GPEN Exam Simulation — 100 Questions

Question 1

Which THREE of the following are valid methods to mitigate the risk of password spray attacks in an integrated Azure AD environment?

Accepted Answer

Enforce Multi-Factor Authentication for all users.. Password spray attacks target common passwords across many accounts. Protecting against this requires a layered approach: enforcing MFA to render weak passwords useless, blocking legacy authentication to prevent bypasses, and utilizing identity protection to detect anomalous logins. These controls are essential for modernizing identity security and protecting against high-volume, low-effort credential attacks that plague hybrid environments.

Answer

Increase the minimum password length to 50 characters.

Answer

Require all users to use the same password for both on-premises and cloud.

Question 2

What is the main risk associated with storing cleartext credentials in environment variables or configuration files?

Accepted Answer

They can be read by any user or process with sufficient file permissions.. Cleartext credentials are easily accessible to anyone with local read access. In a penetration test, finding these files is a 'low-hanging fruit' that often leads to privilege escalation or lateral movement. Many applications inadvertently store sensitive data in logs, config files, or scripts, creating a security debt that attackers exploit to gain unauthorized access without needing to crack passwords through time-consuming cryptographic analysis of captured hashes.

Answer

They are susceptible to rainbow table attacks.

Answer

They prevent the use of multi-factor authentication.

Answer

They automatically trigger account lockouts after one reading.

Question 3

Which document should a penetration tester consult to determine the allowed scope and rules of engagement for a vulnerability scan?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement (RoE) or Statement of Work (SOW) defines the legal and operational boundaries of the assessment. It specifies which systems are in scope, which are out of scope, and what scanning techniques are permitted. Adhering to these documents is essential for maintaining compliance and avoiding unauthorized actions that could lead to legal repercussions or unintended service disruption during the testing phase.

Answer

The organization's public-facing bug bounty program policy.

Answer

The vendor's hardware specification sheets.

Answer

The latest version of the Common Vulnerabilities and Exposures (CVE) list.

Question 4

What is the primary risk associated with storing credentials in plain text within scripts or configuration files?

Accepted Answer

It allows an attacker to bypass authentication without cracking.. Storing cleartext credentials is a critical security failure because it provides an immediate, usable password to any attacker who gains read access to the file system. This often leads to lateral movement and privilege escalation because these scripts are frequently used by administrators to automate tasks across multiple servers. Identifying these files is a major component of any internal penetration test's post-exploitation phase.

Answer

It increases the complexity of the password hashes.

Answer

It prevents the use of multi-factor authentication.

Answer

It triggers an alert in the Windows Event Logs.

Question 5

During an internal penetration test, an attacker successfully captures an NTLMv2 challenge-response authentication exchange from a network segment. The adversary wishes to perform an offline brute-force cracking attack against the captured hash using Hashcat. Which specific Hashcat attack mode and hash format identifier must be specified to successfully crack this captured challenge-response pair?

Accepted Answer

Mode 5600, targeting NetNTLMv2 network authentication captures.. Hashcat mode 5600 specifically targets NetNTLMv2 authentication exchanges captured during network sniffing or LLMNR/NBT-NS poisoning attacks. Using the correct mode ensures Hashcat formats the challenge, username, domain, and response fields properly for structural verification and decryption. Selecting incorrect modes results in immediate errors or zero matches during computation, making accurate identification of authentication protocols a vital pentesting skill.

Answer

Mode 1000, targeting local SAM database NTLM hashes.

Answer

Mode 1300, targeting legacy Windows NT hashes.

Answer

Mode 3000, targeting LM hashes with challenge data.

Question 6

Which TWO of the following are characteristics of 'Salted' hashes compared to 'Unsalted' hashes?

Accepted Answer

They prevent the identification of identical passwords.. Salted hashes introduce a unique, random string to the hashing process for every user, ensuring that identical passwords result in different hashes. This makes it impossible to use global rainbow tables. Unsalted hashes are inherently vulnerable to these tables, as the same plaintext always produces the same hash, allowing for near-instant cracking of common passwords across an entire database once a single table is computed.

Answer

They enable the use of rainbow tables.

Answer

They are inherently faster to crack than unsalted hashes.

Answer

They are usually stored in cleartext in the configuration file.

Question 7

During a penetration test, you successfully dump the LSASS memory space and extract a set of NTLM hashes. Which of the following is the most efficient next step if the goal is to determine the plaintext password of a high-value administrator account?

Accepted Answer

Run Hashcat with a combination of wordlists and mask attacks.. Once NTLM hashes are acquired, the most efficient method to recover the password is using an optimized GPU-based cracking tool like Hashcat. By employing a hybrid attack strategy—starting with a dictionary list supplemented by mask-based brute forcing—the tester can maximize the likelihood of recovering passwords that follow common corporate complexity patterns. This is significantly faster than manual analysis and allows for rapid testing against high-value target accounts.

