GPEN Practice Test 2 — 25 Questions

Question 1

Which of the following best describes the 'Gray-box' testing methodology?

Accepted Answer

Partial knowledge of internal systems and limited documentation.. Gray-box testing combines elements of both black-box and white-box testing. The tester has limited knowledge of the environment, such as network diagrams or internal documentation, but does not have full source code access. This approach is highly effective for simulating a sophisticated attacker, such as an insider or an attacker who has already gained an initial foothold, allowing for a more focused and efficient security assessment.

Answer

Complete lack of knowledge about the target environment.

Answer

Full access to source code, network diagrams, and documentation.

Answer

Testing only the physical security controls of a facility.

Question 2

You are performing OSINT on a target and have collected a list of employee names from LinkedIn. You want to generate likely corporate email addresses and then verify which ones are valid without sending email to the target's mail servers. Which approach best accomplishes this?

Accepted Answer

Query a breach-compilation or email-verification API that checks syntax, domain MX, and known breach data. Email-verification APIs and breach-compilation services evaluate candidate addresses using syntax checks, MX validation, and known breach data without contacting the target's mail servers. This keeps the activity passive while still filtering out invalid addresses. It is the only listed method that both validates individual addresses and avoids direct interaction with the target, satisfying the scenario's constraints.

Answer

Use the SMTP VRFY command against the organization's MX host for each candidate address

Answer

Perform a DNS MX lookup for the domain and assume any address at that domain is valid

Answer

Send a test message to each candidate address and monitor for bounce-backs

Question 3

During an Azure penetration test, you discover an App Registration with an expired client secret that still has active refresh tokens issued prior to expiration. The application holds high-privilege directory roles. How do these leaked refresh tokens behave regarding Azure AD security boundaries?

Accepted Answer

The refresh tokens continue to function and can be exchanged for new access tokens until the refresh token's own lifetime expires or it is explicitly revoked.. Active refresh tokens bypass initial credential checks until they expire or are explicitly revoked, allowing prolonged unauthorized access to enterprise resources. Understanding this persistence mechanism is critical for penetration testers assessing token lifetime policies and identifying stealthy persistence vectors within enterprise environments.

Answer

The refresh tokens are instantly invalidated the moment the underlying client secret expires or is rotated in the Azure portal.

Answer

The refresh tokens automatically convert into guest user sessions with restricted privileges to mitigate potential compromise of internal directory roles.

Answer

The refresh tokens fail immediately because Azure AD enforces continuous access evaluation for all service principal API interactions.

Question 4

During an internal penetration test, an attacker compromises a standard user account in a hybrid Azure AD environment. The organization synchronizes on-premises identities using Azure AD Connect with Pass-Through Authentication enabled. Which technique allows the attacker to compromise additional cloud and on-premises identities without triggering standard cloud MFA prompts?

Accepted Answer

Abusing compromised credentials against legacy authentication endpoints or poorly secured client applications that bypass modern conditional access and MFA controls.. Pass-Through Authentication validates user credentials directly against the on-premises Active Directory by passing the raw credentials through the authentication agent. When an attacker compromises an active session or abuses legacy authentication protocols that bypass conditional access and multi-factor authentication requirements, they can pivot between cloud and on-premises domains seamlessly without triggering supplementary challenges.

Answer

Injecting malicious golden tickets into Azure AD Connect sync engine database tables to forge valid cloud security tokens.

Answer

Exploiting seamless single sign-on kerberos ticket requests to harvest master keys directly from the Azure AD service bus.

Answer

Modifying the cloud synchronization agent configuration file to downgrade password hashing algorithms from PBKDF2 to plain text.

Question 5

A client asks you to perform a penetration test on their web application. During the planning phase, they mention that the application is hosted on a third-party cloud provider and they do not have written permission from the provider to test the underlying infrastructure. What is the MOST appropriate action?

Accepted Answer

Request that the client obtain written authorization from the cloud provider before any testing begins.. The most appropriate action is to request that the client obtain written authorization from the cloud provider. This ensures the testing is legal and compliant with the provider's policies. Proceeding without it or limiting testing does not resolve the fundamental authorization gap and could expose both parties to legal and operational risks.

Answer

Limit testing to a static code review of the application source code to avoid any interaction with the cloud environment.

Answer

Perform the test anyway, since the client owns the application and has authorized you to test it.

Answer

Proceed with testing the application layer only, avoiding any tests that could impact the cloud infrastructure.

Question 6

What is the primary security advantage of utilizing salts in password hashing?

Accepted Answer

It prevents the use of precomputed rainbow tables.. Salts are random strings added to passwords before they are hashed. This ensures that even if two users have the same password, their resulting hashes will be different. This prevents the use of precomputed lookup tables (rainbow tables) from successfully identifying passwords. Protecting against rainbow tables is a fundamental security practice that forces attackers to crack each hash individually, significantly increasing the time and computational resources required for a successful breach.

Answer

It increases the length of the password, making it harder to guess.

