PEN-200 Practice Exam 2 — 20 Questions

Question 1

During an assessment, you identify a Cross-Site Scripting vulnerability that allows you to execute arbitrary JavaScript in the context of a victim user's browser session. What is the primary objective of leveraging this capability against an authenticated user?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hijacking the user session by accessing session tokens or performing actions on their behalf within the application. XSS allows attackers to execute scripts in the victim browser session, giving them access to document.cookie, local storage, and the ability to perform actions on behalf of the user. This effectively hijacks their session without needing to crack their underlying password.

Answer

Extracting plaintext password hashes directly from the remote web server operating system memory

Answer

Modifying the enterprise DNS records hosted on the primary domain controller via client-side DOM manipulation

Answer

Bypassing enterprise firewall packet inspection rules by encapsulating shellcode inside HTTPS headers

Question 2

During an external penetration test, you discover a web application that uses a JSON Web Token (JWT) for authentication. The token header is {"alg":"HS256","typ":"JWT"}, and you have captured a valid token. You want to escalate privileges by modifying the "role" claim from "user" to "admin". Which action would most likely allow you to forge a valid token?

Accepted Answer

Brute-force the HMAC secret used to sign the token, then re-sign the modified token.. The JWT is signed with HS256, meaning a symmetric secret is used. If that secret is weak, an attacker can crack it offline and then sign arbitrary tokens. Changing the algorithm to "none" might work only if the server is misconfigured, but brute-forcing the secret is a direct and reliable method when the secret is guessable. The other options either rely on server misconfigurations or incorrect cryptographic assumptions.

Answer

Change the "alg" value to "none" and remove the signature, then send the token.

Answer

Modify the "role" claim and recompute the signature using the original token's signature as the key.

Answer

Change the "alg" value to "RS256" and sign the token with the public key.

Question 3

Which of the following describes the 'Open Redirect' vulnerability often used in phishing attacks?

Accepted Answer

The application uses user-supplied parameters to control the destination of a redirect.. Open Redirect occurs when an application accepts user-supplied input to determine a destination URL without validating it against a whitelist. Attackers exploit this to redirect users to a malicious site. Because the URL starts with the trusted domain, victims are less likely to suspect a phishing attempt, making it a highly effective social engineering technique to steal credentials or deliver malware.

Answer

The application reflects user input into the HTML body, allowing for XSS.

Answer

The application fails to set the Secure flag on cookies during redirection.

Answer

The application allows arbitrary file uploads to the server's redirect directory.

Question 4

A penetration tester is investigating scheduled tasks for potential privilege escalation. Which TWO conditions must be met for a scheduled task to be successfully exploited for gaining SYSTEM privileges?

Accepted Answer

The task is configured to run under the context of the SYSTEM account or a member of the Administrators group.. Scheduled tasks are a common persistence and escalation vector. For escalation, the task must execute with higher privileges than the current user, typically as SYSTEM or an Administrator. Additionally, the attacker must have the ability to influence what the task executes, either by modifying the executable file, a script it calls, or the task configuration itself to point to a malicious file.

Answer

The task must have a trigger set to 'At log on' for any user on the system.

Answer

The 'Hidden' attribute must be enabled in the task settings to bypass Windows Defender detection.

Answer

The task must be part of the default Windows installation rather than a third-party application.

Question 5

During an internal penetration test, you compromise a Linux machine that acts as a pivot host, but the target internal web server only permits HTTP traffic from localhost. Which local port forwarding syntax allows you to securely access this web application via your attacking machine?

Accepted Answer

ssh -L 8080:10.0.4.5:80 user@pivot-host. Local port forwarding binds a port on your attacking machine and forwards any connections through the compromised pivot host to the destination service. This technique bypasses strict perimeter controls by tunneling traffic securely across an existing SSH session, enabling interaction with internal services restricted strictly to localhost interfaces.

Answer

ssh -R 8080:10.0.4.5:80 user@pivot-host

Answer

ssh -D 1080 user@pivot-host

Answer

ssh -w 0:0 user@pivot-host

Question 6

Refer to the exhibit. You are running a public exploit, but it fails with a 'Connection refused' error. What should you investigate first?

