GPEN Practice Test 9 — 10 Questions

Question 1

A client asks you to perform a penetration test on their internal network. During the planning phase, they provide you with a list of IP addresses and ask you to sign a document that limits your testing to those addresses. Which of the following best describes the purpose of this document?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It defines the scope of the engagement and legally authorizes testing only on the specified targets.. The document is a scope and authorization agreement. It legally permits testing only on specified IP addresses and protects both parties by clearly defining what is allowed. Without it, testing could be deemed unauthorized, leading to legal consequences.

Answer

It is a liability waiver that absolves the tester of any responsibility for system damage.

Answer

It is a service level agreement outlining the expected uptime of the target systems during testing.

Answer

It serves as a non-disclosure agreement to protect the client's confidential information.

Question 2

A penetration tester is performing an offline attack against a Windows domain. They have obtained the NTDS.dit file and the SYSTEM hive. Which tool is most effective for extracting the NTLM hashes for offline cracking?

Accepted Answer

secretsdump.py. Impacket's secretsdump.py is the industry standard for parsing NTDS.dit files and SYSTEM hives to extract domain credentials. It leverages the boot key stored in the SYSTEM hive to decrypt the encrypted hashes within the NTDS.dit database. Understanding this process is critical for penetration testers because it represents the most common method of achieving domain-wide compromise after gaining the necessary domain controller files.

Answer

Hashcat

Answer

Mimikatz

Answer

John the Ripper

Question 3

During an assessment, you find that 'Device Writeback' is enabled. What is the security concern regarding the registration of these devices in Azure AD?

Accepted Answer

It allows untrusted devices to satisfy Conditional Access requirements.. Device Writeback registers on-premises devices in Microsoft Entra ID. If an attacker manages to join an unauthorized device to the domain, it is automatically synchronized to the cloud. Once in the cloud, this device might satisfy Conditional Access requirements, allowing an attacker to bypass device-based security controls. This expands the trusted device pool, which is a major security loophole if device registration is not tightly controlled.

Answer

It allows the cloud to push malware to on-premises devices.

Answer

It automatically grants the devices administrative access to the cloud tenant.

Answer

It requires all devices to be hardware-encrypted with TPM 2.0.

Question 4

When conducting a penetration test on an Azure App Service, you discover an 'environment.js' file in the public directory containing a 'CLIENT_ID'. What is the risk associated with this finding?

Accepted Answer

The attacker can use the Client ID to construct a tailored consent-phishing URL.. Client IDs are public and not secrets in themselves. However, exposing them can reveal the application's configuration and identifier, which an attacker can then use to craft malicious authorization requests. If the application is misconfigured to allow unauthorized consent or has other vulnerabilities, the Client ID acts as the starting point for a targeted phishing or consent-based attack against the organization's users.

Answer

The attacker can use the Client ID to authenticate as the application.

Answer

The attacker can use the Client ID to reset the application's password.

Answer

The attacker can use the Client ID to bypass MFA for the application.

Question 5

Refer to the exhibit. What does this error log suggest regarding the C2 connection attempt?

Accepted Answer

The client system does not trust the C2 server's certificate.. The 'tlsv1 alert unknown ca' error indicates that the client rejected the server's certificate because it was not signed by a trusted root CA. In the context of C2, this often happens when an automated beacon tries to connect to an infrastructure node using a self-signed certificate, and the host's security policy or a proxy is performing SSL inspection and fails the trust validation process.

Answer

The C2 server is unreachable due to a network outage.

Answer

The C2 server is performing a man-in-the-middle attack.

Answer

The C2 server has exhausted its connection limit.

Question 6

An attacker uses a 'redirector' in their C2 infrastructure. What is the primary purpose of this architectural component?

Accepted Answer

To provide a layer of obfuscation for the C2 server.. Redirectors act as a layer of separation between the compromised host and the actual C2 server. They proxy the incoming beacon traffic to the real server, masking the location of the true command infrastructure. This protects the C2 server from being directly identified and blacklisted, as the traffic appears to originate from the redirector node. This is a critical component for maintaining a resilient and stealthy operational environment.

Answer

To increase the bandwidth of the C2 connection.

Answer

To translate commands into local system calls.

Answer

To manage the encryption keys for the C2 channel.

Question 7

Which of the following describes the purpose of 'encoding' shellcode in an exploitation context?

Accepted Answer

To bypass character-based filters and detection systems.. Encoding is used to transform shellcode to bypass security filters, such as Intrusion Detection Systems (IDS) or character filtering (like null bytes). By changing the signature of the payload, it avoids triggering pattern-based detection. This is a fundamental technique for ensuring the payload reaches its intended execution point without being sanitized or blocked by input validation controls that inspect data for known malicious sequences.

Answer

To increase the execution speed of the exploit.

Answer

To encrypt the traffic for legal compliance.

Answer

To permanently store the payload on the target's disk.

Question 8

Which TWO of the following scenarios are most indicative of a successful Kerberoasting attack occurring within a network?

Accepted Answer

Multiple TGS-REQ packets from a single workstation targeting various SPNs within a short timeframe.. Kerberoasting is characterized by the bulk request of service tickets and the subsequent offline cracking of the service account's password. Detectors look for anomalous TGS-REQ volume and specific encryption types (like RC4-HMAC) in the requests. Identifying these patterns allows security analysts to pinpoint service accounts that are currently under attack, enabling timely password resets or the implementation of Group Managed Service Accounts (gMSAs) to mitigate future risk.

Answer

A sudden spike in AS-REQ events using expired Kerberos TGTs.

Answer

Frequent failed logins followed by a successful Kerberos authentication.

Answer

An influx of TGT-REQ packets originating from non-domain controllers.

Question 9

When escalating privileges using a Kernel exploit, why is it considered a high-risk activity for a penetration test?

Accepted Answer

It frequently causes system instability and crashes.. Kernel exploits target the core of the operating system. If the exploit fails or contains errors, it frequently leads to a system crash (Blue Screen of Death). This causes significant downtime for the client, which is usually prohibited. Because kernel-level code runs with the highest possible privilege, any mistake results in immediate system instability, making it one of the most dangerous vectors to test in a production environment.

Answer

It requires the user to have administrative credentials.

Answer

It is easily detected by standard antivirus software.

Answer

It can only be executed on outdated operating systems.

Question 10

You are performing an offline attack against a password hash stored in an NTDS.dit file. You have successfully dumped the hashes using secretsdump.py. Given the format 'Username:RID:LMHash:NTHash:::', which hash should be targeted for a modern Windows environment to maximize cracking efficiency?

Accepted Answer

The NTHash, because it is the primary hash used by NTLM authentication.. Modern Windows systems prioritize NTLM authentication, which relies on the NTHash. The LM hash is deprecated, weak, and often stored as a null value or a fixed constant in modern systems. Targeting the NTHash allows for pass-the-hash attacks or brute-force attempts that align with the underlying authentication protocol. Understanding the structure of these hashes is crucial for penetration testers to select the correct dictionary or mask attack strategies during local account auditing.

Answer

The LMHash, because it is shorter and faster to calculate.

Answer

The RID, because it provides the unique identifier for the account.

Answer

The entire string, including the colons, to ensure format integrity.