GPEN Practice Test 13 — 15 Questions

Question 1

You are scanning a target that resides behind a firewall configured to drop TCP packets with the ACK flag set. You want to determine whether the firewall is stateful or stateless. Which Nmap scan type should you use to help make this determination by analyzing the responses to ACK packets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP ACK scan (-sA). The TCP ACK scan is specifically designed to map firewall rulesets and determine if they are stateful. By sending ACK packets, it elicits different responses from stateful versus stateless firewalls. Stateful firewalls drop unsolicited ACKs, while stateless firewalls may allow them, causing the host to respond with RST. This differential response is the key to the determination.

Answer

UDP scan (-sU)

Answer

TCP FIN scan (-sF)

Answer

TCP connect scan (-sT)

Question 2

During an Azure penetration test, you gain access to a Linux VM in a subnet that has a user-defined route forcing all traffic through a Network Virtual Appliance (NVA). You want to reach the Azure Instance Metadata Service (IMDS) to steal managed identity tokens. Which of the following best describes how you can access IMDS from this VM?

Accepted Answer

IMDS is reachable at 169.254.169.254, and the user-defined route does not affect this link-local address, so you can query it directly from the VM.. The Azure Instance Metadata Service is a REST endpoint at 169.254.169.254 that provides metadata and managed identity tokens to VMs. Because it uses a link-local address, traffic to it is intercepted by the Azure platform and is not subject to user-defined routes, NVAs, or network security groups. An attacker on a compromised VM can directly query IMDS to obtain access tokens for any managed identity assigned to that VM, enabling lateral movement or privilege escalation.

Answer

IMDS is reachable at 168.63.129.16, but the user-defined route will block access, requiring you to disable the route first.

Answer

IMDS is reachable at 169.254.169.254, but the user-defined route will redirect the request to the NVA, so you must use a proxy to reach it.

Answer

IMDS is reachable only from within the Azure portal, so you must use the Azure CLI from your attacker workstation to query it.

Question 3

During an internal assessment you obtain a Meterpreter session on a Windows Server 2016 host running as a low-privileged service account. You want to identify whether the host is missing security updates that could allow local privilege escalation without immediately running an exploit. Which Metasploit post-exploitation module should you use to enumerate installed hotfixes and compare them against known vulnerabilities?

Accepted Answer

post/windows/gather/enum_patches. Enumerating installed hotfixes and comparing them to known Microsoft vulnerabilities is exactly what the enum_patches module provides, and it does so without triggering exploit code on a production server. The other modules either list applications, suggest exploits through active checks, or report current token privileges, none of which produce a patch-level inventory needed before selecting a kernel escalation path.

Answer

post/multi/recon/local_exploit_suggester

Answer

post/windows/gather/enum_applications

Answer

post/windows/gather/win_privs

Question 4

You are performing a penetration test and need to scan a large Class B network (10.0.0.0/16) for live hosts. You want to minimize the scan time while still getting accurate results. Which Nmap option should you use to perform a ping sweep without port scanning?

Accepted Answer

-sn. The -sn option performs a ping scan (host discovery) without port scanning. It is the current and correct way to do a ping sweep. The other options either perform port scanning, disable host discovery, or use deprecated syntax.

Answer

-sP

Answer

-sS

Answer

-P0

Question 5

A penetration tester needs to scan a large enterprise network for vulnerabilities but has only a short maintenance window. The tester wants to maximize scan coverage while minimizing the impact on production systems. Which Nessus scan policy setting should the tester adjust to balance speed and accuracy?

Accepted Answer

Adjust the 'Performance' settings to use a 'Custom' scan with optimized timeouts and throttling.. The correct answer involves adjusting performance settings to a custom configuration. This allows the tester to optimize timeouts, throttling, and concurrency to complete the scan within the maintenance window while maintaining sufficient accuracy. Other options either focus solely on safety, risk disruption, or reduce coverage, failing to balance speed and accuracy as required.

Answer

Enable 'Safe checks' to prevent denial-of-service conditions.

Answer

Increase the 'Max concurrent checks per host' value.

Answer

Disable 'Thorough tests' to reduce scan time.

Question 6

A penetration tester is using Nmap to scan a target subnet and wants to identify all hosts that are up without performing port scanning. The tester also wants to avoid sending TCP SYN packets to reduce noise. Which Nmap option should the tester use?

Accepted Answer

-sn. The -sn option is designed for host discovery only, performing a ping scan without port scanning. It sends various probes to determine if hosts are up, but does not scan ports, thus reducing noise from TCP SYN packets to ports. Other options either perform port scanning, are deprecated, or skip discovery entirely, making them unsuitable for the scenario.

Answer

-sS

Answer

-sP

Answer

-Pn

Question 7

A penetration tester has captured a NetNTLMv2 challenge-response hash from a Windows workstation over SMB. The tester plans to recover the plaintext password offline using Hashcat on a workstation with a dedicated GPU. The hash file is saved as 'capture.txt' in the format 'username::domain:challenge:response:blob'. Which Hashcat mode should the tester specify to correctly crack this hash?

Accepted Answer

Hashcat mode 5600. The captured hash is a NetNTLMv2 challenge-response, which requires Hashcat mode 5600. This mode correctly emulates the NetNTLMv2 protocol, allowing the GPU to compute the HMAC-MD5 response for each password candidate. Other modes target different hash types such as NTLM, NetNTLMv1, or LM, and will not parse or crack the hash. Therefore, mode 5600 is the only correct choice for this scenario.

Answer

Hashcat mode 5500

Answer

Hashcat mode 1000

Answer

Hashcat mode 3000

Question 8

A penetration tester is conducting a vulnerability scan against a web application and notices that the scanner reports a critical SQL injection vulnerability on a page that does not accept user input. The tester manually verifies the page and finds no input fields or parameters. What is the most likely cause of this false positive?