Accepted Answer

The service availability and network path to the target.. A 'Connection refused' error usually indicates that the target port is not open, the service is not running, or a firewall is blocking the connection. Investigating the network connectivity and service status using tools like Nmap or netcat is essential. This allows you to confirm the service is actually reachable and running on the expected port before assuming the exploit itself is flawed or the payload is failing.

Answer

The exploit's payload encoding settings.

Answer

The exploit's memory address offsets.

Answer

The target's operating system version.

Question 7

You are assessing a Windows host and discover the Print Spooler service is running. You locate a public PoC for CVE-2021-1675 that requires an attacker-controlled SMB share hosting a malicious DLL. You want to execute the exploit from your Kali machine against the target. Which action must you take FIRST before running the PoC?

Accepted Answer

Configure a Samba share on your Kali machine with anonymous read access that hosts the malicious DLL.. The PrintNightmare PoC abuses the Spooler's driver installation to load a DLL from a UNC path. The attacker must therefore host that DLL on an SMB share reachable by the target, typically with anonymous read access. The other options either target the wrong delivery mechanism or assume capabilities the attacker does not yet possess.

Answer

Upload the DLL to C:\Windows\Temp on the target using an existing low-privilege session.

Answer

Start a Metasploit handler on port 445 to catch the reverse shell from the Spooler service.

Answer

Disable Windows Defender Real-Time Protection on the target through a registry remoting call.

Question 8

You have compromised a Linux host that sits on both your external network and an isolated internal network containing a Windows server with SMB exposed. From your Kali machine you need to interact with the SMB service as if it were local. Which single command creates the correct tunnel?

Accepted Answer

ssh -L 127.0.0.1:445:10.10.10.20:445 user@10.10.10.10. A local port forward created with -L makes your attacking machine listen on a chosen local address and port, then relays that traffic through the SSH server to a destination reachable from the pivot. Binding to 127.0.0.1 keeps the forwarded port private to your host, which is appropriate when only your local tools need to reach the internal SMB service. Remote and dynamic forwards solve different problems and do not give a direct local-to-internal mapping here.

Answer

ssh -D 445 user@10.10.10.10

Answer

ssh -R 127.0.0.1:445:10.10.10.20:445 user@10.10.10.10

Answer

ssh -L 0.0.0.0:445:10.10.10.20:445 user@10.10.10.10

Question 9

You have compromised a service account that has the SeEnableDelegationPrivilege right on a domain controller. You want to abuse Kerberos delegation to gain access to a target server's file share. Which two steps are required to configure and exploit unconstrained delegation on a controlled computer object? (Choose two.)

Accepted Answer

Set the TRUSTED_FOR_DELEGATION flag on the controlled computer object so the domain controller will forward TGTs to it.. Unconstrained delegation abuse requires two things: enabling the TRUSTED_FOR_DELEGATION flag on a controlled computer so the DC forwards TGTs to it, and coercing a privileged user to authenticate to that computer so a TGT is cached in memory. Extracting the TGT then allows impersonation. The other options describe constrained delegation, an unrelated SPN configuration, or a security control that blocks the attack.

Answer

Configure a Service Principal Name on the controlled computer object for the target file share service (cifs/target).

Answer

Modify the msDS-AllowedToDelegateTo attribute on the controlled computer to include the target server's CIFS service.

Answer

Add the controlled computer to the Protected Users group to ensure delegation tokens are cached securely.

Question 10

You have obtained a plaintext password for a domain user and want to quickly identify which domain-joined systems the account can access with local administrative rights, without triggering account lockout. Which approach is most appropriate?

Accepted Answer

Use CrackMapExec with the -u and -p options against a list of hosts and the smb module to check for administrative access.. CrackMapExec with valid credentials is the standard tool for quickly checking administrative access across many hosts. It performs a single authentication per host using the known password, avoiding lockout, and reports whether the account has local admin rights. Alternatives either risk lockout, capture unrelated credentials, or collect session data that does not directly answer the access question.

Answer

Execute BloodHound with SharpHound using the -c Session collection method to enumerate where the user has administrative rights.

Answer

Use Hydra to brute-force the password against SMB on each host to confirm administrative access.

Answer

Run Responder on the network to poison LLMNR and capture administrative credentials from other hosts.

