GPEN Multiple Select — 20 Questions

Question 1

Which THREE of the following are valid methods to mitigate the risk of password spray attacks in an integrated Azure AD environment?

Accepted Answer

Enforce Multi-Factor Authentication for all users.. Password spray attacks target common passwords across many accounts. Protecting against this requires a layered approach: enforcing MFA to render weak passwords useless, blocking legacy authentication to prevent bypasses, and utilizing identity protection to detect anomalous logins. These controls are essential for modernizing identity security and protecting against high-volume, low-effort credential attacks that plague hybrid environments.

Answer

Increase the minimum password length to 50 characters.

Answer

Require all users to use the same password for both on-premises and cloud.

Question 2

Which TWO of the following are characteristics of 'Salted' hashes compared to 'Unsalted' hashes?

Accepted Answer

They prevent the identification of identical passwords.. Salted hashes introduce a unique, random string to the hashing process for every user, ensuring that identical passwords result in different hashes. This makes it impossible to use global rainbow tables. Unsalted hashes are inherently vulnerable to these tables, as the same plaintext always produces the same hash, allowing for near-instant cracking of common passwords across an entire database once a single table is computed.

Answer

They enable the use of rainbow tables.

Answer

They are inherently faster to crack than unsalted hashes.

Answer

They are usually stored in cleartext in the configuration file.

Question 3

A penetration tester is analyzing the results of a vulnerability scan and needs to prioritize remediation efforts. Which two factors should be considered when determining the criticality of a vulnerability? (Choose two.)

Accepted Answer

The potential impact on the business if exploited. CVSS base score and business impact are key factors for prioritizing vulnerabilities. CVSS provides a standardized severity metric, while business impact ensures that remediation efforts focus on what matters most to the organization. Together, they help balance technical severity with real-world consequences.

Answer

The age of the vulnerability in the CVE database

Answer

The number of other vulnerabilities on the same host

Answer

The scanner's confidence level in the finding

Question 4

A penetration tester is configuring a vulnerability scan against a large enterprise network. The tester needs to balance scan accuracy, speed, and impact on production systems. Which TWO of the following settings, when adjusted, will MOST directly reduce the risk of disrupting fragile network devices during the scan? (Choose two.)

Accepted Answer

Enable 'Safe Checks' in the scan policy.. The two settings that most directly reduce disruption are Safe Checks and Max checks per host. Safe Checks excludes plugins known to potentially crash services, while lowering Max checks per host throttles concurrent probes to each target. Together they limit both the type and the rate of intrusive traffic, protecting fragile production devices. Other options either increase load or do not specifically target device stability.

Answer

Increase the maximum number of concurrent hosts scanned.

Answer

Disable 'Thorough tests' in the scan policy.

Answer

Set the scanner to use UDP instead of TCP for all checks.

Question 5

A penetration tester has captured a set of NTLMv2 challenge-response pairs from a network segment. The tester wants to crack these hashes offline using Hashcat. Which TWO of the following statements are true regarding the cracking of NTLMv2 hashes with Hashcat? (Choose two.)

Accepted Answer

Hashcat mode 5600 is used for NTLMv2 hashes.. NTLMv2 challenge-response pairs are cracked using Hashcat mode 5600, and the captured hash must include the server challenge for the computation to be possible. The challenge is unique per authentication, so precomputed tables are useless. The username is part of the hash but does not act as a salt. An attack mode must always be specified.

Answer

NTLMv2 hashes can be cracked using precomputed rainbow tables.

Answer

Hashcat can crack NTLMv2 hashes without specifying a wordlist or mask.

Answer

NTLMv2 hashes are salted with the username, making them more resistant to cracking.

Question 6

You are analyzing a target environment and need to identify UDP services. Which THREE of the following are significant challenges associated with performing an accurate UDP scan compared to a TCP scan?

Accepted Answer

UDP is connectionless, requiring Nmap to wait for a response that may never come.. UDP is a connectionless protocol, which creates inherent difficulties in scanning. Because there is no handshake, responses are inconsistent, leading to unreliable results. Testers must be aware that UDP scanning is often significantly slower and prone to false negatives due to rate-limiting by target hosts. Understanding these limitations is critical for reporting accurate service maps and knowing when to re-scan or verify results using alternative methods.

