GPEN Practice Test 15 — 15 Questions

Question 1

A penetration tester is preparing to exploit a stack-based buffer overflow on a Linux target. The target binary has non-executable stack (NX) enabled. Which technique should the tester use to achieve code execution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Return-to-libc (ret2libc) attack. Return-to-libc is the correct technique because it leverages existing executable code in shared libraries to bypass the non-executable stack. It allows the tester to call functions like `system()` to execute commands without injecting shellcode. Other options either assume an executable stack or are not applicable to stack-based overflows on Linux with NX enabled.

Answer

Use a NOP sled and jump to shellcode on the stack

Answer

Stack pivot to a writable and executable memory region

Answer

Heap spraying

Question 2

You are performing an authorized penetration test and have established a C2 channel using HTTPS. To evade network detection, you configure your C2 beacon to use domain fronting. Which of the following best describes how domain fronting masks the true destination of your C2 traffic?

Accepted Answer

The TLS SNI field contains the domain of a legitimate high-reputation service, while the HTTP Host header contains the actual C2 domain.. Domain fronting works by manipulating the TLS SNI and HTTP Host header. The SNI, visible during the TLS handshake, points to a legitimate domain hosted on a CDN, while the encrypted Host header points to the actual C2 domain also hosted on the same CDN. This makes the traffic appear to be destined for the legitimate domain to network observers, effectively hiding the C2 communication.

Answer

The C2 traffic is routed through multiple compromised hosts in a peer-to-peer network, making it difficult to trace back to the origin.

Answer

The TLS SNI field contains the actual C2 domain, while the HTTP Host header contains the domain of a legitimate service.

Answer

The C2 traffic is encapsulated within DNS queries to a legitimate domain, and the responses contain the C2 instructions.

Question 3

A penetration tester is reviewing Active Directory for Kerberos delegation misconfigurations that could allow privilege escalation. Which of the following TWO configurations should the tester flag as directly enabling an attacker to impersonate a domain administrator to a target service? (Choose two.)

Accepted Answer

A user account configured for constrained delegation with the 'Use any authentication protocol' option and msDS-AllowedToDelegateTo set to a sensitive service.. Unconstrained delegation caches TGTs of authenticating users, so a domain administrator's logon on such a host exposes their TGT for impersonation. Constrained delegation with protocol transition and a sensitive target allows an attacker controlling the delegating account to impersonate any user, including administrators, to that service. Both configurations directly enable the described escalation and should be flagged.

Answer

A standard user account with the 'Account is sensitive and cannot be delegated' flag set.

Answer

A group Managed Service Account (gMSA) with a 120-character automatically rotated password.

Answer

A domain controller configured with the 'Trusted for Delegation' flag but no users currently logged on.

Question 4

A penetration tester has compromised a host in a restricted network that only allows outbound DNS queries to a specific internal resolver. The tester needs to establish a command and control channel that can traverse this restriction. Which C2 technique is most appropriate?

Accepted Answer

DNS tunneling. DNS tunneling is the only technique that can operate within a network that only allows DNS queries to an internal resolver. It encapsulates C2 traffic within DNS packets, which are forwarded by the resolver to external authoritative servers. This makes it ideal for bypassing strict egress filtering. Other techniques require protocols or ports that are not permitted in this scenario.

Answer

SMTP beaconing

Answer

ICMP tunneling

Answer

HTTPS beaconing

Question 5

You are using Cobalt Strike in an authorized penetration test. The target network uses a next-generation firewall that performs SSL inspection and blocks self-signed certificates. You need to configure your HTTPS beacon to blend in with legitimate traffic and avoid detection. (Choose two.)

Accepted Answer

Configure the beacon to use a malleable C2 profile that mimics a known application like Microsoft Outlook Web Access.. To evade SSL inspection and blend in, using a valid certificate from a trusted CA ensures the TLS handshake is accepted, and a malleable C2 profile mimicking a known application like OWA makes the traffic appear legitimate at the application layer. Together, they address both certificate trust and traffic pattern detection. Other options do not resolve the certificate blocking or are less effective for blending.

Answer

Enable the TCP beacon instead of the HTTPS beacon.

Answer

Use a self-signed certificate but set the beacon's user agent to match a common browser.

Answer

Set the beacon's sleep time to 60 seconds with 30% jitter.

Question 6

You are configuring a C2 listener to use a malleable profile to blend in with legitimate traffic. Which two of the following are key benefits of using a malleable C2 profile in a penetration test? (Choose two.)

Accepted Answer

It provides a mechanism to define how the C2 server responds to specific requests, including error pages and other decoy content.. Malleable C2 profiles are used to customize the network traffic generated by a C2 framework to evade detection. They allow operators to define request and response structures, including headers, URIs, and body content, so that the traffic mimics legitimate services. This customization helps in blending with normal network activity and avoiding signature-based detection, making it a valuable tool during penetration tests.

