PEN-200 Practice Test 1 — 10 Questions

Question 1

You are performing a network scan on a client segment and notice that a host responds to ICMP echo requests but shows all TCP ports as 'filtered' when using Nmap. Which conclusion is most accurate?

Accepted Answer

A network-based firewall is likely dropping incoming TCP packets while allowing ICMP traffic to pass through.. The 'filtered' status indicates that a firewall or packet-filtering device is likely intercepting the TCP SYN packets and dropping them or sending prohibited ICMP error messages. Since the host responds to ICMP, the host is live, but the network path or host-based firewall prevents TCP probing. Understanding this distinction is critical for pivoting strategies and determining if the target's attack surface is truly closed or merely protected by perimeter security controls.

Answer

The target machine is powered off and the ICMP response is generated by a gateway device.

Answer

The target host is running a non-standard TCP/IP stack that ignores all incoming connection attempts.

Answer

The network interface on the target machine is misconfigured and unable to process TCP/IP traffic.

Question 2

You are auditing a web application and notice it uses base64 encoding to store user credentials in a cookie. What is the most accurate assessment of this security practice?

Accepted Answer

The implementation is insecure because base64 is an encoding, not a cryptographic protection.. Base64 is an encoding scheme, not an encryption or hashing algorithm. It is completely reversible and provides zero confidentiality for sensitive data. An attacker can easily decode these values to reveal plaintext credentials. This is a common finding in penetration tests that highlights a lack of understanding of the difference between obfuscation and actual security controls, requiring immediate remediation to protect session integrity.

Answer

The credentials are secure because base64 is difficult to reverse without the secret key.

Answer

The credentials are protected from casual inspection but vulnerable to automated tools.

Answer

The implementation is acceptable if the connection is encrypted with TLS.

Question 3

During an authorized penetration test, you want to perform a client-side attack by delivering a malicious HTA file via a phishing email. Which technique is most effective to execute native commands silently when the user opens the file?

Accepted Answer

Using mshta.exe to process a VBScript payload embedded within the HTA container to spawn a reverse shell. HTA files execute via mshta.exe, allowing VBScript or JScript integration to run operating system commands directly without standard browser security sandboxes. This makes HTA files highly effective for initial access vectors during social engineering engagements when users trust and run local executables.

Answer

Embedding the HTA inside a standard PDF document using an external URI scheme pointing to a remote script

Answer

Hosting the HTA file on an Apache web server with a fake mime-type configuration forcing automatic execution

Answer

Converting the HTA payload into a malicious shortcut (.lnk) file that calls PowerShell with hidden window arguments

Question 4

Which of the following describes a successful Path Traversal attack in a web application?

Accepted Answer

Using dot-dot-slash sequences to read /etc/passwd on a Linux server.. Path Traversal allows attackers to access files outside the intended web root directory by manipulating input parameters that contain file paths. By using dot-dot-slash sequences, an attacker escapes the restricted directory. This is a critical vulnerability that can lead to the exposure of configuration files, sensitive system data, or source code, which is why validating input is a fundamental security requirement.

Answer

Injecting JavaScript into a form field to capture user session cookies.

Answer

Submitting a crafted SQL query to retrieve data from the database.

Answer

Overloading the server with requests to exhaust system memory.

Question 5

Refer to the exhibit.

[!] Error compiling payload: Function 'VirtualAlloc' not found in target assembly scope.

An operator is writing a custom process injection loader in C# and encounters the compilation error shown above while attempting to allocate memory for shellcode. How should the operator properly resolve this issue to enable low-level memory allocation?

Accepted Answer

Import the unmanaged function from kernel32.dll using Platform Invoke (P/Invoke) declarations.. Managed languages like C# do not natively expose low-level Windows API functions like VirtualAlloc without explicit interoperability declarations. Utilizing Platform Invoke allows developers to import unmanaged DLL functions from kernel32.dll, bridging the gap between managed code execution and low-level memory manipulation required for advanced payload execution.

Answer

Replace VirtualAlloc with the standard .NET File.ReadAllBytes method to read the shellcode into a byte array.

