GPEN Practice Test 3 — 25 Questions

Question 1

During an internal penetration test, you capture an NTLMv2 hash challenge-response pair from a network segment. You want to crack the user's password using Hashcat. Which hashcat attack mode and hash format identifier should you use to crack this specific challenge-response pair efficiently on a modern GPU?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mode 5600, which targets NetNTLMv2 hashes captured during network authentication events or LLMNR/NBT-NS spoofing attacks.. Hashcat utilizes mode 5600 specifically for NetNTLMv2 hashes, which allows leveraging high-speed GPU acceleration to perform dictionary and mask attacks against captured enterprise authentication handshakes. Selecting the correct mode ensures hashcat parses the challenge, username, domain, and response fields accurately according to the standard NTLMv2 response format specification.

Answer

Mode 1000, which targets local Windows SAM NT hashes extracted from a compromised registry hive export.

Answer

Mode 5500, which is designed exclusively for cracking legacy NTLMv1 network authentication challenge-response pairs.

Answer

Mode 3000, which processes LanMan hashes historically found on very old Windows NT and 95 operating systems.

Question 2

A penetration tester is performing a password audit and has obtained a set of NTLM hashes from a Windows system. The tester wants to use Hashcat to crack these hashes but needs to choose the correct mode. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

Hashcat mode 1000. NTLM hashes are MD4-based and are cracked using Hashcat mode 1000. This mode correctly interprets the hash format and applies the appropriate algorithm. Other modes target different hash types such as NetNTLMv1, NetNTLMv2, or LM, and will not work for NTLM hashes. Therefore, mode 1000 is the only correct choice for this scenario.

Answer

Hashcat mode 3000

Answer

Hashcat mode 5500

Answer

Hashcat mode 5600

Question 3

Which Kerberos feature is specifically exploited when an attacker uses 'constrained delegation' to escalate privileges?

Accepted Answer

The S4U2Self and S4U2Proxy extensions.. Constrained delegation allows a service to impersonate a user to a specific set of other services, defined in the 'msDS-AllowedToDelegateTo' attribute. If an attacker compromises a service account configured for constrained delegation, they can request a service ticket for any user to the allowed target services. This allows the attacker to pivot throughout the network while impersonating high-privilege users without needing their credentials.

Answer

The TGT's ability to be renewed indefinitely.

Answer

The PAC validation performed by the Domain Controller.

Answer

The ability to use RC4 encryption for TGS requests.

Question 4

A penetration tester obtains a password hash from a Linux system's /etc/shadow file that begins with $6$. Which statement correctly describes this hash and its implications for cracking?

Accepted Answer

It is a SHA-512 crypt hash and can be cracked using Hashcat mode 1800.. The $6$ prefix in /etc/shadow indicates SHA-512 crypt. Hashcat mode 1800 is the correct mode for cracking sha512crypt hashes. Other modes correspond to different algorithms: mode 500 for md5crypt, mode 3200 for bcrypt, and mode 7400 for sha256crypt. Identifying the prefix correctly is essential to select the right cracking mode and avoid wasted effort.

Answer

It is a bcrypt hash and can be cracked using Hashcat mode 3200.

Answer

It is a SHA-256 crypt hash and can be cracked using Hashcat mode 7400.

Answer

It is an MD5-based hash and can be cracked using Hashcat mode 500.

Question 5

A penetration tester has obtained a password hash from a Windows system: `aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0`. They attempt to crack it using Hashcat with mode 1000 but are unable to recover any plaintext. What is the most likely explanation for this failure?

Accepted Answer

The LM hash is empty, and the NT hash corresponds to a blank password.. The hash consists of an LM part and an NT part separated by a colon. The LM part `aad3b435b51404eeaad3b435b51404ee` is the constant for an empty LM hash, and the NT part `31d6cfe0d16ae931b73c59d7e0c089c0` is the NT hash of an empty password. Hashcat mode 1000 correctly handles NTLM, but since the password is blank, cracking yields an empty string, which may not be displayed. Thus, the failure is due to the password being blank, not a mode or salt issue.

