PEN-200 Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. Based on the HTTP response headers provided, what critical information can be gathered for your reconnaissance?

Accepted Answer

The web server version and PHP version are disclosed.. The headers explicitly disclose the web server (Apache 2.4.41) and the application framework (PHP 7.4.3). This is crucial intelligence because these specific versions may have known vulnerabilities or CVEs associated with them. By identifying the exact software stack, you can tailor your future exploitation efforts to target the specific weaknesses documented for these versions, significantly increasing the probability of a successful engagement and minimizing the noise generated by generic testing.

Answer

The operating system is exclusively Windows.

Answer

The database being used is Microsoft SQL Server.

Answer

The application is currently configured for debugging mode.

Question 2

You have successfully identified a Windows target and need to perform deep enumeration. Which TWO techniques are most effective for identifying hidden local services and internal network connections?

Accepted Answer

Execute 'netstat -ano' to identify local listening ports and associated process IDs.. Enumerating internal connections and services is essential for identifying lateral movement paths or local-only management interfaces. Using netstat confirms listening sockets that may not be exposed to the external network. Simultaneously, querying the Service Control Manager allows for the discovery of non-standard or custom services that might not be detected by typical port scans. Mastering these OS-specific enumeration techniques significantly increases the likelihood of finding vulnerabilities in non-obvious entry points.

Answer

Run 'nmap -sS -p- 127.0.0.1' from the target machine to map all possible services.

Answer

Analyze the 'hosts' file to find hidden DNS records for internal applications.

Answer

Check the system event logs for recent login attempts by administrative users.

Question 3

Refer to the exhibit. You are attempting a local port forward using PLINK, but receive a 'Connection refused' error. Which of the following is the most likely cause?

Accepted Answer

The SSH service on the jump host is unavailable.. A 'Connection refused' error typically indicates that the SSH service is not running on the target jump host (192.168.1.10) or that a firewall is blocking the connection to port 22. Even if the internal destination (10.0.0.5:80) is unreachable, the SSH connection to the jump host itself must be established first. If the initial SSH handshake fails, the tunnel cannot be created.

Answer

The internal target (10.0.0.5) is down.

Answer

The password provided is incorrect.

Answer

The local port 8080 is already in use.

Question 4

In the context of pivoting, what is 'double pivoting'?

Accepted Answer

Tunneling through one compromised host to reach another.. Double pivoting involves chaining two or more tunnels together to reach a network segment that is not reachable from the primary jump host. You use the first compromised host to tunnel into a second host, then tunnel from that second host into the target network. This is a complex but necessary technique when navigating multi-layered network security architectures where subnets are isolated from each other.

Answer

Running two separate SSH processes to the same host.

Answer

Using two different protocols simultaneously for redundancy.

Answer

Encrypting the tunnel twice for double security.

Question 5

Which of the following conditions is required to execute a successful Pass-the-Hash (PtH) attack against a target workstation?

Accepted Answer

The NTLM hash must correspond to an account with local administrative rights.. Pass-the-Hash relies on the fact that NTLM authentication uses the hash of a password rather than the password itself. If an attacker gains the NTLM hash of a user who has local administrative rights on a target, they can authenticate as that user. This is a primary method for lateral movement within an AD environment, allowing attackers to escalate privileges across hosts without ever needing to know the user's actual cleartext password.

Answer

The target machine must have Kerberos disabled.

Answer

The attacker must possess the cleartext password of the target user.

Answer

The target machine must be a Domain Controller.

Question 6

An analyst is attempting to execute a custom C2 stager on a Windows 10 workstation with active Windows Defender. They decide to use a PowerShell one-liner that downloads a script from a remote server and executes it directly using the Invoke-Expression (IEX) cmdlet. Why is this method generally more effective than downloading an .exe file to the Desktop?

Accepted Answer

Memory-only execution avoids the file-on-disk signature scanning process.. In-memory execution avoids the creation of files on the physical disk, which is where most traditional antivirus solutions perform their primary signature-based scanning. By keeping the malicious payload within the volatile memory of the PowerShell process, the attacker minimizes the forensic footprint and reduces the likelihood of triggering alerts associated with suspicious file creation or modification events on the local file system.

Answer

It bypasses the Antimalware Scan Interface (AMSI) entirely by default.

Answer

PowerShell scripts are automatically trusted by the Windows integrity system.

Answer

The method uses the System.Net.WebClient class which encrypts the payload.

Question 7

When evaluating antivirus evasion techniques for Windows targets in a penetration test, which TWO of the following approaches specifically target memory-based detection mechanisms rather than static disk signatures? (Choose TWO)

Accepted Answer

Direct system calls invoked via assembly instructions to bypass user-mode hooks placed by security software in ntdll.dll.. Memory-based evasion techniques focus on how payloads behave in RAM and interact with operating system APIs. Syscall manipulation avoids hooked functions in ntdll.dll, while process injection executes code within legitimate, trusted processes to blend in with normal system activity and avoid heuristic flags.

Answer

Applying a multi-layer XOR encoder to obfuscate the binary payload before writing the executable to the target hard drive.

Answer

Modifying the compilation timestamp within the portable executable header to confuse static signature heuristics.

Answer

Compressing the compiled binary with UPX to scramble sections and alter the import address table layout.

Question 8

During a stack-based buffer overflow exploit development exercise against a custom Windows application, an OSCP student successfully overwrites the instruction pointer (EIP) with the address of a JMP ESP instruction. However, upon triggering the vulnerability, the application immediately crashes with an access violation before executing the shellcode located directly after the return address. Which of the following is the most likely root cause of this execution failure?

