GPEN Practice Test 5 — 25 Questions

Question 1

You are the lead penetration tester for an engagement at a regional bank. The client's legal team has approved testing of their external IP range, but the Statement of Work does not mention the third-party core banking platform hosted by a vendor on a shared subnet. During reconnaissance, you discover that one of the client's external IPs routes directly into the vendor's shared environment. What is the MOST appropriate action before conducting any exploitation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pause testing and obtain written authorization from both the client and the third-party vendor covering the shared environment.. Discovering that an in-scope IP routes into a third-party shared environment creates a legal scope conflict. The tester must halt activity on that asset and secure written authorization from both the client and the hosting vendor before any exploitation. This aligns with Rules of Engagement principles that require explicit consent for every tested system, especially third-party infrastructure.

Answer

Exploit the vulnerability but immediately notify the vendor after obtaining the initial shell to demonstrate impact.

Answer

Document the finding as informational and skip any testing of that IP, moving on to other in-scope targets.

Answer

Continue testing because the IP address appears in the client's external range and was approved in the Statement of Work.

Question 2

You are using a C2 framework that supports malleable C2 profiles. Your current profile uses a default HTTP GET beacon with a fixed User-Agent and a URI of /submit.php. The target's network monitoring has flagged this traffic as suspicious. You need to modify the profile to better blend with legitimate traffic. Which of the following changes is the MOST effective for evading network-based detection?

Accepted Answer

Mimic a legitimate application's traffic pattern by using its specific User-Agent, URI structure, and request headers, and set the beacon interval to match its typical polling frequency.. To evade network-based detection, the C2 traffic must closely resemble legitimate traffic. Simply changing the User-Agent or URI is insufficient because the overall pattern may still be anomalous. The most effective approach is to fully emulate a legitimate application, including its headers, URI structure, and timing. This makes the C2 traffic indistinguishable from the application's normal traffic, bypassing both signature and anomaly-based detection. The other options only partially address the problem.

Answer

Increase the beacon interval to several hours and add large amounts of jitter to make the traffic less frequent and more random.

Answer

Enable HTTPS with a valid certificate and use a domain that is categorized as 'business' by the firewall's URL filtering.

Answer

Change the User-Agent to match a common browser and set the URI to a random string for each beacon.

Question 3

During a penetration test, a tester compromises a workstation and extracts a Kerberos TGT for a domain user from memory. The tester wants to use this TGT to access a file share on a remote server without knowing the user's password. Which action should the tester take?

Accepted Answer

Inject the TGT into the current session using Rubeus ptt and request a service ticket for the file share's SPN.. Injecting a stolen TGT into the current session allows the system to request service tickets as the compromised user, enabling access to resources like file shares without the password. Pass-the-ticket leverages the TGT's validity until expiration, making it a powerful lateral movement technique.

Answer

Perform an S4U2Self request to obtain a service ticket for the file share using the extracted TGT.

Answer

Forge a new TGT using the user's NTLM hash, which can be derived from the extracted TGT.

Answer

Crack the TGT offline to recover the user's password, then authenticate normally to the file share.

Question 4

You are conducting passive reconnaissance against a target organization and want to identify internet-facing systems and services without sending any packets to the target's own IP space. Which two techniques best satisfy this requirement? (Choose two.)

Accepted Answer

Reviewing historical WHOIS and ASN data to map the organization's owned netblocks. Querying Shodan leverages a third-party scan database that already collected banners and port states, and reviewing WHOIS and ASN registries maps owned netblocks through public records. Neither technique sends packets to the target's IP space, so both remain passive. Together they provide a service inventory and an address inventory, which are the core outputs needed for passive internet-facing reconnaissance.

Answer

Running an Nmap SYN scan with a low timing template against the target's external ranges

Answer

Using a web application scanner to crawl the target's public website for hidden directories

Answer

Performing DNS zone transfer attempts against each authoritative name server

Question 5

You are planning a penetration test for a client that has a hybrid cloud environment. The client's security team wants to ensure that the test does not violate the shared responsibility model of their cloud provider. Which of the following should you do FIRST to align the test with the cloud provider's policies?

Accepted Answer

Review the cloud provider's acceptable use policy and penetration testing guidelines.. The first step is to review the cloud provider's penetration testing policies. These policies define what is allowed, what requires notification, and what is strictly prohibited. Aligning with them ensures the test is both effective and compliant, avoiding disruption to the client's cloud services.

