GPEN Practice Test 8 — 10 Questions

Question 1

What is the primary danger of using a 'bind shell' payload in a penetration test?

Accepted Answer

It opens a listening port that is easily discovered.. A bind shell opens a listening port on the target machine, which is highly visible to firewalls and network monitoring. This makes it an insecure choice, as it allows anyone else on the network to potentially connect to the listener. In a professional engagement, using a reverse shell is preferred, as it initiates the connection from the target back to the tester, which is far more likely to bypass perimeter firewalls.

Answer

It is always detected by local antivirus.

Answer

It requires the target to have an internet connection.

Answer

It automatically crashes the target's kernel.

Question 2

Which technique is most effective for exploiting a heap-based buffer overflow compared to a stack-based overflow?

Accepted Answer

Manipulating heap metadata to achieve write-what-where.. Heap overflows are significantly more complex because they involve manipulating heap management metadata (like chunk headers) rather than simply overwriting a return address on the stack. Techniques like 'unlink' or 'house of force' are used to corrupt the heap structures to gain arbitrary write-what-where primitives. Understanding this distinction is vital, as stack-based knowledge does not directly transfer to the more intricate heap exploitation landscape required for modern applications.

Answer

Overwriting the return address on the stack.

Answer

Using a simple NOP sled to reach the shellcode.

Answer

Increasing the size of the input string.

Question 3

Refer to the exhibit. Which step should a tester prioritize next based on the server header information?

Accepted Answer

Search for known vulnerabilities for Apache 2.4.41.. The server header indicates a specific version of Apache running on Ubuntu. A tester should cross-reference this version with known vulnerabilities, such as CVEs in the Apache HTTP Server. This is a foundational step in identifying applicable exploits. Knowing the specific version allows for targeted research into public or private exploit modules, increasing the probability of a successful engagement by focusing on documented, verifiable weaknesses within that specific software build.

Answer

Run a brute-force password attack against the server.

Answer

Immediately deploy a rootkit on the server.

Answer

Close the connection and report the server as secure.

Question 4

An attacker has obtained the NTLM hash of a service account. They want to perform a Kerberoasting attack to escalate privileges. Why is this specific hash insufficient for standard Kerberoasting?

Accepted Answer

Kerberoasting targets the service account's password hash by requesting a TGS, not by leveraging existing NTLM hashes.. Kerberoasting requires requesting a Service Ticket (TGS) from the Key Distribution Center (KDC) for a specific Service Principal Name (SPN). The attacker then extracts the encrypted TGS blob from memory or network traffic to crack the service account's password offline. The NTLM hash is a separate credential format; having it allows for Pass-the-Hash or silver ticket creation, but does not involve the KDC-based SPN request process required for Kerberoasting.

Answer

The NTLM hash is insufficient because it cannot be used to request a Ticket Granting Ticket (TGT).

Answer

The NTLM hash is only useful for Pass-the-Hash attacks and cannot facilitate any Kerberos interactions.

Answer

The NTLM hash must first be converted to a Kerberos AES-256 key before a TGS request can be initiated.

Question 5

Refer to the exhibit. What does this output indicate regarding the current exploitation attempt?

Accepted Answer

The tester has successfully redirected execution flow.. The Instruction Pointer (EIP/RIP) being set to 0x41414141 (the hex representation of 'AAAA') proves that the tester has successfully overwritten the return address on the stack. This confirms the vulnerability is exploitable because the tester now has control over the execution flow. The next logical step is to replace the padding ('AAAA') with a valid memory address that points to the desired malicious shellcode.

Answer

The application is secure from buffer overflow attacks.

Answer

The system is protected by DEP/NX.

Answer

The payload is too large for the allocated buffer.

Question 6

Which of the following describes the 'AS-REP Roasting' attack?

Accepted Answer

It allows an attacker to crack user account passwords for accounts without pre-authentication.. AS-REP Roasting targets user accounts that have 'Do not require Kerberos preauthentication' enabled. An attacker can request a TGT for such an account without providing a password. The KDC responds with an encrypted ticket (the AS-REP) that the attacker can then extract and crack offline, similar to how Kerberoasting works, to obtain the user's plaintext password.

Answer

It targets service accounts that are configured with SPNs.

Answer

It relies on the interception of a TGS request to obtain encrypted credentials.

Answer

It is a technique for escalating privileges using the KRBTGT account.

Question 7

During planning, a client requests that you use a specific automated scanner that is known to produce false positives and potential system instability. What is the most professional way to handle this request?

Accepted Answer

Document the risks, communicate them to the client, and propose a validated alternative.. Professional pentesting requires the expert to validate the tools used against the client's operational constraints. Accepting a tool that causes instability ignores the core principle of 'do no harm'. By explaining the technical risks and proposing a safer, more reliable methodology, the tester acts as a trusted advisor, ensuring the client receives accurate, actionable intelligence without risking their production environment's stability during the process.

Answer

Agree to use the tool but run it only during off-peak hours.

Answer

Refuse the request and insist on using your own proprietary toolset.

Answer

Use the requested tool but ignore the potential instability issues.

Question 8

When performing a penetration test, why is it safer to crack hashes offline rather than online?

Accepted Answer

Offline cracking prevents account lockouts.. Offline cracking is performed on the tester's own hardware, which means there is no network traffic generated towards the target system. This prevents the triggering of intrusion detection systems (IDS), account lockout policies, or audit logs that monitor failed authentication attempts. It provides a stealthy way to test password strength without risking operational disruption or alerting the client's defensive security team, which is the primary concern during a professional assessment.

Answer

Offline cracking is always faster than online methods.

Answer

Offline cracking allows for the use of more complex passwords.

Answer

Offline cracking is required to obtain the hash from memory.

Question 9

A client asks for an 'unannounced' penetration test to test their incident response team. What is the most important preparatory step before commencing this exercise?

Accepted Answer

Obtain written authorization from a senior executive who can stop the test.. An unannounced test simulates a real-world breach, but it carries significant risk to business operations if the responders block legitimate internal traffic or if the testers are arrested by physical security. Ensuring that at least one senior decision-maker, such as the CISO, is aware of the test is vital. This provides a 'safe harbor' and a mechanism to immediately stop the test if it causes unintended consequences.

Answer

Ensure that the entire IT staff is informed of the test dates.

Answer

Launch the test during a holiday weekend to minimize user disruption.

Answer

Use only low-impact passive scanning to avoid triggering alarms.

Question 10

You are drafting the Rules of Engagement for an internal penetration test. Which TWO of the following items are considered mandatory for the 'Communication Plan' section?

Accepted Answer

The names and 24/7 contact information for designated incident response leads.. A robust communication plan is essential for maintaining control during an engagement. By defining specific emergency protocols and status reporting cadences, both the testing team and the client minimize the risk of operational downtime. These elements ensure that technical findings are communicated effectively while providing a clear escalation path if an unexpected system failure occurs, maintaining professional accountability throughout the duration of the testing period.

Answer

A list of all vulnerabilities found during the previous year's audit.

Answer

The specific exploit payloads that will be used during the test.

Answer

The estimated total cost of the project and payment schedule.