PEN-200 Practice Test 2 — 10 Questions

Question 1

During an internal Active Directory assessment, you have compromised a standard domain user account. You run BloodHound and identify that this user has the 'GenericAll' permission over a computer object named WEB01. You want to leverage this permission to compromise WEB01 and obtain administrative access to it. Which of the following is the most direct and reliable technique to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the GenericAll permission to perform a shadow credentials attack by adding a Key Credential to the msDS-KeyCredentialLink attribute of WEB01.. GenericAll over a computer object allows full control, including modifying the msDS-KeyCredentialLink attribute. By adding a Key Credential, an attacker can authenticate as the computer account via PKINIT and obtain a TGT, effectively taking over the machine. This shadow credentials technique is direct and does not require cracking or additional accounts, making it the most efficient path to compromise WEB01.

Answer

Use the GenericAll permission to perform a targeted Kerberoasting attack by setting an SPN on a user account you control, then request a service ticket.

Answer

Perform a Kerberoasting attack against the machine account of WEB01 to obtain its hash and then crack it offline.

Answer

Use the GenericAll permission to perform a resource-based constrained delegation attack by modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

Question 2

Which of the following is the most effective way to prevent Cross-Site Scripting (XSS) in a web application?

Accepted Answer

Implementing context-aware output encoding for all user-supplied data.. The most effective defense against XSS is context-aware output encoding. By converting special characters into their HTML entity equivalents before rendering, you ensure the browser treats the input as data rather than executable code. This is a critical security practice because it handles the root cause of the vulnerability—the browser's inability to distinguish between intended content and injected malicious scripts, regardless of the user input provided.

Answer

Using a blacklist to filter out common JavaScript keywords.

Answer

Disabling all JavaScript in the user's browser settings.

Answer

Setting all cookies with the 'Secure' flag in the response header.

Question 3

What is the most likely security risk associated with the configuration shown in the exhibit?

Accepted Answer

Attackers can browse the directory and discover sensitive files.. The 'Indexes' option enables directory listing, allowing attackers to browse the web server's file system if no index file is present. This is a significant information disclosure vulnerability because it exposes sensitive configuration files, backups, and source code that were never intended for public view. Disabling directory browsing is a fundamental hardening step for any web server to prevent accidental leakage of proprietary or sensitive infrastructure information.

Answer

The server will allow remote code execution through the index file.

Answer

The configuration will prevent users from accessing any files.

Answer

The server will stop processing PHP files entirely.

Question 4

When performing a DCSync attack, what is the core mechanism being exploited?

Accepted Answer

The Active Directory Replication Service (DRS) protocol. DCSync exploits the Active Directory replication protocol. By mimicking the behavior of a domain controller, an attacker can request that another domain controller replicate user credentials, including password hashes, to them. This requires the attacker to hold 'Replication-Get-Changes' and 'Replication-Get-Changes-All' permissions, which are typically only held by domain controllers or highly privileged administrators, making it a powerful tool for dumping the entire domain's secrets.

Answer

The Kerberos ticket granting service process

Answer

The LDAP signing enforcement on the Domain Controller

Answer

The storage of passwords in the SYSVOL share

Question 5

What is the primary purpose of an exploit payload in a buffer overflow context?

Accepted Answer

To execute arbitrary commands on the target system.. The exploit payload is the set of instructions (often shellcode) that you want the CPU to execute once you have successfully redirected the program's control flow. The goal is to perform an action, such as spawning a reverse shell or executing a command. The entire process of finding an offset and overwriting the return address is merely the delivery vehicle for this payload, which provides the desired post-exploitation access.

Answer

To increase the size of the target buffer.

Answer

To crash the application for a denial-of-service attack.

Answer

To bypass the authentication mechanism of the application.

Question 6

When evaluating a web application for Cross-Site Scripting vulnerabilities during a penetration test, which TWO input contexts should you examine because they frequently lead to executable script injection?

Accepted Answer

Input reflected directly between opening and closing HTML tags, such as

USER_INPUT

. XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Answer

Input processed by a backend database stored procedure for primary key generation

Answer

Input stored as an encrypted binary blob inside the browser local session storage

Answer

Input utilized as a parameter value inside a server-side JSON response header without content-type sniffing

Question 7

During enumeration, you discover that the registry keys 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated' and 'HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated' are both set to 1. Which of the following is the most efficient way to exploit this configuration?

Accepted Answer

Generate a malicious MSI file and execute it using 'msiexec /quiet /qn /i payload.msi'.. The AlwaysInstallElevated policy is a specific Windows feature that allows non-privileged users to run Windows Installer (MSI) packages with SYSTEM privileges. For this to work, the policy must be enabled in both the machine (HKLM) and user (HKCU) registry hives. Attackers can exploit this by crafting a malicious MSI file that executes a command, such as adding a user or opening a reverse shell.

Answer

Use 'certutil' to download and execute a portable executable (EXE) directly.

Answer

Modify the 'AlwaysInstallElevated' key in HKCU to point to a malicious script instead of '1'.

Answer

Inject a malicious DLL into the 'msiexec.exe' process while it is running.

Question 8

You are adapting a public exploit whose payload is a reverse shell. The exploit runs and the service reports success, but your netcat listener never receives a connection. Which cause is most likely?

Accepted Answer

The target's outbound firewall blocks the callback port, or the payload is calling back to an address the target cannot route to.. When exploitation succeeds but no callback arrives, the network path from target to listener is the prime suspect. Outbound firewall rules or a payload addressed to an unroutable interface stop the reverse shell even though the vulnerability was triggered. Offset errors would crash the service, netcat is a valid listener, and high-port binding needs no elevated privileges.

Answer

Netcat is not capable of receiving reverse shells and a different listener is required.

Answer

The exploit's buffer overflow offset is incorrect, so the payload never reaches the instruction pointer.

Answer

The exploit was run without administrative privileges on the attacker machine, preventing the listener from binding.

Question 9

Refer to the exhibit. ```http HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

Welcome

``` Based on the HTTP response headers and body shown in the exhibit, what significant security risk is present regarding client-side attacks?

Accepted Answer

The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting. The inclusion of the 'unsafe-inline' directive in the Content Security Policy script-src allows the browser to execute inline script blocks present in the HTML. This configuration largely defeats the protective benefits of a CSP against Cross-Site Scripting, as attackers who can inject inline scripts will achieve execution.

Answer

The application is completely immune to Cross-Site Scripting because a Content Security Policy is strictly enforced

Answer

The server is vulnerable to remote code execution because the nginx version header is explicitly exposed

Answer

The session token is vulnerable to interception because the response is transmitted over unencrypted HTTP

Question 10

During an engagement, you capture an AS-REP response from the domain controller. What is the specific prerequisite for this account to be vulnerable to AS-REP Roasting?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' option enabled.. AS-REP Roasting is possible when a user account has the 'Do not require Kerberos pre-authentication' attribute enabled in Active Directory. This allows an attacker to request a ticket for the user without needing the correct password, which can then be cracked offline. Understanding this specific AD attribute is critical for identifying vulnerable accounts during internal reconnaissance, as it represents a significant misconfiguration that simplifies the path to credential recovery.

Answer

The account must have a Service Principal Name (SPN) set in the domain properties.

Answer

The user must be a member of the Domain Admins or Enterprise Admins group.

Answer

The account must be configured with a password that has never been rotated.