GPEN Practice Test 4 — 25 Questions

Question 1

Which of the following describes the 'AS-REP Roasting' attack?

Accepted Answer

It allows an attacker to crack user account passwords for accounts without pre-authentication.. AS-REP Roasting targets user accounts that have 'Do not require Kerberos preauthentication' enabled. An attacker can request a TGT for such an account without providing a password. The KDC responds with an encrypted ticket (the AS-REP) that the attacker can then extract and crack offline, similar to how Kerberoasting works, to obtain the user's plaintext password.

Answer

It targets service accounts that are configured with SPNs.

Answer

It relies on the interception of a TGS request to obtain encrypted credentials.

Answer

It is a technique for escalating privileges using the KRBTGT account.

Question 2

During planning, a client requests that you use a specific automated scanner that is known to produce false positives and potential system instability. What is the most professional way to handle this request?

Accepted Answer

Document the risks, communicate them to the client, and propose a validated alternative.. Professional pentesting requires the expert to validate the tools used against the client's operational constraints. Accepting a tool that causes instability ignores the core principle of 'do no harm'. By explaining the technical risks and proposing a safer, more reliable methodology, the tester acts as a trusted advisor, ensuring the client receives accurate, actionable intelligence without risking their production environment's stability during the process.

Answer

Agree to use the tool but run it only during off-peak hours.

Answer

Refuse the request and insist on using your own proprietary toolset.

Answer

Use the requested tool but ignore the potential instability issues.

Question 3

When performing a penetration test, why is it safer to crack hashes offline rather than online?

Accepted Answer

Offline cracking prevents account lockouts.. Offline cracking is performed on the tester's own hardware, which means there is no network traffic generated towards the target system. This prevents the triggering of intrusion detection systems (IDS), account lockout policies, or audit logs that monitor failed authentication attempts. It provides a stealthy way to test password strength without risking operational disruption or alerting the client's defensive security team, which is the primary concern during a professional assessment.

Answer

Offline cracking is always faster than online methods.

Answer

Offline cracking allows for the use of more complex passwords.

Answer

Offline cracking is required to obtain the hash from memory.

Question 4

A client asks for an 'unannounced' penetration test to test their incident response team. What is the most important preparatory step before commencing this exercise?

Accepted Answer

Obtain written authorization from a senior executive who can stop the test.. An unannounced test simulates a real-world breach, but it carries significant risk to business operations if the responders block legitimate internal traffic or if the testers are arrested by physical security. Ensuring that at least one senior decision-maker, such as the CISO, is aware of the test is vital. This provides a 'safe harbor' and a mechanism to immediately stop the test if it causes unintended consequences.

Answer

Ensure that the entire IT staff is informed of the test dates.

Answer

Launch the test during a holiday weekend to minimize user disruption.

Answer

Use only low-impact passive scanning to avoid triggering alarms.

Question 5

You are drafting the Rules of Engagement for an internal penetration test. Which TWO of the following items are considered mandatory for the 'Communication Plan' section?

Accepted Answer

The names and 24/7 contact information for designated incident response leads.. A robust communication plan is essential for maintaining control during an engagement. By defining specific emergency protocols and status reporting cadences, both the testing team and the client minimize the risk of operational downtime. These elements ensure that technical findings are communicated effectively while providing a clear escalation path if an unexpected system failure occurs, maintaining professional accountability throughout the duration of the testing period.

Answer

A list of all vulnerabilities found during the previous year's audit.

Answer

The specific exploit payloads that will be used during the test.

Answer

The estimated total cost of the project and payment schedule.

Question 6

A client asks you to perform a penetration test on their internal network. During the planning phase, they provide you with a list of IP addresses and ask you to sign a document that limits your testing to those addresses. Which of the following best describes the purpose of this document?

Accepted Answer

It defines the scope of the engagement and legally authorizes testing only on the specified targets.. The document is a scope and authorization agreement. It legally permits testing only on specified IP addresses and protects both parties by clearly defining what is allowed. Without it, testing could be deemed unauthorized, leading to legal consequences.

Answer

It is a liability waiver that absolves the tester of any responsibility for system damage.

Answer

It is a service level agreement outlining the expected uptime of the target systems during testing.

Answer

It serves as a non-disclosure agreement to protect the client's confidential information.

Question 7

A penetration tester is performing an offline attack against a Windows domain. They have obtained the NTDS.dit file and the SYSTEM hive. Which tool is most effective for extracting the NTLM hashes for offline cracking?

Accepted Answer

secretsdump.py. Impacket's secretsdump.py is the industry standard for parsing NTDS.dit files and SYSTEM hives to extract domain credentials. It leverages the boot key stored in the SYSTEM hive to decrypt the encrypted hashes within the NTDS.dit database. Understanding this process is critical for penetration testers because it represents the most common method of achieving domain-wide compromise after gaining the necessary domain controller files.

