GPEN Practice Test 19 — 15 Questions

Question 1

Why do many C2 frameworks include a 'sleep' command that can be configured by the operator?

Accepted Answer

To minimize the visibility of the C2 beacon.. The 'sleep' command allows an operator to control the frequency of beaconing manually. This is useful for balancing the need for responsiveness with the need for stealth. By increasing the sleep time, the operator makes the beacon less frequent, which reduces the chance of detection by network anomaly systems. This flexibility is a core feature of modern C2 suites, enabling operators to manage the trade-off between active engagement and operational security.

Answer

To allow the malware to clear its memory footprint.

Answer

To bypass the need for a persistent connection.

Answer

To prevent the target from shutting down the system.

Question 2

Which THREE conditions must be met for a successful AS-REP Roasting attack?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' flag set.. AS-REP Roasting targets accounts configured with the 'Do not require Kerberos pre-authentication' flag. This vulnerability allows an attacker to request a TGT without providing the user's password. The KDC responds with an encrypted structure that can be cracked offline. Understanding this process is vital for identifying misconfigured service accounts that provide a low-hanging fruit for attackers to gain credentials without triggering common alerts.

Answer

The attacker must have Domain Admin credentials.

Answer

The service account must have AES-256 encryption enabled.

Question 3

Which file in a Windows system is required, along with the NTDS.dit file, to decrypt cached credentials stored in the database?

Accepted Answer

SYSTEM hive. The NTDS.dit file is the primary database for Active Directory, but it is encrypted. The encryption key, known as the boot key, is stored in the SYSTEM registry hive. Without access to the SYSTEM hive, the NTDS.dit file is useless for offline credential extraction. This relationship underscores the need for testers to obtain both files during a post-exploitation phase to achieve successful credential recovery.

Answer

SAM hive

Answer

SOFTWARE hive

Answer

SECURITY hive

Question 4

Which of the following describes the risk of 'App Role' over-assignment in Azure AD?

Accepted Answer

It allows an attacker to escalate privileges if a user account is compromised.. App Roles define what a user or application can do within a specific application context. If an administrator assigns 'Admin' roles to too many users, an attacker compromising any one of those users gains elevated privileges within that application. This lateral movement risk emphasizes the need to assign roles to groups rather than individual users and to audit role assignments periodically to ensure least privilege.

Answer

It increases the likelihood of a brute-force attack on the tenant.

Answer

It automatically bypasses the need for Multi-Factor Authentication.

Answer

It prevents the application from using external OAuth2 scopes.

Question 5

You are tasked with gathering information about a target organization's employees to craft a phishing campaign. Which of the following tools is specifically designed to collect email addresses, subdomains, and hostnames from public sources like search engines and PGP key servers?

Accepted Answer

theHarvester. theHarvester is specifically built to collect email addresses, subdomains, and hostnames from public sources such as search engines and PGP key servers. Its focused functionality makes it the most appropriate tool for gathering employee information to support a phishing campaign. Other tools may have overlapping capabilities but are not as specialized for this task.

Answer

Recon-ng

Answer

Shodan

Answer

Maltego

Question 6

During an assessment, you discover a federated identity setup using AD FS. What is a common security risk associated with the reliance on the token-signing certificate in this architecture?

Accepted Answer

Compromise of the private signing key allows for the creation of unauthorized authentication tokens.. The token-signing certificate is the foundation of trust in a federated environment. If an attacker compromises the private key of this certificate, they can forge SAML tokens for any user in the directory. This bypasses Multi-Factor Authentication and allows for complete identity impersonation, making the protection of the AD FS server and its associated secrets a critical objective for both defenders and attackers.

Answer

The certificate is public knowledge and can be used to decrypt all cloud traffic.

Answer

AD FS requires the certificate to be stored in an unsecured plaintext file on the web server.

Answer

The relying party cannot verify the identity if the certificate expires.

Question 7

During the planning phase of a penetration test for a multinational corporation, you discover that the client's legal department requires all testing activities to comply with the laws of each country where their offices are located. The client has offices in Germany, Brazil, and Japan. Which of the following is the MOST important consideration when planning the engagement?

Accepted Answer

Ensure that testing does not violate any local laws regarding unauthorized access, even if the client has authorized it.. The most important consideration is ensuring that testing activities comply with the local laws of each country where targets reside. Client authorization does not override local criminal laws. A thorough legal review and, if necessary, local legal counsel are essential to avoid criminal liability.

Answer

Perform all testing from a central location in the client's home country to avoid international legal issues.

Answer

Use only automated tools that are approved by the client's legal department in each country.

Answer

Obtain a single global authorization letter from the client's headquarters that covers all offices.

Question 8

You are drafting the Rules of Engagement (RoE) for a penetration test of a client's internal network. The client wants to ensure that the engagement is legally sound and that all parties understand their responsibilities. Which TWO of the following items are essential to include in the RoE? (Choose two.)

Accepted Answer

Explicit written authorization from the client to perform the test.. The two essential items are explicit written authorization and emergency contact information. Written authorization provides legal protection and confirms consent, while emergency contacts ensure rapid response to incidents. These elements are fundamental to a legally sound and operationally safe penetration test, distinguishing the RoE from other planning documents.

Answer

A statement of work (SOW) detailing the deliverables and timeline.

Answer

A list of all vulnerabilities that will be tested.

Answer

The specific tools and techniques that will be used during the test.