Answer

It enables the C2 server to automatically generate new domain names for each beacon, avoiding domain blacklisting.

Answer

It encrypts the C2 traffic using a unique, randomly generated key for each session, ensuring perfect forward secrecy.

Answer

It allows the C2 traffic to be routed through multiple redirectors without additional configuration.

Question 7

During an authorized penetration test, you compromise a Windows host in a restricted network segment that only permits outbound DNS (UDP 53) to an internal resolver. You need to establish a command-and-control channel that can survive reboots and provide interactive shell access while blending with normal DNS traffic. Which of the following is the MOST appropriate technique to achieve this?

Accepted Answer

Use a DNS tunneling tool such as dnscat2, configure it with a domain you control, and set up a scheduled task to restart the client on boot.. The scenario requires a C2 channel that works over DNS only, supports interactive shell, and survives reboots. DNS tunneling via dnscat2 meets these requirements because it encapsulates data in DNS queries and responses, which are allowed. Persistence via scheduled task ensures the client restarts after a reboot. The other options either violate the allowed protocol (TCP/443, ICMP) or attempt to bypass the internal resolver, which is not permitted.

Answer

Use a DNS TXT record to store commands, and have the compromised host poll a public DNS server directly on UDP 53, bypassing the internal resolver.

Answer

Use a reverse TCP Meterpreter payload over port 443 with TLS, and rely on the firewall's deep packet inspection to allow it as HTTPS.

Answer

Use an ICMP tunnel such as ptunnel to encapsulate shell traffic in echo requests, and configure a registry run key for persistence.

Question 8

You are configuring a Cobalt Strike beacon for a penetration test. The client's security team monitors for periodic beaconing patterns. You want to reduce the chance of detection by network behavior analysis. Which beacon setting should you adjust?

Accepted Answer

Increase the sleep time and add jitter.. Adjusting sleep time and jitter directly modifies the beacon's communication schedule, making it less predictable. Longer sleep intervals reduce traffic volume, and jitter adds randomness, breaking the periodic pattern that network behavior analysis seeks. Other options affect different layers (application headers, transport, or TLS) but do not address the timing-based detection described.

Answer

Change the user agent to match a common browser.

Answer

Use a self-signed certificate for the HTTPS listener.

Answer

Enable the TCP beacon instead of HTTPS.

Question 9

During a penetration test, you have established a C2 channel using a domain fronting technique with a CDN. The target organization's proxy logs show connections to a high-reputation domain, but the actual C2 traffic is destined for your backend server. Which component is essential for this setup to function?

Accepted Answer

A CDN that supports domain fronting and allows you to configure the Host header separately from the SNI.. Domain fronting requires a CDN that permits the Host header to differ from the SNI. The CDN uses the Host header to route to the correct backend, while the SNI shows a trusted domain. This makes the traffic appear to go to a high-reputation domain. Without CDN support, the technique cannot work. Other options are either handled by the CDN or irrelevant to the mechanism.

Answer

An HTTP redirect from the high-reputation domain to your backend server.

Answer

A DNS TXT record pointing to your backend server.

Answer

A valid SSL certificate for the high-reputation domain on your backend server.

Question 10

You are setting up a C2 infrastructure for a penetration test. To protect the backend C2 server from direct exposure, you deploy a redirector. Which of the following best describes the primary function of a redirector in this context?

Accepted Answer

It acts as a proxy that forwards only malicious traffic to the C2 server while blocking or misdirecting other traffic.. A redirector's primary function is to act as a proxy that filters incoming traffic, forwarding only legitimate C2 traffic to the backend server while blocking or misdirecting other connections. This protects the C2 server's location and makes it more difficult for defenders to identify and block the actual C2 infrastructure. Encryption, load balancing, and domain generation are separate concerns handled by other components or techniques.

Answer

It generates random domain names for the C2 server to evade domain blacklisting.

Answer

It load-balances incoming connections across multiple C2 servers to ensure high availability.

Answer

It encrypts all traffic between the compromised host and the C2 server, ensuring confidentiality.

Question 11

During an internal assessment, a tester has valid domain credentials for a standard user and captures Kerberos traffic with Wireshark. The tester notices several TGS-REQ packets for service principal names ending in "/MSSQLSvc" across multiple hosts. The tester wants to identify which accounts are vulnerable to offline password cracking without triggering account lockouts. Which action should the tester take next?

Accepted Answer

Use Rubeus with the kerberoast action to request TGS tickets for the MSSQLSvc SPNs and save the extracted hashes for offline cracking.. Requesting service tickets for accounts with registered SPNs yields TGS material encrypted with the service account's key, enabling offline cracking without lockout risk. The captured TGS-REQ traffic for MSSQLSvc SPNs confirms kerberoastable targets. Tools like Rubeus automate extraction and output hashcat-compatible hashes, letting the tester verify weak service account passwords safely.

Answer

Run BloodHound with the collection method All to map SPN relationships and infer which accounts use weak passwords.

