GPEN Practice Test 17 — 15 Questions

Question 1

During OSINT gathering, you are investigating a target's presence on social media and professional networking sites. Which TWO of the following methods are effective for gathering metadata about employees to facilitate future social engineering attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Extracting EXIF data from public photos. OSINT activities focus on harvesting publicly available information to profile individuals within an organization. By analyzing professional profiles and image metadata, an attacker gains insight into corporate hierarchies and technical stacks. This information is vital for crafting targeted phishing campaigns or pretexting scenarios. Understanding how to extract this data demonstrates a comprehensive approach to reconnaissance by focusing on the 'human' element alongside technical network infrastructure.

Answer

Performing a brute-force attack on the corporate firewall

Answer

Conducting a port scan of the internal network

Answer

Directly calling the IT helpdesk to request employee email addresses

Question 2

Which of the following describes the function of the 'msfvenom' tool within the Metasploit ecosystem?

Accepted Answer

To generate and encode custom payloads. Msfvenom combines the functionality of the old 'msfpayload' and 'msfencode' tools. It is used to generate standalone, malicious payloads for a variety of platforms. Understanding how to generate custom shellcode is essential for penetration testers who need to tailor their delivery mechanism to bypass specific security controls, such as application whitelisting or signature-based antivirus, which often block default, well-known Metasploit payload binaries.

Answer

To act as a central vulnerability database

Answer

To automate the exploitation of remote services

Answer

To manage active sessions and post-exploitation

Question 3

Which technique is most effective for maintaining persistence on a Windows domain-joined machine while remaining stealthy by avoiding common registry keys?

Accepted Answer

Creating a WMI event subscription for system events.. Persistence is often detected via common registry keys like Run or RunOnce. Using Windows Management Instrumentation (WMI) event subscriptions allows for persistence that is harder to detect. By creating an EventFilter and EventConsumer, an attacker can trigger a malicious script based on system events, such as a specific time or system uptime, bypassing traditional registry-based forensic analysis and providing a robust, fileless-like execution method.

Answer

Adding a startup shortcut to the All Users Startup folder.

Answer

Modifying the existing service binary to include a backdoor.

Answer

Running a scheduled task with a visible command prompt window.

Question 4

Which of the following is considered a 'client-side' exploitation scenario?

Accepted Answer

Tricking a user into opening a malicious PDF.. Client-side exploitation involves targeting an application running on a user's machine, such as a browser, document viewer, or email client. Unlike server-side exploitation, which targets a persistent service, client-side attacks rely on tricking a user into interacting with a malicious resource. This shift in vector requires testers to consider social engineering and user behavior as key components of the attack chain, which is distinct from direct network-based vulnerability exploitation.

Answer

Exploiting an unpatched web server service.

Answer

Attacking an open database port.

Answer

Brute-forcing an SSH login on a server.

Question 5

During a penetration test on a Linux system, you have gained root access and want to ensure that your backdoor survives system reboots. Which of the following methods is the most reliable and commonly used for this purpose?

Accepted Answer

Create a systemd service unit that runs your payload at startup.. Creating a systemd service unit is the most reliable method for ensuring a backdoor runs at system startup on modern Linux distributions. Systemd is the standard init system, and service units are executed automatically during boot. This method is persistent, can run with root privileges, and is less likely to be disabled by default than legacy mechanisms like rc.local or cron @reboot.

Answer

Add your payload to the /etc/rc.local file.

Answer

Add a cron job with @reboot schedule that executes your payload.

Answer

Modify the root user's .bash_profile to execute your payload on login.

Question 6

Which phase of a vulnerability assessment typically involves comparing the output against a known database of CVEs?

Accepted Answer

Vulnerability Detection. After performing reconnaissance and data collection, the scanner matches discovered software versions and configurations against a vulnerability database. This matching phase is where the raw data is translated into actionable information. Understanding this is crucial because it highlights that the scanner's efficacy is strictly tied to the quality and recency of its signature database, which must be updated regularly to identify modern threats.

Answer

Host Discovery

Answer

Service Identification

Answer

Remediation Verification

Question 7

A penetration tester has compromised a workstation and obtained a Kerberos TGT for a low-privileged domain user. The tester wants to abuse unconstrained delegation configured on a member server named APP01 to escalate privileges. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Extract the cached TGT from APP01 and inject it into the tester's session for reuse.. Abusing unconstrained delegation requires forcing a high-value account, such as a domain controller, to authenticate to the delegation-enabled host so its TGT is cached, then extracting and reusing that TGT. Coercion techniques place the DC's TGT on APP01, and extraction tools enable impersonation, leading to domain compromise.

Answer

Request a service ticket for the krbtgt account using the compromised user's TGT.

Answer

Disable Kerberos pre-authentication on the compromised user account to facilitate ticket capture.

Answer

Modify the msDS-AllowedToDelegateTo attribute on APP01 to include the domain controller.

Question 8

What is the purpose of the 'meterpreter' payload in the Metasploit framework?

Accepted Answer

To provide an extensible, memory-only command interface. Meterpreter is a sophisticated, memory-resident payload that provides an advanced interactive shell. It operates entirely in memory, which helps it evade disk-based antivirus detection. Its importance lies in its extensibility; it allows testers to load modules dynamically, perform file system operations, dump memory, and migrate processes without writing files to the disk, making it a critical component for stealthy and efficient post-exploitation operations in modern security assessments.

