PEN-200 Practice Exam 3 — 20 Questions

Question 1

Why might a public exploit for a specific service fail to execute even when the service version matches the vulnerability description exactly?

Accepted Answer

The target environment has different memory protections or patch levels.. Public exploits are typically written against a specific environment, which may differ from your target's configuration. Variations in operating systems, patch levels, installed libraries, or memory protection mechanisms like ASLR and DEP can prevent the exploit from succeeding. Understanding these environmental dependencies is key to troubleshooting failed exploits, as it often requires you to manually port or adjust the exploit to fit the target's unique security posture.

Answer

The exploit code is always written in an incompatible shell format.

Answer

Public exploits are intentionally corrupted to prevent usage.

Answer

You forgot to increase the network timeout settings.

Question 2

You have identified an open port 445 on a Windows machine. Which tool is most effective for checking if the machine is vulnerable to common SMB-based exploits like EternalBlue?

Accepted Answer

Use Nmap with the --script smb-vuln-ms17-010 argument.. Nmap's scripting engine (NSE) is the most effective way to check for specific vulnerabilities like EternalBlue without requiring a full-scale vulnerability scanner. The 'smb-vuln-ms17-010' script is specifically designed to detect this vulnerability. Using such targeted scripts allows for accurate assessment with minimal footprint, which is a hallmark of professional penetration testing practices, ensuring the system's security posture is evaluated safely and effectively during the reconnaissance phase.

Answer

Use ping to verify the host is reachable.

Answer

Run a full Nessus scan against the IP.

Answer

Use telnet to manually send an exploit string.

Question 3

You need to fingerprint the web server technology behind an HTTP service without sending malformed or intrusive requests. Which two actions best accomplish passive-leaning banner and behavior fingerprinting during enumeration? (Choose two.)

Accepted Answer

Inspect the Server and X-Powered-By response headers returned in the HTTP reply.. Header inspection and error-page analysis both identify server technology using ordinary, non-destructive requests. Headers may name the server and runtime directly, while distinctive 404 templates expose the stack when banners are hidden. Together they fingerprint the web service safely, whereas crash attempts, full port sweeps, and credential guessing are intrusive or simply unrelated to identifying the technology.

Answer

Send a buffer of several thousand bytes in the request line to provoke a crash signature.

Answer

Run a full TCP port scan of all 65535 ports on the host to infer the web stack.

Answer

Attempt default administrative credentials against the web login form.

Question 4

You have a Windows host with outbound internet access but want to avoid installing a full agent. You decide to use Chisel to pivot. Which statement accurately describes how Chisel establishes the tunnel in this scenario?

Accepted Answer

The Chisel client on the compromised host connects outbound to the Chisel server on your attacking machine, and the server can expose a SOCKS proxy on your side.. Chisel's client dials the server, so a compromised host with only outbound access can still establish a tunnel. When the server is started with reverse tunneling and SOCKS support, the operator gets a SOCKS proxy locally that routes through the client into the internal network. This makes Chisel a practical choice when a full agent is undesirable.

Answer

Chisel encrypts traffic only when the --tls flag is used, and otherwise sends plaintext over the wire.

Answer

The Chisel server must run on the compromised host so the client on your attacking machine can pull traffic from the internal network.

Answer

Chisel requires a kernel TUN interface on both endpoints to carry the tunneled traffic.

Question 5

Why must you carefully identify 'bad characters' before finalizing an exploit payload?

Accepted Answer

To ensure the shellcode is correctly copied into memory in its entirety.. Bad characters are bytes that cause a function or protocol to stop processing input prematurely. If these characters exist in your shellcode, the application will truncate the payload. Identifying these characters ensures that the full exploit string is correctly placed into memory, allowing the overflow to reach the return address and execute the shellcode as intended without corruption or partial injection.

Answer

To prevent the shellcode from triggering an antivirus alert.

Answer

To allow the CPU to perform faster instruction decoding.

