GPEN Practice Test 3 — 30 Questions

Question 1

An attacker is performing reconnaissance on an Azure AD tenant and notices that 'Guest' users can enumerate the directory. Which specific setting should be checked to remediate this?

Accepted Answer

External collaboration settings for Guest user access restrictions.. By default, Microsoft Entra ID allows guest users to see other users and groups in the directory. This is a common reconnaissance vector for attackers to map the organization's structure. Restricting this access is a critical step in hardening the tenant, ensuring that guest identities have limited visibility into the internal organizational structure during an initial compromise.

Answer

Conditional Access policy for guest users.

Answer

The 'Enable Global Reader' role for guests.

Answer

The 'AppRoleAssignmentRequired' property of the tenant.

Question 2

A penetration tester has obtained a hash from a Linux system: `$1$salt$hash`. The tester wants to crack it using John the Ripper. Which format should be specified, and what is the main weakness of this hash type?

Accepted Answer

md5crypt, and the main weakness is that it is fast to compute, making brute-force attacks easier.. The `$1$` prefix is the identifier for md5crypt. John the Ripper supports this format with the 'md5crypt' option. The primary weakness is that MD5 is a fast hash function, so despite salting and a fixed number of iterations, it can be cracked quickly using modern hardware. This makes it less secure than slower algorithms like bcrypt or SHA-512 crypt with high iteration counts.

Answer

sha512crypt, and the main weakness is that the iteration count is too low by default.

Answer

descrypt, and the main weakness is that it only uses the first 8 characters of the password.

Answer

bcrypt, and the main weakness is that the salt is too short, allowing rainbow table attacks.

Question 3

You are conducting passive reconnaissance against a target that uses a Web Application Firewall (WAF) and a Content Delivery Network (CDN). You want to discover the origin IP address of the web server to bypass the CDN during later testing. Which technique is most likely to reveal the origin IP without sending any traffic to the target's domain?

Accepted Answer

Use a third-party service like SecurityTrails to view historical DNS records.. Historical DNS records from services like SecurityTrails are a passive way to discover an origin IP that was used before the CDN was implemented. Because the data is stored by a third party, querying it does not touch the target's CDN or origin. This makes it a safe and effective method for bypassing CDN obfuscation during reconnaissance.

Answer

Send HTTP requests with a spoofed Host header to the CDN edge servers.

Answer

Query the target's SPF record to find the origin IP.

Answer

Perform a DNS zone transfer against the target's authoritative nameserver.

Question 4

Which of the following describes the risk associated with cached credentials in the Windows operating system during a penetration test?

Accepted Answer

They provide a target for offline cracking to recover domain passwords.. Windows caches credentials for domain accounts that have previously logged into a machine to allow users to sign in when the domain controller is unavailable. These cached entries, often stored in the registry, can be extracted by an attacker with administrative privileges. This provides a persistent source of credentials that, if cracked, could grant an attacker access to the domain even when the targeted user is not currently logged on.

Answer

Cached credentials only store the user's username.

Answer

They allow offline authentication, but are stored in plain text.

Answer

They are automatically wiped upon every system reboot.

Question 5

During a red team engagement, an operator successfully dumps the LSA secrets and NTDS.dit database from a Windows domain controller. Which TWO advanced password extraction and analysis techniques should the operator prioritize to uncover administrative access vectors? (Choose two)

Accepted Answer

Performing offline dictionary and rule-based cracking against extracted NTLM hashes using high-performance GPU clusters.. Extracting credentials from NTDS.dit allows the recovery of NTLM hashes and potentially cleartext passwords stored via reversible encryption. Pass-the-hash utilizes captured NTLM hashes for lateral movement without cracking, while offline dictionary cracking recovers original plaintext passwords for reuse against external portals or multi-factor authentication boundaries where hash reuse fails.

Answer

Injecting malicious DLL payloads into the Local Security Authority Subsystem Service to capture plaintext credentials in real-time.

Answer

Executing Kerberoasting against all user accounts to extract service tickets encrypted with legacy RC4 encryption keys.

Answer

Running a responder-based LLMNR/NBT-NS poisoning campaign to capture incoming network authentication challenge-response pairs.

Question 6

Refer to the exhibit. What is the primary purpose of the 'jitter' parameter in this C2 configuration?

Accepted Answer

To prevent detection via traffic pattern analysis.. The jitter parameter introduces a random percentage of variation into the beacon interval, preventing the C2 traffic from appearing as a perfectly rhythmic heartbeat. Static intervals are highly detectable through statistical analysis, as they create distinct patterns in network traffic logs. Introducing jitter makes the C2 communication appear more organic and unpredictable, complicating efforts by defenders to identify the malicious connection using simple frequency-based anomaly detection algorithms.

Answer

To reduce the CPU overhead on the infected host.

Answer

To synchronize beaconing across multiple infected hosts.

