PEN-200 Practice Test 3 — 25 Questions

Question 1

You have compromised a dual-homed Linux host that can reach an internal network. You want to use it as a SOCKS proxy so that tools like Nmap and Metasploit can route traffic into that internal network. You decide to use SSH dynamic port forwarding. Which command should you run from your attacking machine to create a SOCKS proxy on local port 1080 that tunnels through the compromised host?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ssh -D 1080 user@compromised-host. Dynamic port forwarding with ssh -D creates a local SOCKS proxy that forwards connections through the SSH server. Applications configured to use that SOCKS proxy can reach any host the SSH server can reach, making it ideal for pivoting into internal networks with tools like Nmap and Metasploit.

Answer

ssh -D 1080 -L 1080:127.0.0.1:1080 user@compromised-host

Answer

ssh -L 1080:compromised-host:1080 user@compromised-host

Answer

ssh -R 1080 user@compromised-host

Question 2

You are enumerating an Apache web server and discover the '.git' directory is accessible. What is the most significant risk this poses for your reconnaissance?

Accepted Answer

The entire source code repository can be downloaded.. An exposed '.git' directory allows an attacker to download the entire project repository, including source code, configuration files, and commit history. This is a critical discovery because the source code may contain hardcoded credentials, API keys, or sensitive business logic that would otherwise be hidden. Analyzing this data often provides the most direct path to exploitation, as it reveals the application's internal workings and potential flaws that are not apparent from the outside.

Answer

It indicates the server is using an outdated version of Apache.

Answer

It means the server is vulnerable to SQL injection.

Answer

It suggests that the server is running on a Windows OS.

Question 3

When analyzing a stack buffer, what is the significance of the 'saved EBP' value?

Accepted Answer

It helps the program restore the previous stack frame.. The saved EBP is part of the standard function epilogue, which helps the program restore the stack frame of the calling function. In a buffer overflow, this value is overwritten immediately before the return address. While usually not the primary target for flow hijacking, it is a critical piece of the stack frame that, if corrupted, will likely cause the program to crash when it attempts to restore the stack frame after the function finishes.

Answer

It is the primary register for shellcode execution.

Answer

It is a security mechanism to prevent overflows.

Answer

It stores the base address of the shellcode.

Question 4

You are assessing a login form and suspect a blind SQL injection vulnerability. The application does not return database errors, but the response time varies significantly based on the input. Which TWO of the following techniques would be most effective to confirm this vulnerability?

Accepted Answer

Injecting 'SLEEP(5)' or equivalent wait commands.. Blind SQL injection relies on inferring data through side channels like time delays or Boolean logic. Time-based payloads force the database to pause, while Boolean-based payloads cause the page content to change based on true/false conditions. These methods are essential when direct data output is suppressed, allowing an attacker to reconstruct the database contents systematically through repeated, measured queries to the back-end server.

Answer

Reviewing the server's source code files.

Answer

Forcing the application to display verbose error messages.

Answer

Attempting to perform a Cross-Site Request Forgery.

Question 5

During an internal penetration test, you gain shell access to a Linux machine. You want to pivot deeper into a segmented internal network that is completely unreachable directly from your attack host. Which tunneling approach establishes a true layer 2 network tunnel by creating a virtual network interface, allowing you to route raw Ethernet frames and perform ARP scanning?

Accepted Answer

Setting up a TAP network interface tunnel. Creating a TUN or TAP device using tools like sshuttle or OpenVPN establishes a Layer 3 or Layer 2 tunnel respectively. A TAP interface operates at Layer 2, allowing raw Ethernet frames to cross the boundary. This capability is essential when standard TCP/UDP port forwarding fails because you need to execute broadcast-dependent reconnaissance or vulnerability scanning against hidden internal subnets.

Answer

Local port forwarding using SSH (-L flag)

Answer

Remote port forwarding using SSH (-R flag)

Answer

Dynamic port forwarding using an SSH SOCKS proxy (-D flag)

Question 6

Which property of a URL is most commonly used as a source for DOM-based XSS because it is not sent to the server?

Accepted Answer

The URL fragment (everything after the # character).. The URL fragment (the part after the # character) is strictly handled by the browser and is never included in the HTTP request sent to the server. Because developers often assume this data is 'safe' or ignored by the backend, they frequently fail to sanitize it before using it in client-side operations, creating an ideal vector for DOM-based XSS attacks that bypass traditional WAFs.

Answer

The query string (everything after the ? character).

Answer

The HTTP Referer header.

Answer

The user-agent string.

Question 7

During an authorized penetration test, you deliver a malicious script to a victim's browser by exploiting a reflected XSS vulnerability. The script executes in the context of the vulnerable application and silently sends a crafted HTTP request to the application's password-change endpoint. The victim is currently authenticated. Which client-side attack technique are you performing?

Accepted Answer

Cross-Site Scripting (XSS)-based request forgery. The correct technique is XSS-based request forgery, where JavaScript executed via XSS in the victim's browser is used to send authenticated requests to the application. Because the script runs in the origin of the vulnerable site, it can read anti-CSRF tokens and include them in the forged request, defeating typical CSRF protections. This is a client-side attack that combines script execution with request forgery.

