GPEN Practice Test 22 — 15 Questions

Question 1

During an internal penetration test, you have compromised a Windows workstation and need to establish a covert channel that will survive network address translation and filtering. You decide to use the Domain Name System (DNS) TXT record for command and control. Which tool should you use to create a DNS tunnel that encapsulates IP traffic over DNS queries and responses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

iodine. The correct tool for encapsulating IP traffic over DNS is iodine. It creates a virtual network interface and tunnels IPv4 packets inside DNS queries and responses, effectively providing a VPN over DNS. This allows the attacker to bypass network restrictions that only allow DNS traffic. Other tools like dnscat2 and dns2tcp provide C2 channels but do not encapsulate IP traffic.

Answer

dnscat2

Answer

dns2tcp

Answer

iodine-client

Question 2

During an internal network penetration test, you capture NetNTLMv2 challenge-response hashes. You decide to perform a relay attack rather than cracking them offline. Which protocol characteristic makes SMB relaying feasible against a target host?

Accepted Answer

The target machine has disabled SMB signing, allowing challenge-response reuse.. SMB relaying succeeds when message signing is disabled on the target server, allowing an attacker to intercept authentication requests and forward them to another machine. GPEN candidates must understand that signing protects the integrity of SMB sessions. Without it, session hijacking and relaying become trivial threats within local area networks.

Answer

The target machine enforces mandatory SMB signing across all network shares.

Answer

The user account used for authentication has a blank password stored.

Answer

Kerberos protocol is exclusively enforced for all domain controller communications.

Question 3

When planning for an engagement involving sensitive data, which TWO of the following must be included in the data handling plan?

Accepted Answer

The encryption standards for data at rest and in transit.. Data handling is paramount when managing sensitive information during a penetration test. The tester must ensure that data is encrypted at rest and in transit, and that it is securely destroyed once the project concludes. These protocols protect the client from data breaches caused by the testing activity itself, maintaining the integrity and confidentiality of the sensitive information processed during the course of the engagement.

Answer

The public keys of all developers involved in the project.

Answer

The names of all servers used to store the data.

Answer

A list of all public websites the testers use for research.

Question 4

During a penetration test, you are performing passive reconnaissance against a target organization. You want to gather information about the organization's public-facing infrastructure without directly interacting with their systems. Which two of the following techniques are considered passive reconnaissance? (Choose two.)

Accepted Answer

Querying WHOIS databases for domain registration details. Passive reconnaissance involves gathering information without directly interacting with the target's systems. Querying WHOIS databases and using Shodan both rely on third-party data sources, so they do not send traffic to the target. In contrast, DNS zone transfers and TCP SYN scans directly interact with the target's infrastructure, making them active techniques. Browsing a website, while often low-risk, still involves direct interaction and may be logged.

Answer

Performing a DNS zone transfer against the target's name server

Answer

Browsing the target's public website and analyzing its content

Answer

Conducting a TCP SYN scan on the target's public IP addresses

Question 5

You are conducting a penetration test and have gained access to a target's internal network. You want to perform reconnaissance to identify other live hosts and services without using traditional port scanning that might trigger IDS alerts. Which of the following techniques would be most effective for low-noise host discovery on the internal network?

Accepted Answer

ARP scanning using arp-scan. ARP scanning is a Layer 2 technique that discovers live hosts by sending ARP requests. Since ARP is essential for local network communication, it is rarely filtered or monitored by IDS. This makes it a stealthy and effective method for internal host discovery. The other techniques involve IP or TCP/UDP packets that can be detected or blocked, making them less suitable for low-noise reconnaissance.

Answer

TCP SYN scan using nmap

Answer

UDP scan using nmap

Answer

ICMP ping sweep using fping

Question 6

You have identified an SUID binary on a Linux system that executes a shell command without using an absolute path. What is the most effective way to exploit this for privilege escalation?

Accepted Answer

Modify the PATH variable to point to a malicious directory.. When a binary calls a command without an absolute path, it relies on the PATH environment variable to locate the executable. By modifying the PATH to include a directory under the attacker's control, the attacker can place a malicious executable with the same name as the target command. This forces the SUID binary to execute the malicious file instead of the intended system utility, resulting in command execution as the owner.

Answer

Overflow the buffer of the binary.

Answer

Use LD_PRELOAD to inject a shared object.

Answer

Inject arguments into the binary.

Question 7

During a penetration test against an Active Directory environment, you extract the NTLM hash of a domain user from a memory dump. You attempt to crack it with Hashcat using mode 1000 but fail after several hours. You suspect the password is longer than 12 characters and contains symbols. Which adjustment to your cracking strategy is most likely to succeed within a reasonable timeframe?

Accepted Answer

Use a mask attack with a custom charset targeting the estimated length and character set.. The password is suspected to be long and complex, so a targeted mask attack that specifies the exact length and character set is the most efficient use of cracking resources. Rule-based and combinator attacks rely on existing wordlists and transformations, which may not cover the required length and symbol diversity. Rainbow tables are infeasible for such a large keyspace. Thus, the mask attack is the best choice.

Answer

Switch to a rule-based attack using the best64.rule with a large wordlist.

Answer

Utilize a rainbow table specific to NTLM hashes.

Answer

Perform a combinator attack using two separate wordlists of common passwords.

Question 8

You have obtained a Meterpreter session as a standard user on an Ubuntu 20.04 server during an authorized penetration test. You want to identify reliable local privilege escalation vectors. Which two findings most directly indicate a path to root? (Choose two.)

Accepted Answer

A systemd service unit that runs a script located in /opt/backup, and the /opt/backup directory is world-writable.. Two findings give direct root: a root-run service executing a script from a world-writable directory, allowing script replacement, and passwordless sudo for find, whose -exec flag spawns arbitrary commands. Both convert standard user access into root on the same host. The remaining findings are hygiene or lateral-movement issues that do not, by themselves, elevate privileges locally.

