PEN-200 Practice Test 10 — 10 Questions

Question 1

You have successfully obtained a NTLM hash dump from a domain controller. You intend to perform a pass-the-hash attack to move laterally. What is the most critical requirement for this technique to succeed in a modern Windows environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authentication protocol must permit NTLM or legacy authentication methods to facilitate the hash usage.. Pass-the-hash (PtH) relies on the fact that authentication protocols like NTLM require the hash itself rather than the cleartext password. Understanding this mechanism is vital because it allows attackers to impersonate users without needing to crack complex passwords. The technique effectively bypasses the need for plaintext credentials, making it a staple for lateral movement in internal penetration tests when local administrator or service account access is achieved.

Answer

The target system must have the Kerberos pre-authentication disabled for the user account.

Answer

The victim machine must have the 'Restricted Admin' mode enabled in the RDP configuration.

Answer

The target machine must be running a version of Windows older than Windows Server 2012.

Question 2

During a web application assessment, you discover that the application allows users to upload profile pictures. The server saves these files with their original extensions in a publicly accessible directory. What is the most effective client-side risk associated with this misconfiguration?

Accepted Answer

Execution of Stored Cross-Site Scripting when a victim user navigates directly to the uploaded SVG or HTML file. Allowing arbitrary file uploads without strict extension validation enables attackers to upload malicious HTML or SVG files containing embedded JavaScript. When another user visits the direct URL of the uploaded file, the browser renders the content, leading to Stored Cross-Site Scripting.

Answer

Direct execution of native ELF binaries on the underlying Linux web server operating system

Answer

Immediate compromise of the backend database via automated SQL injection through the filename

Answer

Bypassing network perimeter firewalls through encapsulated ICMP tunneling inside the image metadata

Question 3

Which TWO of the following are common reasons for a buffer overflow exploit to fail even after the return address is correctly overwritten?

Accepted Answer

The presence of undocumented bad characters in the payload.. Exploits often fail due to environmental factors that were not accounted for during the development phase. Even with a perfect offset, the presence of hidden bad characters can truncate the shellcode before it reaches the stack. Additionally, security controls like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization) can prevent the shellcode from executing if the environment is locked down, rendering a simple stack-based overflow ineffective.

Answer

The use of a static JMP ESP address.

Answer

The pattern generator failed to reach the buffer.

Answer

The shellcode is too short for the buffer.

Question 4

You are analyzing a binary and identify a function that uses strcpy() to copy user input into a fixed-size stack buffer. Which register must be controlled to redirect the instruction pointer to your shellcode?

Accepted Answer

The saved Return Address on the stack. To redirect the execution flow, you must overwrite the saved Return Address on the stack. When a function finishes, the CPU pops the value at the saved EIP/RIP location into the Instruction Pointer. By overflowing the buffer and reaching this specific memory location, you gain control over the program's subsequent execution path, which is the foundational concept for stack-based buffer overflow exploitation in the PEN-200 curriculum.

Answer

The ESP register

Answer

The EAX register

Answer

The EBP register

Question 5

During a stack-based buffer overflow exploitation attempt in a Win32 environment, you notice that your shellcode execution fails because certain memory addresses contain null bytes (0x00). Which component of the exploit development process is primarily responsible for identifying and mitigating bad characters?

Accepted Answer

Sending a byte array from 0x00 to 0xFF into the vulnerable buffer and inspecting memory to see which bytes are altered or truncated.. Identifying bad characters is a critical step in buffer overflow development because application functions or memory copy routines may terminate prematurely upon encountering values like null bytes. During the discovery phase, testers systematically send all byte arrays to analyze how memory handles specific inputs, ensuring subsequent shellcode generation avoids breaking the exploit chain and successfully achieves remote code execution.

Answer

Generating a cyclic pattern using pattern_create.rb to determine the precise offset required to overwrite the saved instruction pointer.

Answer

Analyzing memory contents in a debugger to find a stable return-oriented programming gadget pointer.

Answer

Compiling the exploit script with Python to encode the payload using a standard XOR-based encoding scheme.

Question 6

Which of the following describes the primary difference between a Golden Ticket and a Silver Ticket attack in an Active Directory environment?

