PEN-200 Practice Test 4 — 25 Questions

Question 1

When performing a kernel exploit for privilege escalation, what is the most significant risk to the stability of the target system?

Accepted Answer

The system might experience a kernel panic, causing a complete crash.. Kernel exploits operate at the lowest level of the operating system. If the exploit code contains errors or interacts incorrectly with kernel memory structures, it can lead to a kernel panic, crashing the entire system. This is a significant operational risk, as it results in downtime and potentially triggers alerts that lead to discovery, emphasizing the need for caution and testing exploits in isolated environments before deployment on production targets.

Answer

The system will automatically log the attacker's IP address.

Answer

The exploit will permanently delete all data on the disk.

Answer

The system firewall will automatically block the user account.

Question 2

Why are static memory addresses for 'JMP ESP' preferred over dynamic stack addresses?

Accepted Answer

Static addresses remain constant across different executions.. Stack addresses change during every execution of a program due to factors like system environment variables and memory allocation. If you use a hardcoded stack address in your exploit, it will likely be invalid the next time the program runs. A static JMP ESP address, found in a loaded DLL or the binary itself, remains constant, providing a reliable and stable redirect for your shellcode execution every time.

Answer

Static addresses are faster to access by the CPU.

Answer

Static addresses are less likely to contain bad characters.

Answer

Static addresses are protected by DEP and ASLR.

Question 3

When fuzzing an application to identify a buffer overflow, what is the most common symptom indicating that the application's memory boundaries have been exceeded?

Accepted Answer

The application returns an 'Access Violation' or 'Segmentation Fault'. Fuzzing involves sending large amounts of data to an application to find stability issues. The most common indicator of a buffer overflow is the application crashing, specifically resulting in a segmentation fault or an access violation. This occurs because the injected data has overwritten critical stack memory, such as the return address, causing the CPU to attempt an execution from an invalid or unauthorized memory location.

Answer

The application begins to consume high CPU resources

Answer

The application prints a stack dump to the console

Answer

The application generates a new network port listener

Question 4

You are performing a client-side phishing engagement and need to deliver a malicious payload using an ISO image file. Why is this delivery method often effective against modern Windows security warnings?

Accepted Answer

Windows natively mounts ISO files without requiring external software, and extracted payloads can evade certain Mark of the Web propagation behaviors. ISO image files can be mounted natively by Windows without third-party software, and files contained within the ISO often inherit a lower severity of Mark of the Web restrictions when extracted or executed, helping bypass certain SmartScreen prompts compared to direct web downloads.

Answer

ISO files automatically disable Windows Defender Antivirus real-time protection upon mounting

Answer

ISO files encrypt all internal payload binaries, rendering static signature analysis completely impossible

Answer

Mark of the Web attributes are permanently stripped from all files stored within virtual disk containers

Question 5

You have successfully found the exact offset to overwrite the EIP register and identified a reliable JMP ESP instruction inside an unProtected DLL. However, when your shellcode executes, the program immediately crashes with an access violation before launching the payload. Inspection reveals that the stack pointer (ESP) points directly to the beginning of your shellcode, but the memory page housing the stack lacks execution permissions. Which modern defense mechanism is preventing your exploit from succeeding?

Accepted Answer

Data Execution Prevention (DEP) configured as OptOut or OptIn across the operating system environment.. Data Execution Prevention marks memory regions such as the stack and heap as non-executable to prevent malicious code from running directly from those locations. When an exploit attempts to jump into shellcode residing on the stack, the CPU generates an access violation because execution permissions are explicitly denied on that memory page.

Answer

Control Flow Guard (CFG) validating indirect call targets against a pre-compiled bitmap of valid function entries.

Answer

Address Space Randomization relocating the base addresses of operating system libraries dynamically on every reboot.

Answer

Structured Exception Handling Overwrite Protection guarding exception handler chains from malicious pointer manipulation.

Question 6

Refer to the exhibit. Which ports are currently open on the target host 192.168.1.10?

Accepted Answer

Ports 22 and 80.. The Nmap output clearly indicates the state of the scanned ports. In this exhibit, ports 22 and 80 are explicitly listed as 'open', while 998 others are closed. Identifying these specific ports is the first step in mapping the target's attack surface. Understanding how to read scan output is a core competency that allows a tester to prioritize their focus towards the services that are most likely to be exploitable.

Answer

All ports from 1 to 1000.

Answer

Only port 22.

Answer

No ports are open.

Question 7

When analyzing a public exploit, which TWO elements should you specifically look for to understand its networking behavior? (Choose TWO)

Accepted Answer

The target port the exploit connects to.. Understanding how an exploit communicates is vital for both success and stealth. By identifying the hardcoded target port and the type of callback payload (e.g., reverse shell vs. bind shell), you can align your listener and firewall configuration to ensure the exploit functions correctly. This level of technical oversight is essential to avoid common pitfalls where the exploit succeeds, but the attacker fails to receive the connection due to network-level misconfigurations.

