GPEN Practice Test 16 — 15 Questions

Question 1

A penetration tester has obtained a hash from a Linux system's /etc/shadow file: $6$rounds=656000$XyZ123$... The tester wants to crack this hash using John the Ripper. Which format should be specified to John to ensure correct cracking?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--format=sha512crypt. The hash begins with $6$, which is the identifier for SHA-512 crypt. John the Ripper's format for this is sha512crypt. The other formats correspond to different algorithms (bcrypt, md5crypt, descrypt) that do not match the $6$ prefix. Therefore, specifying sha512crypt is necessary for successful cracking.

Answer

--format=bcrypt

Answer

--format=md5crypt

Answer

--format=descrypt

Question 2

During a penetration test, you have gained access to a Microsoft Entra ID tenant with Global Administrator privileges. You want to establish a backdoor that allows you to authenticate as any user in the tenant without knowing their password, even if your Global Administrator account is removed. Which of the following methods would best achieve this?

Accepted Answer

Modify the tenant's federation settings to point to an attacker-controlled identity provider.. Modifying the tenant's federation settings to trust an attacker-controlled identity provider allows the attacker to forge SAML tokens for any user. This backdoor is highly persistent because it survives the removal of the attacker's Global Administrator account. It enables authentication as any user without knowing their password, making it an effective persistence mechanism.

Answer

Assign the 'Company Administrator' role to a service principal.

Answer

Create a new user account with the same privileges as a Global Administrator.

Answer

Add a new credential to an existing application with high privileges.

Question 3

A healthcare client hires your team for an internal penetration test. During the kickoff meeting, the client's compliance officer asks which document formally defines the specific systems, time windows, and testing techniques that are authorized for the engagement. Which document should you reference?

Accepted Answer

The Rules of Engagement. The Rules of Engagement is the document that operationalizes the engagement by listing authorized targets, permitted techniques, testing windows, escalation contacts, and data handling requirements. It bridges contractual documents like the Statement of Work and the actual execution of testing, giving compliance and legal stakeholders a clear, auditable definition of what is and is not allowed.

Answer

The Statement of Work

Answer

The master services agreement

Answer

The Non-Disclosure Agreement

Question 4

You are performing passive reconnaissance on a target organization that uses a cloud-based email service. You want to gather information about the organization's email infrastructure and potential phishing targets without alerting the target. Which TWO of the following techniques would be most effective and appropriate for this goal? (Choose two.)

Accepted Answer

Use the Hunter.io API to discover email addresses associated with the target's domain.. Querying MX records via a public resolver reveals the email provider without touching the target. Using Hunter.io's API collects email addresses from third-party databases, also without target contact. Both techniques are passive, effective for mapping email infrastructure, and provide valuable data for phishing or social engineering while avoiding detection.

Answer

Run a brute-force attack on the target's OWA login page to guess passwords.

Answer

Perform a dictionary attack against the target's SMTP server to enumerate valid email addresses.

Answer

Send test emails to common addresses like info@ and support@ to see which ones bounce.

Question 5

You are performing a penetration test on a Linux system and have obtained a low-privileged shell. You want to escalate privileges by exploiting misconfigured file permissions. Which two of the following file permission scenarios are most likely to allow privilege escalation? (Choose two.)

Accepted Answer

A world-writable script that is executed by a root cron job.. The two scenarios most likely to allow privilege escalation are a world-writable script executed by root cron and a root-owned SUID binary that calls a command without an absolute path. The former allows direct code injection as root, while the latter allows PATH manipulation to execute malicious code as root. The other options either do not provide direct escalation or lack a trigger mechanism.

Answer

A world-readable configuration file that contains database credentials.

Answer

A world-writable file in /etc/ that is not used by any service or cron job.

Answer

A directory with permissions 755 owned by root, containing a script that is executed by root.