Answer

To increase the throughput of the C2 channel.

Question 7

When evaluating the security of an organization's C2 detection capabilities, which log source is the most valuable for detecting DNS-based C2?

Accepted Answer

Centralized DNS query logs.. DNS query logs are the primary data source for identifying DNS-based C2. By analyzing these logs, security teams can identify anomalies such as high volumes of queries to a specific domain, unusual record types like TXT or NULL records, or domains with extremely high entropy. Without centralized DNS logging, detecting this specific type of C2 becomes nearly impossible, as the traffic occurs at the infrastructure level rather than the end-host level.

Answer

Endpoint system event logs.

Answer

Firewall traffic logs (Layer 4).

Answer

Antivirus detection logs.

Question 8

What is the primary danger of leaving a 'backdoor' account on a compromised system after a penetration test?

Accepted Answer

The account acts as a persistent entry point for unauthorized parties.. Leaving a backdoor account creates an unauthorized access path that persists after the engagement ends. This violates the principle of 'cleanup' and can lead to security breaches by third parties who discover the account. It represents a significant liability and risk for the client, as an unsecured backdoor account is a prime target for malicious actors looking to exploit the environment without further effort.

Answer

The account may trigger an automated system update.

Answer

The system performance will degrade due to the account.

Answer

The account automatically encrypts data in the directory.

Question 9

Which of the following describes the 'Persistence' phase in the context of the cyber kill chain?

Accepted Answer

Maintaining a presence on the system through system restarts.. Persistence ensures that an attacker maintains access to a system even after reboots, credential changes, or other disruptions. This is achieved through various techniques like scheduled tasks, registry modifications, or backdoored services. Persistence is vital for long-term intelligence gathering and ensures that the attacker remains within the environment to pursue their objectives despite potential detection or system maintenance activities performed by legitimate users.

Answer

Gaining initial access to a target network via phishing.

Answer

Exfiltrating sensitive data to an external server.

Answer

Encrypting the system for ransomware purposes.

Question 10

In Metasploit, what is the significance of the 'LHOST' parameter when setting up a reverse shell?

Accepted Answer

It identifies the attacker's IP address for the callback. The LHOST parameter is the IP address of the attacker's machine. It tells the target machine where to send its callback once the payload is executed. Misconfiguring this is a common point of failure for beginners. Ensuring the correct LHOST is set is critical for establishing a stable connection between the target and the penetration tester's workstation during the exploitation phase of the engagement.

Answer

It defines the target's listening port

Answer

It is used to scan the local network

Answer

It defines the exploit's remote host target

Question 11

What is the primary danger of using a 'bind shell' payload in a penetration test?

Accepted Answer

It opens a listening port that is easily discovered.. A bind shell opens a listening port on the target machine, which is highly visible to firewalls and network monitoring. This makes it an insecure choice, as it allows anyone else on the network to potentially connect to the listener. In a professional engagement, using a reverse shell is preferred, as it initiates the connection from the target back to the tester, which is far more likely to bypass perimeter firewalls.

Answer

It is always detected by local antivirus.

Answer

It requires the target to have an internet connection.

Answer

It automatically crashes the target's kernel.

Question 12

Which technique is most effective for exploiting a heap-based buffer overflow compared to a stack-based overflow?

Accepted Answer

Manipulating heap metadata to achieve write-what-where.. Heap overflows are significantly more complex because they involve manipulating heap management metadata (like chunk headers) rather than simply overwriting a return address on the stack. Techniques like 'unlink' or 'house of force' are used to corrupt the heap structures to gain arbitrary write-what-where primitives. Understanding this distinction is vital, as stack-based knowledge does not directly transfer to the more intricate heap exploitation landscape required for modern applications.

Answer

Overwriting the return address on the stack.

Answer

Using a simple NOP sled to reach the shellcode.

Answer

Increasing the size of the input string.

Question 13

Refer to the exhibit. Which step should a tester prioritize next based on the server header information?

Accepted Answer

Search for known vulnerabilities for Apache 2.4.41.. The server header indicates a specific version of Apache running on Ubuntu. A tester should cross-reference this version with known vulnerabilities, such as CVEs in the Apache HTTP Server. This is a foundational step in identifying applicable exploits. Knowing the specific version allows for targeted research into public or private exploit modules, increasing the probability of a successful engagement by focusing on documented, verifiable weaknesses within that specific software build.

Answer

Run a brute-force password attack against the server.

Answer

Immediately deploy a rootkit on the server.

Answer

Close the connection and report the server as secure.

Question 14

An attacker has obtained the NTLM hash of a service account. They want to perform a Kerberoasting attack to escalate privileges. Why is this specific hash insufficient for standard Kerberoasting?

