PEN-200 Practice Test 22 — 15 Questions

Question 1

You are performing active reconnaissance against a web server and want to identify hidden directories and files that may not be linked from the main site. Which two techniques are most appropriate for this goal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using a tool like Gobuster with a wordlist to brute-force common directory and file names.. Brute-forcing with Gobuster and inspecting robots.txt are both effective for discovering hidden directories and files on a web server. Gobuster actively probes for common names, while robots.txt may list disallowed paths that administrators wish to keep out of search engines. The other techniques focus on port scanning, DNS, or registration data, which do not directly enumerate web content.

Answer

Running a full TCP port scan with Nmap to identify all open ports on the server.

Answer

Performing a WHOIS lookup to gather registration details about the domain.

Answer

Using the `dig` command to perform a zone transfer on the DNS server.

Question 2

A penetration tester delivers a custom .NET executable to a Windows 10 host running Microsoft Defender with cloud-delivered protection enabled. The binary contains an embedded shellcode blob in its .data section. After the loader decrypts the shellcode in memory and begins executing it, Defender terminates the process even though the file itself never touched disk again. Which technique would most directly address this specific detection?

Accepted Answer

Change the shellcode's allocation from VirtualAlloc with PAGE_EXECUTE_READWRITE to VirtualAlloc with PAGE_READWRITE, then use VirtualProtect to flip the page to PAGE_EXECUTE_READ just before invoking the shellcode.. The detection is behavioral and memory-resident, so the fix must change how memory is allocated and protected. Marking a single region both writable and executable is a classic high-signal indicator that Defender's behavioral engine correlates with shellcode loaders. Allocating writable, writing the payload, and then re-protecting the page as executable removes that indicator while still allowing the shellcode to run. Encoding, compiler flags, and static obfuscation do not affect the in-memory execution profile.

Answer

Base64-encode the shellcode and decode it immediately before calling CreateThread.

Answer

Encrypt the shellcode with XOR and decrypt it at runtime using a stack-based routine.

Answer

Recompile the loader with the /GS- flag to disable stack cookies and reduce the binary's static footprint.

Question 3

A public exploit for a Linux service includes a compiled payload that connects back to a hardcoded IP address. You need to adapt it for your PEN-200 engagement. Which TWO actions are most appropriate? (Choose two.)

Accepted Answer

Edit the exploit source to replace the hardcoded IP with your attacker IP, then recompile the payload if the exploit includes source.. The hardcoded callback address must be replaced with the tester's reachable address, and the payload must match the target architecture. Regenerating with msfvenom or editing and recompiling the source both accomplish this while preserving the exploit's vulnerability trigger. Router forwarding and firewall changes do not alter the embedded address, and a bind shell changes the exploitation model unnecessarily.

Answer

Disable the target firewall with an initial command so the hardcoded callback address becomes reachable.

Answer

Replace the payload with a bind shell on a common port so no callback address is needed.

Answer

Run the exploit as-is and rely on port forwarding on your router to redirect the callback to your machine.

Question 4

What role does the 'padding' play in a buffer overflow payload structure?

Accepted Answer

It ensures the return address is correctly aligned for overwriting.. Padding is the data placed between the start of the buffer and the return address. Its purpose is to exactly fill the buffer space so that the subsequent bytes in the payload land precisely on the return address. Without correct padding, the return address would be overwritten by the wrong bytes, causing the program to jump to an unintended and invalid location, leading to a crash rather than code execution.

Answer

It acts as a NOP sled for the payload.

Answer

It prevents the stack from overflowing too quickly.

Answer

It is used to encode the shellcode against detection.

Question 5

Refer to the exhibit. Given the sudo privileges, which command will successfully spawn a root shell?

Accepted Answer

sudo /usr/bin/vim -c ':!/bin/sh'. The exhibit shows that the user can run 'vim' as root without a password. Since vim has a built-in shell execution feature, an attacker can escape the editor to a root-privileged command prompt. This is a classic example of misconfigured sudo rights, where allowing full access to a versatile utility that supports command execution effectively grants the user complete control over the system.