Answer

Deploy a jump box in the cloud to conduct testing from within the provider's network.

Answer

Assume that the client's authorization covers all cloud resources since they pay for the service.

Answer

Obtain written authorization from the client's CEO to test all cloud-hosted assets.

Question 6

You are performing a penetration test against a Windows domain and have obtained domain user credentials. You want to identify which domain controllers are vulnerable to a specific privilege escalation technique. Which TWO tools or techniques are most appropriate for enumerating domain controllers and their potential vulnerabilities? (Choose two.)

Accepted Answer

BloodHound with SharpHound collector. BloodHound with SharpHound and PowerView's Get-NetDomainController are both designed to enumerate Active Directory environments, including domain controllers. BloodHound maps attack paths and can highlight misconfigurations like unconstrained delegation, while PowerView directly queries domain controller information. Other tools like Nmap SMB scripts, Metasploit SMB scanner, and Responder focus on different aspects such as share enumeration, version scanning, or credential capture, and do not provide the specific domain controller vulnerability enumeration required.

Answer

Nmap with the smb-enum-shares script

Answer

Metasploit's auxiliary/scanner/smb/smb_version

Answer

Responder with LLMNR poisoning

Question 7

You are conducting external reconnaissance against a target that uses a split-horizon DNS configuration. From the public internet, you query the organization's authoritative name server for the A record of vpn.contoso.com and receive NXDOMAIN. However, you have obtained a leaked internal zone file that shows the same hostname resolving to 10.10.10.50. Which technique would best allow you to identify additional internal-only hostnames without sending traffic to the target's internal network?

Accepted Answer

Certificate transparency log enumeration for the domain. Certificate transparency logs are a public, append-only record of issued certificates, and they routinely capture subject alternative names for hosts that never appear in public DNS. Because the organization uses split-horizon DNS, public queries return NXDOMAIN for internal names, but the CT logs still disclose them. Querying a CT aggregator for the domain yields those internal hostnames without any traffic to the internal network.

Answer

DNS cache snooping against the recursive resolver used by the organization

Answer

Zone transfer (AXFR) against each authoritative name server for the domain

Answer

Reverse DNS (PTR) lookups against the 10.0.0.0/8 private address space

Question 8

During planning for a penetration test, the client states the goal is to evaluate how well the security operations center detects and responds to attacker activity. Which engagement type best aligns with this objective?

Accepted Answer

A red team engagement that emulates adversary tactics and measures detection and response.. When the goal is evaluating detection and response, the engagement should generate realistic adversary activity that the defensive team can observe and act on. A red team engagement does exactly that, with objectives tied to whether the SOC detects, investigates, and contains the simulated intrusion, producing measurable findings about people and process rather than only technical weaknesses.

Answer

A vulnerability assessment that enumerates and rates missing patches across the environment.

Answer

A wireless survey mapping access point coverage and rogue device presence.

Answer

A compliance audit against a regulatory framework with control-by-control evidence collection.

Question 9

You have a shell as www-data on an Ubuntu 20.04 web server and notice a cron job that runs every minute as root executing a script located in /opt/backup/run.sh. The script is writable by the www-data user. What is the most direct way to escalate privileges in this situation?

Accepted Answer

Append a reverse shell command to run.sh so the next cron execution spawns a root shell back to your listener. When a root-owned cron job executes a script that a lower-privileged user can write to, the attacker effectively controls code that will run as root. Appending a reverse shell to that script is the simplest and most reliable escalation, since it leverages the scheduler's existing root context rather than requiring a separate vulnerability.

Answer

Change the permissions on /bin/bash to SUID root so any user can spawn a privileged shell

Answer

Use the writable script to add www-data to the sudoers file and then run sudo su

Answer

Replace run.sh with a symbolic link to /etc/passwd so cron overwrites the password file with a new root entry

Question 10

You are planning an external penetration test for a financial services firm. The client's legal team wants assurance that the engagement can be defended if law enforcement or regulators inquire about the testing. Which TWO of the following should be included in the Rules of Engagement to provide this assurance? (Choose two.)