Answer

The author's name and email address.

Answer

The date the exploit was uploaded.

Answer

The color scheme used in the code.

Question 8

During a web assessment, you find that an application uses an insecure random number generator for token creation. What is the main security implication of this flaw?

Accepted Answer

It leads to session hijacking through token prediction.. Predictable tokens compromise the integrity of session management and password reset mechanisms. If an attacker can determine the algorithm and seed used by the generator, they can forge valid session tokens or reset codes for other users. This vulnerability highlights the necessity of using cryptographically secure pseudorandom number generators (CSPRNGs) to ensure that sensitive authentication tokens cannot be guessed or recreated by adversaries.

Answer

It allows attackers to perform Cross-Site Request Forgery (CSRF).

Answer

It triggers a stack overflow in the web server process.

Answer

It makes the application vulnerable to SQL Injection.

Question 9

A penetration tester uses process hollowing to hide their payload inside 'svchost.exe'. They start the process in a suspended state, unmap its memory, write their shellcode, and resume the thread. What is a specific indicator that an advanced EDR might use to detect this activity?

Accepted Answer

The entry point of the process in memory differs from the image on disk.. Process hollowing is a powerful evasion technique, but it leaves behind traces in the system's memory and process metadata. Advanced EDR solutions monitor for discrepancies between the file on disk and the code in memory. They also track specific API call sequences, such as creating a process in a suspended state followed immediately by memory unmapping and cross-process writing.

Answer

The 'svchost.exe' process will show a significantly higher CPU usage.

Answer

The process will be unable to communicate with the network.

Answer

The system will automatically restart the process due to a checksum error.

Question 10

Refer to the exhibit. What can you conclude about the security of this service binary?

Accepted Answer

The binary can be replaced by any local user to achieve privilege escalation.. The icacls output shows that 'BUILTIN\Users' has '(M)' or Modify permissions on the binary. This means a low-privileged user can replace the legitimate service executable with a malicious one. Because services run as SYSTEM, replacing this file allows for immediate privilege escalation upon the next service restart. This is a common misconfiguration where excessive folder or file permissions enable attackers to gain total control over the host.

Answer

The service is vulnerable to a DLL hijacking attack.

Answer

The service is secure because only SYSTEM and Administrators have full access.

Answer

The service cannot be stopped by a standard user.

Question 11

Refer to the exhibit. What is the most likely goal of this command execution in a privilege escalation context?

Accepted Answer

To perform automated enumeration for privilege escalation.. This command downloads and executes a PowerShell script directly into memory from a remote server. This is a common technique for running automated enumeration scripts like PowerUp or WinPEAS without writing them to the disk. By executing in memory, the attacker minimizes their footprint on the host system, avoiding detection by file-based signature scanning while gathering information about potential escalation vectors.

Answer

To install a persistent backdoor on the system.

Answer

To escalate privileges to SYSTEM directly.

Answer

To exfiltrate sensitive files from the system.

Question 12

You have compromised a Linux jump host and need to access an internal web application on 192.168.1.50:80 that is firewalled from your local machine. You have SSH access to the jump host. Which command should you execute on your local machine to securely access the application via your browser?

Accepted Answer

ssh -L 8080:192.168.1.50:80 user@jump-host. Local port forwarding allows you to tunnel traffic from a local port to a destination reachable by the SSH server. By mapping a local port to the internal web server's address, you bypass network restrictions imposed by firewalls. This technique is fundamental for pivoting through compromised hosts, enabling tools like Burp Suite or browsers to interact with internal services as if they were running locally, which is vital for further web application vulnerability assessment.

Answer

ssh -R 8080:192.168.1.50:80 user@jump-host

Answer

ssh -D 8080 user@jump-host

Answer

ssh -fN -L 192.168.1.50:80:8080 user@jump-host

Question 13

You have obtained a low-privileged domain user account and are performing internal enumeration. You identify a computer object in the domain where the 'ms-MCS-AdmPwd' attribute is readable by your user account. Which attack path does this vulnerability facilitate?

Accepted Answer

Extracting the cleartext local administrator password. The ms-MCS-AdmPwd attribute stores the cleartext Local Administrator Password for a computer managed by LAPS. By reading this attribute, an attacker can extract the password for the local administrator account of the target machine. This is a critical discovery because it allows immediate lateral movement from a low-privileged domain context to local administrative privileges on that specific host, potentially leading to further credential harvesting or domain escalation.

Answer

Kerberoasting the computer account password hash

Answer

Exploiting the GPO to modify the Domain Admins group

Answer

Performing an AS-REP Roasting attack on the machine

Question 14

You are using Proxychains to route your Nmap scan through a SOCKS proxy. Which configuration file must you modify to ensure that the proxy settings are correctly applied during your scan?

Accepted Answer

/etc/proxychains.conf. Proxychains relies on a configuration file to determine which proxy servers to use for traffic redirection. Misconfiguring this file is a common pitfall that leads to scans either failing or leaking traffic directly from your machine. Correctly setting the proxy type, IP address, and port ensures that all traffic generated by the tools you prefix with proxychains is routed through the specified tunnel, maintaining your stealth and reachability.