Answer

Use the hashes to perform a Pass-the-Hash attack on every server.

Answer

Submit the hashes to an online cloud-based cracking service.

Answer

Reverse the MD4 algorithm to recover the original string.

Question 8

Refer to the exhibit. What does the Nmap status 'open|filtered' indicate about the target port, and why does this result commonly occur in penetration testing scenarios?

Accepted Answer

The port is likely open but the scanner is not receiving a clear response.. The 'open|filtered' state means Nmap cannot determine if the port is open or filtered. This happens when the port sends no response to a probe, which is typical behavior for firewalls that drop packets rather than rejecting them. Understanding this distinction is critical for testers, as it implies that the port might be open but protected, necessitating further probing to determine the true state of the service behind the security boundary.

Answer

The port is definitely open but the response was malformed.

Answer

The port is likely closed and the firewall is silently dropping traffic.

Answer

The port is definitely filtered and the service is unreachable.

Question 9

You are analyzing the results of a passive reconnaissance scan using a tool that harvests metadata from files found on a company website. What is the primary security risk associated with this information disclosure?

Accepted Answer

It discloses internal network naming conventions and software versions.. Metadata in files like PDFs or Word documents often includes internal paths, printer names, software versions used for creation, and author usernames. This information is a goldmine for an attacker attempting to build a social engineering lure or profile the target's workstation environment. Understanding that reconnaissance extends beyond network headers to document analysis is a hallmark of an advanced penetration tester who understands holistic information leakage.

Answer

The files can be used to execute arbitrary commands on the client machine.

Answer

It indicates the current load on the corporate web server.

Answer

It bypasses the need for an external vulnerability assessment.

Question 10

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

Accepted Answer

Applying statistical analysis to traffic patterns.. Since jitter and randomized timing break the simple periodic heartbeat, security teams must use statistical analysis to identify the traffic. By calculating the frequency distribution of connections over a long time window, analysts can identify the underlying regularity that persists despite the jitter. This behavioral approach is significantly more effective than static threshold-based alerts, which are easily defeated by the randomness built into modern C2 communication protocols.

Answer

Blocking all traffic to unknown IP addresses.

Answer

Scanning for specific byte signatures in the payloads.

Answer

Monitoring for high-bandwidth bursts in the network.

Question 11

Which document is primarily responsible for defining the 'Rules of Engagement' (RoE) in a penetration testing project?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement document serves as the operational handbook for the penetration test, detailing exactly what is permitted, what is prohibited, and the emergency procedures to follow. It bridges the gap between the legal contract and the technical execution, ensuring that all parties have a mutual understanding of the engagement's boundaries, safety protocols, and professional expectations, which is critical for minimizing risks during testing.

Answer

The Statement of Work (SOW).

Answer

The Non-Disclosure Agreement (NDA).

Answer

The Service Level Agreement (SLA).

Question 12

During an internal penetration test, you capture an NTLMv2 net-NTLM hash using LLMNR/NBT-NS poisoning. You attempt to crack the hash offline using Hashcat with a standard rockyou.txt wordlist, but the operation yields no plaintext. What is the most effective next step to recover the credentials given that the password complexity requirements were met?

Accepted Answer

Apply rule-based attack modes or hybrid mask attacks in Hashcat to mutate base wordlist entries with common character substitutions, appending numbers, and special symbols.. NTLMv2 hashes utilize a challenge-response mechanism that cannot be reversed directly, requiring offline brute-forcing or rule-based attacks against the captured challenge and response. Because standard wordlists often fail against complex alphanumeric passwords, applying dynamic rule sets or combining masks significantly expands the search space to cover permutations users typically create to satisfy strict corporate password policies during assessments.

Answer

Re-capture the hash using Kerberoasting to obtain a valid Ticket Granting Service ticket for a service principal name instead of relying on the LLMNR response.

Answer

Convert the net-NTLMv2 hash format directly into an MD5 hash format using a custom script so that standard rainbow tables can instantly identify the plaintext password string.

Answer

Downgrade the captured authentication traffic by forcing the domain controller to negotiate LM hashing during the next SMB session establishment phase to simplify cracking.

Question 13

You are performing a penetration test against a web server and want to identify the exact version of the HTTP service running on port 80. Which Nmap command should you use?

Accepted Answer

nmap -sV -p 80 <target>. Service version detection with -sV is the correct technique to identify the software and version running on an open port. It sends probes and compares responses against a signature database, providing the HTTP server version needed for further vulnerability assessment.

Answer

nmap -sS -p 80 <target>

Answer

nmap -sn -p 80 <target>

Answer

nmap -O -p 80 <target>

Question 14

What is the primary benefit of using passive reconnaissance before initiating active scanning?

