PEN-200 Exam Simulation — 100 Questions

Question 1

You are performing a network scan on a client segment and notice that a host responds to ICMP echo requests but shows all TCP ports as 'filtered' when using Nmap. Which conclusion is most accurate?

Accepted Answer

A network-based firewall is likely dropping incoming TCP packets while allowing ICMP traffic to pass through.. The 'filtered' status indicates that a firewall or packet-filtering device is likely intercepting the TCP SYN packets and dropping them or sending prohibited ICMP error messages. Since the host responds to ICMP, the host is live, but the network path or host-based firewall prevents TCP probing. Understanding this distinction is critical for pivoting strategies and determining if the target's attack surface is truly closed or merely protected by perimeter security controls.

Answer

The target machine is powered off and the ICMP response is generated by a gateway device.

Answer

The target host is running a non-standard TCP/IP stack that ignores all incoming connection attempts.

Answer

The network interface on the target machine is misconfigured and unable to process TCP/IP traffic.

Question 2

You are auditing a web application and notice it uses base64 encoding to store user credentials in a cookie. What is the most accurate assessment of this security practice?

Accepted Answer

The implementation is insecure because base64 is an encoding, not a cryptographic protection.. Base64 is an encoding scheme, not an encryption or hashing algorithm. It is completely reversible and provides zero confidentiality for sensitive data. An attacker can easily decode these values to reveal plaintext credentials. This is a common finding in penetration tests that highlights a lack of understanding of the difference between obfuscation and actual security controls, requiring immediate remediation to protect session integrity.

Answer

The credentials are secure because base64 is difficult to reverse without the secret key.

Answer

The credentials are protected from casual inspection but vulnerable to automated tools.

Answer

The implementation is acceptable if the connection is encrypted with TLS.

Question 3

During an authorized penetration test, you want to perform a client-side attack by delivering a malicious HTA file via a phishing email. Which technique is most effective to execute native commands silently when the user opens the file?

Accepted Answer

Using mshta.exe to process a VBScript payload embedded within the HTA container to spawn a reverse shell. HTA files execute via mshta.exe, allowing VBScript or JScript integration to run operating system commands directly without standard browser security sandboxes. This makes HTA files highly effective for initial access vectors during social engineering engagements when users trust and run local executables.

Answer

Embedding the HTA inside a standard PDF document using an external URI scheme pointing to a remote script

Answer

Hosting the HTA file on an Apache web server with a fake mime-type configuration forcing automatic execution

Answer

Converting the HTA payload into a malicious shortcut (.lnk) file that calls PowerShell with hidden window arguments

Question 4

Which of the following describes a successful Path Traversal attack in a web application?

Accepted Answer

Using dot-dot-slash sequences to read /etc/passwd on a Linux server.. Path Traversal allows attackers to access files outside the intended web root directory by manipulating input parameters that contain file paths. By using dot-dot-slash sequences, an attacker escapes the restricted directory. This is a critical vulnerability that can lead to the exposure of configuration files, sensitive system data, or source code, which is why validating input is a fundamental security requirement.

Answer

Injecting JavaScript into a form field to capture user session cookies.

Answer

Submitting a crafted SQL query to retrieve data from the database.

Answer

Overloading the server with requests to exhaust system memory.

Question 5

Refer to the exhibit.

[!] Error compiling payload: Function 'VirtualAlloc' not found in target assembly scope.

An operator is writing a custom process injection loader in C# and encounters the compilation error shown above while attempting to allocate memory for shellcode. How should the operator properly resolve this issue to enable low-level memory allocation?

Accepted Answer

Import the unmanaged function from kernel32.dll using Platform Invoke (P/Invoke) declarations.. Managed languages like C# do not natively expose low-level Windows API functions like VirtualAlloc without explicit interoperability declarations. Utilizing Platform Invoke allows developers to import unmanaged DLL functions from kernel32.dll, bridging the gap between managed code execution and low-level memory manipulation required for advanced payload execution.

