GPEN Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are valid methods to mitigate the risk of password spray attacks in an integrated Azure AD environment?

Accepted Answer

Enforce Multi-Factor Authentication for all users.. Password spray attacks target common passwords across many accounts. Protecting against this requires a layered approach: enforcing MFA to render weak passwords useless, blocking legacy authentication to prevent bypasses, and utilizing identity protection to detect anomalous logins. These controls are essential for modernizing identity security and protecting against high-volume, low-effort credential attacks that plague hybrid environments.

Answer

Increase the minimum password length to 50 characters.

Answer

Require all users to use the same password for both on-premises and cloud.

Question 2

Refer to the exhibit. What does the Nmap status 'open|filtered' indicate about the target port, and why does this result commonly occur in penetration testing scenarios?

Accepted Answer

The port is likely open but the scanner is not receiving a clear response.. The 'open|filtered' state means Nmap cannot determine if the port is open or filtered. This happens when the port sends no response to a probe, which is typical behavior for firewalls that drop packets rather than rejecting them. Understanding this distinction is critical for testers, as it implies that the port might be open but protected, necessitating further probing to determine the true state of the service behind the security boundary.

Answer

The port is definitely open but the response was malformed.

Answer

The port is likely closed and the firewall is silently dropping traffic.

Answer

The port is definitely filtered and the service is unreachable.

Question 3

You are analyzing the results of a passive reconnaissance scan using a tool that harvests metadata from files found on a company website. What is the primary security risk associated with this information disclosure?

Accepted Answer

It discloses internal network naming conventions and software versions.. Metadata in files like PDFs or Word documents often includes internal paths, printer names, software versions used for creation, and author usernames. This information is a goldmine for an attacker attempting to build a social engineering lure or profile the target's workstation environment. Understanding that reconnaissance extends beyond network headers to document analysis is a hallmark of an advanced penetration tester who understands holistic information leakage.

Answer

The files can be used to execute arbitrary commands on the client machine.

Answer

It indicates the current load on the corporate web server.

Answer

It bypasses the need for an external vulnerability assessment.

Question 4

A penetration tester is using Nmap to scan a target network and wants to identify open UDP ports. The tester runs a UDP scan but notices that many ports are reported as 'open|filtered'. Which technique can help determine whether these ports are actually open or filtered?

Accepted Answer

Send a UDP packet with a known payload and analyze the response.. Sending a UDP packet with a known payload that triggers a response from a specific service can help determine if a port is open. If the service responds, the port is open; if no response or an ICMP unreachable is received, it may be filtered. This active probing provides more definitive results than generic scans.

Answer

Use a TCP ACK scan to infer UDP port states.

Answer

Perform a TCP SYN scan on the same ports.

Answer

Run a UDP scan with a longer timeout and more retries.

Question 5

You have successfully obtained a copy of the NTDS.dit database and the SYSTEM registry hive during a domain controller compromise. Which TWO tools can you use offline to extract the password hashes from these files without relying on living-off-the-land binaries on a live system? (Choose TWO)

Accepted Answer

Impacket's secretsdump.py script. Both Impacket's secretsdump.py and the standalone utility NTDSXtract are industry-standard tools designed for offline parsing of NTDS.dit files when combined with the SYSTEM hive. Pentesters must know how to perform offline extraction to minimize forensic footprint and bypass endpoint detection systems running on live domain controllers during active assessments.

Answer

Windows Sysinternals ProcDump utility

Answer

BloodHound GUI collector

Answer

Responder network poisoning tool

Question 6

An attacker compromises a web application hosted in Azure App Service that utilizes a system-assigned managed identity to connect to an Azure SQL Database. How can the attacker pivot from the compromised web app to extract secrets or access backend resources?

Accepted Answer

Querying the Azure Instance Metadata Service (IMDS) local endpoint at http://169.254.169.254/metadata/identity/oauth2/token using an injected script or command execution shell.. Compromised Azure workloads hosting managed identities allow attackers to query the local Instance Metadata Service endpoint to retrieve OAuth access tokens. Recognizing this attack path is vital for penetration testers demonstrating the risk of server-side request forgery or remote code execution vulnerabilities.

Answer

Decrypting the application's Web.config file to retrieve the plaintext password associated with the system-assigned managed identity principal.

Answer

Extracting the master certificate from the local machine certificate store to forge administrative Kerberos tickets for the Azure domain.

Answer

Initiating a brute-force attack against the Azure Resource Manager public API using the public application ID found in the portal overview.

Question 7

A penetration tester is configuring a vulnerability scan against a large enterprise network. The tester needs to balance scan accuracy, speed, and impact on production systems. Which TWO of the following settings, when adjusted, will MOST directly reduce the risk of disrupting fragile network devices during the scan? (Choose two.)

Accepted Answer

Enable 'Safe Checks' in the scan policy.. The two settings that most directly reduce disruption are Safe Checks and Max checks per host. Safe Checks excludes plugins known to potentially crash services, while lowering Max checks per host throttles concurrent probes to each target. Together they limit both the type and the rate of intrusive traffic, protecting fragile production devices. Other options either increase load or do not specifically target device stability.