Answer

DOM-based XSS

Answer

Cross-Site Request Forgery (CSRF)

Answer

Clickjacking

Question 8

A penetration tester is preparing to bypass antivirus on a Windows target during a PEN-200 lab. The tester wants to use packing and encryption to alter the payload's signature and avoid static detection. Which TWO techniques are effective for evading static signature-based detection by changing the file's binary appearance without altering its functionality? (Choose two.)

Accepted Answer

Encrypting the payload with a unique key and including the decryption routine in a custom loader.. Effective static evasion requires changing the bytes that signatures match. Packers encrypt and compress the original code, so the on-disk file no longer contains the recognizable pattern. Encrypting the payload with a unique key and a custom loader achieves the same by making each build's bytes unique. Both preserve functionality while altering the binary appearance. Appending random bytes, renaming, or modifying PE metadata do not change the core code sections that signatures target, so they are ineffective for evading static detection.

Answer

Modifying the PE header to change the compile timestamp and checksum.

Answer

Renaming the executable file to a system process name such as svchost.exe.

Answer

Appending random bytes to the end of the executable to change its file hash.

Question 9

During a network assessment, you want to enumerate users on a domain controller. Which protocol and port combination is the most standard target for this type of enumeration?

Accepted Answer

LDAP on port 389. LDAP, running on port 389, is the standard protocol for querying directory information in a Windows domain. By successfully connecting to the LDAP service, a tester can often dump user lists, group memberships, and other organizational data. Understanding this protocol is vital, as it provides the foundation for password spraying attacks and deeper reconnaissance within Active Directory, which is a common objective in enterprise penetration tests.

Answer

HTTP on port 80

Answer

FTP on port 21

Answer

SMTP on port 25

Question 10

Which TWO of the following actions are considered best practice during the initial host enumeration phase to avoid detection by security monitoring tools?

Accepted Answer

Prioritize passive reconnaissance using OSINT sources.. To minimize detection, penetration testers should prioritize passive information gathering before engaging in active, noisy scanning. When active scanning is required, rate-limiting and targeting specific ports rather than performing a 'scan all' approach helps blend the traffic into normal network behavior. These practices are essential for maintaining the stealth required in professional engagements, ensuring that the tester remains undetected while collecting the necessary intelligence to identify high-value targets.

Answer

Perform a full port scan on all 65535 ports concurrently.

Answer

Use aggressive service detection flags in all scans.

Answer

Scan from the same IP address at all times.

Question 11

During a buffer overflow exploit development, you need to ensure that your shellcode does not contain any null bytes. You have generated shellcode that includes a null byte. Which of the following is the most appropriate action?

Accepted Answer

Use an encoder such as Shikata Ga Nai to encode the shellcode, which will remove null bytes and add a decoder stub.. When shellcode contains bad characters like null bytes, encoding it with a tool like Shikata Ga Nai is the standard solution. The encoder transforms the shellcode into a null-free version and adds a decoder stub that reconstructs the original code in memory. This allows the exploit to deliver the payload without the bad characters causing premature termination. It is a fundamental step in exploit development, especially for stack-based overflows.

Answer

Manually replace the null byte with a NOP (0x90) instruction.

Answer

Split the shellcode into two parts and execute them sequentially using a staged payload.

Answer

Use a different shellcode that does not contain null bytes, such as one generated with the 'alpha_mixed' encoder.

Question 12

You are on a Windows 10 machine and discover that the folder 'C:\Temp' has permissions: BUILTIN\Users:(F). You also notice that a scheduled task runs every hour, executing 'C:\Temp\cleanup.exe' as SYSTEM. However, cleanup.exe does not exist in the folder. What is the most effective way to escalate privileges?

Accepted Answer

Place a malicious cleanup.exe in C:\Temp and wait for the scheduled task to run.. The scheduled task runs a missing executable from a writable directory as SYSTEM. By placing a malicious cleanup.exe in C:\Temp, you ensure that the task executes your code with SYSTEM privileges. This is a classic privilege escalation via weak folder permissions and scheduled tasks.

Answer

Use icacls to change permissions on the scheduled task file.

Answer

Create a new scheduled task that runs as SYSTEM.

Answer

Modify the scheduled task to run a different command using schtasks.

Question 13

Refer to the exhibit. You identify an Apache 2.4.49 vulnerability and locate the exploit. After reviewing the exploit code, you realize it requires a specific input format to trigger the path traversal. What is the most effective way to verify the vulnerability without crashing the server?

Accepted Answer

Use a simple path traversal payload to request a harmless file.. Verification is a critical phase where you test for the vulnerability's presence using non-destructive inputs. By attempting a benign request, such as reading a safe, non-sensitive file like a public README, you confirm the exploit works without risking a Denial of Service. This professional approach demonstrates a cautious mindset, essential for performing assessments that prioritize target stability while successfully confirming the vulnerability exists.

Answer

Execute the exploit immediately against the root directory.

Answer

Run the exploit as is and hope the server remains stable.

Answer

Modify the exploit to dump the entire password file immediately.

