PEN-200 Practice Test 20 — 15 Questions

Question 1

When using SSH tunneling, what is the primary security risk of using the '-R' flag in a multi-user environment?

Accepted Answer

It exposes the tunnel to all users on the remote server.. The -R flag binds a port on the remote (attacker/server) machine. If that machine has other users logged in, they can potentially connect to the forwarded port and gain access to the internal network through the tunnel you established. This exposes your pivot to unintended access by other users on the same machine, which is a significant risk in shared lab or production environments.

Answer

It forces the remote server to enable password-less login.

Answer

It requires the remote server to have a GUI installed.

Answer

It automatically disables logs on the jump host.

Question 2

During a PEN-200 lab engagement, a tester delivers a custom C# implant compiled with csc.exe. Windows Defender's real-time protection immediately quarantines the executable at rest on disk, before any process is created. The tester wants to keep the same implant logic but reduce static file-based detection. Which approach best addresses this specific detection stage?

Accepted Answer

Pack the executable with a custom crypter that XOR-encrypts the payload bytes and decrypts them only in memory at runtime.. Detection at rest is driven by static signatures over the file's bytes and PE structure. Changing the stored representation so the original signature no longer matches, while reconstructing the functional payload only in memory, directly defeats that stage. Renaming, self-signing, and archiving leave the underlying executable bytes unchanged, so the same on-disk signature continues to match once the file is written or extracted.

Answer

Rename the executable to a trusted Windows binary name such as svchost.exe and place it in C:\Windows\System32.

Answer

Compress the executable into a password-protected ZIP archive and deliver the archive to the target host.

Answer

Sign the executable with a self-signed code-signing certificate generated with makecert.exe.

Question 3

When evaluating an antivirus solution's effectiveness, what is the primary difference between signature-based detection and behavioral-based detection?

Accepted Answer

Signatures identify known files, while behavior identifies suspicious actions.. Signature-based detection is a reactive approach that relies on a database of known threats, while behavioral-based detection is a proactive approach that monitors for suspicious actions. Understanding this distinction is crucial for evasion, as bypassing one often requires different techniques than bypassing the other, such as obfuscating file content versus using legitimate system tools for malicious purposes.

Answer

Signatures look for file hashes, while behavior looks for network traffic.

Answer

Signatures are only used for disk scans, while behavior is for memory scans.

Answer

Behavioral detection is always more accurate and faster than signature-based.

Question 4

During an external penetration test, you discover a web server hosting multiple virtual hosts. You want to enumerate additional hostnames that resolve to the same IP address without triggering intrusion detection systems. Which technique is most appropriate?

Accepted Answer

Query public Certificate Transparency logs for certificates issued for the target domain.. Certificate Transparency logs are a passive reconnaissance resource that aggregates certificates issued for domains. By querying these logs, you can discover subdomains and virtual hostnames without interacting with the target. This avoids IDS alerts and is a standard OSINT technique. The other options involve active scanning or noisy DNS queries that are more likely to be detected.

Answer

Send HTTP requests with different Host headers to the web server and analyze responses.

Answer

Perform a DNS zone transfer (AXFR) against the authoritative name server.

Answer

Use a reverse DNS sweep of the IP address range to identify PTR records.

Question 5

What is the primary security risk of an application that fails to properly validate the 'Content-Type' header during a file upload process?

Accepted Answer

It enables an attacker to bypass file type restrictions to upload executable scripts.. Relying on the 'Content-Type' header is dangerous because it is sent by the client and easily spoofed. If an application uses this header to determine file safety, an attacker can upload malicious scripts disguised as images. This leads to Remote Code Execution (RCE) if the web server executes the uploaded file, making secure file upload handling a critical defense-in-depth practice.

Answer

It allows attackers to perform SQL Injection attacks.

Answer

It prevents the server from storing large files, leading to denial of service.

Answer

It exposes the server to Cross-Site Request Forgery (CSRF) attacks.

