SY0-501 · Question #357
A third-party penetration testing company was able to successfully use an ARP cache poison technique to gain root access on a server. The tester successfully moved to another server that was not in…
The correct answer is B. Pivoting. The scenario describes using an initial compromised server to gain access to another server on a different network, which is the definition of pivoting. This technique allows attackers to move laterally within a target environment that they couldn't directly reach.
Question
A third-party penetration testing company was able to successfully use an ARP cache poison technique to gain root access on a server. The tester successfully moved to another server that was not in the original network. Which of the following is the MOST likely method used to gain access to the other host?
Options
- ABackdoor
- BPivoting
- CPersistance
- DLogic bomp
How the community answered
(45 responses)- A7% (3)
- B78% (35)
- C4% (2)
- D11% (5)
Why each option
The scenario describes using an initial compromised server to gain access to another server on a different network, which is the definition of pivoting. This technique allows attackers to move laterally within a target environment that they couldn't directly reach.
A backdoor is a hidden method for bypassing normal authentication to gain access to a system, which describes a type of access but not the lateral movement between different network segments.
Pivoting is the technique where an attacker uses a compromised system (the initial server) as an intermediary to route traffic and gain access to other systems (the second server) that are not directly accessible from the attacker's original location, especially when they are on a different network segment. This effectively extends the attacker's reach into otherwise isolated network areas, matching the described movement to a server 'not in the original network'.
Persistence refers to techniques used by attackers to maintain access to a compromised system across reboots or after credentials change, rather than the act of moving from one system to another.
A logic bomb is a malicious piece of code that triggers a specific action when predefined conditions are met, representing a payload or attack component, not a method of lateral movement between servers.
Concept tested: Pivoting and lateral movement techniques
Source: https://learn.microsoft.com/en-us/defender-for-cloud/alert-reference#lateral-movement-and-internal-reconnaissance
Topics
Community Discussion
No community discussion yet for this question.