Question 9

During an internal assessment, a tester uses the auxiliary scanner auxiliary/scanner/smb/smb_version and receives the result 'Host is running Windows Server 2016'. The tester then selects exploit/windows/smb/ms17_010_eternalblue but the exploit reports 'The target is not vulnerable'. Which Metasploit feature should the tester use to determine why the exploit check failed and what SMB dialect the target actually supports?

Accepted Answer

Run the exploit module's check method and then inspect the module's verbose output for the SMB dialect and error details. Exploit modules include a check method that returns a status and, with Verbose enabled, prints the negotiated SMB dialect and the reason the target failed the vulnerability test. Running check and reading that output directly explains the mismatch between the scanner result and the exploit check. Forcing the exploit or running another scanner does not surface the underlying diagnostic detail.

Answer

Switch to auxiliary/scanner/smb/smb_ms17_010 and review its output

Answer

Use the smb_version scanner with the SMB2 option disabled to force SMB1 negotiation

Answer

Run the exploit with the ForceExploit advanced option set to true

Question 10

A penetration tester is using Nessus to scan a large subnet and needs to avoid overwhelming older printers that are known to crash when too many simultaneous connections are made. The tester also wants to ensure the scan completes in a reasonable timeframe. Which Nessus scan policy setting should be adjusted to control the number of simultaneous hosts being scanned?

Accepted Answer

Max concurrent hosts. The Max concurrent hosts setting directly controls how many hosts are scanned at the same time. Lowering this value ensures that fewer devices are probed concurrently, reducing the chance of crashing sensitive equipment like older printers. It balances scan speed with safety, making it the appropriate adjustment for the scenario.

Answer

Reduce parallel checks per host

Answer

Scan window size

Answer

Max concurrent checks per host

Question 11

During a Windows assessment you obtain a low-privileged domain user's credentials. Enumeration reveals a Group Policy Preference file on a readable SYSVOL share containing a cpassword value. What is the most effective next step to escalate privileges?

Accepted Answer

Decrypt the cpassword value using the publicly known AES key and authenticate as the account it protects.. Credentials in Group Policy Preferences were encrypted with a static AES key that Microsoft published, so a cpassword value found on SYSVOL can be decrypted immediately with tools like gpp-decrypt. The recovered plaintext often belongs to a privileged account, and because no cracking or protocol interaction is required, decryption is the fastest route to privilege escalation from the low-privileged credentials already held.

Answer

Crack the cpassword value with hashcat using the NTLM hash mode.

Answer

Relay the cpassword value to an SMB service to obtain a session on a file server.

Answer

Use the cpassword value directly in a pass-the-hash authentication against a domain controller.

Question 12

During the reconnaissance phase of a penetration test, you are examining a target's public-facing web application. You notice that the application returns detailed error messages that include full file paths and database query snippets. Which of the following best describes the primary risk associated with this finding?

Accepted Answer

It provides attackers with information that can be used to craft more targeted attacks. Detailed error messages are an information disclosure vulnerability. They reveal internal paths, database queries, and technology details that attackers can use to map the application and plan further attacks. This information is valuable for reconnaissance and can significantly reduce the effort required to exploit other vulnerabilities.

Answer

It causes the application to crash, leading to a denial of service

Answer

It allows attackers to perform cross-site scripting (XSS) attacks

Answer

It enables attackers to bypass authentication mechanisms

Question 13

Why does the Kerberos 'PAC' (Privilege Attribute Certificate) pose a security risk in the context of ticket forgery attacks?

Accepted Answer

The PAC allows attackers to inject arbitrary group memberships into a forged ticket.. The PAC is a data structure embedded within Kerberos tickets that contains user identity and group membership information. Because the PAC is signed by the KDC, it is normally trusted. However, if an attacker can forge a ticket, they can also manipulate the PAC within that ticket to elevate their privileges, such as adding themselves to the 'Domain Admins' group, bypassing normal authorization checks completely.

Answer

The PAC is always encrypted with the user's password, making it easy to crack.

Answer

The PAC prevents the KDC from verifying the ticket's signature.

Answer

The PAC is required for TGT requests, making it a primary target for sniffers.

Question 14

You are performing a network audit and need to identify live hosts across a segmented network while minimizing the risk of triggering IDS alerts. Which Nmap technique is most appropriate for stealthy host discovery in a subnet where ICMP echo requests are filtered by the firewall?

Accepted Answer

Utilize TCP SYN ping (-PS) on common service ports.. Nmap's TCP SYN ping (-PS) is highly effective because it sends a small SYN packet to specified ports, like 80 or 443, which are typically open or acknowledged by firewalls. This bypasses ICMP filters while mimicking legitimate traffic. Understanding how to circumvent basic perimeter defenses is critical for penetration testers to ensure comprehensive discovery without alerting security systems that monitor for common ICMP-based scanning patterns or heavy traffic floods.

Answer

Perform a standard ICMP echo sweep (-PE).

Answer

Execute a full TCP connect scan on all ports (-sT).

Answer

Run an ARP scan across the entire subnet (-PR).

Question 15

You are performing a penetration test and discover a service running as SYSTEM that is vulnerable to DLL hijacking. What is the most appropriate action to take to ensure the test is successful and safe?

Accepted Answer

Use a benign DLL to prove execution.. DLL hijacking involves placing a malicious DLL in a directory that a process searches before the legitimate DLL. To do this safely, you must ensure the DLL does not crash the service, which would cause a denial of service. Using a benign payload, such as one that launches a notepad process or logs a specific action, confirms the vulnerability without disrupting the client's business operations.

Answer

Immediately drop a reverse shell.

Answer

Reboot the server to force the service to restart.

Answer

Modify the Windows Registry to disable the service.