While testing a web application that relies on JavaScript-based client-side security controls, which method is most effective for bypassing these controls without triggering server-side alerts?

• A. Injecting malicious JavaScript into the login page
• B. Reverse-engineering the proprietary encryption algorithm
• C. Using a proxy tool to intercept and modify client-side requests
• D. Disabling JavaScript in the browser and submitting invalid data

A cybersecurity team at a regional healthcare provider is conducting an internal red team exercise to assess their exposure to service enumeration attacks. Amanda, a senior penetration tester, is assigned to probe the internal network for services that may reveal usernames, group information, or system details without requiring prior authentication. She decides to target common services running on specific ports that are often misconfigured or loosely monitored. During her reconnaissance, Amanda identifies several open ports across various hosts and must now prioritize which ones to probe first for maximum information gain related to enumeration. Which of the following services should Amanda target as a priority to enumerate usernames and group information without authentication?

• A. TCP 139 and UDP 137, 138
• B. TCP 21 and UDP 137, 138
• C. TCP 23 and UDP 137, 138
• D. TCP 25 and UDP 133

A financial clearinghouse in Newark, New Jersey, initiated a structured vulnerability review across its enterprise servers. The scanning platform was configured to collect detailed information about installed updates, local security configurations, and system policy settings on each target machine. The resulting report contained granular host-level findings, including configuration inconsistencies and patch gaps that required direct system-level inspection to obtain. Based on the activity described, what type of vulnerability scanning is being performed?

• A. Credentialed Scanning
• B. Automated Scanning
• C. Non-Credentialed Scanning
• D. Application Scanning

A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing the Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this service to conceal malicious activities?

• A. Because BITS operates exclusively through HTTP tunneling.
• B. Because BITS utilizes IP fragmentation to evade intrusion detection systems.
• C. Because BITS traffic uses encrypted DNS packets.
• D. Because BITS packets appear identical to normal Windows Update traffic.