Answer

UDP ports must be scanned sequentially, preventing parallelization.

Answer

UDP packets are always blocked by stateful firewalls regardless of status.

Question 7

When selecting an exploit for a target system, which TWO factors are most critical to ensure the exploit succeeds without crashing the target service?

Accepted Answer

The exact version of the application or OS service.. Successful exploitation requires precise alignment between the exploit's memory address assumptions and the target's environment. Crashes typically occur when the exploit targets an incorrect memory offset or assumes a different architecture than the one present. By verifying target versioning and architectural requirements, a tester minimizes the risk of service instability, ensuring that the exploit fulfills its objective while maintaining the operational integrity of the production environment.

Answer

The color scheme of the target's command shell.

Answer

The network bandwidth available to the target.

Answer

The number of users currently logged in.

Question 8

You are planning a penetration test for a financial institution that operates a large mainframe environment. The client wants to ensure that the test does not disrupt critical batch processing jobs. Which TWO of the following are the MOST important items to include in the Rules of Engagement (RoE) to address this concern? (Choose two.)

Accepted Answer

A list of emergency contacts for both the penetration testing team and the client's operations staff.. The most critical RoE elements to avoid disrupting batch processing are clearly defined testing windows and emergency contacts. Testing windows prevent conflicts with scheduled jobs, while emergency contacts enable quick resolution if problems arise. Together, they balance thorough testing with operational stability.

Answer

A clause allowing the tester to disable antivirus software on the mainframe during testing.

Answer

A provision to use only automated scanning tools to minimize manual intervention.

Answer

A requirement that all testing be conducted from an external IP address.

Question 9

During a red team engagement, an operator successfully dumps the LSA secrets and NTDS.dit database from a Windows domain controller. Which TWO advanced password extraction and analysis techniques should the operator prioritize to uncover administrative access vectors? (Choose two)

Accepted Answer

Performing offline dictionary and rule-based cracking against extracted NTLM hashes using high-performance GPU clusters.. Extracting credentials from NTDS.dit allows the recovery of NTLM hashes and potentially cleartext passwords stored via reversible encryption. Pass-the-hash utilizes captured NTLM hashes for lateral movement without cracking, while offline dictionary cracking recovers original plaintext passwords for reuse against external portals or multi-factor authentication boundaries where hash reuse fails.

Answer

Injecting malicious DLL payloads into the Local Security Authority Subsystem Service to capture plaintext credentials in real-time.

Answer

Executing Kerberoasting against all user accounts to extract service tickets encrypted with legacy RC4 encryption keys.

Answer

Running a responder-based LLMNR/NBT-NS poisoning campaign to capture incoming network authentication challenge-response pairs.

Question 10

You are drafting the Rules of Engagement for an internal penetration test. Which TWO of the following items are considered mandatory for the 'Communication Plan' section?

Accepted Answer

The names and 24/7 contact information for designated incident response leads.. A robust communication plan is essential for maintaining control during an engagement. By defining specific emergency protocols and status reporting cadences, both the testing team and the client minimize the risk of operational downtime. These elements ensure that technical findings are communicated effectively while providing a clear escalation path if an unexpected system failure occurs, maintaining professional accountability throughout the duration of the testing period.

Answer

A list of all vulnerabilities found during the previous year's audit.

Answer

The specific exploit payloads that will be used during the test.

Answer

The estimated total cost of the project and payment schedule.

Question 11

Which TWO of the following scenarios are most indicative of a successful Kerberoasting attack occurring within a network?

Accepted Answer

Multiple TGS-REQ packets from a single workstation targeting various SPNs within a short timeframe.. Kerberoasting is characterized by the bulk request of service tickets and the subsequent offline cracking of the service account's password. Detectors look for anomalous TGS-REQ volume and specific encryption types (like RC4-HMAC) in the requests. Identifying these patterns allows security analysts to pinpoint service accounts that are currently under attack, enabling timely password resets or the implementation of Group Managed Service Accounts (gMSAs) to mitigate future risk.

