PEN-200 Multiple Select — 10 Questions

Question 1

When evaluating a web application for Cross-Site Scripting vulnerabilities during a penetration test, which TWO input contexts should you examine because they frequently lead to executable script injection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Input reflected directly between opening and closing HTML tags, such as

USER_INPUT

. XSS occurs when untrusted user input is rendered in an unsafe context within the HTML document. Examining input reflected directly inside HTML body tags or inside event handler attributes (like onload or onerror) are primary areas where browsers will evaluate injected strings as executable JavaScript.

Answer

Input processed by a backend database stored procedure for primary key generation

Answer

Input stored as an encrypted binary blob inside the browser local session storage

Answer

Input utilized as a parameter value inside a server-side JSON response header without content-type sniffing

Question 2

A penetration tester is investigating scheduled tasks for potential privilege escalation. Which TWO conditions must be met for a scheduled task to be successfully exploited for gaining SYSTEM privileges?

Accepted Answer

The task is configured to run under the context of the SYSTEM account or a member of the Administrators group.. Scheduled tasks are a common persistence and escalation vector. For escalation, the task must execute with higher privileges than the current user, typically as SYSTEM or an Administrator. Additionally, the attacker must have the ability to influence what the task executes, either by modifying the executable file, a script it calls, or the task configuration itself to point to a malicious file.

Answer

The task must have a trigger set to 'At log on' for any user on the system.

Answer

The 'Hidden' attribute must be enabled in the task settings to bypass Windows Defender detection.

Answer

The task must be part of the default Windows installation rather than a third-party application.

Question 3

You have compromised a service account that has the SeEnableDelegationPrivilege right on a domain controller. You want to abuse Kerberos delegation to gain access to a target server's file share. Which two steps are required to configure and exploit unconstrained delegation on a controlled computer object? (Choose two.)

Accepted Answer

Set the TRUSTED_FOR_DELEGATION flag on the controlled computer object so the domain controller will forward TGTs to it.. Unconstrained delegation abuse requires two things: enabling the TRUSTED_FOR_DELEGATION flag on a controlled computer so the DC forwards TGTs to it, and coercing a privileged user to authenticate to that computer so a TGT is cached in memory. Extracting the TGT then allows impersonation. The other options describe constrained delegation, an unrelated SPN configuration, or a security control that blocks the attack.

Answer

Configure a Service Principal Name on the controlled computer object for the target file share service (cifs/target).

Answer

Modify the msDS-AllowedToDelegateTo attribute on the controlled computer to include the target server's CIFS service.

Answer

Add the controlled computer to the Protected Users group to ensure delegation tokens are cached securely.

Question 4

A penetration tester needs to deliver a Meterpreter payload to a Windows target protected by an EDR that performs both static file scanning and behavioral monitoring of process creation. The tester wants to reduce the chance of detection during initial execution while still obtaining a session. Which two techniques most directly reduce detection in this combined scenario? (Choose two.)

Accepted Answer

Spawn the payload by injecting into a legitimate, already-running process such as explorer.exe rather than starting a new process.. The scenario involves two distinct controls: static file scanning and behavioral process monitoring. A custom loader with encrypted shellcode removes recognizable bytes from disk, defeating static signatures. Injecting into an existing trusted process avoids the new-process creation event that behavioral engines monitor, placing execution inside a process already deemed legitimate. Together these address both controls. Renaming, UPX packing, and registry tampering either leave the static bytes intact or generate their own high-signal events.

Answer

Disable Windows Defender real-time protection by modifying the registry before executing the payload.

Answer

Rename the payload executable to svchost.exe and place it in the user's temp directory.

Answer

Compress the payload with UPX and deliver it as a self-extracting archive.

Question 5

You need to fingerprint the web server technology behind an HTTP service without sending malformed or intrusive requests. Which two actions best accomplish passive-leaning banner and behavior fingerprinting during enumeration? (Choose two.)

Accepted Answer

Inspect the Server and X-Powered-By response headers returned in the HTTP reply.. Header inspection and error-page analysis both identify server technology using ordinary, non-destructive requests. Headers may name the server and runtime directly, while distinctive 404 templates expose the stack when banners are hidden. Together they fingerprint the web service safely, whereas crash attempts, full port sweeps, and credential guessing are intrusive or simply unrelated to identifying the technology.