Question 6

You compromise a Windows host and dump local account hashes with secretsdump, obtaining the NTLM hash of a local administrator. That same local administrator password was reused across every workstation in the environment. Which technique most directly allows lateral movement to other hosts using that hash without ever recovering the cleartext password?

Accepted Answer

Pass-the-Hash using the NTLM hash to authenticate to SMB on other hosts. Pass-the-Hash works because NTLM authentication relies on the stored hash to compute the challenge response, so possessing the hash equals possessing the credential for that account. With the local administrator password reused across workstations, feeding the hash to tools that support hash-based SMB authentication lets you move laterally to each host without cracking anything. Kerberos-based roasting techniques do not apply to local SAM accounts.

Answer

Kerberoasting the local administrator account to request a service ticket

Answer

AS-REP roasting the local account to recover its hash offline

Answer

Downgrading NTLM to LM and replaying the resulting LM hash

Question 7

You are performing a client-side attack against a target web application that uses a Content Security Policy (CSP) with the directive `script-src 'self'`. Which TWO techniques are most likely to bypass this CSP and execute JavaScript in a victim’s browser? (Choose two.)

Accepted Answer

Exploiting a JSONP endpoint on the target domain that reflects a callback parameter into executable JavaScript.. A CSP with script-src 'self' trusts scripts loaded from the target’s own origin. Therefore, an attacker who can host or reflect JavaScript on that origin bypasses the policy. Uploading a JavaScript file and loading it via a script tag, or abusing a same-origin JSONP endpoint, both result in script execution from a trusted origin. External scripts, inline scripts, and data URIs are blocked because they do not match 'self'.

Answer

Using an open redirect on the target domain to load a script from an external domain.

Answer

Using a data: URI in a script tag to embed the JavaScript payload.

Answer

Injecting an inline script tag with the payload directly into the HTML.

Question 8

Which file is essential for auditing to determine which users have been granted sudo privileges?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the configuration file that controls sudo access. It defines exactly which users or groups can execute commands with elevated privileges and under what conditions. Auditing this file is the standard way to identify misconfigurations that could allow a low-privileged user to gain root access. Understanding its syntax is vital for any security professional to accurately identify and remediate potential privilege escalation paths in a Linux environment.

Answer

/etc/passwd

Answer

/etc/shadow

Answer

/etc/group

Question 9

When performing reconnaissance on an unknown network, you discover a service running on port 161. What is the most appropriate action to take to determine if this service can be abused?

Accepted Answer

Use snmpwalk to attempt to retrieve data using default community strings.. Port 161 is the default port for SNMP (Simple Network Management Protocol). Often, SNMP is misconfigured with default community strings like 'public' or 'private'. By testing these strings, a tester can potentially retrieve sensitive system information such as running processes, network interfaces, and even user accounts. This is a classic, high-value enumeration target that frequently yields significant information for further lateral movement or privilege escalation within the network environment.

Answer

Attempt a brute-force attack on the SSH service.

Answer

Run a full Nmap script scan for all protocols.

Answer

Ignore the port as it is rarely used for anything critical.

Question 10

An ethical hacker wants to evade signature-based detection while developing a custom reverse shell loader for a PEN-200 lab assignment. Which technique fundamentally alters the binary's byte signatures without modifying its core execution logic or breaking the payload?

Accepted Answer

Applying XOR encoding to the payload buffer and implementing a custom runtime stub to decrypt it in memory.. Encoding or encrypting the payload alters static byte signatures that antivirus engines use to flag known malicious files. By decoding the payload dynamically in memory at runtime, the payload remains obfuscated on disk, preventing signature detection while preserving the exact execution logic required for the reverse shell to successfully connect back to the attacking machine.

Answer

Stripping all debugging symbols and symbol tables from the executable using strip.

Answer

Modifying the file extension from .exe to .scr to trick the operating system shell.

