GPEN Practice Test 12 — 15 Questions

Question 1

During a penetration test, you obtain a password hash from a Linux system's /etc/shadow file. The hash starts with '$6$'. Which Hashcat mode should you use to crack it?

Accepted Answer

Hashcat mode 1800 (sha512crypt). The '$6$' prefix unambiguously identifies a SHA-512 crypt hash. Hashcat mode 1800 is specifically built for this format, ensuring correct salt handling and efficient cracking. Other modes correspond to different hash algorithms and would not successfully crack the hash.

Answer

Hashcat mode 3200 (bcrypt)

Answer

Hashcat mode 500 (md5crypt)

Answer

Hashcat mode 1500 (DEScrypt)

Question 2

During a vulnerability scan of a web application, the scanner reports a critical SQL injection vulnerability on a login form. A manual test using a single quote in the username field returns a generic error page with no database details. The scanner's evidence shows a time-based blind SQL injection payload that caused a five-second delay. Which action should the penetration tester take next to validate the finding?

Accepted Answer

Manually inject a time-based payload that includes a conditional delay, such as '; IF (1=1) WAITFOR DELAY '0:0:5'--, and compare response times with a false condition.. The most reliable way to confirm time-based blind SQL injection is to use a conditional payload that delays only when a true condition is met, and compare that with a false condition. This controls for network and server latency, demonstrating that the delay is caused by the injected SQL logic. Simply re-running the scanner or relying on a single delay is insufficient for validation.

Answer

Immediately report the SQL injection as a confirmed critical finding based on the scanner's time-based evidence.

Answer

Re-run the scanner with the same payload multiple times and compare the response times to confirm the delay is consistent.

Answer

Submit the login form with a benign username and password to check if the application returns a different error, then conclude the vulnerability is a false positive.

Question 3

A penetration tester has obtained the NTLM hash of a domain user and wants to authenticate to a remote server without cracking the password. Which of the following techniques allows the tester to use the hash directly for authentication?

Accepted Answer

Pass-the-Hash (PtH) using Mimikatz sekurlsa::pth. Pass-the-Hash allows an attacker to authenticate using the NTLM hash without cracking it. Tools like Mimikatz can inject the hash into a session, enabling lateral movement or access to resources. Other options involve cracking or forging tickets, which are different attack vectors. The scenario emphasizes using the hash directly, making Pass-the-Hash the correct technique.

Answer

Golden Ticket attack using the KRBTGT hash

Answer

Kerberoasting to request a service ticket

Answer

Rainbow table lookup to recover the plaintext password

Question 4

A penetration tester is reviewing a captured NTLMv2 challenge-response pair and wants to crack it offline using Hashcat. Which Hashcat mode should the tester use to attack this specific hash type?

Accepted Answer

Hashcat mode 5600 (NetNTLMv2). Hashcat mode 5600 is the correct choice because it is tailored for NetNTLMv2 challenge-response pairs, which are commonly captured during penetration tests. This mode understands the structure of the NTLMv2 response, including the server challenge and the HMAC-MD5 computation. Other modes target different hash types, such as raw NT hashes or Kerberos tickets, and would not correctly parse or crack the captured NTLMv2 data. Using the right mode ensures efficient and successful cracking.

Answer

Hashcat mode 0 (MD5)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 1000 (NTLM)

Question 5

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a workstation. You attempt to crack it offline using Hashcat, but after several hours with a large wordlist and rules, the hash remains uncracked. Which factor most directly determines the feasibility of cracking this hash?

Accepted Answer

The length and complexity of the user's password. The feasibility of cracking a NetNTLMv2 hash offline is fundamentally governed by the password's entropy. NetNTLMv2 uses HMAC-MD5 with the user's NT hash and a server challenge, making it resistant to precomputation and requiring brute-force or dictionary attacks. If the password is long and complex, the search space becomes too large for practical cracking, regardless of hardware or network factors.

Answer

The version of the SMB protocol used during authentication

Answer

The network speed between the attacker and the victim

Answer

The amount of RAM available on the cracking machine

Question 6

A penetration tester extracts a domain user's NT hash from the SAM database of a workstation and wants to authenticate to a file share on a different server without knowing the plaintext password. Which of the following techniques should the tester use?