Answer

It forces the hashing algorithm to use more CPU cycles.

Answer

It encrypts the password instead of hashing it.

Question 7

A penetration tester has captured a set of NTLMv2 challenge-response pairs from a network segment. The tester wants to crack these hashes offline using Hashcat. Which TWO of the following statements are true regarding the cracking of NTLMv2 hashes with Hashcat? (Choose two.)

Accepted Answer

Hashcat mode 5600 is used for NTLMv2 hashes.. NTLMv2 challenge-response pairs are cracked using Hashcat mode 5600, and the captured hash must include the server challenge for the computation to be possible. The challenge is unique per authentication, so precomputed tables are useless. The username is part of the hash but does not act as a salt. An attack mode must always be specified.

Answer

NTLMv2 hashes can be cracked using precomputed rainbow tables.

Answer

Hashcat can crack NTLMv2 hashes without specifying a wordlist or mask.

Answer

NTLMv2 hashes are salted with the username, making them more resistant to cracking.

Question 8

A penetration tester is reviewing Kerberos traffic and notices that a user account has the DONT_REQ_PREAUTH flag set in its userAccountControl attribute. The tester wants to obtain crackable material for this account without any domain credentials. Which technique should the tester use?

Accepted Answer

AS-REP Roasting by sending an AS-REQ without pre-authentication and capturing the encrypted AS-REP.. The DONT_REQ_PREAUTH flag allows an unauthenticated attacker to request an AS-REP for the account and receive data encrypted with the user's key. Capturing that response enables offline password cracking without any domain credentials, directly exploiting the disabled pre-authentication setting.

Answer

Golden ticket creation by forging a TGT using the krbtgt hash obtained from the domain controller.

Answer

Kerberoasting by requesting a TGS for an SPN associated with the account and cracking the service ticket.

Answer

Silver ticket creation by forging a service ticket using the target account's NTLM hash.

Question 9

During a penetration test, a tester extracts the SAM database from a Windows system. Which of the following tools is specifically designed to extract password hashes from the SAM file?

Accepted Answer

secretsdump.py. secretsdump.py is specifically designed to extract password hashes from Windows registry hives, including SAM, SYSTEM, and SECURITY. It can operate offline on extracted files, making it ideal for this scenario. Mimikatz is more for live memory extraction, while Hashcat and John the Ripper are cracking tools. Thus, secretsdump.py is the correct choice for extracting hashes from a SAM file.

Answer

John the Ripper

Answer

Mimikatz

Answer

Hashcat

Question 10

An enterprise client insists on a blind 'black-box' penetration test where the testing team receives zero prior knowledge regarding network architecture, IP ranges, or applications. However, the client's primary objective is to thoroughly test deep-seated business logic vulnerabilities within a critical custom web application. Why is this planning approach fundamentally misaligned with the client's stated objective?

Accepted Answer

Discovery phases consume disproportionate time, leaving insufficient hours for the deep manual analysis required to uncover logic flaws.. Black-box testing forces testers to spend the majority of the engagement on reconnaissance and basic discovery rather than deep vulnerability analysis. To effectively evaluate complex business logic flaws, testers require white-box or gray-box scoping with documentation and credentials to achieve adequate depth within standard assessment timeframes.

Answer

Black-box testing is legally prohibited under international cybersecurity standards for any application handling financial data.

Answer

Zero-knowledge assessments automatically violate standard industry rules of engagement by preventing the execution of automated scanners.

Answer

Client stakeholders cannot legally authorize a penetration test without providing a complete network diagram and asset inventory.

Question 11

An attacker has compromised an Azure App Service and obtained the application's managed identity token. They want to use it to access an Azure SQL Database. The managed identity has been granted access to the SQL server. Which of the following is the correct way to authenticate to the SQL Database using the managed identity token?

Accepted Answer

Use the token in the 'Access Token' property of a SqlConnection object with 'Authentication=Active Directory Access Token'.. The correct method is to use the managed identity's access token directly in the SqlConnection object with 'Authentication=Active Directory Access Token'. The token must be scoped to https://database.windows.net/. This allows the application to authenticate to Azure SQL using the managed identity, leveraging its assigned permissions.

Answer

Use the token to call the Azure SQL REST API to execute queries.

Answer

Use the token as the password in a SQL connection string with 'Authentication=Active Directory Password'.

Answer

Use the token to authenticate to the Azure SQL server's master database and then impersonate a user.

Question 12

You are performing a penetration test on a Microsoft Entra ID tenant that uses federated authentication with Active Directory Federation Services (AD FS). You have obtained a user's credentials and want to maintain persistent access even if the user's password is changed. Which of the following methods would best achieve this?

Accepted Answer

Forge a SAML token using the AD FS token-signing certificate.. In AD FS federated environments, the token-signing certificate is the root of trust. If an attacker compromises the AD FS server and exports the token-signing certificate's private key, they can forge SAML tokens for any user. These tokens are accepted by Entra ID, providing persistent access even after password changes. This is a critical persistence technique in federated identity setups.

