GPEN Practice Exam 2 — 20 Questions

Question 1

You are conducting an external penetration test against a client who uses a split-horizon DNS configuration. You want to identify internal hostnames and IP addresses without sending any traffic to the client's internal network. Which of the following techniques would best accomplish this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze historical DNS data from passive DNS databases and certificate transparency logs. Split-horizon DNS separates internal and external views, so external queries won't reveal internal names. Passive DNS and certificate transparency logs are public data sources that may contain leaked internal hostnames from misconfigured certificates or historical records. These sources require no interaction with the target's infrastructure, making them ideal for stealthy reconnaissance.

Answer

Perform DNS cache snooping against the internal recursive resolver

Answer

Use DNS zone transfer requests against the external authoritative name servers

Answer

Query the internal DNS server directly using its private IP address

Question 2

During an internal penetration test, an operator intercepts an AS-REP response for a user account that does not have Kerberos pre-authentication enabled. What is the most efficient next step to recover the account password offline?

Accepted Answer

Use GetNPUsers.py to request the AS-REP ticket and crack the derived hash offline using Hashcat mode 18200.. Disabling Kerberos pre-authentication allows any unauthenticated user to request an AS-REP for that account, containing a ticket encrypted with the user's secret key. Tools like Rubeus or GetNPUsers.py can harvest these tickets, which are formatted specifically for offline cracking using hashcat mode 18200 without requiring valid domain credentials initially.

Answer

Run GetUserSPNs.py to request service ticket hashes for Kerberoasting against the domain controller.

Answer

Capture an NTLMv1 challenge-response handshake by forcing authentication over SMB using Responder.

Answer

Execute Hashcat with mode 13100 against the captured NTLM hash dumped from the local security authority subsystem service.

Question 3

Refer to the exhibit. During an Azure engagement, you query a service principal via the Microsoft Graph API and notice that 'appRoleAssignmentRequired' is set to 'false'. What security implication does this setting present for enterprise applications?

Accepted Answer

Any user in the Azure AD tenant can authenticate to the application and obtain access tokens without prior assignment.. The 'appRoleAssignmentRequired' property dictates whether users must be explicitly assigned to an enterprise application before they can successfully authenticate. When set to false, any user within the directory can acquire tokens for the application, expanding the attack surface and potential exposure.

Answer

Only users explicitly assigned via Azure AD Enterprise Applications can authenticate and access the application.

Answer

The application is prohibited from utilizing OAuth 2.0 authorization code flows and must rely exclusively on client credentials.

Answer

Global administrators must manually approve every single sign-in attempt generated by standard users in the tenant.

Question 4

A penetration tester is configuring a vulnerability scan against a large enterprise network. The tester needs to balance scan accuracy, speed, and impact on production systems. Which TWO of the following settings, when adjusted, will MOST directly reduce the risk of disrupting fragile network devices during the scan? (Choose two.)

Accepted Answer

Enable 'Safe Checks' in the scan policy.. The two settings that most directly reduce disruption are Safe Checks and Max checks per host. Safe Checks excludes plugins known to potentially crash services, while lowering Max checks per host throttles concurrent probes to each target. Together they limit both the type and the rate of intrusive traffic, protecting fragile production devices. Other options either increase load or do not specifically target device stability.

Answer

Increase the maximum number of concurrent hosts scanned.

Answer

Disable 'Thorough tests' in the scan policy.

Answer

Set the scanner to use UDP instead of TCP for all checks.

Question 5

During an exploitation attempt against a web application, you inject a payload that causes the server to return a verbose error message containing a stack trace and database query. What is the most likely type of vulnerability you have discovered?

Accepted Answer

SQL injection. Verbose error messages that include database queries and stack traces are a hallmark of SQL injection. They occur when user input is not properly sanitized, allowing attackers to manipulate SQL statements and trigger errors that reveal backend details. This information can be used to further exploit the database.