Accepted Answer

Data Execution Prevention (DEP) is enabled on the target application, blocking CPU execution instructions from the non-executable stack memory region.. An access violation directly following an EIP overwrite usually indicates that the target memory address pointed to by ESP is non-executable due to Data Execution Prevention (DEP). Even though control flow successfully transfers via JMP ESP, modern operating systems enforce hardware-level NX/DEP protections, preventing shellcode execution on the stack unless bypassed through Return-Oriented Programming or valid OS API functions.

Answer

The bad characters array contained null bytes that truncated the shellcode payload before it could reach the return address offset.

Answer

The stack pointer (ESP) was offset too far forward, causing the processor to execute NOP sled instructions instead of the first shellcode instruction.

Answer

The chosen JMP ESP instruction address contained little-endian byte ordering that corrupted the stack frame alignment during the return operation.

Question 9

You have identified an AlwaysOn service running with SYSTEM privileges. The service binary is read-only, but you have write access to its directory. What is the most likely escalation vector?

Accepted Answer

DLL Hijacking.. If the binary is read-only but the directory is writable, you may be able to perform DLL hijacking. Windows applications often look for DLLs in the application directory before searching system folders. By placing a malicious DLL with the same name as a dependency into the application's folder, you can force the application to load your code when it starts, gaining SYSTEM privileges.

Answer

Exploiting the unquoted service path.

Answer

Modify the service binary directly.

Answer

Overwriting the service configuration file.

Question 10

When enumerating a web application, which THREE of the following items are most important to identify to increase the likelihood of finding a vulnerability?

Accepted Answer

Hidden directories and files.. Effective web enumeration requires looking beyond the main page. Identifying hidden directories, software versions, and input fields allows a tester to map the attack surface comprehensively. By finding these components, a tester can research known vulnerabilities associated with specific technologies or test for common web flaws like SQL injection or cross-site scripting, which are frequently found in custom application code and forgotten administrative paths.

Answer

The color scheme of the website.

Answer

The number of images hosted on the server.

Question 11

You are analyzing a Windows 32-bit application that uses a fixed-size stack buffer and calls strcpy() without bounds checking. You want to determine the exact offset to overwrite the saved return address. Which tool or method is most appropriate for this task?

Accepted Answer

Use a debugger to send a unique cyclic pattern and inspect the value of EIP.. The most reliable way to find the exact offset is to send a unique cyclic pattern and observe which four bytes overwrite EIP. This directly maps input position to the return address. Tools like Mona.py automate this process. Static counting or random fuzzing are less precise and can be misleading.

Answer

Use a disassembler to count the number of bytes between the buffer and the return address.

Answer

Use a hex editor to modify the binary and insert a breakpoint at the return instruction.

Answer

Use a fuzzer to send random data and monitor for a crash, then guess the offset.

Question 12

Which command is most useful for identifying processes that are running as root, which might be potential targets for privilege escalation?

Accepted Answer

ps aux | grep root. The 'ps' command is essential for process enumeration. By using specific flags like 'aux', you can display all processes running on the system, including their owner. Identifying services owned by root allows you to focus your efforts on finding vulnerabilities in those specific processes. This is a fundamental enumeration step, as privilege escalation often involves finding a misconfigured or vulnerable service that is already running with the target privileges.

Answer

ls -l /proc

Answer

netstat -tulnp

Answer

cat /etc/passwd | grep root

Question 13

An attacker places a malicious 'version.dll' file into the same directory as a legitimate, signed executable that is known to load that DLL. When the legitimate program starts, it loads the malicious DLL instead of the one in the System32 folder. What evasion technique is being demonstrated?

Accepted Answer

DLL Sideloading. DLL Sideloading exploits the default search order that Windows uses to locate dynamic-link libraries. By placing a malicious DLL in the application's local directory, the attacker ensures it is loaded before the legitimate system DLL. This allows malicious code to run under the context of a trusted, signed process, which often bypasses security controls and behavioral alerts.

Answer

DLL Injection

Answer

COM Hijacking

Answer

Reflective DLL Loading

Question 14

Refer to the exhibit. What is the primary purpose of the command provided?

Accepted Answer

Cracking NTLM hashes using a dictionary-based approach.. This command initiates a dictionary attack against NTLM hashes. Mode 1000 is specifically designated for NTLM authentication hashes, while -a 0 denotes a straight dictionary attack using a wordlist. Knowing how to map hash formats to their corresponding Hashcat mode is a fundamental skill for password cracking. Incorrectly identifying the mode or the attack type will result in an inability to recover the plaintext credentials during a penetration test.

Answer

Performing a brute-force attack on a SHA-256 encrypted archive.

Answer

Attempting a mask attack to guess passwords based on a specific pattern.

Answer

Extracting domain user hashes from a SAM database file.

Question 15

What is the primary objective of a 'Clickjacking' attack?

Accepted Answer

To trick users into clicking on a hidden element, often to perform unauthorized actions.. Clickjacking tricks users into clicking something different from what they perceive, often by overlaying a hidden, malicious iframe over a legitimate page element. The objective is to force the user to perform unintended actions, like changing account settings or transferring funds, while they believe they are interacting with the benign UI. This leverages the user's existing session to execute authorized requests without their informed consent.

Answer

To steal the user's session cookies through hidden JavaScript execution.

Answer

To bypass the Same-Origin Policy by forcing cross-domain requests.

Answer

To inject malicious scripts into the page to capture keystrokes.