Answer

Configure an Azure AD application with a client secret and assign it the 'Directory.Read.All' permission.

Answer

Create a new user account in Entra ID with Global Administrator privileges.

Answer

Register a new device in Entra ID and use it to obtain a Primary Refresh Token (PRT).

Question 13

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.

Question 14

What is the primary purpose of the 'Scope' section in the Rules of Engagement?

Accepted Answer

To define the specific boundaries of the assessment.. The scope section is essential to clearly define the boundaries of the test. It explicitly identifies which systems, applications, and networks are authorized for testing, protecting both the client and the tester from potential legal issues. By delineating these boundaries, it prevents 'scope creep' and ensures that the testing effort is focused on the intended targets, maximizing the impact of the assessment while minimizing risk.

Answer

To outline the payment terms for the penetration test.

Answer

To detail the specific tools to be used by the tester.

Answer

To list the names of all employees who will be interviewed.

Question 15

A penetration tester is analyzing a password hash captured from a web application's database. The hash is `5f4dcc3b5aa765d61d8327deb882cf99` and is 32 characters long. Which type of hash is this, and what is a common tool to crack it?

Accepted Answer

MD5, and Hashcat can be used with mode 0.. The hash is 32 characters long, which is the length of an MD5 hash. Hashcat mode 0 is used for raw MD5 hashes. This is a straightforward identification task. The hash `5f4dcc3b5aa765d61d8327deb882cf99` is a common example (MD5 of 'password'), but the key is recognizing the format. A penetration tester should use this knowledge to select the correct cracking mode and proceed with offline cracking.

Answer

SHA-256, and Hashcat can be used with mode 1400.

Answer

SHA-1, and Hashcat can be used with mode 100.

Answer

NTLM, and Hashcat can be used with mode 1000.

Question 16

When selecting an exploit for a target system, which TWO factors are most critical to ensure the exploit succeeds without crashing the target service?

Accepted Answer

The exact version of the application or OS service.. Successful exploitation requires precise alignment between the exploit's memory address assumptions and the target's environment. Crashes typically occur when the exploit targets an incorrect memory offset or assumes a different architecture than the one present. By verifying target versioning and architectural requirements, a tester minimizes the risk of service instability, ensuring that the exploit fulfills its objective while maintaining the operational integrity of the production environment.

Answer

The color scheme of the target's command shell.

Answer

The network bandwidth available to the target.

Answer

The number of users currently logged in.

Question 17

During an internal penetration test, you capture NTLMv2 hashes from a network segment. You want to crack these hashes using Hashcat on a dedicated GPU rig. Which Hashcat mode number corresponds directly to the NTLMv2 hash format commonly captured via LLMNR/NBT-NS poisoning?

Accepted Answer

Hashcat mode 5600 targets NetNTLMv2 hashes captured during network authentication processes like SMB or HTTP challenges.. Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes, which are generated during SMB authentication challenges captured through poisoning tools like Responder. Understanding these specific hash modes is critical for pentesters to quickly transition from passive or active credential capture to offline brute-forcing and dictionary attacks against Windows domain environments.

Answer

Hashcat mode 1000 represents standard NTLM password hashes extracted from the Windows SAM database or NTDS.dit.

Answer

Hashcat mode 3000 handles LANMAN hashes, which are legacy Windows password hashes stored for backwards compatibility on older systems.

Answer

Hashcat mode 13100 is utilized for Kerberos 5 TGS-REP etype 23 hashes gathered through service ticket requests.

Question 18

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 19

During a penetration test, you successfully obtain an encrypted NTLM hash but are unable to crack it. What is the most effective alternative strategy to gain access to the system?

Accepted Answer

Perform a Pass-the-Hash attack using the captured hash.. When an NTLM hash cannot be cracked, the most effective alternative is a Pass-the-Hash (PtH) attack. Because NTLM authentication verifies the user based on the knowledge of the hash rather than the plaintext password, an attacker can use the captured hash to authenticate to various network services directly. This approach is highly effective for lateral movement, bypassing the need for plaintext recovery while maintaining the ability to compromise the target system.

Answer

Attempt a brute-force attack on the Kerberos TGT.

Answer

Use a social engineering attack to reset the password.

Answer

Re-run the cracking attack with a longer wordlist.

Question 20

You are conducting an internal penetration test and have obtained a set of NTLM hashes from a compromised server. You want to crack them using Hashcat on a dedicated GPU rig. Which hash mode should you use?

Accepted Answer

Hashcat mode 1000 (NTLM). NTLM hashes are stored in Windows systems and are commonly extracted during penetration tests. Hashcat mode 1000 is designed to crack these hashes efficiently. Other modes correspond to different hash types, such as NetNTLMv2, Kerberos, or Linux crypt formats, and would not correctly process NTLM hashes.

Answer

Hashcat mode 1800 (sha512crypt)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 5500 (NetNTLMv2)