PEN-200 Practice Test 18 — 15 Questions

Question 1

During enumeration you discover a DNS server that allows zone transfers to any client. What is the most valuable outcome of performing a successful AXFR against this server?

Accepted Answer

Obtaining a complete list of hostnames and IP addresses defined in the zone, revealing internal naming and structure.. An unrestricted AXFR hands over the entire zone contents, including internal hostnames, address records, and service pointers that are otherwise difficult to enumerate. This produces a detailed map of the organization's naming scheme and reachable systems. It does not grant server control, expose signing keys, or decrypt past traffic, so the real value lies in the breadth of hostname and address intelligence revealed.

Answer

Decrypting previously captured DNS query traffic between clients and the server.

Answer

Gaining administrative control over the DNS server's configuration files.

Answer

Retrieving the server's private TLS keys used to sign DNSSEC records.

Question 2

When performing a password spraying attack, why is it considered best practice to use a single common password against many accounts rather than many passwords against one account?

Accepted Answer

It increases the number of accounts that can be compromised simultaneously.. Password spraying leverages the low frequency of attempts per account to evade account lockout thresholds while maximizing the probability of finding at least one compromised credential. This approach is highly effective in enterprise environments where account policies restrict the number of failed login attempts per user. By spreading attempts, an attacker bypasses these security controls, whereas targeted brute-forcing of a single user would quickly trigger a lockout and alert security teams.

Answer

It is faster for the tool to process a single password.

Answer

It prevents the detection of the attack by network firewalls.

Answer

It guarantees that the password will be found for every user.

Question 3

Based on the exhibit, what is the primary risk if your shellcode contains the byte \x0d?

Accepted Answer

The application terminates the input string early. The exhibit lists \x0d as a bad character, which often acts as a carriage return in various network protocols or string-handling functions. If shellcode contains this byte, the application may truncate the input buffer prematurely, preventing the full payload from reaching the stack. This truncation causes the exploit to fail, as the shellcode becomes malformed or incomplete before the CPU can execute it during the return sequence.

Answer

The memory address becomes non-executable

Answer

The JMP ESP instruction fails to trigger

Answer

The CPU enters an infinite loop state

Question 4

A penetration tester modifies a known exploit's payload by changing variable names and adding junk instructions. Despite these changes, the antivirus software still flags the file as 'Trojan.Generic' immediately upon being written to disk. What is the most likely reason for this detection?

Accepted Answer

Heuristic analysis identified suspicious code patterns or structures.. While simple obfuscation like renaming variables can bypass basic string-matching signatures, modern antivirus engines use heuristic analysis to identify suspicious patterns or structures common to malware. If the core logic or the arrangement of functional code blocks remains recognizable, the heuristic engine will flag the file based on its similarity to known malicious software families even without an exact match.

Answer

The antivirus is using signature-based detection on the specific junk code.

Answer

The file's entropy was too low, triggering an automatic quarantine.

Answer

The junk instructions were identified as malicious shellcode by the CPU.

Question 5

Why is it often effective to check for 'Capabilities' on Linux binaries when SUID is not present?

Accepted Answer

They allow a binary to perform privileged operations without full root UID.. Linux capabilities allow for fine-grained control over privileged operations, such as network raw socket access or file modification, without requiring the full root user. If a binary has excessive capabilities assigned, it can be abused to perform privileged actions. This is a subtle but powerful alternative to SUID that is frequently overlooked during security assessments, making it a valuable path for privilege escalation when traditional SUID targets are unavailable.

Answer

Capabilities are automatically granted to all users on a system.

Answer

Capabilities only work on binaries that have the SUID bit set.

Answer

They enable the user to bypass the sudo password prompt.

Question 6

You are building a malicious Microsoft Word document for a phishing campaign. You need the embedded macro to execute automatically as soon as the document is opened, without requiring the victim to click an additional button or dismiss a prompt beyond the initial security warning. Which document element must the macro reside in to achieve automatic execution?

Accepted Answer

The ThisDocument object's Document_Open event handler. The ThisDocument object exposes document-level event handlers, and Document_Open runs automatically when Word loads the file, provided macros are enabled. That combination gives the operator code execution without an additional click. Storing the payload elsewhere requires a separate trigger, which undermines the goal of immediate execution.

Answer

An Auto_Close macro stored in a standard module

Answer

A UserForm's Initialize event

Answer

A standard module inside the VBA project

Question 7

You download a public exploit archive from an unknown source. Before using it in the PEN-200 lab, which step best protects your own attacking machine from a trojanized exploit?

Accepted Answer

Run the exploit inside a disposable virtual machine with no shared folders and no host network bridging.. Isolating the exploit in a disposable VM without shared folders or bridged networking contains any malicious behavior and prevents it from reaching the host or other lab systems. Antivirus scans, hash lookups, and author claims all fail to prove safety because a trojanized exploit is designed to evade exactly those checks.

Answer

Scan the archive with the antivirus installed on your host before extracting it.

Answer

Read the exploit's comments and README to confirm the author claims it is safe.

Answer

Check the exploit's file hash against an online malware database and proceed if it is unknown.

Question 8

During post-exploitation on a Linux target, you discover a binary with the SUID bit set owned by root. Running 'strings' on the binary reveals it calls 'system("ps")' without specifying an absolute path. Which of the following techniques is most likely to allow you to escalate privileges by exploiting this behavior?

Accepted Answer

Create a malicious 'ps' executable in a directory earlier in the PATH, then run the SUID binary.. The SUID binary calls system("ps") without an absolute path, meaning it relies on the PATH environment variable to locate the ps command. If an attacker can prepend a writable directory to PATH and place a malicious ps script there, the SUID binary will execute it with root privileges. This is a classic PATH hijacking privilege escalation.

