GPEN Practice Exam 3 — 20 Questions

Question 1

When selecting an exploit for a target system, which TWO factors are most critical to ensure the exploit succeeds without crashing the target service?

Accepted Answer

The exact version of the application or OS service.. Successful exploitation requires precise alignment between the exploit's memory address assumptions and the target's environment. Crashes typically occur when the exploit targets an incorrect memory offset or assumes a different architecture than the one present. By verifying target versioning and architectural requirements, a tester minimizes the risk of service instability, ensuring that the exploit fulfills its objective while maintaining the operational integrity of the production environment.

Answer

The color scheme of the target's command shell.

Answer

The network bandwidth available to the target.

Answer

The number of users currently logged in.

Question 2

During an internal penetration test, you capture NTLMv2 hashes from a network segment. You want to crack these hashes using Hashcat on a dedicated GPU rig. Which Hashcat mode number corresponds directly to the NTLMv2 hash format commonly captured via LLMNR/NBT-NS poisoning?

Accepted Answer

Hashcat mode 5600 targets NetNTLMv2 hashes captured during network authentication processes like SMB or HTTP challenges.. Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes, which are generated during SMB authentication challenges captured through poisoning tools like Responder. Understanding these specific hash modes is critical for pentesters to quickly transition from passive or active credential capture to offline brute-forcing and dictionary attacks against Windows domain environments.

Answer

Hashcat mode 1000 represents standard NTLM password hashes extracted from the Windows SAM database or NTDS.dit.

Answer

Hashcat mode 3000 handles LANMAN hashes, which are legacy Windows password hashes stored for backwards compatibility on older systems.

Answer

Hashcat mode 13100 is utilized for Kerberos 5 TGS-REP etype 23 hashes gathered through service ticket requests.

Question 3

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 4

During a penetration test, you successfully obtain an encrypted NTLM hash but are unable to crack it. What is the most effective alternative strategy to gain access to the system?

Accepted Answer

Perform a Pass-the-Hash attack using the captured hash.. When an NTLM hash cannot be cracked, the most effective alternative is a Pass-the-Hash (PtH) attack. Because NTLM authentication verifies the user based on the knowledge of the hash rather than the plaintext password, an attacker can use the captured hash to authenticate to various network services directly. This approach is highly effective for lateral movement, bypassing the need for plaintext recovery while maintaining the ability to compromise the target system.

Answer

Attempt a brute-force attack on the Kerberos TGT.

Answer

Use a social engineering attack to reset the password.

Answer

Re-run the cracking attack with a longer wordlist.

Question 5

You are conducting an internal penetration test and have obtained a set of NTLM hashes from a compromised server. You want to crack them using Hashcat on a dedicated GPU rig. Which hash mode should you use?

Accepted Answer

Hashcat mode 1000 (NTLM). NTLM hashes are stored in Windows systems and are commonly extracted during penetration tests. Hashcat mode 1000 is designed to crack these hashes efficiently. Other modes correspond to different hash types, such as NetNTLMv2, Kerberos, or Linux crypt formats, and would not correctly process NTLM hashes.

Answer

Hashcat mode 1800 (sha512crypt)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 5500 (NetNTLMv2)

Question 6

You have compromised a workstation and extracted the NTLM hash of a service account that is configured for unconstrained delegation. You want to craft a Silver Ticket to impersonate a domain administrator when accessing a specific file server. Which piece of information is absolutely required to forge this ticket?

Accepted Answer

The service account's NTLM hash or Kerberos key. To forge a Silver Ticket, the attacker must have the target service account's NTLM hash or Kerberos key to encrypt the service ticket. The domain SID and user RID are needed for the PAC but are not the encryption key. A TGT is not required because the ticket is presented directly to the service. The krbtgt hash is for Golden Tickets.

Answer

The domain SID and the target user's RID

Answer

A valid TGT for the service account

Answer

The krbtgt account's NTLM hash

Question 7

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Accepted Answer

Implementing Domain Generation Algorithms (DGA).. Resilient C2 infrastructure often relies on decentralized or dynamic components to ensure that the connection remains viable even if individual nodes are identified and blocked. By utilizing domain generation algorithms and cloud-based relay services, attackers create a moving target that is difficult for incident responders to fully dismantle in a timely manner. Mastery of these techniques is essential for assessing the robust nature of an organization's defense-in-depth posture.

Answer

Hardcoding the IP address of the C2 server.

Answer

Using unencrypted HTTP for all C2 traffic.

Answer

Requiring manual operator interaction for beaconing.

Question 8

You are finalizing the Rules of Engagement (RoE) for a penetration test of a regional hospital network. The client's legal counsel requires that any testing activity be immediately suspended if a life-safety system is affected. Which element should you add to the RoE to satisfy this requirement?

Accepted Answer

A documented emergency stop procedure with named client contacts and a defined notification method.. An emergency stop procedure is the operational control that lets the hospital halt testing instantly when a life-safety system is at risk. It specifies authorized personnel, the notification channel, and the required acknowledgment, making the requirement enforceable and auditable. Scheduling limits, waivers, and reporting timelines all operate after or around the event rather than stopping it in real time.