Answer

A sudden spike in AS-REQ events using expired Kerberos TGTs.

Answer

Frequent failed logins followed by a successful Kerberos authentication.

Answer

An influx of TGT-REQ packets originating from non-domain controllers.

Question 12

A penetration tester has obtained a set of NTLM hashes from a Windows domain controller. The tester plans to perform an offline password cracking attack. Which two of the following techniques are most effective for increasing the success rate of cracking these hashes? (Choose two.)

Accepted Answer

Leveraging GPU acceleration with Hashcat. Rule-based attacks and GPU acceleration are both highly effective for offline cracking of NTLM hashes. Rule-based attacks expand the wordlist with common transformations, covering many user-chosen passwords. GPU acceleration with Hashcat maximizes computational speed, allowing millions of guesses per second. Together, they significantly improve the success rate. Other options like rainbow tables or online attacks are either impractical or inefficient in this scenario.

Answer

Conducting an online brute-force attack against the domain controller

Answer

Performing a rainbow table attack using precomputed tables for NTLM

Answer

Using a dictionary attack with a list of common passwords only

Question 13

You are conducting passive reconnaissance against a target organization and want to identify internet-facing systems and services without sending any packets to the target's own IP space. Which two techniques best satisfy this requirement? (Choose two.)

Accepted Answer

Reviewing historical WHOIS and ASN data to map the organization's owned netblocks. Querying Shodan leverages a third-party scan database that already collected banners and port states, and reviewing WHOIS and ASN registries maps owned netblocks through public records. Neither technique sends packets to the target's IP space, so both remain passive. Together they provide a service inventory and an address inventory, which are the core outputs needed for passive internet-facing reconnaissance.

Answer

Running an Nmap SYN scan with a low timing template against the target's external ranges

Answer

Using a web application scanner to crawl the target's public website for hidden directories

Answer

Performing DNS zone transfer attempts against each authoritative name server

Question 14

You are performing a penetration test against a Windows domain and have obtained domain user credentials. You want to identify which domain controllers are vulnerable to a specific privilege escalation technique. Which TWO tools or techniques are most appropriate for enumerating domain controllers and their potential vulnerabilities? (Choose two.)

Accepted Answer

BloodHound with SharpHound collector. BloodHound with SharpHound and PowerView's Get-NetDomainController are both designed to enumerate Active Directory environments, including domain controllers. BloodHound maps attack paths and can highlight misconfigurations like unconstrained delegation, while PowerView directly queries domain controller information. Other tools like Nmap SMB scripts, Metasploit SMB scanner, and Responder focus on different aspects such as share enumeration, version scanning, or credential capture, and do not provide the specific domain controller vulnerability enumeration required.

Answer

Nmap with the smb-enum-shares script

Answer

Metasploit's auxiliary/scanner/smb/smb_version

Answer

Responder with LLMNR poisoning

Question 15

You are planning an external penetration test for a financial services firm. The client's legal team wants assurance that the engagement can be defended if law enforcement or regulators inquire about the testing. Which TWO of the following should be included in the Rules of Engagement to provide this assurance? (Choose two.)

Accepted Answer

A list of authorized source IP addresses from which testing will originate.. Authorized source IP addresses and named client signatories are the two elements that most directly support legal defensibility. The source IPs let the client and authorities distinguish sanctioned traffic from real attacks, while the signatories establish a documented chain of authorization. Together they demonstrate that the activity was explicitly approved by authorized parties and originated from known, approved infrastructure.

Answer

The penetration tester's personal home address and after-hours phone number.

Answer

A detailed exploit payload library the testers plan to use against production systems.

Answer

A guarantee that no production system will experience any disruption during testing.

Question 16

A penetration tester is preparing to run a credentialed vulnerability scan against a mixed environment of Windows Server 2019 and Ubuntu 20.04 hosts on an internal /24 subnet. The tester wants to reduce scan duration and network load while still detecting missing patches and misconfigurations. Which two scanning techniques should the tester implement to achieve these goals? (Choose two.)