Answer

Overwrite the /bin/ps binary with a malicious script, then run the SUID binary.

Answer

Modify the binary to replace system("ps") with system("/bin/sh"), then run it.

Answer

Use LD_PRELOAD to inject a shared library that hijacks the system() call.

Question 9

You are developing a proof-of-concept exploit for a Linux x86 UDP service that crashes when sent a long string of 'B's. Before attempting to redirect execution, you want to determine whether the crash gives you control of the instruction pointer. Which single action best confirms that the saved return address on the stack has been overwritten?

Accepted Answer

Send a unique, non-repeating pattern (e.g., generated by pattern_create) and inspect the value of EIP in the debugger after the crash.. Sending a unique cyclic pattern and inspecting EIP in a debugger is the definitive way to prove control of the instruction pointer and calculate the exact offset. The other actions only show that a crash or delivery occurred, which is insufficient to establish exploitability. This step precedes choosing a jump instruction or placing shellcode.

Answer

Use netcat to send 5000 'B's and observe that the service process terminates.

Answer

Run the service under strace and check for a SIGSEGV signal in the output.

Answer

Attach a packet sniffer to the loopback interface and look for the string '41414141' in the UDP payload.

Question 10

You have captured a NetNTLMv2 hash during a man-in-the-middle attack. What is the most effective approach to use this hash to gain access to the target machine?

Accepted Answer

Attempt to relay the hash to another system that has SMB signing disabled.. NetNTLMv2 hashes are challenge-response hashes, not password hashes. They cannot be used in a pass-the-hash attack. Instead, they must be cracked offline to obtain the plaintext password or relayed to a target that supports NTLM authentication. Recognizing the distinction between NetNTLM and NTLM is a critical concept in OSCP-level testing, as it prevents the misuse of these credentials during lateral movement.

Answer

Use the hash directly in a pass-the-hash attack against an RDP session.

Answer

The hash can be used to authenticate to the Domain Controller for domain persistence.

Answer

Directly inject the hash into the LSASS process to create a new user session.

Question 11

What is the primary danger of using a public exploit without first auditing the source code?

Accepted Answer

The script might contain hidden malicious payloads.. Public exploits are often shared without security vetting. They may contain hidden payloads designed to compromise the researcher's system, execute unauthorized commands, or send sensitive information to a third-party server. Auditing the code ensures you understand exactly what the script does, protecting your own infrastructure and confirming that the exploit is safe and focused only on the intended target system during your assessment.

Answer

The script might use too much disk space.

Answer

The script will always work perfectly as intended.

Answer

The script might be written in an obscure language.

Question 12

You are adapting a public Python exploit for a Windows target. The exploit was written for a different architecture and uses a hardcoded payload. Which TWO actions are MOST appropriate to make the exploit work reliably? (Choose two.)

Accepted Answer

Update the exploit's target IP address and port variables to match your listener and the victim host.. Public exploits frequently contain hardcoded payloads and network settings from the original author's environment. Regenerating the payload for the target's architecture and OS, and updating the target and callback addresses, are the two changes that directly make the exploit function against your specific host. Other modifications are unnecessary or require prior access.

Answer

Rewrite the exploit in C to improve execution speed against the target.

Answer

Change the exploit's delivery mechanism from HTTP to SMB to bypass network filtering.

Answer

Disable the target's firewall to allow the reverse shell to connect back.

Question 13

An operator is analyzing why a compiled C# stager payload was flagged immediately by Windows Defender despite having a completely unique cryptographic hash. Which AV detection mechanism is most likely responsible for flagging the binary based on internal structure rather than known file signatures?

Accepted Answer

Heuristic analysis evaluating suspicious API imports, section characteristics, and code patterns indicative of stagers.. Heuristic and behavioral engines examine internal characteristics, structural layouts, and API import patterns rather than relying strictly on known file hashes. If a binary imports suspicious combinations of memory allocation and execution APIs, heuristics flag it as malicious even if the file has never been seen before.

Answer

Cloud-based cryptographic hash lookup databases containing global blacklists of known malware samples.

Answer

Static signature matching using rigid byte sequences extracted from older malware variants.

Answer

Network signature inspection monitoring incoming HTTP traffic headers for default command and control strings.

Question 14

Which Linux kernel feature, if misconfigured or outdated, allows an unprivileged user to gain root access by exploiting a vulnerability in the handling of user namespaces?

Accepted Answer

Unprivileged user namespace clone functionality. User namespaces allow unprivileged processes to behave as root within a confined environment. Vulnerabilities in how the kernel manages these namespaces, such as improper capability checks, can be exploited to gain full root access on the host system. This highlights the importance of kernel patching and minimizing the attack surface by disabling unnecessary namespace features on production servers to prevent escapes.

Answer

AppArmor profile confinement

Answer

Shared memory segment access via IPC

Answer

Extended file attributes (xattr)

Question 15

During a penetration test, you obtain a Kerberos TGS-REP hash for a service account. You want to crack this hash offline to recover the service account's password. Which of the following tools is most appropriate for this task?

Accepted Answer

Hashcat with mode 13100. Kerberoasting yields TGS-REP hashes that can be cracked offline. Hashcat mode 13100 is designed for RC4-encrypted TGS-REP hashes, providing efficient GPU-accelerated cracking. John the Ripper can also do it but is less optimized. Aircrack-ng and Hydra are not appropriate for offline Kerberos hash cracking. Therefore, Hashcat with mode 13100 is the best choice.

Answer

John the Ripper with the krb5tgs format

Answer

Hydra with the kerberos module

Answer

Aircrack-ng with the -K option