PEN-200 Windows Privilege Escalation Practice Question
During a penetration test on a Windows Server 2019 host, you obtain a low-privileged shell as user 'webuser'. You run 'whoami /priv' and observe that the account has SeImpersonatePrivilege enabled. Which exploitation technique is most directly applicable?
⚠ Common exam trap
The trap here is assuming that SeImpersonatePrivilege alone allows direct token theft from any process, when it actually requires coercing a privileged service to authenticate first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a token impersonation attack such as JuicyPotato or PrintSpoofer to impersonate a SYSTEM token.
SeImpersonatePrivilege permits a process to impersonate another user's token. Attackers exploit this by forcing a privileged service to authenticate to a controlled endpoint, then impersonating its token to gain SYSTEM-level access. Tools like JuicyPotato, RoguePotato, or PrintSpoofer automate this. The other options require permissions not granted by this privilege, such as file write or administrative task creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Schedule a task to run as SYSTEM using schtasks with the /RU SYSTEM flag.
Why it's wrong here
Creating a scheduled task that runs as SYSTEM requires administrative privileges. A low-privileged user cannot specify /RU SYSTEM without credentials or elevation. SeImpersonatePrivilege does not allow task creation with elevated privileges. Hence, this method is not feasible and would be blocked by access controls.
- ✓
Use a token impersonation attack such as JuicyPotato or PrintSpoofer to impersonate a SYSTEM token.
Why this is correct
SeImpersonatePrivilege allows a process to impersonate a token, and tools like JuicyPotato or PrintSpoofer abuse this by coercing a privileged service to authenticate, then capturing and impersonating its token. This directly leverages the privilege to escalate to SYSTEM without needing to modify files or registry keys.
- ✗
Modify a service binary that runs as SYSTEM to execute a reverse shell.
Why it's wrong here
Modifying a service binary requires write permissions on that binary or its directory, which is unrelated to SeImpersonatePrivilege. The privilege does not grant file system write access. Therefore, this technique would not work unless the user already had those permissions, making it irrelevant to the observed privilege.
- ✗
Extract password hashes from the SAM database using Mimikatz and pass-the-hash.
Why it's wrong here
SeImpersonatePrivilege does not grant access to the SAM database. Reading SAM requires administrative privileges or direct disk access, which a low-privileged user lacks. Mimikatz needs debug privileges or admin rights to dump hashes. Thus, this approach is not applicable here and would fail due to insufficient permissions.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.