Question 14

Why does enabling 'SMB Signing' prevent NTLM relay attacks?

Accepted Answer

It validates the integrity of the authentication packets. SMB Signing adds a cryptographic signature to each packet in an SMB communication. When a relay attack occurs, the attacker does not possess the session key required to generate these signatures for the relayed packets. Consequently, the target server detects the missing or invalid signature and rejects the authentication attempt, effectively neutering the relay attack at the protocol level.

Answer

It encrypts the entire SMB session using TLS

Answer

It requires the client to prove they have the password

Answer

It disables NTLM authentication globally

Question 15

During an internal assessment, you compromise a workstation and recover a cached domain credential hash for a user who previously logged on. You want to use this hash to authenticate to a file server on the same network, but you do not know the plaintext password. Which of the following tools is specifically designed to perform Pass-the-Hash authentication from a Linux-based attack platform?

Accepted Answer

Impacket's psexec.py. Pass-the-Hash requires a tool that can supply an NTLM hash directly during authentication. Impacket's psexec.py is a Python implementation of PsExec that accepts -hashes, enabling authentication to SMB shares with a hash. The other tools either crack hashes offline, harvest credentials, or extract credentials locally, none of which achieve remote authentication with a hash.

Answer

Hashcat with mode 1000

Answer

Responder with the -w flag

Answer

Mimikatz with the sekurlsa::logonpasswords module

Question 16

Which repository is generally considered the most reliable starting point for finding verified, community-contributed public exploits during an OSCP assessment?

Accepted Answer

The Exploit Database (Exploit-DB) via Searchsploit.. Searchsploit, a command-line tool for the Exploit Database (EDB), is the industry standard for identifying public exploits. It provides a searchable, offline archive of exploits, which is crucial when internet access is limited or unavailable during an exam. Utilizing this tool helps identify specific vulnerability versions and common exploit patterns, allowing for efficient mapping of known vulnerabilities to the target services identified during the enumeration phase.

Answer

A random forum dedicated to malware distribution.

Answer

The dark web marketplace for zero-day vulnerabilities.

Answer

The latest compiled binary downloads from unknown websites.

Question 17

You are performing a network scan on a target network and notice that ICMP echo requests are blocked, but you need to determine if the target host is alive. Which technique should you utilize to identify active hosts without relying on standard ICMP ping?

Accepted Answer

Perform a TCP SYN scan on common ports such as 80, 443, and 22.. When ICMP is filtered by firewalls, TCP SYN scanning on common ports like 80 or 443 is an effective alternative for host discovery. This technique works because the target system responds to a SYN packet with a SYN/ACK if the port is open, or an RST if closed, confirming the host's presence. Mastering non-ICMP discovery is critical for bypass techniques in hardened network environments where security policies block traditional discovery methods.

Answer

Send a UDP packet to port 53 and wait for a DNS response.

Answer

Use ARP scanning regardless of the network topography.

Answer

Send a broadcast ping to the entire subnet range.

Question 18

Which THREE of the following are considered 'active' reconnaissance techniques, as opposed to passive techniques?

Accepted Answer

Port scanning with Nmap.. Active reconnaissance involves direct interaction with the target system, which creates a visible footprint in server logs. Techniques like port scanning, service version detection, and directory brute-forcing are all active because they involve sending packets that the target must respond to. In contrast, passive reconnaissance uses third-party services to gather information without touching the target. Understanding this distinction is vital for maintaining the desired level of stealth throughout the reconnaissance and exploitation process.

Answer

WHOIS lookup.

Answer

Searching Google for public documents.

Question 19

An application is vulnerable to Server-Side Request Forgery (SSRF). You want to use this to scan the internal network. Which target should you attempt to access first to verify the vulnerability?

Accepted Answer

The local loopback address (127.0.0.1) or localhost.. The local loopback address is the most reliable target for verifying SSRF. If the server fetches content from 127.0.0.1, it confirms that the application is making requests on behalf of the user. This is a critical prerequisite before attempting to pivot into the internal network, as it proves that the application's request-handling mechanism can be subverted to interact with restricted infrastructure.

Answer

A known external public domain like google.com.

Answer

The default gateway IP of the server's network.

Answer

An arbitrary private IP address like 10.0.0.1.

Question 20

Refer to the exhibit. An analyst observes this response header after a successful login. What is the security implication of the 'HttpOnly' and 'Secure' flags set on the 'session_id' cookie?

Accepted Answer

The session is protected against XSS theft and cleartext interception.. These security flags are critical for session hardening. 'HttpOnly' prevents client-side scripts from accessing the cookie via document.cookie, mitigating XSS-based session theft. 'Secure' ensures the cookie is only transmitted over encrypted HTTPS connections, preventing interception via man-in-the-middle attacks. Together, they provide a defense-in-depth layer protecting user session integrity, which is essential for maintaining secure authentication sessions against common web-based attacks during the post-authentication phase of an engagement.

Answer

The flags guarantee protection against all SQL injection.

Answer

The cookie will be accessible to JavaScript, but not via HTTP.

Answer

The cookie will be automatically deleted when the browser closes.