Answer

sudo /usr/bin/vim /etc/shadow

Answer

sudo /usr/bin/vim --version

Answer

sudo /usr/bin/vim -u NONE

Question 6

During a PEN-200 lab engagement, you obtain a low-privileged shell on a Windows machine and discover an unquoted service path containing spaces in its directory name. The service runs as Local System, but the parent folder has overly permissive discretionary access control lists granting standard users Full Control. How should you exploit this misconfiguration to escalate your privileges?

Accepted Answer

Upload your malicious executable to the vulnerable intermediate directory using the exact intermediate folder name expected by the path parser.. Placing a malicious executable with a name matching the fragmented path segment allows you to hijack the service binary resolution process when the service restarts. Windows searches for spaces sequentially from left to right, executing your payload with Local System privileges. This technique is a fundamental Windows privilege escalation vector taught in the PEN-200 curriculum.

Answer

Modify the Windows Registry ImagePath entry directly using standard user credentials to append your custom payload path.

Answer

Replace the existing service executable file directly inside the protected system folder to hijack execution upon the next reboot.

Answer

Send a malformed buffer overflow payload directly to the service network port to achieve remote code execution as Local System.

Question 7

You find that a binary relies on a relative path to execute a secondary script. If you cannot modify the PATH variable, what is the best alternative to exploit this configuration?

Accepted Answer

Create the expected directory structure in a location you control and execute the binary from there.. If PATH modification is not possible, you can utilize symlinks or directory traversal to manipulate the binary's search logic. By creating a directory structure that mimics the expected relative path, you can place a malicious executable where the binary expects the legitimate one. This is effective because it exploits the binary's reliance on current working directory context, bypassing strict system-wide path settings entirely.

Answer

Modify the binary's ELF header to change the search path.

Answer

Use the 'ptrace' system call to attach to the binary and change its execution flow.

Answer

Inject environment variables like 'LD_LIBRARY_PATH' to overwrite the binary's functionality.

Question 8

Why is it important to use a local listener that matches the protocol expected by your exploit's payload?

Accepted Answer

It ensures the connection is successfully captured.. If your exploit sends a reverse shell, the listener must be configured to accept the specific connection type (e.g., TCP or UDP) and handle the payload correctly. A mismatch—such as trying to catch a TCP reverse shell on a UDP listener—will result in the connection failing to establish. Proper alignment between the exploit's payload and your listener is the cornerstone of successful, stable remote command execution.

Answer

It makes the exploit run significantly faster.

Answer

It prevents the firewall from blocking your connection.

Answer

It automatically bypasses target authentication.

Question 9

Which TWO techniques are primarily used to bypass static signature-based detection by altering the file's binary appearance without changing its underlying functionality?

Accepted Answer

Binary Packing. Static evasion focuses on changing the 'look' of the file to bypass signature databases. Packing compresses the executable and adds a wrapper that unpacks it in memory, while encryption hides the payload entirely until runtime. Both techniques drastically change the file's hash and byte sequence, making it unrecognizable to scanners that rely on matching known malicious code patterns on disk.

Answer

Process Hollowing

Answer

Direct System Calls

Answer

Token Manipulation

Question 10

You are conducting a penetration test and need to identify the operating system of a target host without sending any packets to it. Which of the following methods is most appropriate?

Accepted Answer

Reviewing publicly available information such as job postings or technology stack details on the company's website.. Passive reconnaissance involves gathering information without directly interacting with the target. Reviewing public sources like job postings and website technology stacks can reveal the operating system without sending any packets. Active methods such as TTL analysis, Nmap OS detection, and banner grabbing all require sending packets to the target, violating the constraint.

Answer

Analyzing the Time-to-Live (TTL) values from a ping response.

Answer

Using Nmap's OS detection (-O) against the target IP address.

