CompTIA PenTest+ (PT0-002) — Question 111

A penetration tester has gained access to the Chief Executive Officer's (CEO's) internal, corporate email. The next objective is to gain access to the network.
Which of the following methods will MOST likely work?

Answer options

• A. Try to obtain the private key used for S/MIME from the CEO's account.
• B. Send an email from the CEO's account, requesting a new account.
• C. Move laterally from the mail server to the domain controller.
• D. Attempt to escalate privileges on the mail server to gain root access.

Correct answer: B

Explanation

The correct answer is B because sending an email from the CEO's account requesting a new account could deceive the IT department into granting access. Option A is unlikely to work as obtaining the private key is more complex and less direct. Option C may not succeed without additional access and Option D involves a higher risk without guaranteed success.