Answer

Compressing the final executable binary using standard ZIP archiving utilities without a password.

Question 11

What is the primary goal of utilizing an intercepting proxy during a web application penetration test?

Accepted Answer

To manipulate HTTP requests and responses for vulnerability testing.. An intercepting proxy allows the tester to pause, inspect, and modify HTTP traffic between the client and the server. This is essential for discovering hidden parameters, testing edge cases, and bypassing client-side validation controls. By controlling the request flow, testers can effectively manipulate application logic to uncover vulnerabilities that would be impossible to trigger through standard web browser interaction alone, making it an indispensable tool for deep analysis.

Answer

To automatically find and patch all vulnerabilities in the application.

Answer

To increase the network speed of the testing machine.

Answer

To hide the tester's identity from the target server.

Question 12

Refer to the exhibit. An examiner attempts to use raw msfvenom output directly in a custom C template for a PEN-200 lab assignment, but the payload is instantly detected. Why is generating raw msfvenom output generally ineffective for antivirus evasion without further modification?

Accepted Answer

Default msfvenom payloads contain heavily signatured stager stubs and byte patterns that are universally fingerprinted by security products.. Default msfvenom templates and encoders contain heavily signatured instruction patterns and well-known strings that antivirus vendors have fingerprinted extensively over many years. Without custom encoding, manual structural modifications, or custom loader implementation, raw framework outputs are immediately flagged by signature scanners.

Answer

The C array output format automatically introduces formatting syntax errors that cause the compiler to generate invalid portable executable headers.

Answer

Using HTTPS as the communication protocol forces the stager to include unencrypted TLS certificates that antivirus software automatically blocks.

Answer

The 64-bit architecture flag conflicts with standard Windows Defender file scanning routines, triggering an immediate administrative alert.

Question 13

Which THREE of the following are valid techniques for achieving persistence within an Active Directory environment?

Accepted Answer

Skeleton Key. Persistence techniques involve creating backdoors that survive account password changes or system reboots. Skeleton Key modifies the LSASS process to accept a master password. Golden Tickets use the KRBTGT hash to forge TGTs indefinitely. Security Descriptor changes on the 'AdminSDHolder' object ensure that specific permissions are consistently applied to privileged groups, even if an administrator removes them manually, maintaining long-term access.

Answer

Kerberoasting

Answer

LLMNR Poisoning

Question 14

You are enumerating a Linux host and find that UDP port 161 responds to SNMP queries with the community string 'public'. Which action yields the most useful reconnaissance data for planning later exploitation?

Accepted Answer

Run snmpwalk against the device to dump the MIB tree and extract system and interface information.. A working SNMP community string grants read access to the Management Information Base, and snmpwalk systematically dumps that tree. The resulting system descriptions, interface listings, and routing data give concrete enumeration value, exposing OS details and network layout that guide subsequent exploitation far better than any write, authentication, or trap-based approach.

Answer

Send SNMP traps to the device to force it to report its running configuration.

Answer

Use the community string to authenticate to the device over SSH on port 22.

Answer

Attempt an SNMP write operation using the same community string to alter device configuration.

Question 15

You have gained a low-privileged shell on a Windows system and discovered a service running as 'LocalSystem' with an unquoted executable path containing spaces. Which action is the most direct way to escalate privileges?

Accepted Answer

Place a malicious binary at a location in the unquoted path that the user can write to.. Unquoted service paths are vulnerable because Windows attempts to resolve the path by interpreting spaces as delimiters. By placing a malicious executable at an intermediate folder in the path, the service manager executes your binary with SYSTEM privileges upon restart. Identifying and exploiting these paths is a foundational skill for post-exploitation, allowing attackers to elevate from standard user to the highest possible integrity level without needing complex kernel exploits.

Answer

Restart the service immediately to trigger a buffer overflow.

Answer

Overwrite the existing service executable with your payload.

Answer

Modify the Windows Registry to point the service to a new location.