Answer

To bypass DEP (Data Execution Prevention) controls.

Question 6

You are performing a penetration test against a Linux server and have obtained a copy of the /etc/shadow file. The file contains a hash for user 'admin' that starts with '$6$'. You want to crack this hash offline. Which hashcat mode should you use?

Accepted Answer

Mode 1800 (sha512crypt). The '$6$' prefix in /etc/shadow denotes SHA-512 crypt, which is handled by hashcat mode 1800 (sha512crypt). The other modes correspond to different algorithms: mode 500 for md5crypt ('$1$'), mode 3200 for bcrypt ('$2a$'), and mode 7400 for sha256crypt ('$5$'). Using the correct mode is essential for successful cracking. Therefore, mode 1800 is the right choice.

Answer

Mode 7400 (sha256crypt)

Answer

Mode 3200 (bcrypt)

Answer

Mode 500 (md5crypt)

Question 7

You are testing a web application that sets a session cookie with the HttpOnly flag. You find a reflected XSS vulnerability on a page that does not require authentication. What is the primary impact of exploiting this XSS given the HttpOnly flag?

Accepted Answer

You can execute arbitrary JavaScript in the victim’s browser to perform actions as the victim, but you cannot directly read the session cookie via document.cookie.. HttpOnly is designed to prevent client-side scripts from reading cookie values, but it does not prevent script execution or stop the browser from sending the cookie with requests. An attacker who achieves XSS can still act as the victim by issuing requests, reading page content, or capturing keystrokes. The session cookie may be inaccessible to document.cookie, but the authenticated session remains exploitable.

Answer

You can read the session cookie using document.cookie because HttpOnly only applies to cookies set over HTTPS.

Answer

You can bypass HttpOnly by using XMLHttpRequest to fetch the cookie from the server’s response headers.

Answer

You cannot execute JavaScript at all because HttpOnly blocks all script execution on the page.

Question 8

Which of the following best describes the function of the EIP register in the context of a stack-based buffer overflow?

Accepted Answer

It points to the memory address of the next instruction to be executed.. The EIP (Extended Instruction Pointer) register holds the memory address of the next instruction the CPU should execute. In an exploit, the goal is to overwrite this register by corrupting the saved return address on the stack. When the function finishes, the CPU pops this controlled value into EIP, forcing the processor to jump to the attacker's shellcode, thus hijacking the control flow of the entire application.

Answer

It stores the current stack frame's base address.

Answer

It keeps track of the number of active threads.

Answer

It holds the results of arithmetic operations.

Question 9

Refer to the exhibit. If you attempt an SSH remote port forward (-R) to bind a port to all network interfaces on the server, what will happen?

Accepted Answer

The port will be bound to 127.0.0.1 instead of 0.0.0.0.. The 'GatewayPorts no' setting in the sshd_config specifically prevents forwarded ports from binding to any interface other than the loopback (localhost). Even if the user specifies 0.0.0.0 or a public IP in their SSH command, the server will ignore this request and bind the port only to 127.0.0.1. This is a common security hardening measure to prevent unauthorized access to forwarded ports from external networks.

Answer

The request will be rejected and the connection will close.

Answer

The server will allow the binding because it is a superuser request.

Answer

The connection will hang indefinitely.

Question 10

During an authorized web application assessment, you discover a search page that reflects the query parameter directly into the HTML response body without encoding. You want to confirm the presence of a reflected cross-site scripting vulnerability using a minimal, non-destructive payload. Which of the following payloads is most likely to execute JavaScript in a victim's browser when injected into the vulnerable parameter?

Accepted Answer

. Reflected cross-site scripting occurs when user input is immediately returned by the web server without proper output encoding, allowing an attacker to inject client-side script. A script tag containing a simple alert is a reliable proof of concept because it executes in the victim's browser context when the crafted URL is visited. The other payloads target SQL injection or path traversal and do not demonstrate JavaScript execution.

