GPEN Practice Test 20 — 15 Questions

Question 1

You are conducting a penetration test for a client and need to enumerate subdomains of example.com to map their external attack surface. During this reconnaissance phase, you decide to use a tool that performs DNS zone transfers. Which of the following is the most appropriate tool to attempt a DNS zone transfer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dig. The dig tool is specifically designed for DNS queries and supports the AXFR query type needed for zone transfer attempts. A successful zone transfer can reveal all DNS records, including subdomains, which is invaluable for mapping the target's external footprint. The other tools serve different reconnaissance purposes and cannot perform this function.

Answer

traceroute

Answer

nmap

Answer

whois

Question 2

A penetration tester has completed an unauthenticated vulnerability scan of a web server and received a report listing several critical CVEs. Before including these in the final report, the tester wants to validate that the findings are not false positives. Which action is the MOST appropriate next step?

Accepted Answer

Manually verify the finding by checking the actual service version and testing the vulnerability.. Manual verification is the gold standard for confirming scanner findings. By directly checking the service version, inspecting configuration, or safely testing the vulnerability, the tester obtains evidence that the issue is real. This eliminates false positives and ensures the report is accurate. Other options either do not validate the specific finding or risk reporting unverified critical issues.

Answer

Lower the scan's severity threshold and rescan to see if more issues appear.

Answer

Re-run the scan with a different scanner and compare results.

Answer

Assume the scanner is correct and include the finding as critical.

Question 3

What is the primary risk of using 'Domain Fronting' in a C2 architecture during a penetration test?

Accepted Answer

It can cause accidental disruption to legitimate services.. Domain fronting relies on the trust placed in large Content Delivery Networks (CDNs). If a penetration tester uses a high-traffic, reputable CDN for C2, the organization's defense team may be unable to block the C2 traffic without also blocking legitimate business services that share the same CDN infrastructure. This creates a significant conflict between security needs and operational availability, which must be carefully managed during the engagement.

Answer

It will trigger an immediate alert on all EDR agents.

Answer

It is easily detectable by standard firewall port filtering.

Answer

It forces the malware to use a non-standard protocol.

Question 4

During a penetration test on a Linux server, you find a cron job that runs every minute as root: '*/1 * * * * root /usr/local/bin/backup.sh'. The script is owned by root but has permissions 777. You are a low-privileged user. What is the most direct way to escalate privileges?

Accepted Answer

Modify the backup.sh script to include a reverse shell command.. The most direct escalation is to modify the world-writable script because it runs as root every minute. By adding a command to create a reverse shell or copy /bin/bash with SUID permissions, you gain root access. Other methods like LD_PRELOAD or symlinking are less reliable or indirect. The writable script is a clear privilege escalation vector.

Answer

Create a malicious shared library and use LD_PRELOAD in the script's environment.

Answer

Use the cron job to copy /etc/shadow to a world-readable location.

Answer

Replace the /usr/local/bin/backup.sh with a symbolic link to /bin/bash.

Question 5

When conducting a network scan, you notice that many hosts are not responding to ping requests, even though they are known to be online. What is the most appropriate Nmap flag to use to ensure these hosts are still scanned for open ports?

Accepted Answer

-Pn (No ping). The -Pn flag is the standard solution when hosts are configured to drop ICMP traffic. It forces Nmap to skip the host discovery phase and proceed directly to port scanning, assuming that every target is 'up'. This is a fundamental technique for penetration testers, as security-conscious organizations often disable ICMP at the perimeter to prevent basic discovery by automated tools and internal network scanning.

Answer

-sP (Ping scan)

Answer

-PR (ARP ping)

Answer

-sn (Disable port scan)

Question 6

During a post-exploitation phase, you identify an unquoted service path vulnerability on a Windows target. What is the most reliable way to escalate privileges through this misconfiguration?