Answer

Hashcat

Answer

Mimikatz

Answer

John the Ripper

Question 8

During an assessment, you find that 'Device Writeback' is enabled. What is the security concern regarding the registration of these devices in Azure AD?

Accepted Answer

It allows untrusted devices to satisfy Conditional Access requirements.. Device Writeback registers on-premises devices in Microsoft Entra ID. If an attacker manages to join an unauthorized device to the domain, it is automatically synchronized to the cloud. Once in the cloud, this device might satisfy Conditional Access requirements, allowing an attacker to bypass device-based security controls. This expands the trusted device pool, which is a major security loophole if device registration is not tightly controlled.

Answer

It allows the cloud to push malware to on-premises devices.

Answer

It automatically grants the devices administrative access to the cloud tenant.

Answer

It requires all devices to be hardware-encrypted with TPM 2.0.

Question 9

When conducting a penetration test on an Azure App Service, you discover an 'environment.js' file in the public directory containing a 'CLIENT_ID'. What is the risk associated with this finding?

Accepted Answer

The attacker can use the Client ID to construct a tailored consent-phishing URL.. Client IDs are public and not secrets in themselves. However, exposing them can reveal the application's configuration and identifier, which an attacker can then use to craft malicious authorization requests. If the application is misconfigured to allow unauthorized consent or has other vulnerabilities, the Client ID acts as the starting point for a targeted phishing or consent-based attack against the organization's users.

Answer

The attacker can use the Client ID to authenticate as the application.

Answer

The attacker can use the Client ID to reset the application's password.

Answer

The attacker can use the Client ID to bypass MFA for the application.

Question 10

Refer to the exhibit. What does this error log suggest regarding the C2 connection attempt?

Accepted Answer

The client system does not trust the C2 server's certificate.. The 'tlsv1 alert unknown ca' error indicates that the client rejected the server's certificate because it was not signed by a trusted root CA. In the context of C2, this often happens when an automated beacon tries to connect to an infrastructure node using a self-signed certificate, and the host's security policy or a proxy is performing SSL inspection and fails the trust validation process.

Answer

The C2 server is unreachable due to a network outage.

Answer

The C2 server is performing a man-in-the-middle attack.

Answer

The C2 server has exhausted its connection limit.

Question 11

An attacker uses a 'redirector' in their C2 infrastructure. What is the primary purpose of this architectural component?

Accepted Answer

To provide a layer of obfuscation for the C2 server.. Redirectors act as a layer of separation between the compromised host and the actual C2 server. They proxy the incoming beacon traffic to the real server, masking the location of the true command infrastructure. This protects the C2 server from being directly identified and blacklisted, as the traffic appears to originate from the redirector node. This is a critical component for maintaining a resilient and stealthy operational environment.

Answer

To increase the bandwidth of the C2 connection.

Answer

To translate commands into local system calls.

Answer

To manage the encryption keys for the C2 channel.

Question 12

Which of the following describes the purpose of 'encoding' shellcode in an exploitation context?

Accepted Answer

To bypass character-based filters and detection systems.. Encoding is used to transform shellcode to bypass security filters, such as Intrusion Detection Systems (IDS) or character filtering (like null bytes). By changing the signature of the payload, it avoids triggering pattern-based detection. This is a fundamental technique for ensuring the payload reaches its intended execution point without being sanitized or blocked by input validation controls that inspect data for known malicious sequences.

Answer

To increase the execution speed of the exploit.

Answer

To encrypt the traffic for legal compliance.

Answer

To permanently store the payload on the target's disk.

Question 13

Which TWO of the following scenarios are most indicative of a successful Kerberoasting attack occurring within a network?

Accepted Answer

Multiple TGS-REQ packets from a single workstation targeting various SPNs within a short timeframe.. Kerberoasting is characterized by the bulk request of service tickets and the subsequent offline cracking of the service account's password. Detectors look for anomalous TGS-REQ volume and specific encryption types (like RC4-HMAC) in the requests. Identifying these patterns allows security analysts to pinpoint service accounts that are currently under attack, enabling timely password resets or the implementation of Group Managed Service Accounts (gMSAs) to mitigate future risk.

Answer

A sudden spike in AS-REQ events using expired Kerberos TGTs.

Answer

Frequent failed logins followed by a successful Kerberos authentication.

Answer

An influx of TGT-REQ packets originating from non-domain controllers.

Question 14

When escalating privileges using a Kernel exploit, why is it considered a high-risk activity for a penetration test?

Accepted Answer

It frequently causes system instability and crashes.. Kernel exploits target the core of the operating system. If the exploit fails or contains errors, it frequently leads to a system crash (Blue Screen of Death). This causes significant downtime for the client, which is usually prohibited. Because kernel-level code runs with the highest possible privilege, any mistake results in immediate system instability, making it one of the most dangerous vectors to test in a production environment.