Answer

1' OR '1'='1

Answer

../../../../etc/passwd

Answer

'; DROP TABLE users; --

Question 11

You have compromised a dual-homed Linux host that can reach an internal network. You want to use it as a SOCKS proxy so that tools like Nmap and Metasploit can route traffic into that internal network. You decide to use SSH dynamic port forwarding. Which command should you run from your attacking machine to create a SOCKS proxy on local port 1080 that tunnels through the compromised host?

Accepted Answer

ssh -D 1080 user@compromised-host. Dynamic port forwarding with ssh -D creates a local SOCKS proxy that forwards connections through the SSH server. Applications configured to use that SOCKS proxy can reach any host the SSH server can reach, making it ideal for pivoting into internal networks with tools like Nmap and Metasploit.

Answer

ssh -D 1080 -L 1080:127.0.0.1:1080 user@compromised-host

Answer

ssh -L 1080:compromised-host:1080 user@compromised-host

Answer

ssh -R 1080 user@compromised-host

Question 12

You are enumerating an Apache web server and discover the '.git' directory is accessible. What is the most significant risk this poses for your reconnaissance?

Accepted Answer

The entire source code repository can be downloaded.. An exposed '.git' directory allows an attacker to download the entire project repository, including source code, configuration files, and commit history. This is a critical discovery because the source code may contain hardcoded credentials, API keys, or sensitive business logic that would otherwise be hidden. Analyzing this data often provides the most direct path to exploitation, as it reveals the application's internal workings and potential flaws that are not apparent from the outside.

Answer

It indicates the server is using an outdated version of Apache.

Answer

It means the server is vulnerable to SQL injection.

Answer

It suggests that the server is running on a Windows OS.

Question 13

When analyzing a stack buffer, what is the significance of the 'saved EBP' value?

Accepted Answer

It helps the program restore the previous stack frame.. The saved EBP is part of the standard function epilogue, which helps the program restore the stack frame of the calling function. In a buffer overflow, this value is overwritten immediately before the return address. While usually not the primary target for flow hijacking, it is a critical piece of the stack frame that, if corrupted, will likely cause the program to crash when it attempts to restore the stack frame after the function finishes.

Answer

It is the primary register for shellcode execution.

Answer

It is a security mechanism to prevent overflows.

Answer

It stores the base address of the shellcode.

Question 14

You are assessing a login form and suspect a blind SQL injection vulnerability. The application does not return database errors, but the response time varies significantly based on the input. Which TWO of the following techniques would be most effective to confirm this vulnerability?

Accepted Answer

Injecting 'SLEEP(5)' or equivalent wait commands.. Blind SQL injection relies on inferring data through side channels like time delays or Boolean logic. Time-based payloads force the database to pause, while Boolean-based payloads cause the page content to change based on true/false conditions. These methods are essential when direct data output is suppressed, allowing an attacker to reconstruct the database contents systematically through repeated, measured queries to the back-end server.

Answer

Reviewing the server's source code files.

Answer

Forcing the application to display verbose error messages.

Answer

Attempting to perform a Cross-Site Request Forgery.

Question 15

During an internal penetration test, you gain shell access to a Linux machine. You want to pivot deeper into a segmented internal network that is completely unreachable directly from your attack host. Which tunneling approach establishes a true layer 2 network tunnel by creating a virtual network interface, allowing you to route raw Ethernet frames and perform ARP scanning?

Accepted Answer

Setting up a TAP network interface tunnel. Creating a TUN or TAP device using tools like sshuttle or OpenVPN establishes a Layer 3 or Layer 2 tunnel respectively. A TAP interface operates at Layer 2, allowing raw Ethernet frames to cross the boundary. This capability is essential when standard TCP/UDP port forwarding fails because you need to execute broadcast-dependent reconnaissance or vulnerability scanning against hidden internal subnets.

