GPEN Practice Test 18 — 15 Questions

Question 1

What is the fundamental difference between Golden Ticket and Silver Ticket attacks?

Accepted Answer

Golden Tickets grant access to any service in the domain, while Silver Tickets only grant access to one service.. The primary difference lies in the level of access and the secret used to forge the ticket. Golden Tickets use the KRBTGT hash to forge a TGT, granting access to any service in the domain. Silver Tickets use the service account hash to forge a TGS, granting access only to the specific service associated with that account. Golden Tickets require a higher level of initial privilege to obtain the KRBTGT hash.

Answer

Golden Tickets require communicating with the KDC, whereas Silver Tickets do not.

Answer

Golden Tickets target the domain controller, while Silver Tickets target user workstations.

Answer

Silver Tickets are more powerful because they are harder to detect than Golden Tickets.

Question 2

When using Metasploit to perform a vulnerability scan, which module type should be selected?

Accepted Answer

Auxiliary modules. Metasploit includes auxiliary modules specifically designed for scanning, reconnaissance, and enumeration. These modules do not necessarily exploit a vulnerability but rather test for their presence or collect information about the target environment. Being proficient with these is crucial for the early reconnaissance phase of a penetration test, allowing the tester to map the target network and identify potential entry points before attempting to launch more invasive exploit modules.

Answer

Exploit modules

Answer

Post-exploitation modules

Answer

Payload modules

Question 3

During a penetration test, an operator compromises a workstation where a domain administrator has an active logon session. The operator wants to extract the domain administrator's Kerberos TGT from LSASS and reuse it to access other systems without knowing the administrator's password. Which of the following techniques is specifically designed for this purpose?

Accepted Answer

Pass-the-Ticket using tools such as Mimikatz's sekurlsa::tickets /export and kerberos::ptt.. Pass-the-Ticket is the technique that extracts and reuses a Kerberos ticket from a compromised host. When a domain administrator has an active session, their TGT resides in LSASS and can be exported and injected into another session. This grants the operator the administrator's access without needing the password or hash, perfectly matching the scenario's constraints.

Answer

Kerberoasting by requesting service tickets for SPNs associated with the domain administrator account.

Answer

Silver Ticket creation by forging a service ticket with the domain administrator's NTLM hash.

Answer

Overpass-the-Hash using Mimikatz's sekurlsa::pth with the administrator's NTLM hash.

Question 4

A penetration tester captures a NetNTLMv2 hash from a network segment using Responder. The tester wants to crack this hash using Hashcat. Which Hashcat mode should be used?

Accepted Answer

5600. NetNTLMv2 hashes captured from network traffic require Hashcat mode 5600. This mode is tailored to the NetNTLMv2 challenge-response format, which uses HMAC-MD5. Other modes correspond to different hash types: 1000 for NTLM, 2500 for NetNTLMv1, and 13100 for Kerberos TGS-REP. Using the correct mode is essential for successful cracking.

Answer

2500

Answer

1000

Answer

13100

Question 5

Which of the following describes the purpose of using Google Dorks during the reconnaissance phase of a penetration test?

Accepted Answer

To identify publicly exposed sensitive files or directories.. Google Dorks are advanced search operators that allow testers to find sensitive information inadvertently indexed by search engines. This is a powerful form of passive reconnaissance that requires no interaction with the target infrastructure. By finding publicly exposed configuration files, logs, or login portals, testers can gain valuable intelligence. Mastering these operators is a fundamental skill for finding 'low hanging fruit' that often gets overlooked by automated scanning tools.

Answer

To bypass the target organization's firewall.

Answer

To execute remote code on the target's web server.

Answer

To perform a brute-force attack on user credentials.

Question 6

Which attack targets service accounts by requesting a service ticket (TGS) from the domain controller and cracking the ticket offline?

Accepted Answer

Kerberoasting. Kerberoasting exploits the nature of Kerberos service tickets, which are encrypted using the hash of the target service account's password. Because the ticket is encrypted with the service account's hash, an attacker who can request a ticket can attempt to brute-force or dictionary-attack that ticket offline. This is a highly stealthy method because no malicious traffic is sent to the target service itself.

Answer

Pass-the-Ticket

Answer

AS-REP Roasting

Answer

Golden Ticket Attack

Question 7

During the scoping phase of a penetration test for a global e-commerce client, you identify that the client uses a cloud-based Content Delivery Network (CDN) to host static assets. Which action is the most critical for ensuring the engagement remains within the Rules of Engagement (RoE)?

Accepted Answer

Verify if the client has explicit written permission from the CDN provider.. Testing a CDN often involves third-party infrastructure that falls outside the client's direct control. Testing these assets without explicit authorization from the CDN provider can trigger automated DDoS mitigations or legal disputes. Confirming whether the CDN is in-scope prevents accidental service disruption and potential contractual violations, ensuring the pentest methodology adheres to legal boundaries and professional standards regarding third-party service provider interaction.

Answer

Perform a SYN scan against the CDN IP ranges to identify open ports.

Answer

Incorporate the CDN provider's IP space into the primary target scope.

Answer

Bypass the CDN by mapping the origin server's IP address directly.

Question 8

During a penetration test, a tester runs an OpenVAS scan against a web server and receives a report indicating a high-severity vulnerability with a CVE identifier. Before including it in the final report, the tester wants to verify if the vulnerability is actually exploitable. Which action should the tester take next?

