PEN-200 Practice Questions

Question 1

You are performing a network scan on a client segment and notice that a host responds to ICMP echo requests but shows all TCP ports as 'filtered' when using Nmap. Which conclusion is most accurate?

Accepted Answer

A network-based firewall is likely dropping incoming TCP packets while allowing ICMP traffic to pass through.. The 'filtered' status indicates that a firewall or packet-filtering device is likely intercepting the TCP SYN packets and dropping them or sending prohibited ICMP error messages. Since the host responds to ICMP, the host is live, but the network path or host-based firewall prevents TCP probing. Understanding this distinction is critical for pivoting strategies and determining if the target's attack surface is truly closed or merely protected by perimeter security controls.

Answer

The target machine is powered off and the ICMP response is generated by a gateway device.

Answer

The target host is running a non-standard TCP/IP stack that ignores all incoming connection attempts.

Answer

The network interface on the target machine is misconfigured and unable to process TCP/IP traffic.

Question 2

You are auditing a web application and notice it uses base64 encoding to store user credentials in a cookie. What is the most accurate assessment of this security practice?

Accepted Answer

The implementation is insecure because base64 is an encoding, not a cryptographic protection.. Base64 is an encoding scheme, not an encryption or hashing algorithm. It is completely reversible and provides zero confidentiality for sensitive data. An attacker can easily decode these values to reveal plaintext credentials. This is a common finding in penetration tests that highlights a lack of understanding of the difference between obfuscation and actual security controls, requiring immediate remediation to protect session integrity.

Answer

The credentials are secure because base64 is difficult to reverse without the secret key.

Answer

The credentials are protected from casual inspection but vulnerable to automated tools.

Answer

The implementation is acceptable if the connection is encrypted with TLS.

Question 3

During an authorized penetration test, you want to perform a client-side attack by delivering a malicious HTA file via a phishing email. Which technique is most effective to execute native commands silently when the user opens the file?

Accepted Answer

Using mshta.exe to process a VBScript payload embedded within the HTA container to spawn a reverse shell. HTA files execute via mshta.exe, allowing VBScript or JScript integration to run operating system commands directly without standard browser security sandboxes. This makes HTA files highly effective for initial access vectors during social engineering engagements when users trust and run local executables.

Answer

Embedding the HTA inside a standard PDF document using an external URI scheme pointing to a remote script

Answer

Hosting the HTA file on an Apache web server with a fake mime-type configuration forcing automatic execution

Answer

Converting the HTA payload into a malicious shortcut (.lnk) file that calls PowerShell with hidden window arguments

Question 4

Which of the following describes a successful Path Traversal attack in a web application?

Accepted Answer

Using dot-dot-slash sequences to read /etc/passwd on a Linux server.. Path Traversal allows attackers to access files outside the intended web root directory by manipulating input parameters that contain file paths. By using dot-dot-slash sequences, an attacker escapes the restricted directory. This is a critical vulnerability that can lead to the exposure of configuration files, sensitive system data, or source code, which is why validating input is a fundamental security requirement.

Answer

Injecting JavaScript into a form field to capture user session cookies.

Answer

Submitting a crafted SQL query to retrieve data from the database.

Answer

Overloading the server with requests to exhaust system memory.

Question 5

Refer to the exhibit.

[!] Error compiling payload: Function 'VirtualAlloc' not found in target assembly scope.

An operator is writing a custom process injection loader in C# and encounters the compilation error shown above while attempting to allocate memory for shellcode. How should the operator properly resolve this issue to enable low-level memory allocation?

Accepted Answer

Import the unmanaged function from kernel32.dll using Platform Invoke (P/Invoke) declarations.. Managed languages like C# do not natively expose low-level Windows API functions like VirtualAlloc without explicit interoperability declarations. Utilizing Platform Invoke allows developers to import unmanaged DLL functions from kernel32.dll, bridging the gap between managed code execution and low-level memory manipulation required for advanced payload execution.

Answer

Replace VirtualAlloc with the standard .NET File.ReadAllBytes method to read the shellcode into a byte array.

Answer

Enable unsafe code blocks in the project settings and use raw C-style pointer arithmetic directly.

