Free GIAC Penetration Tester GPEN Practice Questions

Question 1

A software vendor registers a multitenant application in its own Microsoft Entra tenant. An administrator at a customer organization then consents to the app. Which object is created in the customer's tenant to represent the app there?

1. A service principal that references the vendor's application object
2. A copy of the application object, including its client secrets
3. A guest user account linked to the vendor's app registration
4. A system-assigned managed identity tied to the application

Question 2

Which Metasploit vncinject stager will allow VNC communications from the attacker to a listening port of the attacker's choosing on the victim machine?

1. vncinject/find_tag
2. vncinject/reverse_tcp
3. vncinject/reverse_http
4. vncinject/bind_tcp

Question 3

What is the MOST important document to obtain before beginning any penetration testing?

1. Project plan
2. Exceptions document
3. Project contact list
4. A written statement of permission

Question 4

While reviewing traffic from a tcpdump capture, you notice the following commands being sent from a remote system to one of your web servers:

C:\>sc \\internet.host.com create ncservice binpath= "c:\tools\nc.exe -l -p 2222 -e cmd.exe"
C:\>sc \\internet.host.com query ncservice

What is the intent of the commands?

1. The first command creates a backdoor shell as a service. It is being started on TCP 2222 using cmd.exe. The second command verifies the service is created and its status.
2. The first command creates a backdoor shell as a service. It is being started on UDP 2222 using cmd.exe. The second command verifies the service is created and its status.
3. This creates a service called ncservice which is linked to the cmd.exe command and is designed to stop any instance of nc.exe being run. The second command verifies the service is created and its status.
4. The first command verifies the service is created and its status. The second command creates a backdoor shell as a service. It is being started on TCP 2222 using cmd.exe.

Question 5

Which of the following best describes a client side exploit?

1. Attack of a client application that retrieves content from the network
2. Attack that escalates user privilege to root or administrator
3. Attack of a service listening on a client system
4. Attack on the physical machine

Question 6

Which of the following TCP packet sequences are common during a SYN (or half-open) scan?

1. SYN sent, SYN-ACK returned, ACK sent to complete the handshake; and SYN sent, RST-ACK returned.
2. SYN sent, SYN-ACK returned, RST sent by the scanner; and SYN sent, RST-ACK returned.
3. SYN-ACK sent, RST returned; and ACK sent, RST returned.
4. SYN sent, ACK returned, FIN sent to close the session; and FIN sent, RST returned.

Question 7

During an authorized Azure assessment, a tester finds that a compromised account holds the Reader role assigned at a management group. Which resources can the account read?

1. Only the management group object itself, because role assignments do not flow to child scopes
2. Every subscription, resource group, and resource that sits beneath that management group
3. Only the resource groups that were created after the role assignment was made
4. Every resource in any other Microsoft Entra tenant where the account exists as a guest

Question 8

You have gained shell on a Windows host and want to find other machines to pivot to, but the rules of engagement state that you can only use tools that are already available.

How could you find other machines on the target network?

1. Use the "ping" utility to automatically discover other hosts
2. Use the "ping" utility in a for loop to sweep the network.
3. Use the "edit" utility to read the target's HOSTS file.
4. Use the "net share" utility to see who is connected to local shared drives.

Question 9

A penetration tester obtains telnet access to a target machine using a captured credential. While trying to transfer her exploit to the target machine, the network intrusion detection system keeps detecting her exploit and terminating her connection.

Which of the following actions will help the penetration tester transfer an exploit and compile it in the target system?

1. Use the http service's PUT command to push the file onto the target machine.
2. Use the scp service, protocol SSHv2 to pull the file onto the target machine.
3. Use the telnet service's ECHO option to pull the file onto the target machine
4. Use the ftp service in passive mode to push the file onto the target machine.

Question 10

What section of the penetration test or ethical hacking engagement final report is used to detail and prioritize the results of your testing?

1. Methodology
2. Conclusions
3. Executive Summary
4. Findings

Question 11

During an authorized internal test, a tester exploits a flaw that grants administrator rights on a critical payment server. The final report is due in three weeks. What should the tester do with this finding?

1. Notify the contact named in the assessment plan or rules of engagement immediately
2. Hold the finding until the final report so all results are delivered together
3. Patch the server directly to remove the exposure before anyone else finds it
4. Raise it at the next weekly status meeting, since no incident has occurred

Question 12

Which of the following attacks can be overcome by applying cryptography?

