GPEN Practice Test 10 — 10 Questions

Question 1

Which attack type is most effective when an attacker has a list of usernames and a single password that they believe might be reused across multiple accounts?

Accepted Answer

Password spraying. Password spraying is a technique where an attacker tests a single password against many accounts to avoid triggering account lockout thresholds that occur with brute-forcing a single account. By keeping the number of attempts per account low, the attacker remains under the radar of security monitoring systems. This is a common tactic in modern cloud environments where individual account lockout policies are strict, making mass authentication attempts the most viable entry vector.

Answer

Dictionary attack

Answer

Birthday attack

Answer

Rainbow table attack

Question 2

During a reconnaissance project, you use the 'theHarvester' tool against a target. What information is this tool designed to extract?

Accepted Answer

Emails, subdomains, and user names from public sources.. theHarvester is a widely used OSINT tool designed to gather emails, subdomains, and hostnames from various public sources like search engines and PGP key servers. This information is vital for mapping the organization's digital footprint and identifying targets for social engineering. Its ability to aggregate this data from multiple sources makes it an essential tool for penetration testers aiming to build a comprehensive map of an organization's public-facing presence.

Answer

Internal employee passwords from active memory.

Answer

SQL injection vulnerabilities on web forms.

Answer

Full network topology maps including internal routers.

Question 3

If a penetration tester discovers a vulnerability that could compromise a third-party hosted service during an engagement, what is the correct professional responsibility?

Accepted Answer

Report the finding to the client and let them handle vendor disclosure.. The tester must report this finding only to the primary client, as they are the contractual entity. The tester should not contact the third-party provider directly, as this could violate the engagement's legal agreements. The client is responsible for coordinating with their third-party vendors. Professional ethics require that testers respect the chain of command and the contractual structure established at the start of the engagement.

Answer

Contact the third-party service provider immediately to warn them.

Answer

Ignore the finding as it is outside the client's direct control.

Answer

Publish the finding on a public bug bounty site for remediation.

Question 4

Refer to the exhibit. An Nmap scan returns output indicating a web server is responding, but the `http-enum` script fails to identify common directories. Which action should the tester take to improve detection?

Accepted Answer

Use a specialized web discovery tool like ffuf or Gobuster with a large wordlist.. The current command lacks service-specific depth. Adding a more comprehensive script category or using a specialized tool like Dirbuster or Burp Suite allows for brute-forcing against common file paths. Service version detection and enumeration scripts in Nmap are limited by the wordlist provided. Improving detection requires moving beyond passive enumeration into active path discovery, which is essential for identifying hidden administrative interfaces or unlinked configuration files.

Answer

Increase the timing template to -T5 to make the scan faster.

Answer

Add the --script-args='http-enum.basepath=/admin' argument to the command.

Answer

Change the scan to -sS to perform a stealthy SYN scan instead of service detection.

Question 5

When analyzing C2 traffic, which characteristic of a TLS/SSL certificate is most indicative of a potentially malicious beaconing endpoint?

Accepted Answer

The certificate uses a self-signed or invalid chain.. Malicious C2 infrastructure often uses self-signed certificates or certificates issued by untrusted/free Certificate Authorities to encrypt traffic. In a professional environment, legitimate services typically use well-known, trusted CAs. When a penetration tester sees an endpoint using a certificate with a random common name, short expiration period, or invalid chain, it serves as a strong indicator that the connection is intended for unauthorized command and control purposes.

Answer

The certificate uses a 2048-bit RSA key.

Answer

The certificate is signed by a reputable public CA.

Answer

The certificate includes a valid Subject Alternative Name.

Question 6

During the reconnaissance phase, you notice a target is using an older, unpatched version of a popular CMS. What is the most appropriate next step?

Accepted Answer

Research known CVEs for the identified version.. Identifying a vulnerable version of a CMS is a major reconnaissance success. The next step is to research known vulnerabilities (CVEs) associated with that version. This allows the tester to plan an exploit strategy without immediately running active, loud scans that might tip off the security team. This measured approach ensures that the eventual attack is precise, efficient, and well-supported by prior intelligence gathering efforts.

Answer

Immediately run a Metasploit exploit module against the server.

Answer

Contact the organization's IT department to report the vulnerability.

Answer

Ignore the CMS and look for other systems.

Question 7

During a penetration test, you successfully exploit a web application via SQL injection. You want to use this access to achieve remote code execution (RCE) on the underlying Windows database server. Which feature should you look for to facilitate this?

Accepted Answer

Stored procedure execution via xp_cmdshell. Database features like 'xp_cmdshell' in Microsoft SQL Server allow for the execution of arbitrary operating system commands from within a SQL query. If the database service account has sufficient privileges, this allows an attacker to pivot from SQL injection to full system command execution. Checking for this feature is a critical step in escalating database access to server-level administrative control.

Answer

Database backup functionality

Answer

Database triggers on update

Answer

Database user enumeration

Question 8

A penetration tester has obtained a set of NTLM hashes from a Windows domain controller. The tester plans to perform an offline password cracking attack. Which two of the following techniques are most effective for increasing the success rate of cracking these hashes? (Choose two.)

Accepted Answer

Leveraging GPU acceleration with Hashcat. Rule-based attacks and GPU acceleration are both highly effective for offline cracking of NTLM hashes. Rule-based attacks expand the wordlist with common transformations, covering many user-chosen passwords. GPU acceleration with Hashcat maximizes computational speed, allowing millions of guesses per second. Together, they significantly improve the success rate. Other options like rainbow tables or online attacks are either impractical or inefficient in this scenario.

Answer

Conducting an online brute-force attack against the domain controller

Answer

Performing a rainbow table attack using precomputed tables for NTLM

Answer

Using a dictionary attack with a list of common passwords only

Question 9

While testing a Windows 10 workstation, you find that the account you compromised belongs to the Backup Operators group. You need to escalate to local administrator without installing third-party tools on disk. Which built-in capability of this group can you abuse to obtain administrative access?

Accepted Answer

SeBackupPrivilege allows reading any file, enabling extraction of the SAM and SYSTEM registry hives for offline credential dumping. The Backup Operators group is powerful because SeBackupPrivilege and SeRestorePrivilege bypass file system ACLs. An attacker can therefore read protected files such as the SAM and SYSTEM hives, exfiltrate them, and recover local password hashes offline, then use those credentials to reach administrative access without dropping custom binaries onto the host.

Answer

Membership grants SeDebugPrivilege, permitting direct injection into a SYSTEM process to steal its token

Answer

SeTakeOwnershipPrivilege is granted, allowing ownership takeover of any object followed by full control

Answer

The group can modify the discretionary access control list on the local administrator account to reset its password

Question 10

You are reviewing the scope of an upcoming penetration test and need to identify the organization's mail exchangers and the servers authoritative for its DNS zones using only publicly available records. Which DNS record types should you query to obtain this information directly?

Accepted Answer

MX and NS. MX records list the hosts that accept mail for a domain, and NS records list the authoritative name servers for the zone. Querying these two record types directly returns the mail exchangers and DNS authority the tester needs. Both are standard, publicly resolvable records, making them well suited to the reconnaissance phase without generating suspicious traffic.

Answer

A and AAAA

Answer

SOA and PTR

Answer

CNAME and TXT