Accepted Answer

Use SSH and SMB credentials to allow the scanner to query the local patch database and installed software inventory.. Credentialed scanning with local security checks is the most efficient way to detect missing patches and misconfigurations while minimizing network traffic and scan time. Supplying administrative credentials for Windows and SSH credentials for Linux allows the scanner to read local patch databases and software inventories directly, avoiding extensive remote probing. This approach improves accuracy and reduces load compared to unauthenticated or overly aggressive scanning methods.

Answer

Configure the scanner to perform a SYN stealth scan on all 65,535 TCP ports for every host before authenticating.

Answer

Limit the scan to a predefined list of common ports and disable all plugin families except 'Denial of Service'.

Answer

Set the scanner to use a very aggressive timing template to maximize parallelism across all hosts.

Question 17

You are performing a penetration test against a web server that is protected by a network-based intrusion prevention system (IPS). You need to conduct a port scan while minimizing the chance of being blocked. Which two Nmap options should you use to evade the IPS? (Choose two.)

Accepted Answer

Use -T0 or -T1 to slow down the scan.. To evade an IPS during a port scan, slowing down the scan with -T0 or -T1 and using decoys with -D RND:10 are effective techniques. These methods reduce the scan's signature and make it harder for the IPS to correlate the activity to a single source, thereby minimizing the risk of being blocked.

Answer

Use -O to enable OS detection.

Answer

Use -A to enable aggressive scan options.

Answer

Use -sV to enable version detection.

Question 18

A penetration tester is conducting an offline password attack against a set of NTLM hashes extracted from a Windows domain. The tester wants to maximize the efficiency of the cracking process by using Hashcat. Which two techniques are most effective for this goal? (Choose two.)

Accepted Answer

Utilizing a rule-based attack with a comprehensive rule set like best64.rule. Rule-based attacks and mask attacks are both highly effective for offline NTLM cracking because they intelligently reduce the search space by applying common transformations or adhering to known password policies. Pure brute-force is impractical for long passwords, while options like ignoring usernames or oversubscribing threads do not enhance cracking efficiency.

Answer

Increasing the number of threads to exceed the number of CPU cores

Answer

Using the --username option to ignore usernames during cracking

Answer

Running a pure brute-force attack with all printable ASCII characters up to 12 characters

Question 19

A penetration tester is preparing to crack a set of NTLM hashes obtained from a Windows domain controller. The tester wants to maximize the chances of recovering plaintext passwords. Which TWO of the following techniques are most effective for this goal? (Choose two.)

Accepted Answer

Employing a hybrid attack that combines a wordlist with a mask for appending digits.. Rule-based attacks and hybrid attacks are the most effective because they leverage common password patterns and mutations, which are prevalent in real-world environments. Rule-based attacks apply transformations to wordlists, while hybrid attacks combine words with masks to cover predictable suffixes like digits. Both methods efficiently target likely passwords without the impractical computational cost of full brute-force. Distributed cracking only increases speed, not the likelihood of success, and rainbow tables are limited and outdated.

Answer

Using a distributed cracking setup with multiple GPUs to increase hash rate.

Answer

Performing a brute-force attack with a mask that covers all possible 8-character combinations.

Answer

Utilizing a precomputed rainbow table for NTLM hashes.

Question 20

A penetration tester is planning a vulnerability scan of a network that includes legacy systems and IoT devices. The tester needs to minimize the risk of disrupting these fragile devices while still gathering useful vulnerability data. Which two actions should the tester take? (Choose two.)

Accepted Answer

Configure the scanner to throttle network traffic and reduce the number of concurrent hosts scanned.. Enabling safe checks and throttling network traffic are the two actions that directly reduce the risk of disrupting legacy systems and IoT devices. Safe checks avoid potentially harmful tests, while throttling and reduced concurrency prevent overwhelming devices with too much traffic. The other options either increase load, broaden the scan unnecessarily, or do not address the specific fragility of these devices.

Answer

Increase the scan's maximum number of concurrent checks per host to speed up the scan.

Answer

Use a TCP SYN scan instead of a TCP connect scan to reduce the number of packets sent.

Answer

Disable host discovery and scan all IP addresses in the range.