Accepted Answer

The scanner is configured to perform blind SQL injection tests by injecting payloads into HTTP headers.. The most likely cause is that the scanner injects payloads into HTTP headers, which the application may log into a database. If the logging is vulnerable, the scanner could detect SQL injection even though the page itself has no input. This is a common source of false positives in web application scanning. Other options do not explain why a false positive would occur on a page with no user input.

Answer

The scanner is using an outdated vulnerability database.

Answer

The scanner is using a safe checks policy that skips destructive tests.

Answer

The scanner is unable to authenticate to the web application.

Question 9

During an internal penetration test, you capture an NTLMv2 challenge-response pair using Responder. You want to crack it offline to obtain the user's password. Which Hashcat mode should you use?

Accepted Answer

Mode 5600 (NetNTLMv2). Responder captures NetNTLMv2 challenge-response pairs, which require Hashcat mode 5600 to crack. Mode 5600 correctly parses the username, domain, challenge, and response. Other modes like 5500 (NetNTLMv1), 1000 (NTLM), and 3000 (LM) are for different hash types and would not work. Selecting the correct mode is essential for successful offline cracking.

Answer

Mode 3000 (LM)

Answer

Mode 5500 (NetNTLMv1)

Answer

Mode 1000 (NTLM)

Question 10

You are performing a penetration test and need to identify all live hosts on a subnet without performing a port scan. Which Nmap command should you use to accomplish this?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag is specifically designed for ping scans, also known as host discovery. It instructs Nmap to send discovery probes and report which hosts are up, without proceeding to port scanning. This meets the requirement of identifying live hosts on a subnet while avoiding unnecessary port scans.

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24

Answer

nmap -sU 192.168.1.0/24

Question 11

A penetration tester has just obtained a Meterpreter session on a Linux web server and wants to keep it active while performing other tasks in msfconsole. Which command should the tester issue to return to the msfconsole prompt while leaving the session running in the background?

Accepted Answer

background. The background command returns control to the msfconsole prompt while preserving the Meterpreter session in the framework's session list. The session continues to run and can be resumed later using sessions -i with the session identifier. Commands like exit or non-existent detach and suspend would either terminate the session or fail, so background is the correct choice.

Answer

exit

Answer

suspend

Answer

detach

Question 12

A penetration tester has obtained Domain Admin credentials during an internal engagement and wants to establish long-term persistence that survives a Domain Admin password reset and reboots. The tester needs a method that remains stealthy and does not rely on leaving a binary on disk. Which technique best meets these requirements?

Accepted Answer

Deploy a Golden Ticket by forging a Kerberos TGT using the krbtgt account hash.. A Golden Ticket is forged from the krbtgt hash and validated by the domain's Kerberos service until the krbtgt password is reset twice. This makes it resilient to Domain Admin password changes and reboots, and because it is generated on demand without a persistent binary, it is stealthier than account creation, new services, or ACL modifications. It directly satisfies the scenario's requirements.

Answer

Install a service on a domain controller that runs as Local System and starts automatically.

Answer

Create a new user account with Domain Admin membership and hide it from the default Users container.

Answer

Add an ACL to the Domain Admins group granting Full Control to a controlled user account.

Question 13

During a penetration test, an operator captures a network authentication attempt using the NTLMv2 protocol. The operator wants to crack the captured challenge-response offline using Hashcat. Which hash mode should the operator select to correctly process the captured NetNTLMv2 hash?

Accepted Answer

5600. NetNTLMv2 hashes require Hashcat mode 5600. This mode is optimized for the NetNTLMv2 challenge-response format, which includes the username, domain, server challenge, and HMAC-MD5 response. Using the correct mode is essential for successful offline cracking. Other modes correspond to different hash types and will not work with NetNTLMv2 captures.

Answer

5500

Answer

13100

Answer

1000

Question 14

A penetration tester is planning a vulnerability scan of a network that includes legacy systems and IoT devices. The tester needs to minimize the risk of disrupting these fragile devices while still gathering useful vulnerability data. Which two actions should the tester take? (Choose two.)

Accepted Answer

Configure the scanner to throttle network traffic and reduce the number of concurrent hosts scanned.. Enabling safe checks and throttling network traffic are the two actions that directly reduce the risk of disrupting legacy systems and IoT devices. Safe checks avoid potentially harmful tests, while throttling and reduced concurrency prevent overwhelming devices with too much traffic. The other options either increase load, broaden the scan unnecessarily, or do not address the specific fragility of these devices.

Answer

Increase the scan's maximum number of concurrent checks per host to speed up the scan.

Answer

Use a TCP SYN scan instead of a TCP connect scan to reduce the number of packets sent.

Answer

Disable host discovery and scan all IP addresses in the range.

Question 15

An attacker has obtained a refresh token for an Azure AD application with the 'Mail.Read' delegated permission. The token was issued to a user who has since had their password reset and all refresh tokens revoked. The attacker attempts to use the refresh token to obtain a new access token. What is the expected outcome?

Accepted Answer

The refresh token will fail because it was revoked, and the attacker must re-authenticate to obtain a new one.. Microsoft Entra ID invalidates all refresh tokens for a user when their password is reset or when tokens are explicitly revoked. This is a security measure to prevent token replay after credential compromise. The attacker's refresh token is therefore invalid, and any attempt to redeem it will result in an error. The attacker would need to re-authenticate with valid credentials to obtain new tokens.

Answer

The refresh token will still work because it is not invalidated by password reset or token revocation.

Answer

The refresh token will work only if the application has the 'offline_access' permission.

Answer

The refresh token will fail because it is bound to the user's password hash, which changed.