Accepted Answer

Golden tickets require the KRBTGT hash, while Silver tickets require a service account hash.. The distinction between Golden and Silver tickets is fundamental to understanding post-exploitation persistence. Golden tickets involve the KRBTGT account, granting access to the entire domain, while Silver tickets target specific service accounts. Mastering this difference is essential for determining the scope of an attack and the level of stealth required, as Silver tickets are often safer to deploy as they avoid triggering certain domain controller alerts related to TGT requests.

Answer

Golden tickets are for NTLM, whereas Silver tickets are for Kerberos.

Answer

Silver tickets grant domain admin access, while Golden tickets are restricted to workstations.

Answer

Only Silver tickets require active communication with the Domain Controller.

Question 7

Which attack involves an attacker capturing NTLM authentication traffic from a user and relaying it to another machine to gain unauthorized access?

Accepted Answer

NTLM Relay. NTLM Relay involves capturing authentication requests from a client and forwarding them to a target server. If the target server allows NTLM authentication and does not have protections like SMB signing enabled, the server will accept the relayed authentication as if it came from the original user. This allows the attacker to impersonate the user and execute commands or access files on the target server.

Answer

Kerberoasting

Answer

DCSync

Answer

Golden Ticket

Question 8

A tester is targeting a Windows machine and notices that a specific legitimate application regularly looks for a COM object that is missing from the HKEY_CURRENT_USER (HKCU) registry hive, eventually falling back to HKEY_LOCAL_MACHINE (HKLM). How can this be exploited for evasion?

Accepted Answer

By hijacking the COM object to execute code under a trusted process.. This scenario describes COM Hijacking. By creating the missing registry key in HKCU, the attacker can redirect the application to load a malicious DLL. Since HKCU is searchable before HKLM and can be modified without administrative privileges, this allows for persistent execution of code within a trusted process while bypassing alerts that might trigger on more obvious persistence methods.

Answer

By performing a privilege escalation to modify the HKLM hive.

Answer

By using the missing key to trigger a buffer overflow in the application.

Answer

By deleting the HKLM key to force the application to use HKCU.

Question 9

When auditing a Windows host for privilege escalation vectors during a PEN-200 assessment, you discover that the machine has AlwaysInstallElevated enabled in the Windows Registry. Which TWO conditions must be verified simultaneously to successfully weaponize this misconfigured policy?

Accepted Answer

The AlwaysInstallElevated value must be set to 1 in HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer.. AlwaysInstallElevated allows low-privileged users to install malicious MSI packages with elevated NT AUTHORITY\SYSTEM privileges. However, exploitation requires both registry hive keys to be properly configured to enabled values. Verifying both keys ensures the Windows Installer service honors the elevated installation flag for all packages regardless of user context.

Answer

The local security policy must allow standard users to bypass User Account Control prompts via group policy objects.

Answer

The target user account must possess local Administrator group membership prior to executing the malicious MSI package.

Answer

The Task Scheduler service must be configured to permit interactive logons for disabled service accounts.

Question 10

During an internal penetration test, you compromise a Windows host that has two network interfaces: one on your attack network (10.10.10.0/24) and one on a restricted internal network (172.16.5.0/24). You need to scan a web server at 172.16.5.20:80 from your Kali machine. You decide to use SSH dynamic port forwarding. Which command should you run on your Kali machine to create a SOCKS proxy listening on localhost port 1080 through the compromised Windows host (10.10.10.15) using SSH?

Accepted Answer

ssh -D 1080 user@10.10.10.15. To pivot into an internal network using SSH dynamic port forwarding, the -D option creates a SOCKS proxy on the specified local port. This allows tools like proxychains or browser proxies to route traffic through the SSH tunnel to any host reachable by the compromised server. The command must specify the SSH server address, which is the compromised host's IP on the attack network.

Answer

ssh -R 1080:172.16.5.20:80 user@10.10.10.15

Answer

ssh -D 1080 -L 80:172.16.5.20:80 user@10.10.10.15

Answer

ssh -L 1080:172.16.5.20:80 user@10.10.10.15