Question 6

A penetration tester extracts a password hash from a compromised Linux system. The hash format is `$6$rounds=5000$abcdefgh$...`. Which hashing algorithm and configuration does this represent?

Accepted Answer

SHA-512 crypt with 5000 rounds and salt 'abcdefgh'. The hash begins with `$6$`, which is the standard identifier for SHA-512 crypt. The `rounds=5000` indicates the iteration count, and the following string is the salt. This format is widely used on Linux systems for password storage. A penetration tester must recognize the prefix to select the correct cracking mode, such as Hashcat mode 1800, and configure the tool accordingly to attempt recovery.

Answer

SHA-256 crypt with 5000 rounds and salt 'abcdefgh'

Answer

MD5 crypt with 5000 rounds and salt 'abcdefgh'

Answer

bcrypt with cost factor 5000 and salt 'abcdefgh'

Question 7

During an engagement, a penetration tester obtains a password hash that starts with `$2y$10$`. The client's security policy requires passwords to be at least 12 characters and include complexity. The tester wants to crack the hash using a rule-based attack. Which Hashcat mode should be used, and what is the primary advantage of this hash format?

Accepted Answer

Mode 3200 (bcrypt), and the advantage is that the cost factor makes brute-force attacks significantly slower.. The hash prefix `$2y$10$` is characteristic of bcrypt, with the cost factor 10. Hashcat mode 3200 is designed for bcrypt. The cost factor exponentially increases the number of iterations, making each guess computationally expensive. This slows down brute-force and rule-based attacks, which is the main security benefit. A penetration tester must recognize this and adjust expectations for cracking speed and time.

Answer

Mode 1000 (NTLM), and the advantage is that it is the default Windows hash format, making it widely applicable.

Answer

Mode 500 (md5crypt), and the advantage is that it is fast to compute, allowing more guesses per second.

Answer

Mode 1800 (sha512crypt), and the advantage is that the salt prevents rainbow table attacks.

Question 8

You compromise a Windows workstation and extract the NTLM hash of a local administrator account that is reused across many workstations in the domain. You want to authenticate to remote hosts without cracking the hash. Which technique should you use?

Accepted Answer

Perform a pass-the-hash attack using the extracted NTLM hash to authenticate to remote SMB services.. NTLM authentication treats possession of the hash as sufficient proof of identity, so the extracted local administrator hash can be supplied directly to tools that establish SMB or WMI sessions. Because that local account is reused across workstations, pass-the-hash grants access to many systems immediately, with no cracking step and no dependency on the plaintext password.

Answer

Use the hash as input to an offline brute-force tool to recover the plaintext password.

Answer

Kerberoast service accounts to obtain crackable service ticket hashes.

Answer

Run a relay attack with Responder to capture and forward NetNTLM authentications.

Question 9

During a penetration test, a tester obtains a Meterpreter session on a Windows host but the session dies immediately after the initial connection. The tester suspects that the payload is being terminated by endpoint protection. Which Meterpreter feature should the tester use to migrate the session into a more stable process?

Accepted Answer

migrate. When a Meterpreter session is unstable because the hosting process is being terminated, migrating to a stable process is the appropriate step. The migrate command injects the Meterpreter payload into another process, ideally a long-running one like explorer.exe. Backgrounding, loading extensions, or killing the session do not address the root cause of instability.

Answer

load

Answer

sessions -k

Answer

background

Question 10

A penetration tester is performing a password attack against an Active Directory environment and has obtained a list of domain user accounts. The tester wants to perform a password spraying attack to identify weak passwords while minimizing the risk of account lockouts. Which TWO of the following are best practices for conducting a password spraying attack in this scenario? (Choose two.)

Accepted Answer

Use a small set of commonly used passwords, such as 'Password123' and 'Summer2024', and try each password against all accounts with a delay between attempts.. Effective password spraying requires using a small set of common passwords and pacing attempts to avoid lockouts. Knowing the domain's lockout policy allows the attacker to stay under the threshold. Trying many passwords per account or using high concurrency can trigger lockouts, defeating the purpose. Monitoring lockout events is a defensive measure, not an offensive best practice.

