GPEN Quick Quiz — 10 Questions

Question 1

Which THREE of the following are valid methods to mitigate the risk of password spray attacks in an integrated Azure AD environment?

Accepted Answer

Enforce Multi-Factor Authentication for all users.. Password spray attacks target common passwords across many accounts. Protecting against this requires a layered approach: enforcing MFA to render weak passwords useless, blocking legacy authentication to prevent bypasses, and utilizing identity protection to detect anomalous logins. These controls are essential for modernizing identity security and protecting against high-volume, low-effort credential attacks that plague hybrid environments.

Answer

Increase the minimum password length to 50 characters.

Answer

Require all users to use the same password for both on-premises and cloud.

Question 2

What is the main risk associated with storing cleartext credentials in environment variables or configuration files?

Accepted Answer

They can be read by any user or process with sufficient file permissions.. Cleartext credentials are easily accessible to anyone with local read access. In a penetration test, finding these files is a 'low-hanging fruit' that often leads to privilege escalation or lateral movement. Many applications inadvertently store sensitive data in logs, config files, or scripts, creating a security debt that attackers exploit to gain unauthorized access without needing to crack passwords through time-consuming cryptographic analysis of captured hashes.

Answer

They are susceptible to rainbow table attacks.

Answer

They prevent the use of multi-factor authentication.

Answer

They automatically trigger account lockouts after one reading.

Question 3

Which document should a penetration tester consult to determine the allowed scope and rules of engagement for a vulnerability scan?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement (RoE) or Statement of Work (SOW) defines the legal and operational boundaries of the assessment. It specifies which systems are in scope, which are out of scope, and what scanning techniques are permitted. Adhering to these documents is essential for maintaining compliance and avoiding unauthorized actions that could lead to legal repercussions or unintended service disruption during the testing phase.

Answer

The organization's public-facing bug bounty program policy.

Answer

The vendor's hardware specification sheets.

Answer

The latest version of the Common Vulnerabilities and Exposures (CVE) list.

Question 4

What is the primary risk associated with storing credentials in plain text within scripts or configuration files?

Accepted Answer

It allows an attacker to bypass authentication without cracking.. Storing cleartext credentials is a critical security failure because it provides an immediate, usable password to any attacker who gains read access to the file system. This often leads to lateral movement and privilege escalation because these scripts are frequently used by administrators to automate tasks across multiple servers. Identifying these files is a major component of any internal penetration test's post-exploitation phase.

Answer

It increases the complexity of the password hashes.

Answer

It prevents the use of multi-factor authentication.

Answer

It triggers an alert in the Windows Event Logs.

Question 5

During an internal penetration test, an attacker successfully captures an NTLMv2 challenge-response authentication exchange from a network segment. The adversary wishes to perform an offline brute-force cracking attack against the captured hash using Hashcat. Which specific Hashcat attack mode and hash format identifier must be specified to successfully crack this captured challenge-response pair?

Accepted Answer

Mode 5600, targeting NetNTLMv2 network authentication captures.. Hashcat mode 5600 specifically targets NetNTLMv2 authentication exchanges captured during network sniffing or LLMNR/NBT-NS poisoning attacks. Using the correct mode ensures Hashcat formats the challenge, username, domain, and response fields properly for structural verification and decryption. Selecting incorrect modes results in immediate errors or zero matches during computation, making accurate identification of authentication protocols a vital pentesting skill.

Answer

Mode 1000, targeting local SAM database NTLM hashes.

Answer

Mode 1300, targeting legacy Windows NT hashes.

Answer

Mode 3000, targeting LM hashes with challenge data.

Question 6

Which TWO of the following are characteristics of 'Salted' hashes compared to 'Unsalted' hashes?

Accepted Answer

They prevent the identification of identical passwords.. Salted hashes introduce a unique, random string to the hashing process for every user, ensuring that identical passwords result in different hashes. This makes it impossible to use global rainbow tables. Unsalted hashes are inherently vulnerable to these tables, as the same plaintext always produces the same hash, allowing for near-instant cracking of common passwords across an entire database once a single table is computed.

Answer

They enable the use of rainbow tables.

Answer

They are inherently faster to crack than unsalted hashes.

Answer

They are usually stored in cleartext in the configuration file.

Question 7

During a penetration test, you successfully dump the LSASS memory space and extract a set of NTLM hashes. Which of the following is the most efficient next step if the goal is to determine the plaintext password of a high-value administrator account?

Accepted Answer

Run Hashcat with a combination of wordlists and mask attacks.. Once NTLM hashes are acquired, the most efficient method to recover the password is using an optimized GPU-based cracking tool like Hashcat. By employing a hybrid attack strategy—starting with a dictionary list supplemented by mask-based brute forcing—the tester can maximize the likelihood of recovering passwords that follow common corporate complexity patterns. This is significantly faster than manual analysis and allows for rapid testing against high-value target accounts.

Answer

Use the hashes to perform a Pass-the-Hash attack on every server.

Answer

Submit the hashes to an online cloud-based cracking service.

Answer

Reverse the MD4 algorithm to recover the original string.

Question 8

Refer to the exhibit. What does the Nmap status 'open|filtered' indicate about the target port, and why does this result commonly occur in penetration testing scenarios?

Accepted Answer

The port is likely open but the scanner is not receiving a clear response.. The 'open|filtered' state means Nmap cannot determine if the port is open or filtered. This happens when the port sends no response to a probe, which is typical behavior for firewalls that drop packets rather than rejecting them. Understanding this distinction is critical for testers, as it implies that the port might be open but protected, necessitating further probing to determine the true state of the service behind the security boundary.

Answer

The port is definitely open but the response was malformed.

Answer

The port is likely closed and the firewall is silently dropping traffic.

Answer

The port is definitely filtered and the service is unreachable.

Question 9

You are analyzing the results of a passive reconnaissance scan using a tool that harvests metadata from files found on a company website. What is the primary security risk associated with this information disclosure?

Accepted Answer

It discloses internal network naming conventions and software versions.. Metadata in files like PDFs or Word documents often includes internal paths, printer names, software versions used for creation, and author usernames. This information is a goldmine for an attacker attempting to build a social engineering lure or profile the target's workstation environment. Understanding that reconnaissance extends beyond network headers to document analysis is a hallmark of an advanced penetration tester who understands holistic information leakage.

Answer

The files can be used to execute arbitrary commands on the client machine.

Answer

It indicates the current load on the corporate web server.

Answer

It bypasses the need for an external vulnerability assessment.

Question 10

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

Accepted Answer

Applying statistical analysis to traffic patterns.. Since jitter and randomized timing break the simple periodic heartbeat, security teams must use statistical analysis to identify the traffic. By calculating the frequency distribution of connections over a long time window, analysts can identify the underlying regularity that persists despite the jitter. This behavioral approach is significantly more effective than static threshold-based alerts, which are easily defeated by the randomness built into modern C2 communication protocols.

Answer

Blocking all traffic to unknown IP addresses.

Answer

Scanning for specific byte signatures in the payloads.

Answer

Monitoring for high-bandwidth bursts in the network.