Answer

Cross-site request forgery (CSRF)

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 6

Which of the following best describes the 'Gray-box' testing methodology?

Accepted Answer

Partial knowledge of internal systems and limited documentation.. Gray-box testing combines elements of both black-box and white-box testing. The tester has limited knowledge of the environment, such as network diagrams or internal documentation, but does not have full source code access. This approach is highly effective for simulating a sophisticated attacker, such as an insider or an attacker who has already gained an initial foothold, allowing for a more focused and efficient security assessment.

Answer

Complete lack of knowledge about the target environment.

Answer

Full access to source code, network diagrams, and documentation.

Answer

Testing only the physical security controls of a facility.

Question 7

You are performing OSINT on a target and have collected a list of employee names from LinkedIn. You want to generate likely corporate email addresses and then verify which ones are valid without sending email to the target's mail servers. Which approach best accomplishes this?

Accepted Answer

Query a breach-compilation or email-verification API that checks syntax, domain MX, and known breach data. Email-verification APIs and breach-compilation services evaluate candidate addresses using syntax checks, MX validation, and known breach data without contacting the target's mail servers. This keeps the activity passive while still filtering out invalid addresses. It is the only listed method that both validates individual addresses and avoids direct interaction with the target, satisfying the scenario's constraints.

Answer

Use the SMTP VRFY command against the organization's MX host for each candidate address

Answer

Perform a DNS MX lookup for the domain and assume any address at that domain is valid

Answer

Send a test message to each candidate address and monitor for bounce-backs

Question 8

During an Azure penetration test, you discover an App Registration with an expired client secret that still has active refresh tokens issued prior to expiration. The application holds high-privilege directory roles. How do these leaked refresh tokens behave regarding Azure AD security boundaries?

Accepted Answer

The refresh tokens continue to function and can be exchanged for new access tokens until the refresh token's own lifetime expires or it is explicitly revoked.. Active refresh tokens bypass initial credential checks until they expire or are explicitly revoked, allowing prolonged unauthorized access to enterprise resources. Understanding this persistence mechanism is critical for penetration testers assessing token lifetime policies and identifying stealthy persistence vectors within enterprise environments.

Answer

The refresh tokens are instantly invalidated the moment the underlying client secret expires or is rotated in the Azure portal.

Answer

The refresh tokens automatically convert into guest user sessions with restricted privileges to mitigate potential compromise of internal directory roles.

Answer

The refresh tokens fail immediately because Azure AD enforces continuous access evaluation for all service principal API interactions.

Question 9

During an internal penetration test, an attacker compromises a standard user account in a hybrid Azure AD environment. The organization synchronizes on-premises identities using Azure AD Connect with Pass-Through Authentication enabled. Which technique allows the attacker to compromise additional cloud and on-premises identities without triggering standard cloud MFA prompts?

Accepted Answer

Abusing compromised credentials against legacy authentication endpoints or poorly secured client applications that bypass modern conditional access and MFA controls.. Pass-Through Authentication validates user credentials directly against the on-premises Active Directory by passing the raw credentials through the authentication agent. When an attacker compromises an active session or abuses legacy authentication protocols that bypass conditional access and multi-factor authentication requirements, they can pivot between cloud and on-premises domains seamlessly without triggering supplementary challenges.

Answer

Injecting malicious golden tickets into Azure AD Connect sync engine database tables to forge valid cloud security tokens.

Answer

Exploiting seamless single sign-on kerberos ticket requests to harvest master keys directly from the Azure AD service bus.

Answer

Modifying the cloud synchronization agent configuration file to downgrade password hashing algorithms from PBKDF2 to plain text.

Question 10

A client asks you to perform a penetration test on their web application. During the planning phase, they mention that the application is hosted on a third-party cloud provider and they do not have written permission from the provider to test the underlying infrastructure. What is the MOST appropriate action?