Question 11

During a red team engagement, a tester writes a C# loader that calls the Win32 API function VirtualAllocEx to allocate memory in a remote process, writes shellcode, and creates a remote thread. The loader compiles and runs, but the endpoint's EDR blocks it before the remote thread executes. The tester confirms the EDR is hooking user-mode API functions in ntdll.dll. Which approach most directly avoids the user-mode hooks that triggered the block?

Accepted Answer

Implement direct system calls by reading the syscall numbers from a clean copy of ntdll.dll and executing the syscall instruction directly from the loader's own code.. User-mode EDR hooks are implemented by patching the entry points of functions inside ntdll.dll. Any call that goes through those functions, whether via the kernel32 wrapper or the Nt-prefixed export, passes through the hook. Direct system calls sidestep the problem by placing the syscall instruction in the loader's own code with the correct service number, so execution transitions to kernel mode without touching the hooked ntdll stubs. This is the most reliable way to bypass user-mode hooking without altering system DLLs.

Answer

Add the /DYNAMICBASE:NO linker flag so the loader's base address does not change between runs.

Answer

Replace the calls to VirtualAllocEx and CreateRemoteThread with their NtAllocateVirtualMemory and NtCreateThreadEx equivalents from ntdll.dll.

Answer

Call VirtualProtect on the ntdll.dll .text section to restore the original bytes before invoking the API.

Question 12

During a PEN-200 lab, a penetration tester develops a custom C# loader that allocates memory, writes shellcode, and executes it. Windows Defender's AMSI flags the process when the shellcode buffer is passed to a scanning routine. The tester wants to prevent AMSI from inspecting the buffer at runtime without disabling Defender. Which technique should the tester apply?

Accepted Answer

Use the AmsiScanBuffer function's memory patching to force it to return a clean result.. AMSI scans buffers passed to functions like AmsiScanBuffer; to evade it without disabling Defender, the tester can patch AmsiScanBuffer in memory to return a benign result. This prevents the shellcode from being flagged. Encoding, CFG, or user privileges do not stop AMSI from scanning the buffer at runtime.

Answer

Run the loader under a different user account with limited privileges.

Answer

Base64-encode the shellcode and decode it at runtime before execution.

Answer

Compile the loader with the /guard:cf flag to enable Control Flow Guard.

Question 13

A penetration tester needs to deliver a Meterpreter payload to a Windows target protected by an EDR that performs both static file scanning and behavioral monitoring of process creation. The tester wants to reduce the chance of detection during initial execution while still obtaining a session. Which two techniques most directly reduce detection in this combined scenario? (Choose two.)

Accepted Answer

Spawn the payload by injecting into a legitimate, already-running process such as explorer.exe rather than starting a new process.. The scenario involves two distinct controls: static file scanning and behavioral process monitoring. A custom loader with encrypted shellcode removes recognizable bytes from disk, defeating static signatures. Injecting into an existing trusted process avoids the new-process creation event that behavioral engines monitor, placing execution inside a process already deemed legitimate. Together these address both controls. Renaming, UPX packing, and registry tampering either leave the static bytes intact or generate their own high-signal events.

Answer

Disable Windows Defender real-time protection by modifying the registry before executing the payload.

Answer

Rename the payload executable to svchost.exe and place it in the user's temp directory.

Answer

Compress the payload with UPX and deliver it as a self-extracting archive.

Question 14

An attacker gains a low-privilege shell on a Windows 10 machine and discovers a third-party service named 'DataSync'. The attacker notes that the service runs as SYSTEM and they have 'FILE_WRITE_DATA' permissions on the service executable 'C:\Program Files\DataSync\sync.exe'. Which action is the most direct method to escalate privileges to SYSTEM?

Accepted Answer

Stop the service, replace 'sync.exe' with a malicious payload, and restart the service.. Service binary hijacking is a powerful technique where an attacker replaces a legitimate executable with a malicious one. Since the service runs as SYSTEM, the replaced binary will execute with those high privileges upon the next service start. This method is often more reliable than DLL hijacking because it directly controls the primary execution flow of the service, provided the attacker can restart the service or wait for a system reboot.

Answer

Place a malicious DLL named 'sync.dll' in the 'C:\Windows\System32' directory to intercept calls.

Answer

Modify the service configuration using 'sc config' to point to a different malicious executable.

Answer

Create a new service with the same name in the 'HKCU' registry hive to override the system service.

Question 15

A junior penetration tester is preparing a payload for a Windows 10 target and wants to avoid signature-based detection by changing the binary's appearance without altering its functionality. Which technique is specifically designed to achieve this?