Answer

Perform an AS-REP Roasting scan against all domain users to collect encrypted pre-authentication responses.

Answer

Attempt to authenticate to each MSSQLSvc SPN using the compromised user's credentials to confirm access.

Question 12

You are conducting a penetration test against a target that employs a next-generation firewall (NGFW) with SSL inspection. Your C2 channel uses a custom protocol over TCP port 8443 with a self-signed certificate. The NGFW is blocking your traffic. You need to modify your C2 configuration to evade detection while maintaining command and control. Which of the following changes is MOST likely to succeed?

Accepted Answer

Switch to using a legitimate code-signing certificate issued by a trusted CA and mimic the TLS fingerprint of a common web browser.. The NGFW's SSL inspection is blocking the C2 because it can decrypt the traffic and detect the self-signed certificate or suspicious TLS characteristics. To evade this, the C2 must present a trusted certificate and mimic a legitimate browser's TLS handshake. This makes the traffic indistinguishable from normal HTTPS. The other options either do not address SSL inspection (jitter, port change) or retain the self-signed certificate (domain fronting), which would still be flagged.

Answer

Configure the C2 client to use a random port above 1024 and implement jitter in the beacon interval to avoid pattern detection.

Answer

Use a domain fronting technique with a popular CDN to hide the true destination, and keep the self-signed certificate.

Answer

Encapsulate the C2 traffic within DNS queries to a domain you control, using a high volume of queries to avoid detection.

Question 13

You are designing a resilient command-and-control (C2) infrastructure for an authorized penetration test. The client's network has strict egress filtering and monitors for anomalous traffic. You need to ensure that your C2 channel can survive the takedown of a single server and adapt to changing network conditions. Which two of the following techniques should you implement? (Choose two.)

Accepted Answer

Implement a fallback channel that uses a different protocol (e.g., DNS) if the primary channel is blocked.. Resilient C2 infrastructure requires redundancy and adaptability. Multiple redirectors with domain fronting provide redundancy and hide the true server, making takedown more difficult. A fallback channel using a different protocol ensures communication continues if the primary channel is blocked. These two techniques directly address survivability and adaptability. The other options either introduce single points of failure or focus on stealth rather than resilience.

Answer

Enable jitter and sleep intervals to randomize beacon timing and avoid pattern-based detection.

Answer

Configure the C2 client to use a single hardcoded IP address for the C2 server to simplify reconnection.

Answer

Use a single domain name with a long TTL to minimize DNS lookups and reduce the chance of detection.

Question 14

During an internal assessment, you gain a foothold as a low-privileged domain user on a Windows Server 2019 host that is a member of an Active Directory domain. You run whoami /priv and observe SeImpersonatePrivilege enabled in your token. You need to escalate to NT AUTHORITY\SYSTEM on this host. Which technique is most appropriate?

Accepted Answer

Abuse SeImpersonatePrivilege with a token impersonation tool such as JuicyPotato, RoguePotato, or PrintSpoofer, depending on the OS build.. SeImpersonatePrivilege allows a process to take on the security context of a token it receives, and privileged Windows services can be coerced into connecting to an attacker-controlled listener. Tools such as PrintSpoofer and RoguePotato exploit that behavior to obtain a SYSTEM token on modern Windows builds where older Potato techniques no longer work. Because the privilege is already present in the token, this is the direct escalation route.

Answer

Run a Kerberoasting attack against all service accounts and crack the resulting RC4 hashes offline to obtain a domain administrator password.

Answer

Extract cached domain credentials from the registry using reg save on the SAM and SYSTEM hives and crack them with hashcat.

Answer

Perform an unquoted service path attack by placing a malicious executable in a directory whose path contains a space and is writable.

Question 15

You are conducting an internal penetration test for a client that uses Microsoft Entra ID with on-premises Active Directory. You have obtained Domain Admin credentials in the on-premises domain. The client has deployed Microsoft Entra Connect with Seamless Single Sign-On (SSO) enabled. Which of the following actions would allow you to authenticate as any synchronized user to cloud services like Microsoft 365 WITHOUT knowing their password?

Accepted Answer

Extract the AZUREADSSOACC computer account password hash from the on-premises Active Directory and forge Kerberos service tickets for the cloud service principal.. With Domain Admin privileges, an attacker can extract the password hash of the AZUREADSSOACC computer account, which is used for Seamless Single Sign-On. This hash allows forging Kerberos service tickets for the Microsoft Entra ID service principal, enabling authentication as any synchronized user without their password. This is a critical risk in hybrid identity configurations where Seamless SSO is enabled.

Answer

Retrieve the on-premises user's password hash from the domain controller and use it to authenticate to Microsoft Entra ID via password hash synchronization.

Answer

Leverage the Seamless SSO computer account to perform a Silver Ticket attack against the on-premises domain controller and then access cloud resources.

Answer

Use the Directory Synchronization Account credentials to modify the source anchor attribute of a targeted user to point to a new on-premises object.