Answer

The /etc/hosts file is writable by the standard user account you compromised.

Answer

The target runs an SSH server on port 22 that permits password authentication for all local accounts.

Answer

The host has an outdated OpenSSL library version recorded in the package manifest.

Question 9

During a penetration test, you have identified a Windows domain controller with SMB signing disabled and obtained valid domain user credentials. You want to perform a relay attack to gain administrative access to multiple hosts. Which two conditions are necessary for a successful SMB relay attack? (Choose two.)

Accepted Answer

SMB signing must be disabled on the target hosts.. The necessary conditions for a successful SMB relay attack are that SMB signing is disabled on the target hosts and that the attacker can intercept and relay authentication from a privileged user. These two factors allow the attacker to forward authentication to a target and gain access as that privileged user. Other options are either not required or describe different attack techniques.

Answer

The attacker must have administrative credentials on the domain controller.

Answer

The target hosts must have the same local administrator password.

Answer

The attacker must have a valid NTLM hash for a domain administrator.

Question 10

When mapping a target's network infrastructure, why is it important to use multiple WHOIS and regional internet registry (RIR) databases?

Accepted Answer

To identify all netblocks owned by the target organization.. Different RIRs manage different geographic segments of IP address space. Relying on a single database may result in an incomplete mapping of the organization's network assets. By aggregating data from various sources like ARIN, RIPE, or APNIC, a tester ensures a more accurate inventory of the target's netblocks. This reconnaissance step is critical for defining the scope of the assessment and identifying infrastructure that might be hosted by third-party providers.

Answer

To increase the speed of the DNS resolution process.

Answer

To bypass the need for an active port scan.

Answer

To automatically detect if a server is running an exploit.

Question 11

A financial services client engages you for an external penetration test and wants contractual protection before testing begins. Which TWO items belong in a master services agreement or statement of work to limit the firm's legal exposure while authorizing the work? (Choose two.)

Accepted Answer

A signed authorization and consent to test that identifies the in-scope assets and the permitted time window.. Legal protection for a penetration engagement rests on a signed authorization that identifies in-scope assets and permitted testing windows, paired with a limitation of liability clause that caps damages and excludes consequential losses. Together they establish consent and bound financial exposure. One-sided letters, publication rights, and verbal permissions do not create enforceable authority or meaningful risk transfer.

Answer

A get-out-of-jail-free authorization letter signed only by the tester's project manager.

Answer

A confidentiality clause that allows the tester to publish anonymized findings at will.

Answer

A verbal agreement recorded in meeting minutes that testing may proceed as discussed.

Question 12

Which TWO of the following password cracking techniques are considered 'offline' attacks?

Accepted Answer

Running a dictionary attack against a SAM database file.. Offline attacks involve obtaining a copy of the password hashes and processing them on the attacker's own hardware. This is stealthy as it avoids account lockout policies and audit logging generated by failed login attempts on the target system. Understanding the distinction between online and offline attacks is vital for penetration testers to choose methods that minimize detection while maximizing the probability of successful credential recovery within a controlled and limited engagement timeframe.

Answer

Brute-forcing an SSH service via an internet-facing portal.

Answer

Spraying common passwords against an O365 login portal.

Answer

Phishing users to submit credentials into a fake form.

Question 13

Which term best describes the stage of a cyberattack where a compromised host signals a remote server to request instructions or transmit stolen data?

Accepted Answer

Command and control. The command and control (C2) phase represents the ongoing communication channel between the attacker's infrastructure and the compromised system. It is the tactical link that allows the adversary to remotely manage the infection, deploy additional tools, and exfiltrate information. Recognizing C2 traffic is fundamental to incident response because it is the primary vector for controlling the adversary's actions within the network environment.

Answer

Privilege escalation

Answer

Reconnaissance

Answer

Log clearing

Question 14

Refer to the exhibit. You are performing a penetration test based on this policy. You discover an unpatched SQL injection vulnerability on 192.168.10.20 that could be used to trigger a database lock-up. What is the most appropriate course of action?

Accepted Answer

Document the vulnerability and the risk of DoS without exploitation.. Adhering strictly to the defined scope and allowed attack types is the cornerstone of professional pentesting. Since 'DoS' is explicitly forbidden, any exploit that causes service instability must be avoided. The tester must report the vulnerability as a high-risk finding without executing the destructive payload, as the client's policy prioritizes service availability over demonstrating the full potential of an exploit that risks system uptime.

Answer

Execute the SQL injection to prove the vulnerability exists.

Answer

Attempt the exploit on the excluded host 192.168.10.50 to see if it is vulnerable.

Answer

Extend the testing window to allow for a safer, non-disruptive exploit.

Question 15

You are planning a penetration test for a client with a large wireless network. The client wants to assess the security of their WPA3-Enterprise deployment. Which of the following should be included in the Rules of Engagement to address the risk of disrupting legitimate wireless users?

Accepted Answer

A schedule for testing during off-peak hours and a maximum number of deauthentication frames to send per minute.. The most appropriate inclusion is a schedule for off-peak testing and a limit on deauthentication frames. This minimizes the number of users affected and prevents network instability. It directly mitigates the risk of disrupting legitimate wireless users while still allowing active testing of WPA3-Enterprise security. Other options either do not sufficiently reduce risk or limit testing effectiveness.

Answer

A requirement to use only passive wireless scanning techniques and avoid any active attacks.

Answer

A requirement to perform all wireless testing only during business hours to blend in with normal traffic.

Answer

A predefined list of authorized MAC addresses for testing devices to prevent accidental disconnections.