Answer

To perform network scanning

Answer

To encode payloads for bypass

Answer

To generate shellcode for hardware

Question 9

Refer to the exhibit. You are currently at 17:15. You have just identified a critical, easily exploitable vulnerability on 10.1.1.20. What is the correct next step?

Accepted Answer

Immediately report the finding using the emergency contact procedure.. The defined 'Testing_Time' is 08:00 to 17:00. Performing actions outside this window is a violation of the Rules of Engagement. Given the finding is critical, the tester should halt further testing immediately and notify the client using the established 'Escalation' procedure. This prevents unauthorized testing outside the agreed window while ensuring the critical risk is brought to the client's attention promptly, maintaining both compliance and security awareness.

Answer

Continue testing until you have fully compromised the system.

Answer

Wait until 08:00 the next day to report the vulnerability.

Answer

Run a full vulnerability scan on the remaining hosts to finish early.

Question 10

You have gained standard user execution rights on a hardened Windows 10 enterprise workstation and need to enumerate local privilege escalation vectors. Which TWO methods are most effective for identifying insecure file permissions or unquoted service paths? (Choose two)

Accepted Answer

Executing AccessChk from the Sysinternals suite to review discretionary access control lists on service executables.. Discovering unquoted service paths and vulnerable file permissions represents a foundational step in local Windows privilege escalation. Penetration testers leverage tools and native commands to locate binaries running with SYSTEM privileges that can be modified or hijacked, allowing arbitrary code execution upon service restart.

Answer

Querying the root certificate store via PowerShell to check for untrusted root certification authorities.

Answer

Inspecting the local security policy database using the auditpol utility to check account lockout thresholds.

Answer

Reviewing the Active Directory group policy object inheritance tree using the Resultant Set of Policy tool.

Question 11

When conducting a penetration test, why is it critical to assess the hashing algorithm used for storing passwords rather than focusing solely on the password policy itself?

Accepted Answer

Weak algorithms allow rapid recovery of passwords once a breach occurs.. Even with a strong password policy, an organization remains vulnerable if the hashing algorithm is cryptographically broken or lacks proper salting. A weak algorithm like MD5 or NTLM allows attackers to crack even complex passwords almost instantaneously using modern hardware. Evaluating the hashing implementation ensures that the organization is protected against offline attacks, providing a necessary layer of defense that policies alone cannot guarantee if the underlying data storage mechanism is compromised.

Answer

Password policies are easily bypassed by users sharing credentials.

Answer

Passwords are always transmitted in plain text over the network.

Answer

The password policy is only effective for local accounts.

Question 12

Refer to the exhibit. Given the output from Mimikatz, what is the most appropriate interpretation of the 'LM NTLM' value provided for the administrator account?

Accepted Answer

The hash can be used directly for Pass-the-Hash authentication.. The exhibit displays a captured NTLM hash. In modern Windows environments, the 'LM' (LAN Manager) portion is often empty or disabled for security, leaving only the NTLM hash. The value shown is a hexadecimal representation of the NTLM hash, which acts as the equivalent of a password for authentication. A penetration tester can use this specific string to perform a Pass-the-Hash attack without needing to crack it to plaintext.

Answer

The hash is a salt-based hash requiring a rainbow table.

Answer

The value represents the plaintext password in hex format.

Answer

The session has expired and the hash is now unusable.

Question 13

Which of the following is a key advantage of using a 'Scheduled Task' for persistence on Windows systems?

Accepted Answer

They allow for granular control over execution triggers.. Scheduled tasks are highly configurable, allowing attackers to define specific triggers, user contexts, and repeat intervals. They are natively supported by Windows and appear as legitimate tasks, making them appear less suspicious than custom registry modifications. The ability to run tasks as SYSTEM or as a specific user provides attackers with flexibility in executing their payloads while maintaining a low profile within the system's management tools.

Answer

They automatically bypass all firewall rules.

Answer

They hide the task from the Task Scheduler GUI.

Answer

They are the only way to execute scripts at boot.

Question 14

What is the primary objective of a 'Kerberos Armoring' (FAST) implementation?

Accepted Answer

To protect the initial authentication exchange from interception and modification.. Kerberos Armoring, or Flexible Authentication Secure Tunneling (FAST), protects the exchange between the client and the KDC by creating a secure, encrypted tunnel using a separate key. This protects the AS-REQ and AS-REP packets from interception and tampering, effectively neutralizing attacks that rely on sniffing or modifying the initial authentication traffic.

Answer

To prevent the domain controller from logging failed authentication attempts.

Answer

To force all service accounts to use AES-256 encryption for tickets.

Answer

To bypass the need for a TGT during service authentication.

Question 15

Which TWO of the following methods are commonly used by attackers to achieve persistence on a Linux system via cron jobs?

Accepted Answer

Creating a new file in /etc/cron.d/ with an execution trigger.. Cron is a time-based job scheduler. Attackers utilize /etc/crontab or specific user crontabs to execute malicious scripts at defined intervals. This ensures that even if a session is terminated, the attacker's payload re-executes. Monitoring cron directories and user-specific crontab files is essential for detection, as these are frequent targets for maintaining persistent access on Linux servers.

Answer

Modifying the /etc/shadow file to grant root access.

Answer

Replacing the bash shell binary with a malicious version.

Answer

Setting a boot-time delay in the global /etc/environment file.