Answer

/etc/nmap/nmap.conf

Answer

/etc/ssh/ssh_config

Answer

/etc/network/interfaces

Question 15

Which of the following describes the 'GPP Password' vulnerability?

Accepted Answer

The storage of cleartext credentials in GPO XML files. Group Policy Preferences (GPP) allows administrators to manage local accounts on domain computers. In older versions of Windows, these passwords were encrypted with a static, publicly known AES key. If an attacker gains read access to the 'Groups.xml' file in the SYSVOL share, they can decrypt the 'cpassword' attribute, revealing the cleartext password of the local administrator account for the affected machine.

Answer

A flaw in the Kerberos preauthentication mechanism

Answer

The inability to enforce password complexity on GPOs

Answer

A failure in the Domain Controller's LDAP signing

Question 16

You have successfully obtained a NTLM hash dump from a domain controller. You intend to perform a pass-the-hash attack to move laterally. What is the most critical requirement for this technique to succeed in a modern Windows environment?

Accepted Answer

The authentication protocol must permit NTLM or legacy authentication methods to facilitate the hash usage.. Pass-the-hash (PtH) relies on the fact that authentication protocols like NTLM require the hash itself rather than the cleartext password. Understanding this mechanism is vital because it allows attackers to impersonate users without needing to crack complex passwords. The technique effectively bypasses the need for plaintext credentials, making it a staple for lateral movement in internal penetration tests when local administrator or service account access is achieved.

Answer

The target system must have the Kerberos pre-authentication disabled for the user account.

Answer

The victim machine must have the 'Restricted Admin' mode enabled in the RDP configuration.

Answer

The target machine must be running a version of Windows older than Windows Server 2012.

Question 17

During a web application assessment, you discover that the application allows users to upload profile pictures. The server saves these files with their original extensions in a publicly accessible directory. What is the most effective client-side risk associated with this misconfiguration?

Accepted Answer

Execution of Stored Cross-Site Scripting when a victim user navigates directly to the uploaded SVG or HTML file. Allowing arbitrary file uploads without strict extension validation enables attackers to upload malicious HTML or SVG files containing embedded JavaScript. When another user visits the direct URL of the uploaded file, the browser renders the content, leading to Stored Cross-Site Scripting.

Answer

Direct execution of native ELF binaries on the underlying Linux web server operating system

Answer

Immediate compromise of the backend database via automated SQL injection through the filename

Answer

Bypassing network perimeter firewalls through encapsulated ICMP tunneling inside the image metadata

Question 18

Which TWO of the following are common reasons for a buffer overflow exploit to fail even after the return address is correctly overwritten?

Accepted Answer

The presence of undocumented bad characters in the payload.. Exploits often fail due to environmental factors that were not accounted for during the development phase. Even with a perfect offset, the presence of hidden bad characters can truncate the shellcode before it reaches the stack. Additionally, security controls like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization) can prevent the shellcode from executing if the environment is locked down, rendering a simple stack-based overflow ineffective.

Answer

The use of a static JMP ESP address.

Answer

The pattern generator failed to reach the buffer.

Answer

The shellcode is too short for the buffer.

Question 19

You are analyzing a binary and identify a function that uses strcpy() to copy user input into a fixed-size stack buffer. Which register must be controlled to redirect the instruction pointer to your shellcode?

Accepted Answer

The saved Return Address on the stack. To redirect the execution flow, you must overwrite the saved Return Address on the stack. When a function finishes, the CPU pops the value at the saved EIP/RIP location into the Instruction Pointer. By overflowing the buffer and reaching this specific memory location, you gain control over the program's subsequent execution path, which is the foundational concept for stack-based buffer overflow exploitation in the PEN-200 curriculum.

Answer

The ESP register

Answer

The EAX register

Answer

The EBP register

Question 20

During a stack-based buffer overflow exploitation attempt in a Win32 environment, you notice that your shellcode execution fails because certain memory addresses contain null bytes (0x00). Which component of the exploit development process is primarily responsible for identifying and mitigating bad characters?

Accepted Answer

Sending a byte array from 0x00 to 0xFF into the vulnerable buffer and inspecting memory to see which bytes are altered or truncated.. Identifying bad characters is a critical step in buffer overflow development because application functions or memory copy routines may terminate prematurely upon encountering values like null bytes. During the discovery phase, testers systematically send all byte arrays to analyze how memory handles specific inputs, ensuring subsequent shellcode generation avoids breaking the exploit chain and successfully achieves remote code execution.

Answer

Generating a cyclic pattern using pattern_create.rb to determine the precise offset required to overwrite the saved instruction pointer.

Answer

Analyzing memory contents in a debugger to find a stable return-oriented programming gadget pointer.

Answer

Compiling the exploit script with Python to encode the payload using a standard XOR-based encoding scheme.