GPEN Practice Questions

Question 1

Which THREE of the following are valid methods to mitigate the risk of password spray attacks in an integrated Azure AD environment?

Accepted Answer

Enforce Multi-Factor Authentication for all users.. Password spray attacks target common passwords across many accounts. Protecting against this requires a layered approach: enforcing MFA to render weak passwords useless, blocking legacy authentication to prevent bypasses, and utilizing identity protection to detect anomalous logins. These controls are essential for modernizing identity security and protecting against high-volume, low-effort credential attacks that plague hybrid environments.

Answer

Increase the minimum password length to 50 characters.

Answer

Require all users to use the same password for both on-premises and cloud.

Question 2

What is the main risk associated with storing cleartext credentials in environment variables or configuration files?

Accepted Answer

They can be read by any user or process with sufficient file permissions.. Cleartext credentials are easily accessible to anyone with local read access. In a penetration test, finding these files is a 'low-hanging fruit' that often leads to privilege escalation or lateral movement. Many applications inadvertently store sensitive data in logs, config files, or scripts, creating a security debt that attackers exploit to gain unauthorized access without needing to crack passwords through time-consuming cryptographic analysis of captured hashes.

Answer

They are susceptible to rainbow table attacks.

Answer

They prevent the use of multi-factor authentication.

Answer

They automatically trigger account lockouts after one reading.

Question 3

Which document should a penetration tester consult to determine the allowed scope and rules of engagement for a vulnerability scan?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement (RoE) or Statement of Work (SOW) defines the legal and operational boundaries of the assessment. It specifies which systems are in scope, which are out of scope, and what scanning techniques are permitted. Adhering to these documents is essential for maintaining compliance and avoiding unauthorized actions that could lead to legal repercussions or unintended service disruption during the testing phase.

Answer

The organization's public-facing bug bounty program policy.

Answer

The vendor's hardware specification sheets.

Answer

The latest version of the Common Vulnerabilities and Exposures (CVE) list.

Question 4

What is the primary risk associated with storing credentials in plain text within scripts or configuration files?

Accepted Answer

It allows an attacker to bypass authentication without cracking.. Storing cleartext credentials is a critical security failure because it provides an immediate, usable password to any attacker who gains read access to the file system. This often leads to lateral movement and privilege escalation because these scripts are frequently used by administrators to automate tasks across multiple servers. Identifying these files is a major component of any internal penetration test's post-exploitation phase.

Answer

It increases the complexity of the password hashes.

Answer

It prevents the use of multi-factor authentication.

Answer

It triggers an alert in the Windows Event Logs.

Question 5

During an internal penetration test, an attacker successfully captures an NTLMv2 challenge-response authentication exchange from a network segment. The adversary wishes to perform an offline brute-force cracking attack against the captured hash using Hashcat. Which specific Hashcat attack mode and hash format identifier must be specified to successfully crack this captured challenge-response pair?

Accepted Answer

Mode 5600, targeting NetNTLMv2 network authentication captures.. Hashcat mode 5600 specifically targets NetNTLMv2 authentication exchanges captured during network sniffing or LLMNR/NBT-NS poisoning attacks. Using the correct mode ensures Hashcat formats the challenge, username, domain, and response fields properly for structural verification and decryption. Selecting incorrect modes results in immediate errors or zero matches during computation, making accurate identification of authentication protocols a vital pentesting skill.

Answer

Mode 1000, targeting local SAM database NTLM hashes.

Answer

Mode 1300, targeting legacy Windows NT hashes.

Answer

Mode 3000, targeting LM hashes with challenge data.

Question 6

Which TWO of the following are characteristics of 'Salted' hashes compared to 'Unsalted' hashes?

Accepted Answer

They prevent the identification of identical passwords.. Salted hashes introduce a unique, random string to the hashing process for every user, ensuring that identical passwords result in different hashes. This makes it impossible to use global rainbow tables. Unsalted hashes are inherently vulnerable to these tables, as the same plaintext always produces the same hash, allowing for near-instant cracking of common passwords across an entire database once a single table is computed.

Answer

They enable the use of rainbow tables.

Answer

They are inherently faster to crack than unsalted hashes.

Answer

They are usually stored in cleartext in the configuration file.

Question 7

During a penetration test, you successfully dump the LSASS memory space and extract a set of NTLM hashes. Which of the following is the most efficient next step if the goal is to determine the plaintext password of a high-value administrator account?

Accepted Answer

Run Hashcat with a combination of wordlists and mask attacks.. Once NTLM hashes are acquired, the most efficient method to recover the password is using an optimized GPU-based cracking tool like Hashcat. By employing a hybrid attack strategy—starting with a dictionary list supplemented by mask-based brute forcing—the tester can maximize the likelihood of recovering passwords that follow common corporate complexity patterns. This is significantly faster than manual analysis and allows for rapid testing against high-value target accounts.

Answer

Use the hashes to perform a Pass-the-Hash attack on every server.

Answer

Submit the hashes to an online cloud-based cracking service.

Answer

Reverse the MD4 algorithm to recover the original string.

Question 8

Refer to the exhibit. What does the Nmap status 'open|filtered' indicate about the target port, and why does this result commonly occur in penetration testing scenarios?

Accepted Answer

The port is likely open but the scanner is not receiving a clear response.. The 'open|filtered' state means Nmap cannot determine if the port is open or filtered. This happens when the port sends no response to a probe, which is typical behavior for firewalls that drop packets rather than rejecting them. Understanding this distinction is critical for testers, as it implies that the port might be open but protected, necessitating further probing to determine the true state of the service behind the security boundary.

Answer

The port is definitely open but the response was malformed.

Answer

The port is likely closed and the firewall is silently dropping traffic.