Answer

A liability waiver transferring all damages from the testing firm to the hospital.

Answer

A requirement that all findings be delivered in a written report within thirty days of testing.

Answer

An expanded scan window that limits intrusive testing to overnight hours only.

Question 9

A penetration tester has gained a foothold on a Windows host and wants to escalate privileges. They discover that the host has an unquoted service path vulnerability. Which command should they use to identify services with unquoted paths that contain spaces?

Accepted Answer

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\". Unquoted service paths with spaces allow a tester to place a malicious executable in a directory that Windows will search before the intended binary. The wmic command with the specified filters lists auto-start services and their paths, excluding Windows directory services, making it efficient for spotting vulnerable services.

Answer

tasklist /svc | findstr /i "svchost"

Answer

sc query type= service state= all | findstr /i "SERVICE_NAME"

Answer

net start | findstr /i "service"

Question 10

Which of the following actions is the best way to detect an attacker performing an offline hash-cracking operation within a corporate network?

Accepted Answer

Logging access to the LSASS process and SAM hives.. Detecting an offline attack is challenging because the actual computation happens on the attacker's hardware. However, the initial phase—dumping the hashes from memory or the SAM file—requires access to sensitive system files or processes. By monitoring for access to the LSASS process or reading the SAM/SYSTEM registry hives, security teams can identify the signature of a credential dumping attempt, which is the necessary precursor to any offline attack.

Answer

Monitoring for high CPU usage on all workstations.

Answer

Scanning for the use of the Hashcat tool on the network.

Answer

Monitoring for network traffic to known cracking websites.

Question 11

During an internal penetration test, you capture an NTLMv2 hash challenge-response pair from a network segment. You want to crack the user's password using Hashcat. Which hashcat attack mode and hash format identifier should you use to crack this specific challenge-response pair efficiently on a modern GPU?

Accepted Answer

Mode 5600, which targets NetNTLMv2 hashes captured during network authentication events or LLMNR/NBT-NS spoofing attacks.. Hashcat utilizes mode 5600 specifically for NetNTLMv2 hashes, which allows leveraging high-speed GPU acceleration to perform dictionary and mask attacks against captured enterprise authentication handshakes. Selecting the correct mode ensures hashcat parses the challenge, username, domain, and response fields accurately according to the standard NTLMv2 response format specification.

Answer

Mode 1000, which targets local Windows SAM NT hashes extracted from a compromised registry hive export.

Answer

Mode 5500, which is designed exclusively for cracking legacy NTLMv1 network authentication challenge-response pairs.

Answer

Mode 3000, which processes LanMan hashes historically found on very old Windows NT and 95 operating systems.

Question 12

A penetration tester is performing a password audit and has obtained a set of NTLM hashes from a Windows system. The tester wants to use Hashcat to crack these hashes but needs to choose the correct mode. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

Hashcat mode 1000. NTLM hashes are MD4-based and are cracked using Hashcat mode 1000. This mode correctly interprets the hash format and applies the appropriate algorithm. Other modes target different hash types such as NetNTLMv1, NetNTLMv2, or LM, and will not work for NTLM hashes. Therefore, mode 1000 is the only correct choice for this scenario.

Answer

Hashcat mode 3000

Answer

Hashcat mode 5500

Answer

Hashcat mode 5600

Question 13

Which Kerberos feature is specifically exploited when an attacker uses 'constrained delegation' to escalate privileges?

Accepted Answer

The S4U2Self and S4U2Proxy extensions.. Constrained delegation allows a service to impersonate a user to a specific set of other services, defined in the 'msDS-AllowedToDelegateTo' attribute. If an attacker compromises a service account configured for constrained delegation, they can request a service ticket for any user to the allowed target services. This allows the attacker to pivot throughout the network while impersonating high-privilege users without needing their credentials.

Answer

The TGT's ability to be renewed indefinitely.

Answer

The PAC validation performed by the Domain Controller.

Answer

The ability to use RC4 encryption for TGS requests.

Question 14

A penetration tester obtains a password hash from a Linux system's /etc/shadow file that begins with $6$. Which statement correctly describes this hash and its implications for cracking?

Accepted Answer

It is a SHA-512 crypt hash and can be cracked using Hashcat mode 1800.. The $6$ prefix in /etc/shadow indicates SHA-512 crypt. Hashcat mode 1800 is the correct mode for cracking sha512crypt hashes. Other modes correspond to different algorithms: mode 500 for md5crypt, mode 3200 for bcrypt, and mode 7400 for sha256crypt. Identifying the prefix correctly is essential to select the right cracking mode and avoid wasted effort.

Answer

It is a bcrypt hash and can be cracked using Hashcat mode 3200.

Answer

It is a SHA-256 crypt hash and can be cracked using Hashcat mode 7400.

Answer

It is an MD5-based hash and can be cracked using Hashcat mode 500.

Question 15

A penetration tester has obtained a password hash from a Windows system: `aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0`. They attempt to crack it using Hashcat with mode 1000 but are unable to recover any plaintext. What is the most likely explanation for this failure?

