PEN-200 Windows Privilege Escalation Practice Question
During enumeration of a Windows host, you run `whoami /priv` and see that the current user has SeImpersonatePrivilege enabled. You have also uploaded a custom executable to C:\Windows\Temp. Which privilege escalation technique is most directly applicable in this situation?
⚠ Common exam trap
The trap here is assuming that SeImpersonatePrivilege alone allows direct code execution as SYSTEM without the need for token coercion techniques.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit the SeImpersonatePrivilege using a tool such as PrintSpoofer or RoguePotato to impersonate a SYSTEM token.
SeImpersonatePrivilege permits a process to impersonate another user's token, and tools like PrintSpoofer exploit this by tricking a privileged service into connecting to a controlled endpoint, then impersonating the resulting token. This is a direct escalation path when the privilege is enabled, making it the most applicable technique here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exploit the SeImpersonatePrivilege using a tool such as PrintSpoofer or RoguePotato to impersonate a SYSTEM token.
Why this is correct
SeImpersonatePrivilege allows a process to impersonate a token, and tools like PrintSpoofer or RoguePotato abuse this by coercing a privileged service to authenticate, then capturing and impersonating its token. This is a well-known privilege escalation path when the privilege is enabled, and it directly applies here.
- ✗
Dump LSASS memory using a tool like Mimikatz to extract plaintext credentials and then use them to log in as an administrator.
Why it's wrong here
Dumping LSASS typically requires administrative privileges or SeDebugPrivilege, which are not granted by SeImpersonatePrivilege. Although credential dumping can lead to escalation, it is not the immediate technique enabled by this privilege and would likely fail without additional rights.
- ✗
Modify the service binary path of a running service to point to your uploaded executable and restart the service.
Why it's wrong here
Modifying a service binary requires write permissions on the service configuration or the binary itself, neither of which is implied by SeImpersonatePrivilege. While service exploitation is a common escalation technique, it is not the direct exploitation of this specific privilege.
- ✗
Use `runas /savecred` to execute a command as the local administrator without knowing the password.
Why it's wrong here
`runas /savecred` relies on stored credentials in the Windows Credential Manager, which are not present by default and are unrelated to SeImpersonatePrivilege. This privilege does not grant access to saved credentials, so this approach would fail in this scenario.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.