Answer

Compile the C# application as a 64-bit exclusive binary to match the target operating system architecture.

Question 6

You have identified a vulnerable service using an outdated version of a CMS. You successfully locate a public exploit script on GitHub. What is the most critical first step before running this script against your target?

Accepted Answer

Read the source code to understand its mechanism and potential impact.. Before executing any public exploit, you must analyze the source code to understand its functionality, dependencies, and potential impact. Public exploits are often poorly written or intentionally malicious, potentially causing service crashes or backdooring the attacker machine. Understanding the payload ensures you do not inadvertently trigger unwanted side effects or trigger defensive alarms that could disrupt your assessment during the penetration testing engagement.

Answer

Immediately run the exploit script with administrative privileges.

Answer

Change the target IP address in the script's configuration.

Answer

Install all dependencies listed in the script's requirements file.

Question 7

During external reconnaissance you collect DNS records for a target organization and find an MX record pointing to mail.example.com. You want to identify the IP addresses of other hosts in the same mail infrastructure without sending any packets directly to the target's servers. Which action best fits this passive goal?

Accepted Answer

Query a public passive DNS database such as SecurityTrails or VirusTotal for historical A records of example.com.. Passive reconnaissance relies on data already collected by third parties, so no packets touch the target. Passive DNS services aggregate historical resolution records from many sensors, letting you map subdomains and IP addresses, including hosts no longer published. Zone transfers, ping sweeps, and reverse lookups all generate traffic toward the target or its authoritative infrastructure, which breaks the passive-only requirement stated in the scenario.

Answer

Use nmap -sn 203.0.113.0/24 to discover which hosts in the mail subnet are alive.

Answer

Run dig axfr @ns1.example.com example.com to transfer the full zone.

Answer

Perform a reverse DNS lookup against each IP in the target's announced BGP prefixes.

Question 8

During an internal penetration test, you capture a NetNTLMv2 challenge-response hash from a Windows host. You want to crack it offline to recover the plaintext password. Which tool and mode should you use to maximize efficiency against this hash type?

Accepted Answer

Hashcat with mode 5600 and a wordlist combined with rule-based mutations.. NetNTLMv2 hashes are challenge-response pairs that cannot be used directly for pass-the-hash. To recover the plaintext, offline cracking is required. Hashcat mode 5600 is designed for NetNTLMv2, and combining a wordlist with rules significantly improves success rates by mimicking common password transformations. Other modes or tools may work but are less efficient or incorrect for this hash type.

Answer

Hashcat with mode 1000 and a mask attack targeting eight-character passwords.

Answer

John the Ripper with `--format=netntlmv2` and the `--incremental` mode.

Answer

Use `responder` to relay the hash to another host and gain access without cracking.

Question 9

When exploiting a service via 'Modify' permissions on its binary, why is it necessary to restart the service?

Accepted Answer

To trigger the execution of the new binary.. Services run as long-lived processes. When the service starts, the binary is loaded into memory and executed. If you replace the binary while the service is running, the old process remains active. Restarting the service forces the Service Control Manager to stop the original process and start the new, modified binary, thereby executing your malicious code in the process space of the service.

Answer

To refresh the file system cache.

Answer

To bypass the Windows Service integrity check.

Answer

To allow the service to read the new configuration.

Question 10

During an internal assessment you run a TCP SYN scan and note that a host responds with an RST/ACK for every probed port. What does this behavior most reliably indicate about the target host?

Accepted Answer

The host is up and reachable, but no TCP listeners are present on the probed ports.. A TCP RST/ACK in response to a SYN is the standard signal of a closed but reachable port, because the kernel answers on behalf of a port with no bound listener. It confirms the host is alive and the path is unfiltered, letting you distinguish closed ports from filtered ones and focus subsequent service enumeration on ports that actually return SYN/ACK.

Answer

The target is running an IDS that spoofs resets to mislead the scanner.

Answer

The probed ports are open but the services are refusing the connection.

Answer

A stateful firewall is silently dropping the probe packets before they reach the host.

Question 11

During an internal Active Directory assessment, you have compromised a standard domain user account. You run BloodHound and identify that this user has the 'GenericAll' permission over a computer object named WEB01. You want to leverage this permission to compromise WEB01 and obtain administrative access to it. Which of the following is the most direct and reliable technique to achieve this?