Accepted Answer

The LM hash is empty, and the NT hash corresponds to a blank password.. The hash consists of an LM part and an NT part separated by a colon. The LM part `aad3b435b51404eeaad3b435b51404ee` is the constant for an empty LM hash, and the NT part `31d6cfe0d16ae931b73c59d7e0c089c0` is the NT hash of an empty password. Hashcat mode 1000 correctly handles NTLM, but since the password is blank, cracking yields an empty string, which may not be displayed. Thus, the failure is due to the password being blank, not a mode or salt issue.

Answer

The hash is a domain cached credential and requires mode 2100.

Answer

The hash is salted, and Hashcat mode 1000 does not support salts.

Answer

The hash was captured from a Kerberos ticket and requires mode 13100.

Question 16

A penetration tester is reviewing an Azure Logic App that uses a managed identity to access an Azure SQL Database. The tester finds that the Logic App's workflow definition is stored in a storage account that is publicly accessible. The workflow includes a step that executes a stored procedure with parameters. Which of the following is the most significant risk of this misconfiguration?

Accepted Answer

An attacker can modify the workflow to exfiltrate data from the SQL Database using the managed identity.. The most significant risk is that an attacker can modify the publicly accessible workflow definition to perform malicious actions using the managed identity's privileges. Since the managed identity can access the SQL Database, the attacker could alter the workflow to extract data and send it externally. This highlights the importance of securing Logic App definitions and limiting access to storage accounts.

Answer

An attacker can disable the managed identity by deleting the Logic App.

Answer

An attacker can use the managed identity to authenticate to Azure AD and create new users.

Answer

An attacker can retrieve the managed identity's client secret from the workflow definition.

Question 17

What is the primary security benefit of implementing Group Managed Service Accounts (gMSAs) in an environment vulnerable to Kerberoasting?

Accepted Answer

gMSAs use long, complex passwords that are automatically rotated by the domain controller.. gMSAs are designed to mitigate the risks associated with long-term static service account passwords. They feature automatically managed, complex passwords that are rotated frequently by the Active Directory domain controller. Because the passwords are long and changed regularly, they are effectively impossible to crack offline even if an attacker successfully captures the encrypted TGS ticket during a Kerberoasting attempt, rendering the attack functionally useless.

Answer

gMSAs prevent the KDC from issuing service tickets for the account.

Answer

gMSAs require multi-factor authentication for every TGS-REQ performed.

Answer

gMSAs force all Kerberos traffic to be encrypted using AES-256 only.

Question 18

What is the primary function of 'rules' in tools like Hashcat when performing a dictionary attack?

Accepted Answer

To transform dictionary words into common password variations.. Rules are used to transform wordlist entries into variations. For example, a rule might take the word 'password' and generate 'Password123!' or 'P@ssw0rd'. This increases the effectiveness of dictionary attacks by covering common variations that users employ to meet complexity requirements, without needing a massive, exhaustive dictionary. This is a critical skill for testers to maximize the utility of limited wordlist sizes while increasing the likelihood of cracking complex, user-chosen passwords.

Answer

To decrypt the hash using the specified algorithm.

Answer

To automatically update the hashing algorithm to a newer standard.

Answer

To bypass account lockout mechanisms on the target system.

Question 19

During a penetration test for a multinational retailer, you discover that a legacy internal application in scope contains a hardcoded credential that also grants access to a payment processing system the client explicitly excluded from testing. You have not yet used the credential. What is the MOST appropriate course of action?

Accepted Answer

Immediately notify the client's designated point of contact, document the finding, and await written guidance before accessing the excluded system.. When testing reveals a path into an explicitly excluded system, the tester must stop and escalate rather than proceed. Notifying the client contact, documenting the discovery, and awaiting written direction respects the Rules of Engagement while ensuring the client can act on a serious risk. This balances the obligation to report critical findings with the legal boundary the client set.

Answer

Report the hardcoded credential as an informational finding without mentioning the link to the excluded payment system.

Answer

Continue testing other in-scope systems and include the credential finding in the final report at the end of the engagement.

Answer

Use the credential only to confirm it works against the excluded system, then report the finding without making changes.

Question 20

During a penetration test of a Microsoft Entra ID environment, you discover that an on-premises user account has the ms-DS-ConsistencyGuid attribute set to a value that matches the ImmutableID of a cloud user with higher privileges. What is the most likely security implication of this configuration?

Accepted Answer

It allows the on-premises user to authenticate to the cloud as the privileged user.. The ms-DS-ConsistencyGuid attribute is used as the source anchor when Microsoft Entra Connect is configured to use it. If an attacker can modify this attribute on an on-premises user to match the ImmutableID of a privileged cloud user, the next synchronization will link the on-premises account to the cloud account. The attacker can then authenticate to the cloud as the privileged user, achieving privilege escalation.

Answer

It allows the on-premises user to reset the privileged user's password.

Answer

It enables password hash synchronization for the privileged user.

Answer

It causes a synchronization error that prevents the user from logging in.