GPEN Practice Test 2 — 10 Questions

Question 1

Which document is primarily responsible for defining the 'Rules of Engagement' (RoE) in a penetration testing project?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement document serves as the operational handbook for the penetration test, detailing exactly what is permitted, what is prohibited, and the emergency procedures to follow. It bridges the gap between the legal contract and the technical execution, ensuring that all parties have a mutual understanding of the engagement's boundaries, safety protocols, and professional expectations, which is critical for minimizing risks during testing.

Answer

The Statement of Work (SOW).

Answer

The Non-Disclosure Agreement (NDA).

Answer

The Service Level Agreement (SLA).

Question 2

During an internal penetration test, you capture an NTLMv2 net-NTLM hash using LLMNR/NBT-NS poisoning. You attempt to crack the hash offline using Hashcat with a standard rockyou.txt wordlist, but the operation yields no plaintext. What is the most effective next step to recover the credentials given that the password complexity requirements were met?

Accepted Answer

Apply rule-based attack modes or hybrid mask attacks in Hashcat to mutate base wordlist entries with common character substitutions, appending numbers, and special symbols.. NTLMv2 hashes utilize a challenge-response mechanism that cannot be reversed directly, requiring offline brute-forcing or rule-based attacks against the captured challenge and response. Because standard wordlists often fail against complex alphanumeric passwords, applying dynamic rule sets or combining masks significantly expands the search space to cover permutations users typically create to satisfy strict corporate password policies during assessments.

Answer

Re-capture the hash using Kerberoasting to obtain a valid Ticket Granting Service ticket for a service principal name instead of relying on the LLMNR response.

Answer

Convert the net-NTLMv2 hash format directly into an MD5 hash format using a custom script so that standard rainbow tables can instantly identify the plaintext password string.

Answer

Downgrade the captured authentication traffic by forcing the domain controller to negotiate LM hashing during the next SMB session establishment phase to simplify cracking.

Question 3

You are performing a penetration test against a web server and want to identify the exact version of the HTTP service running on port 80. Which Nmap command should you use?

Accepted Answer

nmap -sV -p 80 <target>. Service version detection with -sV is the correct technique to identify the software and version running on an open port. It sends probes and compares responses against a signature database, providing the HTTP server version needed for further vulnerability assessment.

Answer

nmap -sS -p 80 <target>

Answer

nmap -sn -p 80 <target>

Answer

nmap -O -p 80 <target>

Question 4

What is the primary benefit of using passive reconnaissance before initiating active scanning?

Accepted Answer

To minimize the footprint of the testing engagement.. Passive reconnaissance gathers information without alerting the target, allowing the tester to build a comprehensive profile without being blocked. This minimizes the risk of triggering security systems early in the engagement. By understanding the organization's architecture through public sources first, the tester can perform more targeted and efficient active scanning later, significantly increasing the probability of success while reducing the likelihood of early detection by the security operations center.

Answer

To identify vulnerabilities without touching the server.

Answer

To guarantee access to the target's internal network.

Answer

To bypass the organization's internal intrusion detection systems.

Question 5

Which command in the Metasploit Framework allows a user to interact with a backgrounded session after a successful exploit execution?

Accepted Answer

sessions -i. The 'sessions' command is the primary method for managing active connections within Metasploit. Once an exploit establishes a payload, the session moves to the background. Using 'sessions -i <id>' connects the user to the specific meterpreter shell, enabling post-exploitation activities. This is crucial for maintaining persistence and executing lateral movement tasks in a penetration test, as it allows the operator to toggle between multiple compromised targets effectively.

Answer

exploit -j

Answer

run -s

Answer

use -session

Question 6

A penetration tester is configuring an authenticated scan for a Windows environment. Which credential management strategy best minimizes the security impact while maintaining scan efficacy?

Accepted Answer

Create a dedicated service account with granular WMI and remote registry permissions.. Using dedicated, low-privilege service accounts with specific WMI and registry permissions minimizes the blast radius if credentials are intercepted. This approach adheres to the principle of least privilege, preventing the scanner from having full domain administrator access, which could be abused if the scanning server is compromised. Effective vulnerability management relies on deep system visibility without granting excessive authority to the scanning service.

Answer

Configure the scanner to use the Domain Administrator account for full registry access.

Answer

Use a local account with no password to allow quick automated authentication.

Answer

Store credentials in plain text in the scanner configuration file for easier automation.

Question 7

During an internal penetration test, an attacker intercepts an Active Directory Kerberos AS-REQ for a user account that does not have Kerberos pre-authentication enabled. What is the most effective post-exploitation technique for the operator to perform offline credential cracking against this captured artifact?

Accepted Answer

Conduct an AS-REP roasting attack to extract the encrypted ticket portion and crack the underlying user password offline.. Disabling Kerberos pre-authentication allows an attacker to request an AS-REP for any targeted user account without knowing their password. The returned ticket contains a portion encrypted with the user's NTLM hash, which can then be attacked offline using hashcat or John the Ripper to recover the plaintext password. This attack vector bypasses standard lockout policies completely since no actual authentication attempts are made against the Domain Controller during the cracking phase.

Answer

Execute a DCSync attack using volume shadow copies to extract the NTDS.dit database directly from the primary domain controller.

Answer

Perform a Kerberoasting attack to harvest service ticket hashes for accounts with registered Service Principal Names.

Answer

Inject a malicious golden ticket into memory after dumping the krbtgt account credentials from the lsass process.

Question 8

A penetration tester is using Nmap to scan a target network and wants to identify open UDP ports. The tester runs a UDP scan but notices that many ports are reported as 'open|filtered'. Which technique can help determine whether these ports are actually open or filtered?

Accepted Answer

Send a UDP packet with a known payload and analyze the response.. Sending a UDP packet with a known payload that triggers a response from a specific service can help determine if a port is open. If the service responds, the port is open; if no response or an ICMP unreachable is received, it may be filtered. This active probing provides more definitive results than generic scans.

Answer

Use a TCP ACK scan to infer UDP port states.

Answer

Perform a TCP SYN scan on the same ports.

Answer

Run a UDP scan with a longer timeout and more retries.

Question 9

A penetration tester is analyzing the results of a vulnerability scan and needs to prioritize remediation efforts. Which two factors should be considered when determining the criticality of a vulnerability? (Choose two.)

Accepted Answer

The potential impact on the business if exploited. CVSS base score and business impact are key factors for prioritizing vulnerabilities. CVSS provides a standardized severity metric, while business impact ensures that remediation efforts focus on what matters most to the organization. Together, they help balance technical severity with real-world consequences.

Answer

The age of the vulnerability in the CVE database

Answer

The number of other vulnerabilities on the same host

Answer

The scanner's confidence level in the finding

Question 10

During a penetration test, you successfully inject a payload into a web application that results in the server executing system commands with elevated privileges. Which phase of the exploitation lifecycle does this action primarily represent?

Accepted Answer

Exploitation. This scenario demonstrates the execution of arbitrary code, which is the core of the exploitation phase. Exploitation is the process of leveraging a vulnerability to gain unauthorized access or control over a target system. Understanding this transition from vulnerability discovery to exploitation is critical for testers to effectively assess the impact of security flaws and demonstrate real-world risk to stakeholders during the assessment reporting phase.

Answer

Reconnaissance

Answer

Vulnerability Assessment

Answer

Post-Exploitation