Accepted Answer

A list of authorized source IP addresses from which testing will originate.. Authorized source IP addresses and named client signatories are the two elements that most directly support legal defensibility. The source IPs let the client and authorities distinguish sanctioned traffic from real attacks, while the signatories establish a documented chain of authorization. Together they demonstrate that the activity was explicitly approved by authorized parties and originated from known, approved infrastructure.

Answer

The penetration tester's personal home address and after-hours phone number.

Answer

A detailed exploit payload library the testers plan to use against production systems.

Answer

A guarantee that no production system will experience any disruption during testing.

Question 11

During a Linux assessment you find a root-owned binary with the SUID bit set that calls the system() function using a relative path, such as system("cat /etc/hostname"). The binary's directory is not writable, but your current directory is. Which technique is most likely to let you execute arbitrary code as root?

Accepted Answer

Create a malicious executable named cat in your current directory and manipulate PATH so it is found before /bin. A root-owned SUID binary that calls system() with a relative command name inherits the caller's PATH, so a low-privileged user can place a malicious executable earlier in PATH and have it run as root. This PATH hijacking is the intended escalation for the described weakness, and the unwritable binary directory does not prevent it.

Answer

Use LD_PRELOAD to inject a shared library into the SUID process and hook the system() call

Answer

Set the SUID bit on /bin/cat so the command runs as root when invoked

Answer

Overwrite the SUID binary with a copy of /bin/sh to inherit its root ownership

Question 12

A software-as-a-service provider engages your team for a penetration test of its production environment. The client wants testing to occur during business hours so its engineers can observe. Which planning consideration is MOST important to address in the Rules of Engagement before testing begins?

Accepted Answer

Establishing a rollback and emergency stop procedure in case testing causes service degradation for live customers.. When testing a live SaaS production environment during business hours, the greatest risk is unintended customer impact. The Rules of Engagement must define rollback steps, an emergency stop procedure, and clear communication channels so testing can be halted immediately if service degrades. This protects customers and limits the provider's exposure while still allowing the client's engineers to observe the testing.

Answer

Requiring the testers to sign a new non-disclosure agreement specific to this engagement.

Answer

Confirming that the testers will use only open-source tools to avoid licensing disputes.

Answer

Scheduling the test to coincide with a major marketing campaign to maximize visibility of the security investment.

Question 13

A penetration tester is performing an offline attack against a Kerberos TGS-REP hash obtained via Kerberoasting. Which of the following Hashcat modes should be used?

Accepted Answer

13100. Kerberoasting produces a Kerberos 5 TGS-REP hash, typically using RC4 (etype 23). Hashcat mode 13100 is designed for this hash type. Other modes correspond to different Kerberos or NTLM hashes: 19600 for AES TGS-REP, 7500 for AS-REP, and 1000 for NTLM. Using the correct mode is essential for efficient cracking.

Answer

19600

Answer

7500

Answer

1000

Question 14

During a penetration test, a tester obtains a Kerberos TGS ticket for a service account and wants to crack it offline. The ticket is encrypted with RC4-HMAC. Which of the following best describes the primary reason this attack, known as Kerberoasting, is effective?

Accepted Answer

The TGS ticket is encrypted with the service account's NT hash, which can be cracked offline without contacting the domain controller.. Kerberoasting works by requesting a TGS ticket for a service account with a registered SPN. The ticket is encrypted with the service account's NT hash, and because RC4-HMAC uses the NT hash directly as the encryption key, an attacker can extract the ticket and crack it offline. This avoids detection and does not require further domain controller interaction. The other options misidentify the encryption key or the attack's goal, such as forging golden tickets or extracting plaintext passwords, which are not part of Kerberoasting.

Answer

The TGS ticket contains the service account's plaintext password, which can be read directly from the ticket.

Answer

The TGS ticket is encrypted with the KRBTGT account's hash, allowing the attacker to forge golden tickets.

Answer

The TGS ticket is signed with the domain's private key, which can be cracked to reveal the domain administrator's password.

Question 15

During an internal penetration test, a tester gains access to a Windows domain controller and extracts the NTDS.dit file along with the SYSTEM registry hive. The tester wants to extract all domain user password hashes for offline cracking. Which tool, when used with the appropriate arguments, can parse these files to retrieve the hashes?