Accepted Answer

To minimize the footprint of the testing engagement.. Passive reconnaissance gathers information without alerting the target, allowing the tester to build a comprehensive profile without being blocked. This minimizes the risk of triggering security systems early in the engagement. By understanding the organization's architecture through public sources first, the tester can perform more targeted and efficient active scanning later, significantly increasing the probability of success while reducing the likelihood of early detection by the security operations center.

Answer

To identify vulnerabilities without touching the server.

Answer

To guarantee access to the target's internal network.

Answer

To bypass the organization's internal intrusion detection systems.

Question 15

Which command in the Metasploit Framework allows a user to interact with a backgrounded session after a successful exploit execution?

Accepted Answer

sessions -i. The 'sessions' command is the primary method for managing active connections within Metasploit. Once an exploit establishes a payload, the session moves to the background. Using 'sessions -i <id>' connects the user to the specific meterpreter shell, enabling post-exploitation activities. This is crucial for maintaining persistence and executing lateral movement tasks in a penetration test, as it allows the operator to toggle between multiple compromised targets effectively.

Answer

exploit -j

Answer

run -s

Answer

use -session

Question 16

A penetration tester is configuring an authenticated scan for a Windows environment. Which credential management strategy best minimizes the security impact while maintaining scan efficacy?

Accepted Answer

Create a dedicated service account with granular WMI and remote registry permissions.. Using dedicated, low-privilege service accounts with specific WMI and registry permissions minimizes the blast radius if credentials are intercepted. This approach adheres to the principle of least privilege, preventing the scanner from having full domain administrator access, which could be abused if the scanning server is compromised. Effective vulnerability management relies on deep system visibility without granting excessive authority to the scanning service.

Answer

Configure the scanner to use the Domain Administrator account for full registry access.

Answer

Use a local account with no password to allow quick automated authentication.

Answer

Store credentials in plain text in the scanner configuration file for easier automation.

Question 17

During an internal penetration test, an attacker intercepts an Active Directory Kerberos AS-REQ for a user account that does not have Kerberos pre-authentication enabled. What is the most effective post-exploitation technique for the operator to perform offline credential cracking against this captured artifact?

Accepted Answer

Conduct an AS-REP roasting attack to extract the encrypted ticket portion and crack the underlying user password offline.. Disabling Kerberos pre-authentication allows an attacker to request an AS-REP for any targeted user account without knowing their password. The returned ticket contains a portion encrypted with the user's NTLM hash, which can then be attacked offline using hashcat or John the Ripper to recover the plaintext password. This attack vector bypasses standard lockout policies completely since no actual authentication attempts are made against the Domain Controller during the cracking phase.

Answer

Execute a DCSync attack using volume shadow copies to extract the NTDS.dit database directly from the primary domain controller.

Answer

Perform a Kerberoasting attack to harvest service ticket hashes for accounts with registered Service Principal Names.

Answer

Inject a malicious golden ticket into memory after dumping the krbtgt account credentials from the lsass process.

Question 18

A penetration tester is using Nmap to scan a target network and wants to identify open UDP ports. The tester runs a UDP scan but notices that many ports are reported as 'open|filtered'. Which technique can help determine whether these ports are actually open or filtered?

Accepted Answer

Send a UDP packet with a known payload and analyze the response.. Sending a UDP packet with a known payload that triggers a response from a specific service can help determine if a port is open. If the service responds, the port is open; if no response or an ICMP unreachable is received, it may be filtered. This active probing provides more definitive results than generic scans.

Answer

Use a TCP ACK scan to infer UDP port states.

Answer

Perform a TCP SYN scan on the same ports.

Answer

Run a UDP scan with a longer timeout and more retries.

Question 19

A penetration tester is analyzing the results of a vulnerability scan and needs to prioritize remediation efforts. Which two factors should be considered when determining the criticality of a vulnerability? (Choose two.)

Accepted Answer

The potential impact on the business if exploited. CVSS base score and business impact are key factors for prioritizing vulnerabilities. CVSS provides a standardized severity metric, while business impact ensures that remediation efforts focus on what matters most to the organization. Together, they help balance technical severity with real-world consequences.

Answer

The age of the vulnerability in the CVE database

Answer

The number of other vulnerabilities on the same host

Answer

The scanner's confidence level in the finding

Question 20

During a penetration test, you successfully inject a payload into a web application that results in the server executing system commands with elevated privileges. Which phase of the exploitation lifecycle does this action primarily represent?

Accepted Answer

Exploitation. This scenario demonstrates the execution of arbitrary code, which is the core of the exploitation phase. Exploitation is the process of leveraging a vulnerability to gain unauthorized access or control over a target system. Understanding this transition from vulnerability discovery to exploitation is critical for testers to effectively assess the impact of security flaws and demonstrate real-world risk to stakeholders during the assessment reporting phase.

Answer

Reconnaissance

Answer

Vulnerability Assessment

Answer

Post-Exploitation