Accepted Answer

Pass-the-Hash using the NT hash directly in an authentication request. Pass-the-Hash is the correct technique because Windows authentication protocols accept the NT hash as a valid credential. An attacker who extracts the hash can use it to authenticate to remote services without cracking the plaintext. The other options either aim at password recovery or rely on different credential material, such as Kerberos tickets, which are not present in this scenario. The key distinction is that Pass-the-Hash uses the hash directly for authentication.

Answer

Pass-the-Ticket by injecting a forged Kerberos TGT into memory

Answer

Kerberoasting the target service account to obtain its TGS ticket

Answer

Rainbow table lookup against the NT hash to recover the plaintext password

Question 7

A penetration tester is preparing to run a credentialed vulnerability scan against a mixed environment of Windows Server 2019 and Ubuntu 20.04 hosts on an internal /24 subnet. The tester wants to reduce scan duration and network load while still detecting missing patches and misconfigurations. Which two scanning techniques should the tester implement to achieve these goals? (Choose two.)

Accepted Answer

Use SSH and SMB credentials to allow the scanner to query the local patch database and installed software inventory.. Credentialed scanning with local security checks is the most efficient way to detect missing patches and misconfigurations while minimizing network traffic and scan time. Supplying administrative credentials for Windows and SSH credentials for Linux allows the scanner to read local patch databases and software inventories directly, avoiding extensive remote probing. This approach improves accuracy and reduces load compared to unauthenticated or overly aggressive scanning methods.

Answer

Configure the scanner to perform a SYN stealth scan on all 65,535 TCP ports for every host before authenticating.

Answer

Limit the scan to a predefined list of common ports and disable all plugin families except 'Denial of Service'.

Answer

Set the scanner to use a very aggressive timing template to maximize parallelism across all hosts.

Question 8

A penetration tester has obtained a single NT hash for a domain user account during an internal engagement. The tester wants to authenticate to a remote Windows 10 workstation as that user without knowing the plaintext password. Which tool is designed to perform this authentication using only the NT hash?

Accepted Answer

Mimikatz with the sekurlsa::pth module. Pass-the-Hash uses the NT hash itself as the credential to authenticate to remote systems. Mimikatz's sekurlsa::pth module injects the hash into a new logon session, enabling the tester to access resources as the target user without recovering the plaintext password. Other tools listed perform different functions such as poisoning, enumeration, or online brute-force, and cannot authenticate with an NT hash.

Answer

Responder with the -w flag

Answer

Hydra with the -H option

Answer

Nmap with the smb-enum-users script

Question 9

During an internal penetration test, you need to sweep a /24 subnet for live hosts using Nmap. The client's security team has confirmed that ICMP echo requests are blocked at the host firewall on all workstations, but they want you to use a technique that still elicits responses from hosts that are up without relying on ICMP. Which Nmap host discovery option should you use to maximize host detection in this environment?

Accepted Answer

nmap -sn -PS22,80,443 10.10.10.0/24. A TCP SYN ping (-PS) to common ports like 22, 80, and 443 is effective when ICMP is blocked because it uses TCP handshake responses to determine host liveness. The -sn flag suppresses port scanning and focuses on discovery. This combination reliably identifies live hosts that would otherwise be missed by ICMP-based methods.

Answer

nmap -sn -PP 10.10.10.0/24

Answer

nmap -sn -PE 10.10.10.0/24

Answer

nmap -sn -PR 10.10.10.0/24

Question 10

A penetration tester is configuring a vulnerability scanner to assess a sensitive production network. The tester wants to avoid causing service disruptions or overwhelming network devices. Which scanner setting should be adjusted to best achieve this?

Accepted Answer

Enable safe checks and reduce the scan's performance settings to limit simultaneous connections.. To avoid disrupting a sensitive production network, the scanner should be configured with safe checks enabled and performance settings lowered to reduce concurrent connections and packet rate. This minimizes the risk of overwhelming devices or causing service outages. Disabling DoS plugins and avoiding aggressive timing are also important, but safe checks and reduced performance are the primary controls.

Answer

Disable all plugin families except those that perform denial-of-service testing to quickly identify weak points.

Answer

Set the scanner to use a random port order and maximum timing template to evade detection.

Answer

Increase the maximum number of concurrent hosts and checks per host to finish faster.