Answer

Replace VirtualAlloc with the standard .NET File.ReadAllBytes method to read the shellcode into a byte array.

Answer

Enable unsafe code blocks in the project settings and use raw C-style pointer arithmetic directly.

Answer

Compile the C# application as a 64-bit exclusive binary to match the target operating system architecture.

Question 6

You have identified a vulnerable service using an outdated version of a CMS. You successfully locate a public exploit script on GitHub. What is the most critical first step before running this script against your target?

Accepted Answer

Read the source code to understand its mechanism and potential impact.. Before executing any public exploit, you must analyze the source code to understand its functionality, dependencies, and potential impact. Public exploits are often poorly written or intentionally malicious, potentially causing service crashes or backdooring the attacker machine. Understanding the payload ensures you do not inadvertently trigger unwanted side effects or trigger defensive alarms that could disrupt your assessment during the penetration testing engagement.

Answer

Immediately run the exploit script with administrative privileges.

Answer

Change the target IP address in the script's configuration.

Answer

Install all dependencies listed in the script's requirements file.

Question 7

During external reconnaissance you collect DNS records for a target organization and find an MX record pointing to mail.example.com. You want to identify the IP addresses of other hosts in the same mail infrastructure without sending any packets directly to the target's servers. Which action best fits this passive goal?

Accepted Answer

Query a public passive DNS database such as SecurityTrails or VirusTotal for historical A records of example.com.. Passive reconnaissance relies on data already collected by third parties, so no packets touch the target. Passive DNS services aggregate historical resolution records from many sensors, letting you map subdomains and IP addresses, including hosts no longer published. Zone transfers, ping sweeps, and reverse lookups all generate traffic toward the target or its authoritative infrastructure, which breaks the passive-only requirement stated in the scenario.

Answer

Use nmap -sn 203.0.113.0/24 to discover which hosts in the mail subnet are alive.

Answer

Run dig axfr @ns1.example.com example.com to transfer the full zone.

Answer

Perform a reverse DNS lookup against each IP in the target's announced BGP prefixes.

Question 8

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a Windows host. You want to crack it offline to recover the plaintext password. Which tool and mode should you use to maximize efficiency against this hash type?

Accepted Answer

Hashcat with mode 5600 and a wordlist combined with rule-based mutations.. NetNTLMv2 hashes are challenge-response pairs that cannot be used directly for pass-the-hash. To recover the plaintext, offline cracking is required. Hashcat mode 5600 is designed for NetNTLMv2, and combining a wordlist with rules significantly improves success rates by mimicking common password transformations. Other modes or tools may work but are less efficient or incorrect for this hash type.

Answer

Hashcat with mode 1000 and a mask attack targeting eight-character passwords.

Answer

John the Ripper with `--format=netntlmv2` and the `--incremental` mode.

Answer

Use `responder` to relay the hash to another host and gain access without cracking.

Question 9

When exploiting a service via 'Modify' permissions on its binary, why is it necessary to restart the service?

Accepted Answer

To trigger the execution of the new binary.. Services run as long-lived processes. When the service starts, the binary is loaded into memory and executed. If you replace the binary while the service is running, the old process remains active. Restarting the service forces the Service Control Manager to stop the original process and start the new, modified binary, thereby executing your malicious code in the process space of the service.

Answer

To refresh the file system cache.

Answer

To bypass the Windows Service integrity check.

Answer

To allow the service to read the new configuration.

Question 10

During an internal assessment you run a TCP SYN scan and note that a host responds with an RST/ACK for every probed port. What does this behavior most reliably indicate about the target host?

Accepted Answer

The host is up and reachable, but no TCP listeners are present on the probed ports.. A TCP RST/ACK in response to a SYN is the standard signal of a closed but reachable port, because the kernel answers on behalf of a port with no bound listener. It confirms the host is alive and the path is unfiltered, letting you distinguish closed ports from filtered ones and focus subsequent service enumeration on ports that actually return SYN/ACK.