Answer

Increase the maximum number of concurrent hosts scanned.

Answer

Disable 'Thorough tests' in the scan policy.

Answer

Set the scanner to use UDP instead of TCP for all checks.

Question 8

You have gained execution on a workstation where a global administrator previously ran Azure CLI commands, leaving residual authentication tokens in the local user profile cache. You locate the refresh token files. What is the primary operational security limitation an attacker faces when attempting to replay these stolen Microsoft Entra ID refresh tokens from an external infrastructure IP address?

Accepted Answer

Microsoft Entra ID enforces token binding and conditional access policies that invalidate tokens used from anomalous IP addresses or untrusted devices. Microsoft Entra ID implements robust token binding and continuous access evaluation alongside IP restriction policies. When a refresh token is presented from an unrecognised IP address or external infrastructure lacking the expected device compliance markers or bound cryptographic material, the identity provider frequently rejects the request or triggers step-up multi-factor authentication, defeating simple replay attacks from attacker-controlled servers.

Answer

Refresh tokens lack cryptographic signatures and are immediately rejected by the token endpoint upon any modification

Answer

Refresh tokens expire strictly after exactly fifteen minutes regardless of activity or sliding window configurations

Answer

Azure CLI securely encrypts refresh tokens using the local user's plaintext password, making offline decryption mandatory before replay

Question 9

A penetration tester has captured a set of NTLMv2 challenge-response pairs from a network segment. The tester wants to crack these hashes offline using Hashcat. Which TWO of the following statements are true regarding the cracking of NTLMv2 hashes with Hashcat? (Choose two.)

Accepted Answer

Hashcat mode 5600 is used for NTLMv2 hashes.. NTLMv2 challenge-response pairs are cracked using Hashcat mode 5600, and the captured hash must include the server challenge for the computation to be possible. The challenge is unique per authentication, so precomputed tables are useless. The username is part of the hash but does not act as a salt. An attack mode must always be specified.

Answer

NTLMv2 hashes can be cracked using precomputed rainbow tables.

Answer

Hashcat can crack NTLMv2 hashes without specifying a wordlist or mask.

Answer

NTLMv2 hashes are salted with the username, making them more resistant to cracking.

Question 10

An enterprise client insists on a blind 'black-box' penetration test where the testing team receives zero prior knowledge regarding network architecture, IP ranges, or applications. However, the client's primary objective is to thoroughly test deep-seated business logic vulnerabilities within a critical custom web application. Why is this planning approach fundamentally misaligned with the client's stated objective?

Accepted Answer

Discovery phases consume disproportionate time, leaving insufficient hours for the deep manual analysis required to uncover logic flaws.. Black-box testing forces testers to spend the majority of the engagement on reconnaissance and basic discovery rather than deep vulnerability analysis. To effectively evaluate complex business logic flaws, testers require white-box or gray-box scoping with documentation and credentials to achieve adequate depth within standard assessment timeframes.

Answer

Black-box testing is legally prohibited under international cybersecurity standards for any application handling financial data.

Answer

Zero-knowledge assessments automatically violate standard industry rules of engagement by preventing the execution of automated scanners.

Answer

Client stakeholders cannot legally authorize a penetration test without providing a complete network diagram and asset inventory.

Question 11

An attacker has compromised an Azure App Service and obtained the application's managed identity token. They want to use it to access an Azure SQL Database. The managed identity has been granted access to the SQL server. Which of the following is the correct way to authenticate to the SQL Database using the managed identity token?

Accepted Answer

Use the token in the 'Access Token' property of a SqlConnection object with 'Authentication=Active Directory Access Token'.. The correct method is to use the managed identity's access token directly in the SqlConnection object with 'Authentication=Active Directory Access Token'. The token must be scoped to https://database.windows.net/. This allows the application to authenticate to Azure SQL using the managed identity, leveraging its assigned permissions.

Answer

Use the token to call the Azure SQL REST API to execute queries.

Answer

Use the token as the password in a SQL connection string with 'Authentication=Active Directory Password'.

Answer

Use the token to authenticate to the Azure SQL server's master database and then impersonate a user.

Question 12

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.

Question 13

When selecting an exploit for a target system, which TWO factors are most critical to ensure the exploit succeeds without crashing the target service?

Accepted Answer

The exact version of the application or OS service.. Successful exploitation requires precise alignment between the exploit's memory address assumptions and the target's environment. Crashes typically occur when the exploit targets an incorrect memory offset or assumes a different architecture than the one present. By verifying target versioning and architectural requirements, a tester minimizes the risk of service instability, ensuring that the exploit fulfills its objective while maintaining the operational integrity of the production environment.

Answer

The color scheme of the target's command shell.

Answer

The network bandwidth available to the target.

Answer

The number of users currently logged in.

