During an external security review of a manufacturing firm in Detroit, Michigan, you're asked to prioritize patch baselines for internet-facing servers without logging in or establishing full sessions. To achieve this, you analyze network-level responses and capture application output in order to determine the underlying system and its software release. Which technique best fits this objective?

• A. Vulnerability Scanning
• B. OS Discovery
• C. Service Version Discovery
• D. Port Scanning

You are part of a red team hired to assess the cybersecurity posture of a large retail chain headquartered in New York. The client wants to know whether their defenses can anticipate future attack patterns before they occur. To meet this objective, your team deploys an AI-enabled platform that analyzes previous breaches and anomaly data to forecast potential attack vectors. Which benefit of AI-driven ethical hacking is most critical in this case?

• A. Simulation and testing
• B. Scalability
• C. Predictive analysis
• D. Enhanced reporting

A penetration tester suspects that a web application's login form is vulnerable to SQL injection due to improper sanitization of user input. What is the most appropriate approach to test for SQL injection in the login form?

• A. Use a brute-force attack on the login page to guess valid credentials
• B. Perform a directory traversal attack to access sensitive files
• C. Inject JavaScript into the input fields to test for Cross-Site Scripting (XSS)
• D. Enter ' OR '1'='1 in the username and password fields to bypass authentication

Arjun Mehta, a red team specialist at Sentinel Dynamics, is conducting a controlled reconnaissance assessment against the company's perimeter network. During testing, the security operations team observes that the firewall logs display several different originating systems associated with the same scanning activity. Arjun's objective is to ensure that his actual testing machine cannot be easily distinguished from other recorded entries.
What technique is Arjun using in this scenario?

• A. Source Port Manipulation
• B. Source Routing
• C. IP Address Decoy
• D. IP Address Spoofing

During a black-box penetration test, an attacker runs the following command:
nmap -p25 --script smtp-enum-users --script-args EXPN,RCPT <target IP>
The script successfully returns multiple valid usernames. Which server misconfiguration is being exploited?

• A. The SMTP server allows authentication without credentials
• B. The SMTP server has disabled STARTTLS, allowing plaintext enumeration
• C. SMTP user verification commands are exposed without restrictions
• D. DNS MX records point to an internal mail relay