Answer

The hash is a domain cached credential and requires mode 2100.

Answer

The hash is salted, and Hashcat mode 1000 does not support salts.

Answer

The hash was captured from a Kerberos ticket and requires mode 13100.

Question 6

A penetration tester is reviewing an Azure Logic App that uses a managed identity to access an Azure SQL Database. The tester finds that the Logic App's workflow definition is stored in a storage account that is publicly accessible. The workflow includes a step that executes a stored procedure with parameters. Which of the following is the most significant risk of this misconfiguration?

Accepted Answer

An attacker can modify the workflow to exfiltrate data from the SQL Database using the managed identity.. The most significant risk is that an attacker can modify the publicly accessible workflow definition to perform malicious actions using the managed identity's privileges. Since the managed identity can access the SQL Database, the attacker could alter the workflow to extract data and send it externally. This highlights the importance of securing Logic App definitions and limiting access to storage accounts.

Answer

An attacker can disable the managed identity by deleting the Logic App.

Answer

An attacker can use the managed identity to authenticate to Azure AD and create new users.

Answer

An attacker can retrieve the managed identity's client secret from the workflow definition.

Question 7

What is the primary security benefit of implementing Group Managed Service Accounts (gMSAs) in an environment vulnerable to Kerberoasting?

Accepted Answer

gMSAs use long, complex passwords that are automatically rotated by the domain controller.. gMSAs are designed to mitigate the risks associated with long-term static service account passwords. They feature automatically managed, complex passwords that are rotated frequently by the Active Directory domain controller. Because the passwords are long and changed regularly, they are effectively impossible to crack offline even if an attacker successfully captures the encrypted TGS ticket during a Kerberoasting attempt, rendering the attack functionally useless.

Answer

gMSAs prevent the KDC from issuing service tickets for the account.

Answer

gMSAs require multi-factor authentication for every TGS-REQ performed.

Answer

gMSAs force all Kerberos traffic to be encrypted using AES-256 only.

Question 8

What is the primary function of 'rules' in tools like Hashcat when performing a dictionary attack?

Accepted Answer

To transform dictionary words into common password variations.. Rules are used to transform wordlist entries into variations. For example, a rule might take the word 'password' and generate 'Password123!' or 'P@ssw0rd'. This increases the effectiveness of dictionary attacks by covering common variations that users employ to meet complexity requirements, without needing a massive, exhaustive dictionary. This is a critical skill for testers to maximize the utility of limited wordlist sizes while increasing the likelihood of cracking complex, user-chosen passwords.

Answer

To decrypt the hash using the specified algorithm.

Answer

To automatically update the hashing algorithm to a newer standard.

Answer

To bypass account lockout mechanisms on the target system.

Question 9

During a penetration test for a multinational retailer, you discover that a legacy internal application in scope contains a hardcoded credential that also grants access to a payment processing system the client explicitly excluded from testing. You have not yet used the credential. What is the MOST appropriate course of action?

Accepted Answer

Immediately notify the client's designated point of contact, document the finding, and await written guidance before accessing the excluded system.. When testing reveals a path into an explicitly excluded system, the tester must stop and escalate rather than proceed. Notifying the client contact, documenting the discovery, and awaiting written direction respects the Rules of Engagement while ensuring the client can act on a serious risk. This balances the obligation to report critical findings with the legal boundary the client set.

Answer

Report the hardcoded credential as an informational finding without mentioning the link to the excluded payment system.

Answer

Continue testing other in-scope systems and include the credential finding in the final report at the end of the engagement.

Answer

Use the credential only to confirm it works against the excluded system, then report the finding without making changes.

Question 10

During a penetration test of a Microsoft Entra ID environment, you discover that an on-premises user account has the ms-DS-ConsistencyGuid attribute set to a value that matches the ImmutableID of a cloud user with higher privileges. What is the most likely security implication of this configuration?