Accepted Answer

Request that the client obtain written authorization from the cloud provider before any testing begins.. The most appropriate action is to request that the client obtain written authorization from the cloud provider. This ensures the testing is legal and compliant with the provider's policies. Proceeding without it or limiting testing does not resolve the fundamental authorization gap and could expose both parties to legal and operational risks.

Answer

Limit testing to a static code review of the application source code to avoid any interaction with the cloud environment.

Answer

Perform the test anyway, since the client owns the application and has authorized you to test it.

Answer

Proceed with testing the application layer only, avoiding any tests that could impact the cloud infrastructure.

Question 11

What is the primary security advantage of utilizing salts in password hashing?

Accepted Answer

It prevents the use of precomputed rainbow tables.. Salts are random strings added to passwords before they are hashed. This ensures that even if two users have the same password, their resulting hashes will be different. This prevents the use of precomputed lookup tables (rainbow tables) from successfully identifying passwords. Protecting against rainbow tables is a fundamental security practice that forces attackers to crack each hash individually, significantly increasing the time and computational resources required for a successful breach.

Answer

It increases the length of the password, making it harder to guess.

Answer

It forces the hashing algorithm to use more CPU cycles.

Answer

It encrypts the password instead of hashing it.

Question 12

A penetration tester has captured a set of NTLMv2 challenge-response pairs from a network segment. The tester wants to crack these hashes offline using Hashcat. Which TWO of the following statements are true regarding the cracking of NTLMv2 hashes with Hashcat? (Choose two.)

Accepted Answer

Hashcat mode 5600 is used for NTLMv2 hashes.. NTLMv2 challenge-response pairs are cracked using Hashcat mode 5600, and the captured hash must include the server challenge for the computation to be possible. The challenge is unique per authentication, so precomputed tables are useless. The username is part of the hash but does not act as a salt. An attack mode must always be specified.

Answer

NTLMv2 hashes can be cracked using precomputed rainbow tables.

Answer

Hashcat can crack NTLMv2 hashes without specifying a wordlist or mask.

Answer

NTLMv2 hashes are salted with the username, making them more resistant to cracking.

Question 13

A penetration tester is reviewing Kerberos traffic and notices that a user account has the DONT_REQ_PREAUTH flag set in its userAccountControl attribute. The tester wants to obtain crackable material for this account without any domain credentials. Which technique should the tester use?

Accepted Answer

AS-REP Roasting by sending an AS-REQ without pre-authentication and capturing the encrypted AS-REP.. The DONT_REQ_PREAUTH flag allows an unauthenticated attacker to request an AS-REP for the account and receive data encrypted with the user's key. Capturing that response enables offline password cracking without any domain credentials, directly exploiting the disabled pre-authentication setting.

Answer

Golden ticket creation by forging a TGT using the krbtgt hash obtained from the domain controller.

Answer

Kerberoasting by requesting a TGS for an SPN associated with the account and cracking the service ticket.

Answer

Silver ticket creation by forging a service ticket using the target account's NTLM hash.

Question 14

During a penetration test, a tester extracts the SAM database from a Windows system. Which of the following tools is specifically designed to extract password hashes from the SAM file?

Accepted Answer

secretsdump.py. secretsdump.py is specifically designed to extract password hashes from Windows registry hives, including SAM, SYSTEM, and SECURITY. It can operate offline on extracted files, making it ideal for this scenario. Mimikatz is more for live memory extraction, while Hashcat and John the Ripper are cracking tools. Thus, secretsdump.py is the correct choice for extracting hashes from a SAM file.

Answer

John the Ripper

Answer

Mimikatz

Answer

Hashcat

Question 15

An enterprise client insists on a blind 'black-box' penetration test where the testing team receives zero prior knowledge regarding network architecture, IP ranges, or applications. However, the client's primary objective is to thoroughly test deep-seated business logic vulnerabilities within a critical custom web application. Why is this planning approach fundamentally misaligned with the client's stated objective?