Question 11

You are performing a penetration test against a web server that is protected by a network-based intrusion prevention system (IPS). You need to conduct a port scan while minimizing the chance of being blocked. Which two Nmap options should you use to evade the IPS? (Choose two.)

Accepted Answer

Use -T0 or -T1 to slow down the scan.. To evade an IPS during a port scan, slowing down the scan with -T0 or -T1 and using decoys with -D RND:10 are effective techniques. These methods reduce the scan's signature and make it harder for the IPS to correlate the activity to a single source, thereby minimizing the risk of being blocked.

Answer

Use -O to enable OS detection.

Answer

Use -A to enable aggressive scan options.

Answer

Use -sV to enable version detection.

Question 12

You are performing a penetration test against a target that is behind a firewall configured to drop all TCP packets except those destined for port 443. You need to determine whether the firewall is stateful or stateless to plan your attack. Which Nmap scan technique will best help you make this determination?

Accepted Answer

TCP ACK scan (-sA). The ACK scan is specifically designed to map firewall rulesets and determine if a firewall is stateful. By sending ACK packets, which are not part of a connection establishment, a stateful firewall will drop them, while a stateless firewall may allow them through based on port rules. This difference in behavior reveals the firewall's nature.

Answer

TCP connect scan (-sT)

Answer

TCP Xmas scan (-sX)

Answer

TCP FIN scan (-sF)

Question 13

A penetration tester is conducting an offline password attack against a set of NTLM hashes extracted from a Windows domain. The tester wants to maximize the efficiency of the cracking process by using Hashcat. Which two techniques are most effective for this goal? (Choose two.)

Accepted Answer

Utilizing a rule-based attack with a comprehensive rule set like best64.rule. Rule-based attacks and mask attacks are both highly effective for offline NTLM cracking because they intelligently reduce the search space by applying common transformations or adhering to known password policies. Pure brute-force is impractical for long passwords, while options like ignoring usernames or oversubscribing threads do not enhance cracking efficiency.

Answer

Increasing the number of threads to exceed the number of CPU cores

Answer

Using the --username option to ignore usernames during cracking

Answer

Running a pure brute-force attack with all printable ASCII characters up to 12 characters

Question 14

You are scanning a target from a host on the same Ethernet segment. You run 'nmap -sS -p 445 192.168.1.50' and receive a response indicating the port is open. You then run the same scan from a different subnet across a router and receive no response at all, even though the service is confirmed running. Which statement best explains this difference?

Accepted Answer

A firewall or ACL between the subnets is blocking TCP/445, so the SYN packets never reach the target or the responses never return, resulting in a filtered or no-response state.. The discrepancy between local and remote scan results points to a network-level filter rather than a scanning limitation. SYN scans are routable, so when TCP/445 is reachable on the LAN but silent across a router, an intermediate firewall or ACL is the most probable cause of the filtered result.

Answer

The SYN scan relies on receiving a RST or SYN/ACK, but the router may be filtering or dropping the return traffic, causing the port to appear filtered from the remote subnet.

Answer

The -sS scan requires the --send-eth option when crossing subnets, otherwise Nmap uses IP packets that routers cannot forward.

Answer

Nmap SYN scans only work on the local subnet because they require layer-2 adjacency to receive responses.

Question 15

A penetration tester is preparing to crack a set of NTLM hashes obtained from a Windows domain controller. The tester wants to maximize the chances of recovering plaintext passwords. Which TWO of the following techniques are most effective for this goal? (Choose two.)

Accepted Answer

Employing a hybrid attack that combines a wordlist with a mask for appending digits.. Rule-based attacks and hybrid attacks are the most effective because they leverage common password patterns and mutations, which are prevalent in real-world environments. Rule-based attacks apply transformations to wordlists, while hybrid attacks combine words with masks to cover predictable suffixes like digits. Both methods efficiently target likely passwords without the impractical computational cost of full brute-force. Distributed cracking only increases speed, not the likelihood of success, and rainbow tables are limited and outdated.

Answer

Using a distributed cracking setup with multiple GPUs to increase hash rate.

Answer

Performing a brute-force attack with a mask that covers all possible 8-character combinations.

Answer

Utilizing a precomputed rainbow table for NTLM hashes.