Answer

Local port forwarding using SSH (-L flag)

Answer

Remote port forwarding using SSH (-R flag)

Answer

Dynamic port forwarding using an SSH SOCKS proxy (-D flag)

Question 16

Which property of a URL is most commonly used as a source for DOM-based XSS because it is not sent to the server?

Accepted Answer

The URL fragment (everything after the # character).. The URL fragment (the part after the # character) is strictly handled by the browser and is never included in the HTTP request sent to the server. Because developers often assume this data is 'safe' or ignored by the backend, they frequently fail to sanitize it before using it in client-side operations, creating an ideal vector for DOM-based XSS attacks that bypass traditional WAFs.

Answer

The query string (everything after the ? character).

Answer

The HTTP Referer header.

Answer

The user-agent string.

Question 17

During an authorized penetration test, you deliver a malicious script to a victim's browser by exploiting a reflected XSS vulnerability. The script executes in the context of the vulnerable application and silently sends a crafted HTTP request to the application's password-change endpoint. The victim is currently authenticated. Which client-side attack technique are you performing?

Accepted Answer

Cross-Site Scripting (XSS)-based request forgery. The correct technique is XSS-based request forgery, where JavaScript executed via XSS in the victim's browser is used to send authenticated requests to the application. Because the script runs in the origin of the vulnerable site, it can read anti-CSRF tokens and include them in the forged request, defeating typical CSRF protections. This is a client-side attack that combines script execution with request forgery.

Answer

DOM-based XSS

Answer

Cross-Site Request Forgery (CSRF)

Answer

Clickjacking

Question 18

A penetration tester is preparing to bypass antivirus on a Windows target during a PEN-200 lab. The tester wants to use packing and encryption to alter the payload's signature and avoid static detection. Which TWO techniques are effective for evading static signature-based detection by changing the file's binary appearance without altering its functionality? (Choose two.)

Accepted Answer

Encrypting the payload with a unique key and including the decryption routine in a custom loader.. Effective static evasion requires changing the bytes that signatures match. Packers encrypt and compress the original code, so the on-disk file no longer contains the recognizable pattern. Encrypting the payload with a unique key and a custom loader achieves the same by making each build's bytes unique. Both preserve functionality while altering the binary appearance. Appending random bytes, renaming, or modifying PE metadata do not change the core code sections that signatures target, so they are ineffective for evading static detection.

Answer

Modifying the PE header to change the compile timestamp and checksum.

Answer

Renaming the executable file to a system process name such as svchost.exe.

Answer

Appending random bytes to the end of the executable to change its file hash.

Question 19

During a network assessment, you want to enumerate users on a domain controller. Which protocol and port combination is the most standard target for this type of enumeration?

Accepted Answer

LDAP on port 389. LDAP, running on port 389, is the standard protocol for querying directory information in a Windows domain. By successfully connecting to the LDAP service, a tester can often dump user lists, group memberships, and other organizational data. Understanding this protocol is vital, as it provides the foundation for password spraying attacks and deeper reconnaissance within Active Directory, which is a common objective in enterprise penetration tests.

Answer

HTTP on port 80

Answer

FTP on port 21

Answer

SMTP on port 25

Question 20

Which TWO of the following actions are considered best practice during the initial host enumeration phase to avoid detection by security monitoring tools?

Accepted Answer

Prioritize passive reconnaissance using OSINT sources.. To minimize detection, penetration testers should prioritize passive information gathering before engaging in active, noisy scanning. When active scanning is required, rate-limiting and targeting specific ports rather than performing a 'scan all' approach helps blend the traffic into normal network behavior. These practices are essential for maintaining the stealth required in professional engagements, ensuring that the tester remains undetected while collecting the necessary intelligence to identify high-value targets.

Answer

Perform a full port scan on all 65535 ports concurrently.

Answer

Use aggressive service detection flags in all scans.

Answer

Scan from the same IP address at all times.