Accepted Answer

Discovery phases consume disproportionate time, leaving insufficient hours for the deep manual analysis required to uncover logic flaws.. Black-box testing forces testers to spend the majority of the engagement on reconnaissance and basic discovery rather than deep vulnerability analysis. To effectively evaluate complex business logic flaws, testers require white-box or gray-box scoping with documentation and credentials to achieve adequate depth within standard assessment timeframes.

Answer

Black-box testing is legally prohibited under international cybersecurity standards for any application handling financial data.

Answer

Zero-knowledge assessments automatically violate standard industry rules of engagement by preventing the execution of automated scanners.

Answer

Client stakeholders cannot legally authorize a penetration test without providing a complete network diagram and asset inventory.

Question 16

An attacker has compromised an Azure App Service and obtained the application's managed identity token. They want to use it to access an Azure SQL Database. The managed identity has been granted access to the SQL server. Which of the following is the correct way to authenticate to the SQL Database using the managed identity token?

Accepted Answer

Use the token in the 'Access Token' property of a SqlConnection object with 'Authentication=Active Directory Access Token'.. The correct method is to use the managed identity's access token directly in the SqlConnection object with 'Authentication=Active Directory Access Token'. The token must be scoped to https://database.windows.net/. This allows the application to authenticate to Azure SQL using the managed identity, leveraging its assigned permissions.

Answer

Use the token to call the Azure SQL REST API to execute queries.

Answer

Use the token as the password in a SQL connection string with 'Authentication=Active Directory Password'.

Answer

Use the token to authenticate to the Azure SQL server's master database and then impersonate a user.

Question 17

You are performing a penetration test on a Microsoft Entra ID tenant that uses federated authentication with Active Directory Federation Services (AD FS). You have obtained a user's credentials and want to maintain persistent access even if the user's password is changed. Which of the following methods would best achieve this?

Accepted Answer

Forge a SAML token using the AD FS token-signing certificate.. In AD FS federated environments, the token-signing certificate is the root of trust. If an attacker compromises the AD FS server and exports the token-signing certificate's private key, they can forge SAML tokens for any user. These tokens are accepted by Entra ID, providing persistent access even after password changes. This is a critical persistence technique in federated identity setups.

Answer

Configure an Azure AD application with a client secret and assign it the 'Directory.Read.All' permission.

Answer

Create a new user account in Entra ID with Global Administrator privileges.

Answer

Register a new device in Entra ID and use it to obtain a Primary Refresh Token (PRT).

Question 18

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.

Question 19

What is the primary purpose of the 'Scope' section in the Rules of Engagement?

Accepted Answer

To define the specific boundaries of the assessment.. The scope section is essential to clearly define the boundaries of the test. It explicitly identifies which systems, applications, and networks are authorized for testing, protecting both the client and the tester from potential legal issues. By delineating these boundaries, it prevents 'scope creep' and ensures that the testing effort is focused on the intended targets, maximizing the impact of the assessment while minimizing risk.

Answer

To outline the payment terms for the penetration test.

Answer

To detail the specific tools to be used by the tester.

Answer

To list the names of all employees who will be interviewed.

Question 20

A penetration tester is analyzing a password hash captured from a web application's database. The hash is `5f4dcc3b5aa765d61d8327deb882cf99` and is 32 characters long. Which type of hash is this, and what is a common tool to crack it?

Accepted Answer

MD5, and Hashcat can be used with mode 0.. The hash is 32 characters long, which is the length of an MD5 hash. Hashcat mode 0 is used for raw MD5 hashes. This is a straightforward identification task. The hash `5f4dcc3b5aa765d61d8327deb882cf99` is a common example (MD5 of 'password'), but the key is recognizing the format. A penetration tester should use this knowledge to select the correct cracking mode and proceed with offline cracking.

Answer

SHA-256, and Hashcat can be used with mode 1400.

Answer

SHA-1, and Hashcat can be used with mode 100.

Answer

NTLM, and Hashcat can be used with mode 1000.