Answer

It requires the user to have administrative credentials.

Answer

It is easily detected by standard antivirus software.

Answer

It can only be executed on outdated operating systems.

Question 15

You are performing an offline attack against a password hash stored in an NTDS.dit file. You have successfully dumped the hashes using secretsdump.py. Given the format 'Username:RID:LMHash:NTHash:::', which hash should be targeted for a modern Windows environment to maximize cracking efficiency?

Accepted Answer

The NTHash, because it is the primary hash used by NTLM authentication.. Modern Windows systems prioritize NTLM authentication, which relies on the NTHash. The LM hash is deprecated, weak, and often stored as a null value or a fixed constant in modern systems. Targeting the NTHash allows for pass-the-hash attacks or brute-force attempts that align with the underlying authentication protocol. Understanding the structure of these hashes is crucial for penetration testers to select the correct dictionary or mask attack strategies during local account auditing.

Answer

The LMHash, because it is shorter and faster to calculate.

Answer

The RID, because it provides the unique identifier for the account.

Answer

The entire string, including the colons, to ensure format integrity.

Question 16

Which attack type is most effective when an attacker has a list of usernames and a single password that they believe might be reused across multiple accounts?

Accepted Answer

Password spraying. Password spraying is a technique where an attacker tests a single password against many accounts to avoid triggering account lockout thresholds that occur with brute-forcing a single account. By keeping the number of attempts per account low, the attacker remains under the radar of security monitoring systems. This is a common tactic in modern cloud environments where individual account lockout policies are strict, making mass authentication attempts the most viable entry vector.

Answer

Dictionary attack

Answer

Birthday attack

Answer

Rainbow table attack

Question 17

During a reconnaissance project, you use the 'theHarvester' tool against a target. What information is this tool designed to extract?

Accepted Answer

Emails, subdomains, and user names from public sources.. theHarvester is a widely used OSINT tool designed to gather emails, subdomains, and hostnames from various public sources like search engines and PGP key servers. This information is vital for mapping the organization's digital footprint and identifying targets for social engineering. Its ability to aggregate this data from multiple sources makes it an essential tool for penetration testers aiming to build a comprehensive map of an organization's public-facing presence.

Answer

Internal employee passwords from active memory.

Answer

SQL injection vulnerabilities on web forms.

Answer

Full network topology maps including internal routers.

Question 18

If a penetration tester discovers a vulnerability that could compromise a third-party hosted service during an engagement, what is the correct professional responsibility?

Accepted Answer

Report the finding to the client and let them handle vendor disclosure.. The tester must report this finding only to the primary client, as they are the contractual entity. The tester should not contact the third-party provider directly, as this could violate the engagement's legal agreements. The client is responsible for coordinating with their third-party vendors. Professional ethics require that testers respect the chain of command and the contractual structure established at the start of the engagement.

Answer

Contact the third-party service provider immediately to warn them.

Answer

Ignore the finding as it is outside the client's direct control.

Answer

Publish the finding on a public bug bounty site for remediation.

Question 19

Refer to the exhibit. An Nmap scan returns output indicating a web server is responding, but the `http-enum` script fails to identify common directories. Which action should the tester take to improve detection?

Accepted Answer

Use a specialized web discovery tool like ffuf or Gobuster with a large wordlist.. The current command lacks service-specific depth. Adding a more comprehensive script category or using a specialized tool like Dirbuster or Burp Suite allows for brute-forcing against common file paths. Service version detection and enumeration scripts in Nmap are limited by the wordlist provided. Improving detection requires moving beyond passive enumeration into active path discovery, which is essential for identifying hidden administrative interfaces or unlinked configuration files.

Answer

Increase the timing template to -T5 to make the scan faster.

Answer

Add the --script-args='http-enum.basepath=/admin' argument to the command.

Answer

Change the scan to -sS to perform a stealthy SYN scan instead of service detection.

Question 20

When analyzing C2 traffic, which characteristic of a TLS/SSL certificate is most indicative of a potentially malicious beaconing endpoint?

Accepted Answer

The certificate uses a self-signed or invalid chain.. Malicious C2 infrastructure often uses self-signed certificates or certificates issued by untrusted/free Certificate Authorities to encrypt traffic. In a professional environment, legitimate services typically use well-known, trusted CAs. When a penetration tester sees an endpoint using a certificate with a random common name, short expiration period, or invalid chain, it serves as a strong indicator that the connection is intended for unauthorized command and control purposes.

Answer

The certificate uses a 2048-bit RSA key.

Answer

The certificate is signed by a reputable public CA.

Answer

The certificate includes a valid Subject Alternative Name.