Accepted Answer

It allows the on-premises user to authenticate to the cloud as the privileged user.. The ms-DS-ConsistencyGuid attribute is used as the source anchor when Microsoft Entra Connect is configured to use it. If an attacker can modify this attribute on an on-premises user to match the ImmutableID of a privileged cloud user, the next synchronization will link the on-premises account to the cloud account. The attacker can then authenticate to the cloud as the privileged user, achieving privilege escalation.

Answer

It allows the on-premises user to reset the privileged user's password.

Answer

It enables password hash synchronization for the privileged user.

Answer

It causes a synchronization error that prevents the user from logging in.

Question 11

An attacker is performing reconnaissance on an Azure AD tenant and notices that 'Guest' users can enumerate the directory. Which specific setting should be checked to remediate this?

Accepted Answer

External collaboration settings for Guest user access restrictions.. By default, Microsoft Entra ID allows guest users to see other users and groups in the directory. This is a common reconnaissance vector for attackers to map the organization's structure. Restricting this access is a critical step in hardening the tenant, ensuring that guest identities have limited visibility into the internal organizational structure during an initial compromise.

Answer

Conditional Access policy for guest users.

Answer

The 'Enable Global Reader' role for guests.

Answer

The 'AppRoleAssignmentRequired' property of the tenant.

Question 12

A penetration tester has obtained a hash from a Linux system: `$1$salt$hash`. The tester wants to crack it using John the Ripper. Which format should be specified, and what is the main weakness of this hash type?

Accepted Answer

md5crypt, and the main weakness is that it is fast to compute, making brute-force attacks easier.. The `$1$` prefix is the identifier for md5crypt. John the Ripper supports this format with the 'md5crypt' option. The primary weakness is that MD5 is a fast hash function, so despite salting and a fixed number of iterations, it can be cracked quickly using modern hardware. This makes it less secure than slower algorithms like bcrypt or SHA-512 crypt with high iteration counts.

Answer

sha512crypt, and the main weakness is that the iteration count is too low by default.

Answer

descrypt, and the main weakness is that it only uses the first 8 characters of the password.

Answer

bcrypt, and the main weakness is that the salt is too short, allowing rainbow table attacks.

Question 13

You are conducting passive reconnaissance against a target that uses a Web Application Firewall (WAF) and a Content Delivery Network (CDN). You want to discover the origin IP address of the web server to bypass the CDN during later testing. Which technique is most likely to reveal the origin IP without sending any traffic to the target's domain?

Accepted Answer

Use a third-party service like SecurityTrails to view historical DNS records.. Historical DNS records from services like SecurityTrails are a passive way to discover an origin IP that was used before the CDN was implemented. Because the data is stored by a third party, querying it does not touch the target's CDN or origin. This makes it a safe and effective method for bypassing CDN obfuscation during reconnaissance.

Answer

Send HTTP requests with a spoofed Host header to the CDN edge servers.

Answer

Query the target's SPF record to find the origin IP.

Answer

Perform a DNS zone transfer against the target's authoritative nameserver.

Question 14

Which of the following describes the risk associated with cached credentials in the Windows operating system during a penetration test?

Accepted Answer

They provide a target for offline cracking to recover domain passwords.. Windows caches credentials for domain accounts that have previously logged into a machine to allow users to sign in when the domain controller is unavailable. These cached entries, often stored in the registry, can be extracted by an attacker with administrative privileges. This provides a persistent source of credentials that, if cracked, could grant an attacker access to the domain even when the targeted user is not currently logged on.

Answer

Cached credentials only store the user's username.

Answer

They allow offline authentication, but are stored in plain text.

Answer

They are automatically wiped upon every system reboot.