Answer

Enable unsafe code blocks in the project settings and use raw C-style pointer arithmetic directly.

Answer

Compile the C# application as a 64-bit exclusive binary to match the target operating system architecture.

Question 6

You have identified a vulnerable service using an outdated version of a CMS. You successfully locate a public exploit script on GitHub. What is the most critical first step before running this script against your target?

Accepted Answer

Read the source code to understand its mechanism and potential impact.. Before executing any public exploit, you must analyze the source code to understand its functionality, dependencies, and potential impact. Public exploits are often poorly written or intentionally malicious, potentially causing service crashes or backdooring the attacker machine. Understanding the payload ensures you do not inadvertently trigger unwanted side effects or trigger defensive alarms that could disrupt your assessment during the penetration testing engagement.

Answer

Immediately run the exploit script with administrative privileges.

Answer

Change the target IP address in the script's configuration.

Answer

Install all dependencies listed in the script's requirements file.

Question 7

During external reconnaissance you collect DNS records for a target organization and find an MX record pointing to mail.example.com. You want to identify the IP addresses of other hosts in the same mail infrastructure without sending any packets directly to the target's servers. Which action best fits this passive goal?

Accepted Answer

Query a public passive DNS database such as SecurityTrails or VirusTotal for historical A records of example.com.. Passive reconnaissance relies on data already collected by third parties, so no packets touch the target. Passive DNS services aggregate historical resolution records from many sensors, letting you map subdomains and IP addresses, including hosts no longer published. Zone transfers, ping sweeps, and reverse lookups all generate traffic toward the target or its authoritative infrastructure, which breaks the passive-only requirement stated in the scenario.

Answer

Use nmap -sn 203.0.113.0/24 to discover which hosts in the mail subnet are alive.

Answer

Run dig axfr @ns1.example.com example.com to transfer the full zone.

Answer

Perform a reverse DNS lookup against each IP in the target's announced BGP prefixes.

Question 8

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a Windows host. You want to crack it offline to recover the plaintext password. Which tool and mode should you use to maximize efficiency against this hash type?

Accepted Answer

Hashcat with mode 5600 and a wordlist combined with rule-based mutations.. NetNTLMv2 hashes are challenge-response pairs that cannot be used directly for pass-the-hash. To recover the plaintext, offline cracking is required. Hashcat mode 5600 is designed for NetNTLMv2, and combining a wordlist with rules significantly improves success rates by mimicking common password transformations. Other modes or tools may work but are less efficient or incorrect for this hash type.

Answer

Hashcat with mode 1000 and a mask attack targeting eight-character passwords.

Answer

John the Ripper with `--format=netntlmv2` and the `--incremental` mode.

Answer

Use `responder` to relay the hash to another host and gain access without cracking.

Question 9

When exploiting a service via 'Modify' permissions on its binary, why is it necessary to restart the service?

Accepted Answer

To trigger the execution of the new binary.. Services run as long-lived processes. When the service starts, the binary is loaded into memory and executed. If you replace the binary while the service is running, the old process remains active. Restarting the service forces the Service Control Manager to stop the original process and start the new, modified binary, thereby executing your malicious code in the process space of the service.

Answer

To refresh the file system cache.

Answer

To bypass the Windows Service integrity check.

Answer

To allow the service to read the new configuration.

Question 10

During an internal assessment you run a TCP SYN scan and note that a host responds with an RST/ACK for every probed port. What does this behavior most reliably indicate about the target host?

Accepted Answer

The host is up and reachable, but no TCP listeners are present on the probed ports.. A TCP RST/ACK in response to a SYN is the standard signal of a closed but reachable port, because the kernel answers on behalf of a port with no bound listener. It confirms the host is alive and the path is unfiltered, letting you distinguish closed ports from filtered ones and focus subsequent service enumeration on ports that actually return SYN/ACK.

Answer

The target is running an IDS that spoofs resets to mislead the scanner.

Answer

The probed ports are open but the services are refusing the connection.

Answer

A stateful firewall is silently dropping the probe packets before they reach the host.