Accepted Answer

Place a malicious binary at the first detected space-delimited path segment.. Unquoted service paths exist when the service binary path contains spaces and lacks quotes. Windows interprets the path incorrectly, searching for intermediate executables. Placing a malicious binary at the identified path allows it to execute with SYSTEM privileges upon service restart. This technique is critical for privilege escalation as it exploits inherent Windows path resolution logic, often bypassing standard user restrictions if the directory has weak permissions.

Answer

Overwrite the existing service executable with a custom payload.

Answer

Modify the service configuration using the sc config command.

Answer

Inject a DLL into the running service process memory space.

Question 7

Why are GPUs significantly more effective than CPUs for brute-forcing unsalted NTLM hashes?

Accepted Answer

GPUs handle massive parallel operations on simple math.. GPUs feature thousands of small, specialized cores designed for massive parallel processing, which is ideal for the simple, iterative nature of hashing. While a CPU excels at complex, branch-heavy tasks, a GPU can process thousands of password guesses simultaneously. For an unsalted algorithm like NTLM, this parallelism results in a performance increase of several orders of magnitude, allowing testers to exhaust large keyspaces in seconds rather than days.

Answer

GPUs have larger cache sizes for storing wordlists.

Answer

GPUs have a faster instruction set for MD4 algorithms.

Answer

GPUs can bypass the salt requirement during the attack.

Question 8

You are the lead penetration tester for a financial services client. During the scoping meeting, the client states they want to test their external perimeter but are concerned about accidental disruption to production trading systems. They ask you to propose a testing approach that minimizes operational risk while still validating exploitable vulnerabilities. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Execute a controlled penetration test using non-destructive exploitation techniques, with a defined stop condition for any sign of instability.. The client requires validation of exploitable vulnerabilities with minimal risk to production. A controlled penetration test using non-destructive techniques and clear stop conditions achieves this by avoiding disruptive payloads and ensuring immediate cessation if instability occurs. It respects the client's risk tolerance while still providing meaningful security validation, unlike approaches that either disrupt services or fail to validate exploitability.

Answer

Simulate an insider threat by deploying a physical implant in the data center to test physical security controls.

Answer

Conduct a vulnerability assessment with authenticated scans during off-peak hours and manually validate only critical findings.

Answer

Perform a full-scale denial-of-service test against the trading platform to assess resilience under attack conditions.

Question 9

What is the primary purpose of a 'delta' or 'differential' vulnerability scan?

Accepted Answer

To identify only the changes in the vulnerability posture since the last scan.. Delta scans focus on identifying changes in the environment since the last full assessment. By comparing current findings against a known baseline, testers can quickly isolate new vulnerabilities or unauthorized changes. This is vital for maintaining a continuous security posture, as it reduces scan times and allows security teams to prioritize remediation efforts on newly introduced risks without re-analyzing the entire stable environment.

Answer

To increase the intensity of the scan to ensure all ports are covered.

Answer

To bypass signature-based detection systems by using randomized payloads.

Answer

To perform an exhaustive search for zero-day vulnerabilities on all assets.

Question 10

You are conducting an internal penetration test for a client that uses Microsoft Entra ID (Azure AD) with on-premises Active Directory. You have obtained a low-privileged domain user's credentials. You want to enumerate Entra ID users and groups without triggering sign-in logs on the compromised user. Which of the following techniques would be MOST effective for this goal?

Accepted Answer

Query the on-premises Active Directory for objects synchronized to Entra ID using the user's existing domain access.. The objective is to enumerate Entra ID objects without creating sign-in logs on the compromised user. Querying on-premises Active Directory leverages the existing domain session and does not generate cloud authentication events. This method can reveal synchronized users and groups, providing valuable intelligence while maintaining operational security.

Answer

Authenticate to Microsoft Graph with the compromised user's credentials and enumerate users and groups.

Answer

Use the Azure AD Connect synchronization account to query the Microsoft Graph API.