Accepted Answer

Encoding the payload with msfvenom's shikata_ga_nai encoder multiple times.. Shikata_ga_nai is a polymorphic encoder that mutates the payload's bytes while preserving its functionality, directly targeting signature-based detection by changing the binary appearance. The other options either do not alter the binary signature, are easily unpacked, or change only the delivery mechanism rather than the payload's bytes.

Answer

Splitting the payload into multiple chunks and reassembling at runtime.

Answer

Running the payload from a remote SMB share instead of the local disk.

Answer

Compressing the payload with UPX to reduce its size.

Question 16

When reviewing 'sudo -l' output, what does the 'NOPASSWD' tag signify for the listed command?

Accepted Answer

The command can be run as root without entering a password.. The 'NOPASSWD' tag indicates that the user can execute the specified command with sudo privileges without being prompted for their own password. This is a critical misconfiguration, as it removes the authentication barrier for privilege escalation. In an attack scenario, it allows for immediate, automated execution of commands as root, which is significantly more dangerous than configurations that still require a user to authenticate via their password.

Answer

The user is automatically added to the root group.

Answer

The command is not logged by the system administrator.

Answer

The command will run in a sandbox for security.

Question 17

Which command-line tool is primarily used during the reconnaissance phase to identify open ports and service versions on a remote target?

Accepted Answer

Nmap. Nmap is the industry-standard tool for port scanning and service enumeration. By identifying open ports and the software versions running on them, a tester can pinpoint specific vulnerabilities to research. This step is the foundation of the reconnaissance phase, as it maps the target's attack surface and guides the subsequent selection of exploits, ensuring a focused and efficient penetration testing process.

Answer

netcat

Answer

Wireshark

Answer

grep

Question 18

You have compromised a Windows server and want to escalate privileges using the `AlwaysInstallElevated` setting. You check the registry and find that both `HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` are set to 1. What is the most direct way to leverage this misconfiguration?

Accepted Answer

Create a malicious MSI package and execute it with `msiexec /quiet /qn /i malicious.msi` to run with SYSTEM privileges.. With AlwaysInstallElevated enabled in both registry hives, any MSI package installed by a user runs with SYSTEM privileges. The most direct exploitation is to create a malicious MSI that performs a privileged action, such as adding a user to the Administrators group, and then install it using `msiexec`. This leverages the misconfiguration exactly as designed.

Answer

Leverage the setting to bypass UAC and run any executable as an administrator without an MSI package.

Answer

Use `reg add` to modify the service binary path of a running service to point to a malicious executable.

Answer

Extract the MSI to a writable directory and replace a DLL to achieve privilege escalation.

Question 19

You identify a cron job running as root that executes a script located in a writable directory. What is the most reliable way to escalate privileges in this scenario?

Accepted Answer

Append a reverse shell command to the writable script.. When a cron job runs as root, any script it executes also runs with root privileges. If the script is writeable by a low-privileged user, it can be modified to include a reverse shell. This is a common misconfiguration that highlights the importance of checking file permissions and cron job schedules during the post-exploitation phase of a penetration test or a professional security assessment.

Answer

Modify the /etc/shadow file directly.

Answer

Restart the crond service to force execution.

Answer

Change the ownership of the script using chmod.

Question 20

You are developing an exploit for a 32-bit Windows application that contains a stack-based buffer overflow. After overwriting EIP with a JMP ESP address, you place a payload that includes a reverse shell. During testing, the shell connects back successfully, but the application crashes immediately after the shell terminates. What is the most likely cause of the crash?

Accepted Answer

The shellcode lacks a proper exit sequence, causing the process to execute invalid memory after the shell ends.. The crash after the shell terminates suggests that the shellcode does not properly exit the process. When shellcode completes, it must call a termination function like ExitProcess; otherwise, the CPU continues executing whatever bytes follow, often leading to an access violation. The other options are inconsistent with the observed successful shell connection, which confirms that the overwrite and shellcode execution were correct.

Answer

The offset to EIP was miscalculated, causing the return address to be overwritten with an incorrect value.

Answer

The shellcode was encoded with an XOR encoder that corrupted the payload after execution.

Answer

The JMP ESP address contains a null byte, which truncates the payload during transmission.