GPEN Practice Test 4 — 10 Questions

Question 1

What is the primary security advantage of utilizing salts in password hashing?

Accepted Answer

It prevents the use of precomputed rainbow tables.. Salts are random strings added to passwords before they are hashed. This ensures that even if two users have the same password, their resulting hashes will be different. This prevents the use of precomputed lookup tables (rainbow tables) from successfully identifying passwords. Protecting against rainbow tables is a fundamental security practice that forces attackers to crack each hash individually, significantly increasing the time and computational resources required for a successful breach.

Answer

It increases the length of the password, making it harder to guess.

Answer

It forces the hashing algorithm to use more CPU cycles.

Answer

It encrypts the password instead of hashing it.

Question 2

A penetration tester has captured a set of NTLMv2 challenge-response pairs from a network segment. The tester wants to crack these hashes offline using Hashcat. Which TWO of the following statements are true regarding the cracking of NTLMv2 hashes with Hashcat? (Choose two.)

Accepted Answer

Hashcat mode 5600 is used for NTLMv2 hashes.. NTLMv2 challenge-response pairs are cracked using Hashcat mode 5600, and the captured hash must include the server challenge for the computation to be possible. The challenge is unique per authentication, so precomputed tables are useless. The username is part of the hash but does not act as a salt. An attack mode must always be specified.

Answer

NTLMv2 hashes can be cracked using precomputed rainbow tables.

Answer

Hashcat can crack NTLMv2 hashes without specifying a wordlist or mask.

Answer

NTLMv2 hashes are salted with the username, making them more resistant to cracking.

Question 3

A penetration tester is reviewing Kerberos traffic and notices that a user account has the DONT_REQ_PREAUTH flag set in its userAccountControl attribute. The tester wants to obtain crackable material for this account without any domain credentials. Which technique should the tester use?

Accepted Answer

AS-REP Roasting by sending an AS-REQ without pre-authentication and capturing the encrypted AS-REP.. The DONT_REQ_PREAUTH flag allows an unauthenticated attacker to request an AS-REP for the account and receive data encrypted with the user's key. Capturing that response enables offline password cracking without any domain credentials, directly exploiting the disabled pre-authentication setting.

Answer

Golden ticket creation by forging a TGT using the krbtgt hash obtained from the domain controller.

Answer

Kerberoasting by requesting a TGS for an SPN associated with the account and cracking the service ticket.

Answer

Silver ticket creation by forging a service ticket using the target account's NTLM hash.

Question 4

During a penetration test, a tester extracts the SAM database from a Windows system. Which of the following tools is specifically designed to extract password hashes from the SAM file?

Accepted Answer

secretsdump.py. secretsdump.py is specifically designed to extract password hashes from Windows registry hives, including SAM, SYSTEM, and SECURITY. It can operate offline on extracted files, making it ideal for this scenario. Mimikatz is more for live memory extraction, while Hashcat and John the Ripper are cracking tools. Thus, secretsdump.py is the correct choice for extracting hashes from a SAM file.

Answer

John the Ripper

Answer

Mimikatz

Answer

Hashcat

Question 5

An enterprise client insists on a blind 'black-box' penetration test where the testing team receives zero prior knowledge regarding network architecture, IP ranges, or applications. However, the client's primary objective is to thoroughly test deep-seated business logic vulnerabilities within a critical custom web application. Why is this planning approach fundamentally misaligned with the client's stated objective?

Accepted Answer

Discovery phases consume disproportionate time, leaving insufficient hours for the deep manual analysis required to uncover logic flaws.. Black-box testing forces testers to spend the majority of the engagement on reconnaissance and basic discovery rather than deep vulnerability analysis. To effectively evaluate complex business logic flaws, testers require white-box or gray-box scoping with documentation and credentials to achieve adequate depth within standard assessment timeframes.

Answer

Black-box testing is legally prohibited under international cybersecurity standards for any application handling financial data.

Answer

Zero-knowledge assessments automatically violate standard industry rules of engagement by preventing the execution of automated scanners.

Answer

Client stakeholders cannot legally authorize a penetration test without providing a complete network diagram and asset inventory.

Question 6

An attacker has compromised an Azure App Service and obtained the application's managed identity token. They want to use it to access an Azure SQL Database. The managed identity has been granted access to the SQL server. Which of the following is the correct way to authenticate to the SQL Database using the managed identity token?

Accepted Answer

Use the token in the 'Access Token' property of a SqlConnection object with 'Authentication=Active Directory Access Token'.. The correct method is to use the managed identity's access token directly in the SqlConnection object with 'Authentication=Active Directory Access Token'. The token must be scoped to https://database.windows.net/. This allows the application to authenticate to Azure SQL using the managed identity, leveraging its assigned permissions.

Answer

Use the token to call the Azure SQL REST API to execute queries.

Answer

Use the token as the password in a SQL connection string with 'Authentication=Active Directory Password'.

Answer

Use the token to authenticate to the Azure SQL server's master database and then impersonate a user.

Question 7

You are performing a penetration test on a Microsoft Entra ID tenant that uses federated authentication with Active Directory Federation Services (AD FS). You have obtained a user's credentials and want to maintain persistent access even if the user's password is changed. Which of the following methods would best achieve this?

Accepted Answer

Forge a SAML token using the AD FS token-signing certificate.. In AD FS federated environments, the token-signing certificate is the root of trust. If an attacker compromises the AD FS server and exports the token-signing certificate's private key, they can forge SAML tokens for any user. These tokens are accepted by Entra ID, providing persistent access even after password changes. This is a critical persistence technique in federated identity setups.

Answer

Configure an Azure AD application with a client secret and assign it the 'Directory.Read.All' permission.

Answer

Create a new user account in Entra ID with Global Administrator privileges.

Answer

Register a new device in Entra ID and use it to obtain a Primary Refresh Token (PRT).

Question 8

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.

Question 9

What is the primary purpose of the 'Scope' section in the Rules of Engagement?

Accepted Answer

To define the specific boundaries of the assessment.. The scope section is essential to clearly define the boundaries of the test. It explicitly identifies which systems, applications, and networks are authorized for testing, protecting both the client and the tester from potential legal issues. By delineating these boundaries, it prevents 'scope creep' and ensures that the testing effort is focused on the intended targets, maximizing the impact of the assessment while minimizing risk.

Answer

To outline the payment terms for the penetration test.

Answer

To detail the specific tools to be used by the tester.

Answer

To list the names of all employees who will be interviewed.

Question 10

A penetration tester is analyzing a password hash captured from a web application's database. The hash is `5f4dcc3b5aa765d61d8327deb882cf99` and is 32 characters long. Which type of hash is this, and what is a common tool to crack it?

Accepted Answer

MD5, and Hashcat can be used with mode 0.. The hash is 32 characters long, which is the length of an MD5 hash. Hashcat mode 0 is used for raw MD5 hashes. This is a straightforward identification task. The hash `5f4dcc3b5aa765d61d8327deb882cf99` is a common example (MD5 of 'password'), but the key is recognizing the format. A penetration tester should use this knowledge to select the correct cracking mode and proceed with offline cracking.

Answer

SHA-256, and Hashcat can be used with mode 1400.

Answer

SHA-1, and Hashcat can be used with mode 100.

Answer

NTLM, and Hashcat can be used with mode 1000.