Answer

The target is running an IDS that spoofs resets to mislead the scanner.

Answer

The probed ports are open but the services are refusing the connection.

Answer

A stateful firewall is silently dropping the probe packets before they reach the host.

Question 11

During an internal Active Directory assessment, you have compromised a standard domain user account. You run BloodHound and identify that this user has the 'GenericAll' permission over a computer object named WEB01. You want to leverage this permission to compromise WEB01 and obtain administrative access to it. Which of the following is the most direct and reliable technique to achieve this?

Accepted Answer

Use the GenericAll permission to perform a shadow credentials attack by adding a Key Credential to the msDS-KeyCredentialLink attribute of WEB01.. GenericAll over a computer object allows full control, including modifying the msDS-KeyCredentialLink attribute. By adding a Key Credential, an attacker can authenticate as the computer account via PKINIT and obtain a TGT, effectively taking over the machine. This shadow credentials technique is direct and does not require cracking or additional accounts, making it the most efficient path to compromise WEB01.

Answer

Use the GenericAll permission to perform a targeted Kerberoasting attack by setting an SPN on a user account you control, then request a service ticket.

Answer

Perform a Kerberoasting attack against the machine account of WEB01 to obtain its hash and then crack it offline.

Answer

Use the GenericAll permission to perform a resource-based constrained delegation attack by modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

Question 12

Which of the following is the most effective way to prevent Cross-Site Scripting (XSS) in a web application?

Accepted Answer

Implementing context-aware output encoding for all user-supplied data.. The most effective defense against XSS is context-aware output encoding. By converting special characters into their HTML entity equivalents before rendering, you ensure the browser treats the input as data rather than executable code. This is a critical security practice because it handles the root cause of the vulnerability—the browser's inability to distinguish between intended content and injected malicious scripts, regardless of the user input provided.

Answer

Using a blacklist to filter out common JavaScript keywords.

Answer

Disabling all JavaScript in the user's browser settings.

Answer

Setting all cookies with the 'Secure' flag in the response header.

Question 13

What is the most likely security risk associated with the configuration shown in the exhibit?

Accepted Answer

Attackers can browse the directory and discover sensitive files.. The 'Indexes' option enables directory listing, allowing attackers to browse the web server's file system if no index file is present. This is a significant information disclosure vulnerability because it exposes sensitive configuration files, backups, and source code that were never intended for public view. Disabling directory browsing is a fundamental hardening step for any web server to prevent accidental leakage of proprietary or sensitive infrastructure information.

Answer

The server will allow remote code execution through the index file.

Answer

The configuration will prevent users from accessing any files.

Answer

The server will stop processing PHP files entirely.

Question 14

When performing a DCSync attack, what is the core mechanism being exploited?

Accepted Answer

The Active Directory Replication Service (DRS) protocol. DCSync exploits the Active Directory replication protocol. By mimicking the behavior of a domain controller, an attacker can request that another domain controller replicate user credentials, including password hashes, to them. This requires the attacker to hold 'Replication-Get-Changes' and 'Replication-Get-Changes-All' permissions, which are typically only held by domain controllers or highly privileged administrators, making it a powerful tool for dumping the entire domain's secrets.

Answer

The Kerberos ticket granting service process

Answer

The LDAP signing enforcement on the Domain Controller

Answer

The storage of passwords in the SYSVOL share

Question 15

What is the primary purpose of an exploit payload in a buffer overflow context?

Accepted Answer

To execute arbitrary commands on the target system.. The exploit payload is the set of instructions (often shellcode) that you want the CPU to execute once you have successfully redirected the program's control flow. The goal is to perform an action, such as spawning a reverse shell or executing a command. The entire process of finding an offset and overwriting the return address is merely the delivery vehicle for this payload, which provides the desired post-exploitation access.

Answer

To increase the size of the target buffer.