Answer

Send a buffer of several thousand bytes in the request line to provoke a crash signature.

Answer

Run a full TCP port scan of all 65535 ports on the host to infer the web stack.

Answer

Attempt default administrative credentials against the web login form.

Question 6

You are assessing a login form and suspect a blind SQL injection vulnerability. The application does not return database errors, but the response time varies significantly based on the input. Which TWO of the following techniques would be most effective to confirm this vulnerability?

Accepted Answer

Injecting 'SLEEP(5)' or equivalent wait commands.. Blind SQL injection relies on inferring data through side channels like time delays or Boolean logic. Time-based payloads force the database to pause, while Boolean-based payloads cause the page content to change based on true/false conditions. These methods are essential when direct data output is suppressed, allowing an attacker to reconstruct the database contents systematically through repeated, measured queries to the back-end server.

Answer

Reviewing the server's source code files.

Answer

Forcing the application to display verbose error messages.

Answer

Attempting to perform a Cross-Site Request Forgery.

Question 7

A penetration tester is preparing to bypass antivirus on a Windows target during a PEN-200 lab. The tester wants to use packing and encryption to alter the payload's signature and avoid static detection. Which TWO techniques are effective for evading static signature-based detection by changing the file's binary appearance without altering its functionality? (Choose two.)

Accepted Answer

Encrypting the payload with a unique key and including the decryption routine in a custom loader.. Effective static evasion requires changing the bytes that signatures match. Packers encrypt and compress the original code, so the on-disk file no longer contains the recognizable pattern. Encrypting the payload with a unique key and a custom loader achieves the same by making each build's bytes unique. Both preserve functionality while altering the binary appearance. Appending random bytes, renaming, or modifying PE metadata do not change the core code sections that signatures target, so they are ineffective for evading static detection.

Answer

Modifying the PE header to change the compile timestamp and checksum.

Answer

Renaming the executable file to a system process name such as svchost.exe.

Answer

Appending random bytes to the end of the executable to change its file hash.

Question 8

Which TWO of the following actions are considered best practice during the initial host enumeration phase to avoid detection by security monitoring tools?

Accepted Answer

Prioritize passive reconnaissance using OSINT sources.. To minimize detection, penetration testers should prioritize passive information gathering before engaging in active, noisy scanning. When active scanning is required, rate-limiting and targeting specific ports rather than performing a 'scan all' approach helps blend the traffic into normal network behavior. These practices are essential for maintaining the stealth required in professional engagements, ensuring that the tester remains undetected while collecting the necessary intelligence to identify high-value targets.

Answer

Perform a full port scan on all 65535 ports concurrently.

Answer

Use aggressive service detection flags in all scans.

Answer

Scan from the same IP address at all times.

Question 9

Which THREE of the following are considered 'active' reconnaissance techniques, as opposed to passive techniques?

Accepted Answer

Port scanning with Nmap.. Active reconnaissance involves direct interaction with the target system, which creates a visible footprint in server logs. Techniques like port scanning, service version detection, and directory brute-forcing are all active because they involve sending packets that the target must respond to. In contrast, passive reconnaissance uses third-party services to gather information without touching the target. Understanding this distinction is vital for maintaining the desired level of stealth throughout the reconnaissance and exploitation process.

Answer

WHOIS lookup.

Answer

Searching Google for public documents.

Question 10

When analyzing a public exploit, which TWO elements should you specifically look for to understand its networking behavior? (Choose TWO)

Accepted Answer

The target port the exploit connects to.. Understanding how an exploit communicates is vital for both success and stealth. By identifying the hardcoded target port and the type of callback payload (e.g., reverse shell vs. bind shell), you can align your listener and firewall configuration to ensure the exploit functions correctly. This level of technical oversight is essential to avoid common pitfalls where the exploit succeeds, but the attacker fails to receive the connection due to network-level misconfigurations.

Answer

The author's name and email address.

Answer

The date the exploit was uploaded.

Answer

The color scheme used in the code.