1. Buffer overflow
2. Web ripping
3. DoS
4. Sniffing

Question 13

You want to run the nmap command that includes the host specification of 202.176.56-57.*.

How many hosts will you scan?

1. 512
2. 64
3. 1024
4. 256

Question 14

You suspect that system administrators in one part of the target organization are turning off their systems during the times when penetration tests are scheduled, what feature could you add to the 'Rules of Engagement' that could help your team test that part of the target organization?

1. Unannounced test
2. Tell response personnel the exact time the test will occur
3. Test systems after normal business hours
4. Limit tests to business hours

Question 15

When a DNS server transfers its zone file to a remote system, what port does it typically use?

1. 53/TCP
2. 153/UDP
3. 35/TCP
4. 53/UDP

Question 16

Which of the following tasks can be performed by using netcat utility?

Each correct answer represents a complete solution.

Choose all that apply.

1. Firewall testing
2. Creating a Backdoor
3. Port scanning and service identification
4. Checking file integrity

Question 17

Where are Netcat's own network activity messages, such as when a connection occurs, sent?

1. Standard Error
2. Standard input
3. Standard Logfile
4. Standard Output

Question 18

You work as a Network Penetration tester in the Secure Inc. Your company takes the projects to test the security of various companies. Recently, Secure Inc. has assigned you a project to test the security of the Bluehill Inc. For this, you start monitoring the network traffic of the Bluehill Inc.

In this process, you find that there are many FTP packets traveling in the Bluehill Inc. network.

Now, you want to sniff the traffic and extract usernames and passwords of the FTP server.

Which of the following tools will you use to accomplish the task?

1. Ettercap
2. L0phtcrack
3. NetStumbler
4. SARA

Question 19

Which of the following statements are true about firewalking?

Each correct answer represents a complete solution.

Choose all that apply.

1. To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall.
2. Firewalking works on the UDP packets.
3. In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall.
4. A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall.

Question 20

You are pen testing a Linux target from your windows-based attack platform. You just moved a script file from the windows system to the Linux target, but it will not execute properly.

What is the most likely problem?

1. The byte length is different on the two machines
2. End-of-line characters are different on the two machines
3. The file must have become corrupt during transfer
4. ASCII character sets are different on the two machines

Question 21

You run the following bash script in Linux:

for i in `cat hostlist.txt`; do nc -q 2 -v $i 80 < request.txt; done where the hostlist.txt file contains the list of IP addresses and request.txt is the input file holding the HTTP request sent to each host.

Which of the following tasks do you want to perform by running this script?

1. You want to perform port scanning to the hosts given in the IP address list.
2. You want to transfer file hostlist.txt to the hosts given in the IP address list.
3. You want to perform banner grabbing to the hosts given in the IP address list.
4. You want to put nmap in the listen mode to the hosts given in the IP address list.

Question 22

Which of the following tools connects to and executes files on remote systems?

1. Spector
2. Hk.exe
3. PsExec
4. GetAdmin.exe

Question 23

A tester observes that a protected group retains its hardened permissions even after it was moved into a delegated organizational unit. Which property of protected objects explains this?

1. Permission inheritance is disabled on protected accounts and groups, so they do not pick up permissions from a new parent
2. Moving a protected object automatically promotes it to the forest root domain
3. Protected objects are stored only on read-only domain controllers
4. Protected objects cannot be moved between organizational units at all

Question 24

Joseph works as a Network Administrator for WebTech Inc. He has to set up a centralized area on the network so that each employee can share resources and documents with one another.

Which of the following will he configure to accomplish the task?

1. WEP
2. VPN
3. Intranet
4. Extranet

Question 25

A defender sees a burst of successful event 4768 entries on a domain controller showing Pre-Authentication Type 0 for several different user accounts, all requested from one workstation within a minute. Which MITRE ATT&CK technique does this evidence most likely indicate?

1. AS-REP Roasting
2. Kerberoasting
3. Silver Ticket
4. Password Spraying

Question 26

You work as a Web developer in the IBM Inc. Your area of proficiency is PHP. Since you have proper knowledge of security, you are aware of rainbow table attacks. For mitigating this attack, you design the PHP code based on the following algorithm:

key = hash(password + salt)
for 1 to 65000 do
    key = hash(key + salt)

Which of the following techniques are you implementing in the above algorithm?

