SY0-501 Question #357: Real Exam Question with Answer & Explanation

Question

A third-party penetration testing company was able to successfully use an ARP cache poison technique to gain root access on a server. The tester successfully moved to another server that was not in the original network. Which of the following is the MOST likely method used to gain access to the other host?

Options

• ABackdoor
• BPivoting
• CPersistance
• DLogic bomp

Explanation

The scenario describes using an initial compromised server to gain access to another server on a different network, which is the definition of pivoting. This technique allows attackers to move laterally within a target environment that they couldn't directly reach.

Common mistakes.

• A. A backdoor is a hidden method for bypassing normal authentication to gain access to a system, which describes a type of access but not the lateral movement between different network segments.
• C. Persistence refers to techniques used by attackers to maintain access to a compromised system across reboots or after credentials change, rather than the act of moving from one system to another.
• D. A logic bomb is a malicious piece of code that triggers a specific action when predefined conditions are met, representing a payload or attack component, not a method of lateral movement between servers.

Concept tested. Pivoting and lateral movement techniques

Reference. https://learn.microsoft.com/en-us/defender-for-cloud/alert-reference#lateral-movement-and-internal-reconnaissance

No community discussion yet for this question.