GPEN Practice Test 21 — 15 Questions

Question 1

During a penetration test, you capture network traffic and obtain an MS-CHAPv2 challenge-response handshake. You want to crack it offline to recover the user's password. Which tool and mode combination is most appropriate for this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hashcat mode 5600 (MS-CHAPv2) with a wordlist.. MS-CHAPv2 challenge-response handshakes are cracked using Hashcat mode 5600 or John the Ripper's mschapv2 format. Hashcat mode 5600 correctly processes the challenge and response to recover the password. Other modes like 5500 are for different protocols (NetNTLMv1), and tools like Aircrack-ng are for Wi-Fi. Thus, the appropriate combination is Hashcat mode 5600 with a wordlist.

Answer

Hashcat mode 5500 (NetNTLMv1) with a wordlist.

Answer

Aircrack-ng with the `-E` option for MS-CHAPv2.

Answer

John the Ripper with the `--format=netntlm` option.

Question 2

During an internal penetration test you need to enumerate live hosts on a /24 subnet that you suspect is protected by a stateful firewall dropping ICMP echo requests. You want the scan to be fast and you have administrative (root) privileges on your Kali system. Which Nmap command best accomplishes host discovery in this scenario?

Accepted Answer

nmap -sn -PS22,80,443 10.10.10.0/24. A TCP SYN ping to a commonly open port works even when ICMP is filtered because the firewall permits the TCP handshake to legitimate services. Combining -PS with -sn keeps the scan focused on discovery, making it fast and effective against a stateful firewall that drops echo requests.

Answer

nmap -sn -PE 10.10.10.0/24

Answer

nmap -sn -PR 10.10.10.0/24

Answer

nmap -sS -p 1-1024 10.10.10.0/24

Question 3

During an internal penetration test, you gain access to a Windows workstation and discover that a domain user's password hash is cached in the registry. You extract the hash and want to crack it offline. Which Hashcat mode should you use to attack the cached domain credential?

Accepted Answer

Hashcat mode 2100 (Domain Cached Credentials 2, MS Cache 2). Cached domain credentials are stored as MSCache v2 hashes in the SECURITY registry hive. Hashcat mode 2100 is purpose-built to crack these hashes offline. Other modes target different hash types such as NTLM, LM, or NetNTLMv2, which are not applicable here. Using the correct mode ensures efficient and successful cracking of the cached credential.

Answer

Hashcat mode 1000 (NTLM)

Answer

Hashcat mode 5500 (NetNTLMv2)

Answer

Hashcat mode 3000 (LM)

Question 4

Which TWO of the following are common indicators that a Windows system has been compromised with persistence?

Accepted Answer

Presence of unknown services running as SYSTEM.. Indicators of persistence in Windows include unusual entries in startup folders, unrecognized services set to auto-start, and suspicious registry keys. Monitoring these areas is standard procedure for incident response and threat hunting. Detecting these markers early allows defenders to disrupt the attacker's ability to maintain access, effectively ending the persistence phase and forcing the attacker to re-establish a foothold, which increases the likelihood of detection.

Answer

Increased usage of the CPU by the system kernel.

Answer

Changes to the system's desktop wallpaper.

Answer

A high number of failed login attempts in the event log.

Question 5

An attacker has gained access to an Azure VM and wants to escalate privileges by abusing the VM's managed identity. The managed identity has the 'Contributor' role on the subscription. Which of the following actions would allow the attacker to add a new user to an Azure AD group that has 'Global Administrator' role?

Accepted Answer

The attacker cannot perform this action because the 'Contributor' role does not grant permissions to modify Azure AD groups.. Azure RBAC roles like 'Contributor' grant permissions to manage Azure resources, not Microsoft Entra ID objects. Adding a user to an Microsoft Entra ID group is an Microsoft Entra ID operation that requires directory permissions. The managed identity does not have these permissions, so the attacker cannot escalate privileges this way. The attacker would need to find a different path, such as compromising an account with Microsoft Entra ID admin roles.