Accepted Answer

Kerberoasting targets the service account's password hash by requesting a TGS, not by leveraging existing NTLM hashes.. Kerberoasting requires requesting a Service Ticket (TGS) from the Key Distribution Center (KDC) for a specific Service Principal Name (SPN). The attacker then extracts the encrypted TGS blob from memory or network traffic to crack the service account's password offline. The NTLM hash is a separate credential format; having it allows for Pass-the-Hash or silver ticket creation, but does not involve the KDC-based SPN request process required for Kerberoasting.

Answer

The NTLM hash is insufficient because it cannot be used to request a Ticket Granting Ticket (TGT).

Answer

The NTLM hash is only useful for Pass-the-Hash attacks and cannot facilitate any Kerberos interactions.

Answer

The NTLM hash must first be converted to a Kerberos AES-256 key before a TGS request can be initiated.

Question 15

Refer to the exhibit. What does this output indicate regarding the current exploitation attempt?

Accepted Answer

The tester has successfully redirected execution flow.. The Instruction Pointer (EIP/RIP) being set to 0x41414141 (the hex representation of 'AAAA') proves that the tester has successfully overwritten the return address on the stack. This confirms the vulnerability is exploitable because the tester now has control over the execution flow. The next logical step is to replace the padding ('AAAA') with a valid memory address that points to the desired malicious shellcode.

Answer

The application is secure from buffer overflow attacks.

Answer

The system is protected by DEP/NX.

Answer

The payload is too large for the allocated buffer.

Question 16

Which of the following describes the 'AS-REP Roasting' attack?

Accepted Answer

It allows an attacker to crack user account passwords for accounts without pre-authentication.. AS-REP Roasting targets user accounts that have 'Do not require Kerberos preauthentication' enabled. An attacker can request a TGT for such an account without providing a password. The KDC responds with an encrypted ticket (the AS-REP) that the attacker can then extract and crack offline, similar to how Kerberoasting works, to obtain the user's plaintext password.

Answer

It targets service accounts that are configured with SPNs.

Answer

It relies on the interception of a TGS request to obtain encrypted credentials.

Answer

It is a technique for escalating privileges using the KRBTGT account.

Question 17

During planning, a client requests that you use a specific automated scanner that is known to produce false positives and potential system instability. What is the most professional way to handle this request?

Accepted Answer

Document the risks, communicate them to the client, and propose a validated alternative.. Professional pentesting requires the expert to validate the tools used against the client's operational constraints. Accepting a tool that causes instability ignores the core principle of 'do no harm'. By explaining the technical risks and proposing a safer, more reliable methodology, the tester acts as a trusted advisor, ensuring the client receives accurate, actionable intelligence without risking their production environment's stability during the process.

Answer

Agree to use the tool but run it only during off-peak hours.

Answer

Refuse the request and insist on using your own proprietary toolset.

Answer

Use the requested tool but ignore the potential instability issues.

Question 18

When performing a penetration test, why is it safer to crack hashes offline rather than online?

Accepted Answer

Offline cracking prevents account lockouts.. Offline cracking is performed on the tester's own hardware, which means there is no network traffic generated towards the target system. This prevents the triggering of intrusion detection systems (IDS), account lockout policies, or audit logs that monitor failed authentication attempts. It provides a stealthy way to test password strength without risking operational disruption or alerting the client's defensive security team, which is the primary concern during a professional assessment.

Answer

Offline cracking is always faster than online methods.

Answer

Offline cracking allows for the use of more complex passwords.

Answer

Offline cracking is required to obtain the hash from memory.

Question 19

A client asks for an 'unannounced' penetration test to test their incident response team. What is the most important preparatory step before commencing this exercise?

Accepted Answer

Obtain written authorization from a senior executive who can stop the test.. An unannounced test simulates a real-world breach, but it carries significant risk to business operations if the responders block legitimate internal traffic or if the testers are arrested by physical security. Ensuring that at least one senior decision-maker, such as the CISO, is aware of the test is vital. This provides a 'safe harbor' and a mechanism to immediately stop the test if it causes unintended consequences.

Answer

Ensure that the entire IT staff is informed of the test dates.

Answer

Launch the test during a holiday weekend to minimize user disruption.

Answer

Use only low-impact passive scanning to avoid triggering alarms.

Question 20

You are drafting the Rules of Engagement for an internal penetration test. Which TWO of the following items are considered mandatory for the 'Communication Plan' section?

Accepted Answer

The names and 24/7 contact information for designated incident response leads.. A robust communication plan is essential for maintaining control during an engagement. By defining specific emergency protocols and status reporting cadences, both the testing team and the client minimize the risk of operational downtime. These elements ensure that technical findings are communicated effectively while providing a clear escalation path if an unexpected system failure occurs, maintaining professional accountability throughout the duration of the testing period.

Answer

A list of all vulnerabilities found during the previous year's audit.

Answer

The specific exploit payloads that will be used during the test.

Answer

The estimated total cost of the project and payment schedule.