Accepted Answer

Manually test the vulnerability using a proof-of-concept exploit or crafted request.. Manual testing with a proof-of-concept or crafted request is the most reliable way to verify that a reported vulnerability is exploitable. It provides concrete evidence, reduces false positives, and ensures the finding is accurate before reporting. Other actions may offer context but do not directly confirm exploitability.

Answer

Check the CVE details in the National Vulnerability Database (NVD).

Answer

Review the scanner's plugin documentation to understand the detection logic.

Answer

Re-run the scan with a different scanner to confirm the finding.

Question 9

You have identified a Windows Server 2019 target running a custom service that is vulnerable to a stack-based buffer overflow. You develop a working exploit and want to execute it during an authorized penetration test. After sending the payload, the service crashes and the target reboots. You need to minimize the impact on the production environment while still validating the vulnerability. Which approach should you take?

Accepted Answer

Debug the exploit locally in a lab environment that mirrors the target to identify the correct offset and payload, then test again.. The safest way to develop and validate an exploit is to replicate the target environment in a lab. This allows you to debug the exploit, find the correct offset, and test payloads without risking production systems. Once the exploit is stable, you can perform a controlled test on the target, but only after ensuring it will not crash the service. This approach aligns with penetration testing best practices.

Answer

Use a bind shell payload to gain a command shell and then immediately patch the service.

Answer

Use a staged payload that downloads a second stage, as this reduces the initial payload size and prevents crashes.

Answer

Modify the exploit to use a reverse shell payload and execute it during off-peak hours.

Question 10

Which of the following actions is the most appropriate step after discovering a critical vulnerability that is currently being exploited in the wild?

Accepted Answer

Notify the system owners and trigger an out-of-band remediation process.. Immediate risk mitigation is required for vulnerabilities actively exploited in the wild. This involves prioritizing remediation and documenting the findings. Following standard vulnerability management practices ensures that the highest risks are addressed first, which is essential to minimize the window of exposure. Waiting for a formal report before taking action on actively exploited vulnerabilities could result in a successful compromise of the organization's infrastructure.

Answer

Wait until the full scan report is generated at the end of the month.

Answer

Re-run the scan to verify the vulnerability is not a false positive.

Answer

Isolate the server from the network immediately without notifying anyone.

Question 11

What is the primary risk associated with 'Unconstrained Delegation' in Active Directory?

Accepted Answer

It allows the service to cache user TGTs, which can be extracted by an attacker.. In unconstrained delegation, a service account can take a user's TGT (which is sent to the service during authentication) and store it in its own memory. An attacker who compromises such a service can extract these stored TGTs. Because the TGT is valid for the whole domain, the attacker can then impersonate those users to any service in the domain, leading to total environment compromise.

Answer

It forces the use of NTLM for all authentication requests.

Answer

It requires the domain controller to store plaintext passwords for all users.

Answer

It prevents the KDC from enforcing password expiration policies.

Question 12

Refer to the exhibit. Given this output, which action is most appropriate for a penetration tester?

Accepted Answer

Use the privilege to dump process memory, such as LSASS.. SeDebugPrivilege is a powerful right that allows a user to attach to any process, including those running as SYSTEM. This privilege is instrumental in privilege escalation, as it allows for memory dumping of LSASS to extract credentials or the injection of malicious code into high-privilege processes. Identifying this privilege enables the tester to move from a standard user context to a full system-level compromise effectively.

Answer

Attempt to restart the system to reset privileges.

Answer

Disable the privilege to ensure system stability.

Answer

Install a rootkit to hide the enabled privilege.

Question 13

Which of the following is a primary benefit of using Managed Identities for Azure resources?

Accepted Answer

It removes the need to store and manage credentials in application code.. Managed Identities eliminate the need for developers to manage credentials (like service principal secrets) within their application code. By having Azure handle the identity, the risk of credential leakage via hardcoded strings or insecure configuration files is virtually eliminated. This is a critical security improvement for cloud-native applications, as it relies on the platform to rotate secrets automatically and securely.

Answer

It allows the resource to access any other resource in the tenant by default.

Answer

It provides a mechanism to impersonate any user in the directory.

Answer

It bypasses the need for MFA when accessing sensitive databases.

Question 14

Why is it important to use 'staged' payloads during a penetration test when the target has limited memory or strict filtering?

Accepted Answer

To fit within small buffer constraints during initial exploitation.. Staged payloads are split into a small initial stub and a larger secondary component. The small stub fits into tight buffer constraints or bypasses initial inspection, then downloads the rest of the shellcode. This is crucial for environments with limited memory or security products that block large, anomalous network traffic, as it allows for stealthy, efficient exploitation where a full-sized monolithic payload would fail or trigger an alarm.

Answer

To bypass the system's firewall rules permanently.

Answer

To automatically upgrade the shell to root privileges.

Answer

To increase the target's CPU usage for testing stability.

Question 15

When defining the 'Scope' for a penetration test, which THREE factors are critical to document to ensure the engagement is legally and operationally sound?

Accepted Answer

The exact IP ranges and subnets authorized for testing.. Defining the scope accurately is the most important part of the planning phase. It prevents 'scope creep', protects the tester from claims of unauthorized access, and ensures the testing effort is focused on the most critical assets. By clearly documenting IP ranges, business-critical systems, and exclusions, the tester ensures that the activity remains within the agreed-upon boundaries and that both parties agree on what is being assessed and protected.

Answer

The personal email addresses of the IT administrators.

Answer

The specific passwords used for internal testing accounts.