Question 15

During a red team engagement, an operator successfully dumps the LSA secrets and NTDS.dit database from a Windows domain controller. Which TWO advanced password extraction and analysis techniques should the operator prioritize to uncover administrative access vectors? (Choose two)

Accepted Answer

Performing offline dictionary and rule-based cracking against extracted NTLM hashes using high-performance GPU clusters.. Extracting credentials from NTDS.dit allows the recovery of NTLM hashes and potentially cleartext passwords stored via reversible encryption. Pass-the-hash utilizes captured NTLM hashes for lateral movement without cracking, while offline dictionary cracking recovers original plaintext passwords for reuse against external portals or multi-factor authentication boundaries where hash reuse fails.

Answer

Injecting malicious DLL payloads into the Local Security Authority Subsystem Service to capture plaintext credentials in real-time.

Answer

Executing Kerberoasting against all user accounts to extract service tickets encrypted with legacy RC4 encryption keys.

Answer

Running a responder-based LLMNR/NBT-NS poisoning campaign to capture incoming network authentication challenge-response pairs.

Question 16

Refer to the exhibit. What is the primary purpose of the 'jitter' parameter in this C2 configuration?

Accepted Answer

To prevent detection via traffic pattern analysis.. The jitter parameter introduces a random percentage of variation into the beacon interval, preventing the C2 traffic from appearing as a perfectly rhythmic heartbeat. Static intervals are highly detectable through statistical analysis, as they create distinct patterns in network traffic logs. Introducing jitter makes the C2 communication appear more organic and unpredictable, complicating efforts by defenders to identify the malicious connection using simple frequency-based anomaly detection algorithms.

Answer

To reduce the CPU overhead on the infected host.

Answer

To synchronize beaconing across multiple infected hosts.

Answer

To increase the throughput of the C2 channel.

Question 17

When evaluating the security of an organization's C2 detection capabilities, which log source is the most valuable for detecting DNS-based C2?

Accepted Answer

Centralized DNS query logs.. DNS query logs are the primary data source for identifying DNS-based C2. By analyzing these logs, security teams can identify anomalies such as high volumes of queries to a specific domain, unusual record types like TXT or NULL records, or domains with extremely high entropy. Without centralized DNS logging, detecting this specific type of C2 becomes nearly impossible, as the traffic occurs at the infrastructure level rather than the end-host level.

Answer

Endpoint system event logs.

Answer

Firewall traffic logs (Layer 4).

Answer

Antivirus detection logs.

Question 18

What is the primary danger of leaving a 'backdoor' account on a compromised system after a penetration test?

Accepted Answer

The account acts as a persistent entry point for unauthorized parties.. Leaving a backdoor account creates an unauthorized access path that persists after the engagement ends. This violates the principle of 'cleanup' and can lead to security breaches by third parties who discover the account. It represents a significant liability and risk for the client, as an unsecured backdoor account is a prime target for malicious actors looking to exploit the environment without further effort.

Answer

The account may trigger an automated system update.

Answer

The system performance will degrade due to the account.

Answer

The account automatically encrypts data in the directory.

Question 19

Which of the following describes the 'Persistence' phase in the context of the cyber kill chain?

Accepted Answer

Maintaining a presence on the system through system restarts.. Persistence ensures that an attacker maintains access to a system even after reboots, credential changes, or other disruptions. This is achieved through various techniques like scheduled tasks, registry modifications, or backdoored services. Persistence is vital for long-term intelligence gathering and ensures that the attacker remains within the environment to pursue their objectives despite potential detection or system maintenance activities performed by legitimate users.

Answer

Gaining initial access to a target network via phishing.

Answer

Exfiltrating sensitive data to an external server.

Answer

Encrypting the system for ransomware purposes.

Question 20

In Metasploit, what is the significance of the 'LHOST' parameter when setting up a reverse shell?

Accepted Answer

It identifies the attacker's IP address for the callback. The LHOST parameter is the IP address of the attacker's machine. It tells the target machine where to send its callback once the payload is executed. Misconfiguring this is a common point of failure for beginners. Ensuring the correct LHOST is set is critical for establishing a stable connection between the target and the penetration tester's workstation during the exploitation phase of the engagement.

Answer

It defines the target's listening port

Answer

It is used to scan the local network

Answer

It defines the exploit's remote host target