Accepted Answer

secretsdump.py. secretsdump.py is the correct tool because it can parse an offline NTDS.dit file when paired with the SYSTEM hive to decrypt the encrypted password hashes. It extracts NTLM hashes and other secrets, which can then be cracked offline. Mimikatz is used for live memory extraction, while hashcat and John the Ripper are cracking tools that require pre-extracted hashes. Therefore, secretsdump.py is the only tool that directly accomplishes the extraction from the given files.

Answer

Mimikatz

Answer

John the Ripper

Answer

hashcat

Question 16

During a penetration test, you obtain a password hash from a Linux system's /etc/shadow file. The hash starts with '$6$'. Which Hashcat mode should you use to crack it?

Accepted Answer

Hashcat mode 1800 (sha512crypt). The '$6$' prefix unambiguously identifies a SHA-512 crypt hash. Hashcat mode 1800 is specifically built for this format, ensuring correct salt handling and efficient cracking. Other modes correspond to different hash algorithms and would not successfully crack the hash.

Answer

Hashcat mode 3200 (bcrypt)

Answer

Hashcat mode 500 (md5crypt)

Answer

Hashcat mode 1500 (DEScrypt)

Question 17

During a vulnerability scan of a web application, the scanner reports a critical SQL injection vulnerability on a login form. A manual test using a single quote in the username field returns a generic error page with no database details. The scanner's evidence shows a time-based blind SQL injection payload that caused a five-second delay. Which action should the penetration tester take next to validate the finding?

Accepted Answer

Manually inject a time-based payload that includes a conditional delay, such as '; IF (1=1) WAITFOR DELAY '0:0:5'--, and compare response times with a false condition.. The most reliable way to confirm time-based blind SQL injection is to use a conditional payload that delays only when a true condition is met, and compare that with a false condition. This controls for network and server latency, demonstrating that the delay is caused by the injected SQL logic. Simply re-running the scanner or relying on a single delay is insufficient for validation.

Answer

Immediately report the SQL injection as a confirmed critical finding based on the scanner's time-based evidence.

Answer

Re-run the scanner with the same payload multiple times and compare the response times to confirm the delay is consistent.

Answer

Submit the login form with a benign username and password to check if the application returns a different error, then conclude the vulnerability is a false positive.

Question 18

A penetration tester has obtained the NTLM hash of a domain user and wants to authenticate to a remote server without cracking the password. Which of the following techniques allows the tester to use the hash directly for authentication?

Accepted Answer

Pass-the-Hash (PtH) using Mimikatz sekurlsa::pth. Pass-the-Hash allows an attacker to authenticate using the NTLM hash without cracking it. Tools like Mimikatz can inject the hash into a session, enabling lateral movement or access to resources. Other options involve cracking or forging tickets, which are different attack vectors. The scenario emphasizes using the hash directly, making Pass-the-Hash the correct technique.

Answer

Golden Ticket attack using the KRBTGT hash

Answer

Kerberoasting to request a service ticket

Answer

Rainbow table lookup to recover the plaintext password

Question 19

A penetration tester is reviewing a captured NTLMv2 challenge-response pair and wants to crack it offline using Hashcat. Which Hashcat mode should the tester use to attack this specific hash type?

Accepted Answer

Hashcat mode 5600 (NetNTLMv2). Hashcat mode 5600 is the correct choice because it is tailored for NetNTLMv2 challenge-response pairs, which are commonly captured during penetration tests. This mode understands the structure of the NTLMv2 response, including the server challenge and the HMAC-MD5 computation. Other modes target different hash types, such as raw NT hashes or Kerberos tickets, and would not correctly parse or crack the captured NTLMv2 data. Using the right mode ensures efficient and successful cracking.

Answer

Hashcat mode 0 (MD5)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 1000 (NTLM)

Question 20

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a workstation. You attempt to crack it offline using Hashcat, but after several hours with a large wordlist and rules, the hash remains uncracked. Which factor most directly determines the feasibility of cracking this hash?

Accepted Answer

The length and complexity of the user's password. The feasibility of cracking a NetNTLMv2 hash offline is fundamentally governed by the password's entropy. NetNTLMv2 uses HMAC-MD5 with the user's NT hash and a server challenge, making it resistant to precomputation and requiring brute-force or dictionary attacks. If the password is long and complex, the search space becomes too large for practical cracking, regardless of hardware or network factors.

Answer

The version of the SMB protocol used during authentication

Answer

The network speed between the attacker and the victim

Answer

The amount of RAM available on the cracking machine