engineering Toolkit (SET) to brute-force local
administrative assets.
,D. Spawning an interactive reverse shell on the endpoint using uncompiled
PowerShell scripts.
VERIFIED ANSWER: B
EXPLANATION: Passive network sniffing via a network TAP (Test
Access Point) or SPAN (Switched Port Analyzer) port generates
zero traffic on the wire. This makes it virtually invisible to host-
based endpoint detection and response (EDR) systems while
allowing the analyst to successfully view clear-text protocols (e.g.,
HTTP, FTP, SMTP) containing active credentials or PHI data.
Question 3
A security engineering team wants to restrict external network
reconnaissance. The external firewall rules must prevent threat actors
from mapping internal topologies using ICMP time-exceeded messages.
Which packet parameter should be closely monitored?
A. Time-to-Live (TTL) expiration limits.
B. Fragment Offset header values.
C. Window Size scaling adjustments.
D. Sequence Number predictability rates.
VERIFIED ANSWER: A
EXPLANATION: Tools like Traceroute map networks by sending
packets with sequentially increasing Time-to-Live (TTL) values. When
a router receives a packet with a TTL of 1, it drops the packet and
, sends back an ICMP Type 11 (Time Exceeded) message. Restricting or
blocking these outbound error responses disrupts external topology
mapping.
Question 4
While conducting an external penetration test against a corporate target,
you run an Nmap scan using the -sV flag. What is the explicit technical
objective of utilizing this specific command switch?
A. Forcing the scanner to run an active operating system fingerprinting
routine.
B. Instructing the engine to determine the exact software version names
running on open ports.
C. Executing a fast, non-blocking SYN stealth scan over common ports.
D. Automating vulnerability exploitation scripts from the integrated Nmap
Scripting Engine.
VERIFIED ANSWER: B
EXPLANATION: The -sV flag in Nmap activates service version
detection. It works by communicating with open ports and
comparing the returned banners against a signature database to
pinpoint the exact application version, which helps testers find
known exploits.
Question 5