Answer

Monitor the domain controller's event logs for lockout events (e.g., Event ID 4740) to detect when the lockout threshold is being approached and adjust your attack accordingly.

Answer

Attempt all passwords in your list against a single account before moving to the next account to quickly identify which account has a weak password.

Answer

Use a single password for all accounts and attempt it simultaneously across all accounts using multiple threads to maximize speed.

Question 11

You are performing a reconnaissance task and need to identify the physical location or ownership of an organization's IP space. Which TWO of the following services are standard for this task?

Accepted Answer

WHOIS lookups. WHOIS and GeoIP databases are the industry standard for mapping network ownership and physical presence. WHOIS provides the registrant details for netblocks, while GeoIP services attempt to map IP addresses to physical coordinates. Together, they help a penetration tester understand the geographic footprint and administrative ownership of the target infrastructure, which is essential for accurate scoping and reporting of findings.

Answer

SSH brute-force tools

Answer

Packet sniffing on the target's Wi-Fi

Answer

Web browser history inspection

Question 12

Refer to the exhibit. What is the most likely cause of the 'Connection reset by peer' error when using the PsExec module?

Accepted Answer

Endpoint security or a firewall terminated the SMB connection. The error 'Connection reset by peer' during a PsExec exploit attempt usually indicates that an active security control, such as a host-based firewall or endpoint protection, terminated the connection. PsExec relies on the Admin$ share and the service control manager. If the target system detects the service installation attempt or the connection from an unauthorized source, it will forcefully drop the connection to block the exploitation attempt, a common scenario in hardened enterprise environments.

Answer

The SMB credentials provided are incorrect

Answer

The listener port is blocked by the target firewall

Answer

The payload architecture does not match the target

Question 13

Which of the following is a classic characteristic of 'beaconing' behavior observed in C2 traffic?

Accepted Answer

Consistent, periodic intervals between connections.. Beaconing is characterized by the repeated, predictable nature of the connection attempts from a compromised host to an external server. By analyzing network traffic, one can identify these 'heartbeats' that occur at fixed intervals. This pattern is often the first red flag that a system has been compromised, as legitimate user activity is typically irregular and bursty compared to the methodical, automated nature of a C2 beacon.

Answer

High-volume data exfiltration during business hours.

Answer

Randomized connections to various global IP addresses.

Answer

Traffic that exclusively utilizes UDP transport.

Question 14

When conducting an advanced credential harvesting assessment against an Active Directory environment, a penetration tester attempts Kerberoasting. Which TWO actions or conditions are required to successfully extract and crack service tickets using this technique? (Choose TWO)

Accepted Answer

Possession of a standard domain user account to request service tickets from the Key Distribution Center.. Kerberoasting requires requesting a Ticket Granting Service ticket for any domain user account associated with a Service Principal Name, followed by offline cracking since the ticket is encrypted with the service account password hash. GPEN testers leverage this to extract credentials without touching the target server directly.

Answer

Direct administrative access to the primary Domain Controller file system to steal the NTDS.dit database.

Answer

An active session running specialized exploitation tools on the specific host running the target service.

Answer

Unconstrained Kerberos delegation configured specifically on the local workstation operating system.

Question 15

During a penetration test, you gain access to a server and want to add a new SSH key for persistent access. Where should you place the key in the user's home directory?

Accepted Answer

~/.ssh/authorized_keys. The ~/.ssh/authorized_keys file is the standard location for SSH public keys. By appending a public key to this file, an attacker can log in via SSH using the corresponding private key without needing a password. This is a common, reliable, and stealthy persistence method on Linux systems that allows for repeated, automated access to the compromised server throughout the duration of the test.

Answer

~/.ssh/known_hosts

Answer

/etc/ssh/ssh_config

Answer

/etc/shadow