Answer

The port is definitely filtered and the service is unreachable.

Question 9

You are analyzing the results of a passive reconnaissance scan using a tool that harvests metadata from files found on a company website. What is the primary security risk associated with this information disclosure?

Accepted Answer

It discloses internal network naming conventions and software versions.. Metadata in files like PDFs or Word documents often includes internal paths, printer names, software versions used for creation, and author usernames. This information is a goldmine for an attacker attempting to build a social engineering lure or profile the target's workstation environment. Understanding that reconnaissance extends beyond network headers to document analysis is a hallmark of an advanced penetration tester who understands holistic information leakage.

Answer

The files can be used to execute arbitrary commands on the client machine.

Answer

It indicates the current load on the corporate web server.

Answer

It bypasses the need for an external vulnerability assessment.

Question 10

Which of the following is the most effective way to detect C2 beacons that use jitter and randomized timing?

Accepted Answer

Applying statistical analysis to traffic patterns.. Since jitter and randomized timing break the simple periodic heartbeat, security teams must use statistical analysis to identify the traffic. By calculating the frequency distribution of connections over a long time window, analysts can identify the underlying regularity that persists despite the jitter. This behavioral approach is significantly more effective than static threshold-based alerts, which are easily defeated by the randomness built into modern C2 communication protocols.

Answer

Blocking all traffic to unknown IP addresses.

Answer

Scanning for specific byte signatures in the payloads.

Answer

Monitoring for high-bandwidth bursts in the network.

Question 11

Which document is primarily responsible for defining the 'Rules of Engagement' (RoE) in a penetration testing project?

Accepted Answer

The Rules of Engagement (RoE) document.. The Rules of Engagement document serves as the operational handbook for the penetration test, detailing exactly what is permitted, what is prohibited, and the emergency procedures to follow. It bridges the gap between the legal contract and the technical execution, ensuring that all parties have a mutual understanding of the engagement's boundaries, safety protocols, and professional expectations, which is critical for minimizing risks during testing.

Answer

The Statement of Work (SOW).

Answer

The Non-Disclosure Agreement (NDA).

Answer

The Service Level Agreement (SLA).

Question 12

During an internal penetration test, you capture an NTLMv2 net-NTLM hash using LLMNR/NBT-NS poisoning. You attempt to crack the hash offline using Hashcat with a standard rockyou.txt wordlist, but the operation yields no plaintext. What is the most effective next step to recover the credentials given that the password complexity requirements were met?

Accepted Answer

Apply rule-based attack modes or hybrid mask attacks in Hashcat to mutate base wordlist entries with common character substitutions, appending numbers, and special symbols.. NTLMv2 hashes utilize a challenge-response mechanism that cannot be reversed directly, requiring offline brute-forcing or rule-based attacks against the captured challenge and response. Because standard wordlists often fail against complex alphanumeric passwords, applying dynamic rule sets or combining masks significantly expands the search space to cover permutations users typically create to satisfy strict corporate password policies during assessments.

Answer

Re-capture the hash using Kerberoasting to obtain a valid Ticket Granting Service ticket for a service principal name instead of relying on the LLMNR response.

Answer

Convert the net-NTLMv2 hash format directly into an MD5 hash format using a custom script so that standard rainbow tables can instantly identify the plaintext password string.

Answer

Downgrade the captured authentication traffic by forcing the domain controller to negotiate LM hashing during the next SMB session establishment phase to simplify cracking.

Question 13

You are performing a penetration test against a web server and want to identify the exact version of the HTTP service running on port 80. Which Nmap command should you use?

Accepted Answer

nmap -sV -p 80 <target>. Service version detection with -sV is the correct technique to identify the software and version running on an open port. It sends probes and compares responses against a signature database, providing the HTTP server version needed for further vulnerability assessment.

Answer

nmap -sS -p 80 <target>

Answer

nmap -sn -p 80 <target>

Answer

nmap -O -p 80 <target>

Question 14

What is the primary benefit of using passive reconnaissance before initiating active scanning?

Accepted Answer

To minimize the footprint of the testing engagement.. Passive reconnaissance gathers information without alerting the target, allowing the tester to build a comprehensive profile without being blocked. This minimizes the risk of triggering security systems early in the engagement. By understanding the organization's architecture through public sources first, the tester can perform more targeted and efficient active scanning later, significantly increasing the probability of success while reducing the likelihood of early detection by the security operations center.

Answer

To identify vulnerabilities without touching the server.

Answer

To guarantee access to the target's internal network.

Answer

To bypass the organization's internal intrusion detection systems.

Question 15

Which command in the Metasploit Framework allows a user to interact with a backgrounded session after a successful exploit execution?

Accepted Answer

sessions -i. The 'sessions' command is the primary method for managing active connections within Metasploit. Once an exploit establishes a payload, the session moves to the background. Using 'sessions -i <id>' connects the user to the specific meterpreter shell, enabling post-exploitation activities. This is crucial for maintaining persistence and executing lateral movement tasks in a penetration test, as it allows the operator to toggle between multiple compromised targets effectively.

Answer

exploit -j

Answer

run -s

Answer

use -session

GIAC Penetration Tester GPEN practice test

Three ways to study

Study GPEN by domain

Study GPEN by topic

Attacking Password Hashes practice questions

Password Attacks and Formats practice questions

Scanning and Host Discovery practice questions

Metasploit practice questions

Vulnerability Scanning practice questions

Kerberos Attacks practice questions

Reconnaissance practice questions

Command and Control practice questions

Exploitation Fundamentals practice questions

Azure AD Integration practice questions

Domain Escalation and Persistence practice questions

Azure Apps and Attacks practice questions

GIAC Penetration Tester practice questions