GPEN Practice Test 5 — 10 Questions

Question 1

When selecting an exploit for a target system, which TWO factors are most critical to ensure the exploit succeeds without crashing the target service?

Accepted Answer

The exact version of the application or OS service.. Successful exploitation requires precise alignment between the exploit's memory address assumptions and the target's environment. Crashes typically occur when the exploit targets an incorrect memory offset or assumes a different architecture than the one present. By verifying target versioning and architectural requirements, a tester minimizes the risk of service instability, ensuring that the exploit fulfills its objective while maintaining the operational integrity of the production environment.

Answer

The color scheme of the target's command shell.

Answer

The network bandwidth available to the target.

Answer

The number of users currently logged in.

Question 2

During an internal penetration test, you capture NTLMv2 hashes from a network segment. You want to crack these hashes using Hashcat on a dedicated GPU rig. Which Hashcat mode number corresponds directly to the NTLMv2 hash format commonly captured via LLMNR/NBT-NS poisoning?

Accepted Answer

Hashcat mode 5600 targets NetNTLMv2 hashes captured during network authentication processes like SMB or HTTP challenges.. Hashcat mode 5600 is specifically designed for NetNTLMv2 hashes, which are generated during SMB authentication challenges captured through poisoning tools like Responder. Understanding these specific hash modes is critical for pentesters to quickly transition from passive or active credential capture to offline brute-forcing and dictionary attacks against Windows domain environments.

Answer

Hashcat mode 1000 represents standard NTLM password hashes extracted from the Windows SAM database or NTDS.dit.

Answer

Hashcat mode 3000 handles LANMAN hashes, which are legacy Windows password hashes stored for backwards compatibility on older systems.

Answer

Hashcat mode 13100 is utilized for Kerberos 5 TGS-REP etype 23 hashes gathered through service ticket requests.

Question 3

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 4

During a penetration test, you successfully obtain an encrypted NTLM hash but are unable to crack it. What is the most effective alternative strategy to gain access to the system?

Accepted Answer

Perform a Pass-the-Hash attack using the captured hash.. When an NTLM hash cannot be cracked, the most effective alternative is a Pass-the-Hash (PtH) attack. Because NTLM authentication verifies the user based on the knowledge of the hash rather than the plaintext password, an attacker can use the captured hash to authenticate to various network services directly. This approach is highly effective for lateral movement, bypassing the need for plaintext recovery while maintaining the ability to compromise the target system.

Answer

Attempt a brute-force attack on the Kerberos TGT.

Answer

Use a social engineering attack to reset the password.

Answer

Re-run the cracking attack with a longer wordlist.

Question 5

You are conducting an internal penetration test and have obtained a set of NTLM hashes from a compromised server. You want to crack them using Hashcat on a dedicated GPU rig. Which hash mode should you use?

Accepted Answer

Hashcat mode 1000 (NTLM). NTLM hashes are stored in Windows systems and are commonly extracted during penetration tests. Hashcat mode 1000 is designed to crack these hashes efficiently. Other modes correspond to different hash types, such as NetNTLMv2, Kerberos, or Linux crypt formats, and would not correctly process NTLM hashes.

Answer

Hashcat mode 1800 (sha512crypt)

Answer

Hashcat mode 13100 (Kerberos 5 TGS-REP)

Answer

Hashcat mode 5500 (NetNTLMv2)

Question 6

You have compromised a workstation and extracted the NTLM hash of a service account that is configured for unconstrained delegation. You want to craft a Silver Ticket to impersonate a domain administrator when accessing a specific file server. Which piece of information is absolutely required to forge this ticket?

Accepted Answer

The service account's NTLM hash or Kerberos key. To forge a Silver Ticket, the attacker must have the target service account's NTLM hash or Kerberos key to encrypt the service ticket. The domain SID and user RID are needed for the PAC but are not the encryption key. A TGT is not required because the ticket is presented directly to the service. The krbtgt hash is for Golden Tickets.

Answer

The domain SID and the target user's RID

Answer

A valid TGT for the service account

Answer

The krbtgt account's NTLM hash

Question 7

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Accepted Answer

Implementing Domain Generation Algorithms (DGA).. Resilient C2 infrastructure often relies on decentralized or dynamic components to ensure that the connection remains viable even if individual nodes are identified and blocked. By utilizing domain generation algorithms and cloud-based relay services, attackers create a moving target that is difficult for incident responders to fully dismantle in a timely manner. Mastery of these techniques is essential for assessing the robust nature of an organization's defense-in-depth posture.

Answer

Hardcoding the IP address of the C2 server.

Answer

Using unencrypted HTTP for all C2 traffic.

Answer

Requiring manual operator interaction for beaconing.

Question 8

You are finalizing the Rules of Engagement (RoE) for a penetration test of a regional hospital network. The client's legal counsel requires that any testing activity be immediately suspended if a life-safety system is affected. Which element should you add to the RoE to satisfy this requirement?

Accepted Answer

A documented emergency stop procedure with named client contacts and a defined notification method.. An emergency stop procedure is the operational control that lets the hospital halt testing instantly when a life-safety system is at risk. It specifies authorized personnel, the notification channel, and the required acknowledgment, making the requirement enforceable and auditable. Scheduling limits, waivers, and reporting timelines all operate after or around the event rather than stopping it in real time.

Answer

A liability waiver transferring all damages from the testing firm to the hospital.

Answer

A requirement that all findings be delivered in a written report within thirty days of testing.

Answer

An expanded scan window that limits intrusive testing to overnight hours only.

Question 9

A penetration tester has gained a foothold on a Windows host and wants to escalate privileges. They discover that the host has an unquoted service path vulnerability. Which command should they use to identify services with unquoted paths that contain spaces?

Accepted Answer

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\". Unquoted service paths with spaces allow a tester to place a malicious executable in a directory that Windows will search before the intended binary. The wmic command with the specified filters lists auto-start services and their paths, excluding Windows directory services, making it efficient for spotting vulnerable services.

Answer

tasklist /svc | findstr /i "svchost"

Answer

sc query type= service state= all | findstr /i "SERVICE_NAME"

Answer

net start | findstr /i "service"

Question 10

Which of the following actions is the best way to detect an attacker performing an offline hash-cracking operation within a corporate network?

Accepted Answer

Logging access to the LSASS process and SAM hives.. Detecting an offline attack is challenging because the actual computation happens on the attacker's hardware. However, the initial phase—dumping the hashes from memory or the SAM file—requires access to sensitive system files or processes. By monitoring for access to the LSASS process or reading the SAM/SYSTEM registry hives, security teams can identify the signature of a credential dumping attempt, which is the necessary precursor to any offline attack.

Answer

Monitoring for high CPU usage on all workstations.

Answer

Scanning for the use of the Hashcat tool on the network.

Answer

Monitoring for network traffic to known cracking websites.