Answer

Use the managed identity to assign the 'User Access Administrator' role to itself, then add the user to the group.

Answer

Use the managed identity to call the Microsoft Graph API and add the user to the group.

Answer

Use the managed identity to create a new service principal with 'Global Administrator' role, then use it to add the user.

Question 6

Refer to the exhibit. What is the primary purpose of the Nmap Scripting Engine (NSE) in the context of the output provided, and how does it improve upon standard port scanning?

Accepted Answer

To perform deep inspection of application-layer services.. The NSE allows for automated discovery of application-layer information, such as page titles, service versions, and even vulnerability checks. While basic scanning identifies that a port is open, the NSE probes the service to extract actionable intelligence. This is vital for penetration testers who need to quickly identify the function and potential risks of a service without manually interacting with every discovered endpoint during a large-scale reconnaissance operation.

Answer

To increase the speed of the port discovery phase.

Answer

To bypass firewalls by using script-based obfuscation.

Answer

To convert TCP scans into more reliable UDP scans.

Question 7

Refer to the exhibit. Why did the EternalBlue exploit attempt fail despite the scanner identifying the target as vulnerable?

Accepted Answer

The target environment rejected the payload execution. The exhibit shows the module successfully detected vulnerability but failed exploitation. This often occurs due to differences in the target's operating system build, unexpected memory protection, or a race condition where the service crashed during the initial check. In professional testing, this highlights the instability of kernel-level exploits. Even if a target appears vulnerable, environmental variables like patches, antivirus interference, or DEP/ASLR settings can prevent the shellcode from executing correctly in memory.

Answer

The RHOSTS value is configured incorrectly

Answer

The exploit module requires an active session

Answer

The listener port is already in use by another process

Question 8

Which THREE of the following are primary reasons why the NTLM authentication protocol is considered insecure for modern enterprise environments?

Accepted Answer

Lack of mutual authentication allows for relay attacks.. NTLM is inherently insecure because it is a challenge-response protocol that does not provide mutual authentication, making it susceptible to relay attacks. Furthermore, the NTLM hash is stored in a format that does not include a salt, allowing for the use of precomputed tables. Finally, because NTLM hashes are treated as the 'equivalent' of a password in many contexts, once stolen, they can be reused without needing to crack them.

Answer

NTLM requires a connection to a Domain Controller for every login.

Answer

The protocol uses hard-coded encryption keys for every session.

Question 9

You are performing a Kerberoasting attack against a domain. After requesting service tickets for accounts with SPNs, you extract the tickets and attempt to crack them offline. Which two factors most directly determine the success of cracking these tickets? (Choose two.)

Accepted Answer

The encryption type used for the service ticket. The success of cracking Kerberoasted tickets hinges on the encryption type and the service account's password strength. RC4 tickets are faster to crack than AES, and weak passwords are vulnerable to dictionary attacks. Other factors like number of tickets, domain functional level, or DC location do not affect the cryptographic difficulty of cracking.

Answer

The number of service tickets requested

Answer

The domain functional level

Answer

The physical location of the domain controller

Question 10

You are planning a penetration test for a healthcare provider that must comply with HIPAA. The client wants to ensure that any protected health information (PHI) accessed during testing is handled securely. Which of the following is the MOST critical element to include in the data handling plan?

Accepted Answer

A detailed procedure for encrypting any extracted PHI and securely destroying it after the engagement.. The most critical element is a procedure for encrypting extracted PHI and securely destroying it after the engagement. This directly addresses HIPAA requirements for protecting PHI and minimizes the risk of unauthorized disclosure. Other elements like NDAs, scope, and scheduling are important but do not provide the necessary technical safeguards for PHI encountered during testing.

Answer

A schedule of testing activities to avoid peak business hours.

Answer

A list of all IP addresses and hostnames that are in scope for testing.