Answer

To crash the application for a denial-of-service attack.

Answer

To bypass the authentication mechanism of the application.

Question 16

When evaluating a web application for Cross-Site Scripting vulnerabilities during a penetration test, which TWO input contexts should you examine because they frequently lead to executable script injection?

Accepted Answer

Input reflected directly between opening and closing HTML tags, such as

USER_INPUT

. XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Answer

Input processed by a backend database stored procedure for primary key generation

Answer

Input stored as an encrypted binary blob inside the browser local session storage

Answer

Input utilized as a parameter value inside a server-side JSON response header without content-type sniffing

Question 17

During enumeration, you discover that the registry keys 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated' and 'HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated' are both set to 1. Which of the following is the most efficient way to exploit this configuration?

Accepted Answer

Generate a malicious MSI file and execute it using 'msiexec /quiet /qn /i payload.msi'.. The AlwaysInstallElevated policy is a specific Windows feature that allows non-privileged users to run Windows Installer (MSI) packages with SYSTEM privileges. For this to work, the policy must be enabled in both the machine (HKLM) and user (HKCU) registry hives. Attackers can exploit this by crafting a malicious MSI file that executes a command, such as adding a user or opening a reverse shell.

Answer

Use 'certutil' to download and execute a portable executable (EXE) directly.

Answer

Modify the 'AlwaysInstallElevated' key in HKCU to point to a malicious script instead of '1'.

Answer

Inject a malicious DLL into the 'msiexec.exe' process while it is running.

Question 18

You are adapting a public exploit whose payload is a reverse shell. The exploit runs and the service reports success, but your netcat listener never receives a connection. Which cause is most likely?

Accepted Answer

The target's outbound firewall blocks the callback port, or the payload is calling back to an address the target cannot route to.. When exploitation succeeds but no callback arrives, the network path from target to listener is the prime suspect. Outbound firewall rules or a payload addressed to an unroutable interface stop the reverse shell even though the vulnerability was triggered. Offset errors would crash the service, netcat is a valid listener, and high-port binding needs no elevated privileges.

Answer

Netcat is not capable of receiving reverse shells and a different listener is required.

Answer

The exploit's buffer overflow offset is incorrect, so the payload never reaches the instruction pointer.

Answer

The exploit was run without administrative privileges on the attacker machine, preventing the listener from binding.

Question 19

Refer to the exhibit. ```http HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

Welcome

``` Based on the HTTP response headers and body shown in the exhibit, what significant security risk is present regarding client-side attacks?

Accepted Answer

The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting. The inclusion of the 'unsafe-inline' directive in the Content Security Policy script-src allows the browser to execute inline script blocks present in the HTML. This configuration largely defeats the protective benefits of a CSP against Cross-Site Scripting, as attackers who can inject inline scripts will achieve execution.

Answer

The application is completely immune to Cross-Site Scripting because a Content Security Policy is strictly enforced

Answer

The server is vulnerable to remote code execution because the nginx version header is explicitly exposed

Answer

The session token is vulnerable to interception because the response is transmitted over unencrypted HTTP

Question 20

During an engagement, you capture an AS-REP response from the domain controller. What is the specific prerequisite for this account to be vulnerable to AS-REP Roasting?

Accepted Answer

The account must have the 'Do not require Kerberos pre-authentication' option enabled.. AS-REP Roasting is possible when a user account has the 'Do not require Kerberos pre-authentication' attribute enabled in Active Directory. This allows an attacker to request a ticket for the user without needing the correct password, which can then be cracked offline. Understanding this specific AD attribute is critical for identifying vulnerable accounts during internal reconnaissance, as it represents a significant misconfiguration that simplifies the path to credential recovery.

Answer

The account must have a Service Principal Name (SPN) set in the domain properties.

Answer

The user must be a member of the Domain Admins or Enterprise Admins group.

Answer

The account must be configured with a password that has never been rotated.