Great News!
Many students who study using our platform have reported that a large number of the practice questions here are very similar to those that appear in real exams. View Courses
Many students who study using our platform have reported that a large number of the practice questions here are very similar to those that appear in real exams. View Courses
In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: <name- serial_number>.
Which of the following would be the best action for the tester to take NEXT with this information?
Correct Answer: D. Document the unprotected file repository as a finding in the penetration-testing report.
As a penetration tester, your primary responsibility is to identify vulnerabilities and report them. Since you found cleartext credentials and employee data in an unprotected file repository, the first action should be to document this security flaw as a finding in the penetration test report.
<name-serial_number>) indicates a weak, predictable pattern, which further increases the risk of credential compromise.Why the Other Options Are Incorrect:
Create a custom password dictionary as preparation for password spray testing.
While this could be useful in an active attack scenario, it is not the most immediate or ethical next step.
Before attempting a password spray, you should report the weak credential storage issue first.
Recommend using a password manager/vault instead of text files to store passwords securely.
While using a password manager is a good security recommendation, it is not the first action the tester should take.
Before making recommendations, document the issue as a security risk first.
Recommend configuring password complexity rules in all the systems and applications.
While enforcing strong password policies is important, the primary issue here is the unprotected storage of credentials.
Password complexity alone does not fix the issue of unprotected credentials.
No Payment Cards Needed
Discover a range of courses designed to provide you with the knowledge and skills needed to excel in your chosen field.
You don’t need one month to study and pass your test.
With Prepsaret, it takes you a few days to grasp all the concepts needed to pass your exams