Answer

A requirement that all testers sign a non-disclosure agreement (NDA) before testing begins.

Question 11

You are conducting a penetration test against a web application and have identified a potential SQL injection vulnerability in a login form. You want to confirm the vulnerability and extract the database schema without causing a denial of service. Which technique should you use to safely enumerate the database?

Accepted Answer

Union-based SQL injection to retrieve schema information. Union-based SQL injection is the most direct and efficient method to extract database schema when the application returns query results in its response. It allows the tester to retrieve multiple rows of data in a single request without relying on delays or error messages. This minimizes impact on the application's performance and reduces the risk of triggering defensive mechanisms. Other techniques like time-based or out-of-band are used when union is not possible, but they are slower and can be more disruptive.

Answer

Out-of-band SQL injection using DNS exfiltration

Answer

Error-based SQL injection by forcing detailed error messages

Answer

Time-based blind SQL injection using heavy delays

Question 12

A penetration tester is assessing an Azure environment and discovers a function app with an HTTP trigger that does not require authentication. The function app has a system-assigned managed identity with Contributor role on the subscription. What is the most immediate risk?

Accepted Answer

The function app can be used to perform actions on any resource in the subscription, potentially leading to full subscription compromise.. The unauthenticated HTTP trigger allows anyone to invoke the function. If the function's managed identity has Contributor role on the subscription, an attacker can use the function to execute actions with that identity, effectively gaining Contributor-level access to the entire subscription. This is a severe privilege escalation.

Answer

The function app's source code can be downloaded, revealing secrets and connection strings.

Answer

The function app's logs can be accessed, revealing sensitive information.

Answer

The function app can be used to send emails or messages, leading to spam or phishing.

Question 13

Which THREE of the following are valid techniques for privilege escalation on a Linux system?

Accepted Answer

Exploiting a binary with the SUID bit set to root.. Privilege escalation involves exploiting misconfigurations to gain higher access. Common vectors include exploiting SUID binaries, abusing SUDO rules that allow commands to run as root without passwords, and exploiting kernel vulnerabilities that allow arbitrary code execution in kernel mode. Understanding these vectors is crucial for identifying how an unprivileged user can transition to root and maintain control over the compromised Linux infrastructure.

Answer

Configuring a new user account with no password.

Answer

Renaming the /etc/passwd file to /etc/shadow.

Question 14

Why is it important to perform reconnaissance from a non-attributable source during a penetration test?

Accepted Answer

To avoid triggering security alerts that block the tester's IP.. Using non-attributable sources, such as a VPN or a compromised proxy, prevents the target from tracing reconnaissance activities back to the testing firm or the specific tester. This protects the anonymity of the test, ensuring that the target's security response is triggered based on the activity itself, rather than by blocking a known testing IP. This is essential for simulating a realistic threat actor's behavior and avoiding early detection.

Answer

To improve the speed of data transfer during scans.

Answer

To bypass the need for explicit written authorization.

Answer

To increase the accuracy of vulnerability detection tools.

Question 15

You are planning a penetration test for a healthcare provider that must comply with HIPAA. The client wants to test a new patient portal hosted on AWS. During the kickoff meeting, the client's legal team asks how you will handle any protected health information (PHI) that you might encounter. Which of the following is the most appropriate action to take before testing begins?

Accepted Answer

Sign a Business Associate Agreement (BAA) with the client and ensure your testing infrastructure is covered under it.. Under HIPAA, a penetration tester acting as a business associate must sign a BAA before accessing systems that may contain PHI. This agreement establishes permissible uses and safeguards for protected health information. Without it, the engagement could be non-compliant regardless of technical precautions.

Answer

Encrypt all test data at rest and in transit, and avoid accessing any real patient data by using synthetic records.

Answer

Obtain written authorization from the client's CEO and proceed with testing without additional agreements.

Answer

Conduct the test only after hours to minimize the risk of encountering live patient data.