Accepted Answer

Use the GenericAll permission to perform a shadow credentials attack by adding a Key Credential to the msDS-KeyCredentialLink attribute of WEB01.. GenericAll over a computer object allows full control, including modifying the msDS-KeyCredentialLink attribute. By adding a Key Credential, an attacker can authenticate as the computer account via PKINIT and obtain a TGT, effectively taking over the machine. This shadow credentials technique is direct and does not require cracking or additional accounts, making it the most efficient path to compromise WEB01.

Answer

Use the GenericAll permission to perform a targeted Kerberoasting attack by setting an SPN on a user account you control, then request a service ticket.

Answer

Perform a Kerberoasting attack against the machine account of WEB01 to obtain its hash and then crack it offline.

Answer

Use the GenericAll permission to perform a resource-based constrained delegation attack by modifying the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

Question 12

Which of the following is the most effective way to prevent Cross-Site Scripting (XSS) in a web application?

Accepted Answer

Implementing context-aware output encoding for all user-supplied data.. The most effective defense against XSS is context-aware output encoding. By converting special characters into their HTML entity equivalents before rendering, you ensure the browser treats the input as data rather than executable code. This is a critical security practice because it handles the root cause of the vulnerability—the browser's inability to distinguish between intended content and injected malicious scripts, regardless of the user input provided.

Answer

Using a blacklist to filter out common JavaScript keywords.

Answer

Disabling all JavaScript in the user's browser settings.

Answer

Setting all cookies with the 'Secure' flag in the response header.

Question 13

What is the most likely security risk associated with the configuration shown in the exhibit?

Accepted Answer

Attackers can browse the directory and discover sensitive files.. The 'Indexes' option enables directory listing, allowing attackers to browse the web server's file system if no index file is present. This is a significant information disclosure vulnerability because it exposes sensitive configuration files, backups, and source code that were never intended for public view. Disabling directory browsing is a fundamental hardening step for any web server to prevent accidental leakage of proprietary or sensitive infrastructure information.

Answer

The server will allow remote code execution through the index file.

Answer

The configuration will prevent users from accessing any files.

Answer

The server will stop processing PHP files entirely.

Question 14

When performing a DCSync attack, what is the core mechanism being exploited?

Accepted Answer

The Active Directory Replication Service (DRS) protocol. DCSync exploits the Active Directory replication protocol. By mimicking the behavior of a domain controller, an attacker can request that another domain controller replicate user credentials, including password hashes, to them. This requires the attacker to hold 'Replication-Get-Changes' and 'Replication-Get-Changes-All' permissions, which are typically only held by domain controllers or highly privileged administrators, making it a powerful tool for dumping the entire domain's secrets.

Answer

The Kerberos ticket granting service process

Answer

The LDAP signing enforcement on the Domain Controller

Answer

The storage of passwords in the SYSVOL share

Question 15

What is the primary purpose of an exploit payload in a buffer overflow context?

Accepted Answer

To execute arbitrary commands on the target system.. The exploit payload is the set of instructions (often shellcode) that you want the CPU to execute once you have successfully redirected the program's control flow. The goal is to perform an action, such as spawning a reverse shell or executing a command. The entire process of finding an offset and overwriting the return address is merely the delivery vehicle for this payload, which provides the desired post-exploitation access.

Answer

To increase the size of the target buffer.

Answer

To crash the application for a denial-of-service attack.

Answer

To bypass the authentication mechanism of the application.

OffSec / OSCP Concepts PEN-200 practice test

Three ways to study

Study PEN-200 by domain

Study PEN-200 by topic

Client-Side Attacks practice questions

Enumeration and Reconnaissance practice questions

Active Directory Attacks practice questions

Public Exploits practice questions

Web Application Attacks practice questions

Linux Privilege Escalation practice questions

Buffer Overflow Fundamentals practice questions

Port Redirection and Tunneling practice questions

Antivirus Evasion practice questions

Password Attacks practice questions

Windows Privilege Escalation practice questions

PEN-200 fundamentals practice questions

OffSec PEN-200 / OSCP Concepts practice questions