Question 14

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 15

You have compromised a workstation and extracted the NTLM hash of a service account that is configured for unconstrained delegation. You want to craft a Silver Ticket to impersonate a domain administrator when accessing a specific file server. Which piece of information is absolutely required to forge this ticket?

Accepted Answer

The service account's NTLM hash or Kerberos key. To forge a Silver Ticket, the attacker must have the target service account's NTLM hash or Kerberos key to encrypt the service ticket. The domain SID and user RID are needed for the PAC but are not the encryption key. A TGT is not required because the ticket is presented directly to the service. The krbtgt hash is for Golden Tickets.

Answer

The domain SID and the target user's RID

Answer

A valid TGT for the service account

Answer

The krbtgt account's NTLM hash

Question 16

Which TWO methods are commonly used to achieve C2 persistence while ensuring the communication remains resilient against infrastructure takedowns?

Accepted Answer

Implementing Domain Generation Algorithms (DGA).. Resilient C2 infrastructure often relies on decentralized or dynamic components to ensure that the connection remains viable even if individual nodes are identified and blocked. By utilizing domain generation algorithms and cloud-based relay services, attackers create a moving target that is difficult for incident responders to fully dismantle in a timely manner. Mastery of these techniques is essential for assessing the robust nature of an organization's defense-in-depth posture.

Answer

Hardcoding the IP address of the C2 server.

Answer

Using unencrypted HTTP for all C2 traffic.

Answer

Requiring manual operator interaction for beaconing.

Question 17

A penetration tester is reviewing an Azure Logic App that uses a managed identity to access an Azure SQL Database. The tester finds that the Logic App's workflow definition is stored in a storage account that is publicly accessible. The workflow includes a step that executes a stored procedure with parameters. Which of the following is the most significant risk of this misconfiguration?

Accepted Answer

An attacker can modify the workflow to exfiltrate data from the SQL Database using the managed identity.. The most significant risk is that an attacker can modify the publicly accessible workflow definition to perform malicious actions using the managed identity's privileges. Since the managed identity can access the SQL Database, the attacker could alter the workflow to extract data and send it externally. This highlights the importance of securing Logic App definitions and limiting access to storage accounts.

Answer

An attacker can disable the managed identity by deleting the Logic App.

Answer

An attacker can use the managed identity to authenticate to Azure AD and create new users.

Answer

An attacker can retrieve the managed identity's client secret from the workflow definition.

Question 18

During a penetration test for a multinational retailer, you discover that a legacy internal application in scope contains a hardcoded credential that also grants access to a payment processing system the client explicitly excluded from testing. You have not yet used the credential. What is the MOST appropriate course of action?

Accepted Answer

Immediately notify the client's designated point of contact, document the finding, and await written guidance before accessing the excluded system.. When testing reveals a path into an explicitly excluded system, the tester must stop and escalate rather than proceed. Notifying the client contact, documenting the discovery, and awaiting written direction respects the Rules of Engagement while ensuring the client can act on a serious risk. This balances the obligation to report critical findings with the legal boundary the client set.

Answer

Report the hardcoded credential as an informational finding without mentioning the link to the excluded payment system.

Answer

Continue testing other in-scope systems and include the credential finding in the final report at the end of the engagement.

Answer

Use the credential only to confirm it works against the excluded system, then report the finding without making changes.

Question 19

During a red team engagement, an operator successfully dumps the LSA secrets and NTDS.dit database from a Windows domain controller. Which TWO advanced password extraction and analysis techniques should the operator prioritize to uncover administrative access vectors? (Choose two)

Accepted Answer

Performing offline dictionary and rule-based cracking against extracted NTLM hashes using high-performance GPU clusters.. Extracting credentials from NTDS.dit allows the recovery of NTLM hashes and potentially cleartext passwords stored via reversible encryption. Pass-the-hash utilizes captured NTLM hashes for lateral movement without cracking, while offline dictionary cracking recovers original plaintext passwords for reuse against external portals or multi-factor authentication boundaries where hash reuse fails.

Answer

Injecting malicious DLL payloads into the Local Security Authority Subsystem Service to capture plaintext credentials in real-time.

Answer

Executing Kerberoasting against all user accounts to extract service tickets encrypted with legacy RC4 encryption keys.

Answer

Running a responder-based LLMNR/NBT-NS poisoning campaign to capture incoming network authentication challenge-response pairs.

Question 20

Which TWO of the following are valid methods to identify Azure AD applications that have excessive permissions in a production environment?

Accepted Answer

Reviewing the 'OAuth2Permissions' and 'AppRoles' in the application manifest.. Auditing application permissions is crucial for security. Using the Microsoft Graph API to programmatically review permissions or running Microsoft Entra ID identity protection reports helps identify over-privileged service principals. These methods allow security teams to proactively reduce the blast radius of a potential application compromise by revoking unused or overly broad delegated and application permissions.

Answer

Scanning the 'AppService' source code for hardcoded passwords.

Answer

Analyzing the Azure Activity Logs for login events.

Answer

Checking the storage account's access keys for the application.