PEN-200 Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. Which ports are currently open on the target host 192.168.1.10?

Accepted Answer

Ports 22 and 80.. The Nmap output clearly indicates the state of the scanned ports. In this exhibit, ports 22 and 80 are explicitly listed as 'open', while 998 others are closed. Identifying these specific ports is the first step in mapping the target's attack surface. Understanding how to read scan output is a core competency that allows a tester to prioritize their focus towards the services that are most likely to be exploitable.

Answer

All ports from 1 to 1000.

Answer

Only port 22.

Answer

No ports are open.

Question 2

When analyzing a public exploit, which TWO elements should you specifically look for to understand its networking behavior? (Choose TWO)

Accepted Answer

The target port the exploit connects to.. Understanding how an exploit communicates is vital for both success and stealth. By identifying the hardcoded target port and the type of callback payload (e.g., reverse shell vs. bind shell), you can align your listener and firewall configuration to ensure the exploit functions correctly. This level of technical oversight is essential to avoid common pitfalls where the exploit succeeds, but the attacker fails to receive the connection due to network-level misconfigurations.

Answer

The author's name and email address.

Answer

The date the exploit was uploaded.

Answer

The color scheme used in the code.

Question 3

During a web assessment, you find that an application uses an insecure random number generator for token creation. What is the main security implication of this flaw?

Accepted Answer

It leads to session hijacking through token prediction.. Predictable tokens compromise the integrity of session management and password reset mechanisms. If an attacker can determine the algorithm and seed used by the generator, they can forge valid session tokens or reset codes for other users. This vulnerability highlights the necessity of using cryptographically secure pseudorandom number generators (CSPRNGs) to ensure that sensitive authentication tokens cannot be guessed or recreated by adversaries.

Answer

It allows attackers to perform Cross-Site Request Forgery (CSRF).

Answer

It triggers a stack overflow in the web server process.

Answer

It makes the application vulnerable to SQL Injection.

Question 4

A penetration tester uses process hollowing to hide their payload inside 'svchost.exe'. They start the process in a suspended state, unmap its memory, write their shellcode, and resume the thread. What is a specific indicator that an advanced EDR might use to detect this activity?

Accepted Answer

The entry point of the process in memory differs from the image on disk.. Process hollowing is a powerful evasion technique, but it leaves behind traces in the system's memory and process metadata. Advanced EDR solutions monitor for discrepancies between the file on disk and the code in memory. They also track specific API call sequences, such as creating a process in a suspended state followed immediately by memory unmapping and cross-process writing.

Answer

The 'svchost.exe' process will show a significantly higher CPU usage.

Answer

The process will be unable to communicate with the network.

Answer

The system will automatically restart the process due to a checksum error.

Question 5

Refer to the exhibit. What can you conclude about the security of this service binary?

Accepted Answer

The binary can be replaced by any local user to achieve privilege escalation.. The icacls output shows that 'BUILTIN\Users' has '(M)' or Modify permissions on the binary. This means a low-privileged user can replace the legitimate service executable with a malicious one. Because services run as SYSTEM, replacing this file allows for immediate privilege escalation upon the next service restart. This is a common misconfiguration where excessive folder or file permissions enable attackers to gain total control over the host.

Answer

The service is vulnerable to a DLL hijacking attack.

Answer

The service is secure because only SYSTEM and Administrators have full access.

Answer

The service cannot be stopped by a standard user.

Question 6

Refer to the exhibit. What is the most likely goal of this command execution in a privilege escalation context?

Accepted Answer

To perform automated enumeration for privilege escalation.. This command downloads and executes a PowerShell script directly into memory from a remote server. This is a common technique for running automated enumeration scripts like PowerUp or WinPEAS without writing them to the disk. By executing in memory, the attacker minimizes their footprint on the host system, avoiding detection by file-based signature scanning while gathering information about potential escalation vectors.

Answer

To install a persistent backdoor on the system.

Answer

To escalate privileges to SYSTEM directly.

Answer

To exfiltrate sensitive files from the system.

Question 7

You have compromised a Linux jump host and need to access an internal web application on 192.168.1.50:80 that is firewalled from your local machine. You have SSH access to the jump host. Which command should you execute on your local machine to securely access the application via your browser?

Accepted Answer

ssh -L 8080:192.168.1.50:80 user@jump-host. Local port forwarding allows you to tunnel traffic from a local port to a destination reachable by the SSH server. By mapping a local port to the internal web server's address, you bypass network restrictions imposed by firewalls. This technique is fundamental for pivoting through compromised hosts, enabling tools like Burp Suite or browsers to interact with internal services as if they were running locally, which is vital for further web application vulnerability assessment.

Answer

ssh -R 8080:192.168.1.50:80 user@jump-host

Answer

ssh -D 8080 user@jump-host

Answer

ssh -fN -L 192.168.1.50:80:8080 user@jump-host

Question 8

You have obtained a low-privileged domain user account and are performing internal enumeration. You identify a computer object in the domain where the 'ms-MCS-AdmPwd' attribute is readable by your user account. Which attack path does this vulnerability facilitate?

Accepted Answer

Extracting the cleartext local administrator password. The ms-MCS-AdmPwd attribute stores the cleartext Local Administrator Password for a computer managed by LAPS. By reading this attribute, an attacker can extract the password for the local administrator account of the target machine. This is a critical discovery because it allows immediate lateral movement from a low-privileged domain context to local administrative privileges on that specific host, potentially leading to further credential harvesting or domain escalation.

Answer

Kerberoasting the computer account password hash

Answer

Exploiting the GPO to modify the Domain Admins group

Answer

Performing an AS-REP Roasting attack on the machine

Question 9

You are using Proxychains to route your Nmap scan through a SOCKS proxy. Which configuration file must you modify to ensure that the proxy settings are correctly applied during your scan?

Accepted Answer

/etc/proxychains.conf. Proxychains relies on a configuration file to determine which proxy servers to use for traffic redirection. Misconfiguring this file is a common pitfall that leads to scans either failing or leaking traffic directly from your machine. Correctly setting the proxy type, IP address, and port ensures that all traffic generated by the tools you prefix with proxychains is routed through the specified tunnel, maintaining your stealth and reachability.

Answer

/etc/nmap/nmap.conf

Answer

/etc/ssh/ssh_config

Answer

/etc/network/interfaces

Question 10

Which of the following describes the 'GPP Password' vulnerability?

Accepted Answer

The storage of cleartext credentials in GPO XML files. Group Policy Preferences (GPP) allows administrators to manage local accounts on domain computers. In older versions of Windows, these passwords were encrypted with a static, publicly known AES key. If an attacker gains read access to the 'Groups.xml' file in the SYSVOL share, they can decrypt the 'cpassword' attribute, revealing the cleartext password of the local administrator account for the affected machine.

Answer

A flaw in the Kerberos preauthentication mechanism

Answer

The inability to enforce password complexity on GPOs

Answer

A failure in the Domain Controller's LDAP signing