Answer

Performing a banner grab by connecting to open ports like 22 or 80.

Question 11

While testing a web application, you find that the login form is vulnerable to SQL injection. You input the username 'admin'-- and a blank password. The application logs you in as admin without validating the password. Which type of SQL injection attack is this?

Accepted Answer

Authentication bypass via SQL injection. The attack uses a comment sequence (--) to truncate the SQL query, eliminating the password validation. This directly bypasses authentication, granting access as the admin user. Union-based, error-based, and blind SQL injection are different techniques used for data extraction or inference, not for simple authentication bypass. Thus, authentication bypass via SQL injection is the correct answer.

Answer

Error-based SQL injection

Answer

Blind SQL injection

Answer

Union-based SQL injection

Question 12

You have compromised a domain user account and want to escalate privileges by abusing a misconfigured Group Policy Object (GPO). You discover that the GPO is linked to an Organizational Unit (OU) containing privileged servers and that the domain user has write permissions on the GPO. Which action should you take to escalate privileges?

Accepted Answer

Modify the GPO to add a new immediate scheduled task that runs a reverse shell as SYSTEM on all computers in the OU.. With write permissions on a GPO linked to an OU containing privileged servers, modifying the GPO to add an immediate scheduled task that runs as SYSTEM allows code execution with elevated privileges on those servers. This directly escalates privileges by leveraging the GPO's application to all computers in the OU, achieving SYSTEM-level access.

Answer

Use the compromised user to add themselves to the Domain Admins group directly via LDAP modification.

Answer

Configure a new GPO to deploy a startup script that disables antivirus on all servers in the OU.

Answer

Extract the KRBTGT hash using DCSync and forge a Golden Ticket to gain domain admin access.

Question 13

During an internal penetration test, you run a UDP scan against a Linux server and see the following result: `161/udp open snmp`. You want to extract as much host information as possible without triggering authentication failures. Which command should you run first?

Accepted Answer

`snmpwalk -v2c -c public 10.10.10.25`. The most efficient first action is to query SNMP with the default read-only community string using `snmpwalk`. It both confirms the service is accessible and dumps a large amount of host data in one step. Brute-forcing or using SNMPv3 credentials is premature and risks detection or lockout without adding immediate value.

Answer

`onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 10.10.10.25`

Answer

`snmpwalk -v3 -l authPriv -u admin -a SHA -A password 10.10.10.25`

Answer

`nmap -sU -p161 --script snmp-brute 10.10.10.25`

Question 14

During an internal penetration test, you have captured network traffic and identified a host that responds on TCP port 445. You want to gather detailed information about the SMB service, including the operating system version, NetBIOS name, and domain, without authenticating. Which Nmap NSE script is most appropriate for this task?

Accepted Answer

smb-os-discovery. The smb-os-discovery script is designed to query SMB services for host details such as operating system, NetBIOS name, and domain without requiring credentials. Other SMB scripts focus on shares, brute-forcing, or vulnerability checks, which do not provide the required enumeration data. Therefore, smb-os-discovery is the correct tool for this task.

Answer

smb-vuln-ms17-010

Answer

smb-brute

Answer

smb-enum-shares

Question 15

During a Linux privilege escalation assessment, you obtain a low-privileged shell as user 'student'. You run 'id' and see the user belongs to the 'docker' group. Which command will most reliably escalate to root on this host?

Accepted Answer

docker run -v /:/mnt --rm -it alpine chroot /mnt sh. Docker group membership allows a user to interact with the Docker daemon, which runs as root. By mounting the host root filesystem into a container and chrooting into it, an attacker can effectively gain root-level access to the host. This technique is well-known and reliable, as it leverages the daemon's privileges to bypass filesystem permissions. The other commands either require existing sudo rights, only change group context, or create isolated namespaces without host root privileges.

Answer

newgrp docker

Answer

unshare -Ur

Answer

sudo -u root /bin/bash