Answer

Use the Microsoft Entra admin center with the compromised user's credentials to browse users and groups.

Question 11

When a reverse shell connection fails to reach the listener, what is the best first step for troubleshooting?

Accepted Answer

Check local listener status and connectivity. Network connectivity issues are the most common reason for failed exploitation. Verifying the listener configuration and ensuring the target can actually reach the attacker's IP is the logical starting point. Using tools like 'netcat' to test the connectivity or verifying the LHOST settings ensures that the issue is not a simple misconfiguration, which saves significant time during a penetration test by eliminating basic networking errors before checking for complex security controls.

Answer

Re-run the exploit with a different payload

Answer

Upgrade the Metasploit framework

Answer

Restart the target machine

Question 12

Refer to the exhibit. You executed an Nmap scan against a host and received the output shown. Which scanning technique was most likely used to produce this specific state-based output while avoiding the completion of a full TCP three-way handshake?

Accepted Answer

TCP SYN Scan (-sS). The output indicates open ports without explicitly showing a full connection. Nmap's SYN scan (-sS) is the default and most popular method for this result. It initiates the handshake but sends an RST packet immediately after receiving the SYN/ACK, preventing a full connection. This technique is essential for testers to map services quickly while remaining stealthier than a full connection-based scan which would be logged by most application-layer firewalls.

Answer

TCP Connect Scan (-sT)

Answer

UDP Scan (-sU)

Answer

TCP ACK Scan (-sA)

Question 13

During an internal penetration test, you need to discover live hosts on a flat Layer 2 network segment. The client's IDS is known to alert on TCP SYN packets sent to closed ports. You want to minimize the chance of triggering an alert while still identifying as many hosts as possible. Which Nmap host discovery technique should you use?

Accepted Answer

nmap -sn -PR 10.10.10.0/24. ARP ping is the most reliable and stealthy host discovery method on a local Layer 2 network because ARP requests are broadcast and must be answered by all live hosts. It avoids TCP SYN traffic that would trigger the IDS described. The other options use TCP or ICMP probes that either trigger the IDS or are less reliable on a local segment.

Answer

nmap -sn -PS22,80,443 10.10.10.0/24

Answer

nmap -sn -PA80 10.10.10.0/24

Answer

nmap -sn -PE 10.10.10.0/24

Question 14

During a penetration test against an internal Windows host, you use Metasploit's psexec module with a Meterpreter payload and receive a session. You then run the getuid command and see that you are running as NT AUTHORITY\SYSTEM. However, when you attempt to access a mapped network drive that the logged-on user had access to, you receive an access denied error. Which of the following best explains this behavior?

Accepted Answer

The Meterpreter session is running in the security context of the SYSTEM account, which has no network credentials for the mapped drive.. When psexec runs a payload as a service, the resulting process runs as NT AUTHORITY\SYSTEM. SYSTEM has no user credentials, so it cannot access network resources that require the logged-on user's authentication. To access those resources, the tester must migrate into a process running under the user's context or steal a token.

Answer

The psexec module drops the payload into a temporary directory that lacks the necessary permissions to access network shares.

Answer

The mapped drive was disconnected when the psexec service was created, and you must re-map it manually from the Meterpreter shell.

Answer

The firewall on the target is blocking SMB traffic from the SYSTEM account, preventing access to the mapped drive.

Question 15

You are scanning a target and need to avoid triggering a network IPS that signatures on TCP connect scans. You have root privileges and want to perform a stealthy scan that does not complete the TCP three-way handshake. Which Nmap scan type should you use?

Accepted Answer

nmap -sS <target>. The TCP SYN scan sends a SYN packet and waits for a SYN/ACK or RST response, never completing the three-way handshake. This half-open approach is faster and stealthier than a full connect scan, making it the preferred method to evade IPS signatures that look for completed TCP connections.

Answer

nmap -sT <target>

Answer

nmap -sU <target>

Answer

nmap -sA <target>