1. Key strengthening
2. Hashing
3. Sniffing
4. Salting

Question 27

An assessment explains how Active Directory automatically undoes unauthorized permission changes on protected groups. Which process performs this, and where does it run by default?

1. The Knowledge Consistency Checker, running on every domain controller
2. The garbage collection process, running on the schema master
3. Directory replication, running between all domain controllers
4. SDProp, running every 60 minutes on the PDC Emulator

Question 28

Raw netcat shells and telnet terminals share which characteristic?

1. Ability to send commands to a target machine.
2. Ability to adapt output to the size of display window
3. Shells and terminals are exactly the same.
4. Ability to process standard output control sequences.

Question 29

Your company has decided that the risk of performing a penetration test is too great. You would like to figure out other ways to find vulnerabilities on their systems, which of the following is MOST likely to be a valid alternative?

1. Network scope Analysis
2. Baseline Data Reviews
3. Patch Policy Review
4. Configuration Reviews

Question 30

An authenticated Greenbone scan completes, but the scan details for one host show that none of the local security check VTs were executed, even though credentials were configured for it. What is the most likely explanation?

1. Local security checks run only when safe checks are disabled
2. The scanner could not log in to that host, so the local security checks did not run
3. Local security checks are reserved for hosts that have no open ports
4. Local security checks run only from the second scan of a host onward

Question 31

Which of the following best describes a server side exploit?

1. Attack on the physical machine
2. Attack of a service listening on a network port
3. Attack that escalates user privilege to root or administrator
4. Attack of a client application that retrieves content from the network

Question 32

An assessment finds an unexpected account in the Schema Admins group. In terms of standing privilege, how should the tester characterize what this membership grants by default?

1. Full local administrator rights on all domain controllers in the forest
2. The ability to reset the password of any user in the domain
3. The ability to modify the Active Directory schema, with few other default rights
4. Replication rights that allow pulling password hashes from a domain controller

Question 33

A client wants both an external and an internal penetration test, and the same team will perform both. According to NIST SP 800-115, which order is usually recommended, and why?

1. Internal first, so the team can map the network before testing the perimeter
2. Both at once, so perimeter and internal logs line up exactly
3. Internal first, because internal scans are blocked more often and take longer
4. External first, so the testers do not gain insider knowledge an outside attacker would lack

Question 34

After a consent phishing exercise, a client wants to reduce the risk of users granting malicious apps access without blocking user consent entirely. Which Microsoft Entra user consent setting matches Microsoft's recommendation?

1. Allow user consent for apps from verified publishers, for selected permissions
2. Allow user consent for apps, for any permission that does not require admin consent
3. Allow users to consent to application permissions for apps registered in the tenant
4. Allow user consent only after the user completes multifactor authentication

Question 35

What is the purpose of the following command:

nc.exe -l -p 2222 -e cmd.exe

1. It is used to start a persistent listener linked to cmd.exe on port 2222 TCP
2. It is used to start a listener linked to cmd.exe on port 2222 TCP
3. It is used to start a listener linked to cmd.exe on port 2222 UDP
4. It is used to start a persistent listener linked to cmd.exe on port 2222 UDP

Question 36

When attempting to crack a password using Rainbow Tables, what is the output of the reduction function?

1. A new potential chain
2. A new potential table
3. A new potential password
4. A new potential hash

Question 37

A defender finds that one standard user account generated event 4769 on a domain controller for dozens of different SPNs within two minutes, each with Ticket Encryption Type 0x17. Which MITRE ATT&CK technique does this evidence most likely indicate?

1. Golden Ticket
2. Kerberoasting
3. AS-REP Roasting
4. Pass the Ticket

Question 38

During an engagement, a system owner verbally asks the testers to try a technique that the rules of engagement do not authorize. According to NIST SP 800-115, what is required before the testers deviate from the ROE?

1. Agreement from whichever employee owns the affected system
2. Nothing, provided the technique is noted in the final report
3. Specific permission, normally in writing, from the original signatory or individual in command
4. Approval from the testing firm's own project manager

Question 39

What difference would you expect to result from running the following commands?

(1) $ dig @ns.domain.com target.com -t AXFR
(2) $ dig @ns.domain.com target.com -t IXFR=1002200301

1. Command (1) will display incremental information about a domain and command (2) will provide only 1002200301 bytes of information
2. Command (1) will display all information about a domain and command (2) will provide only incremental updates from SOA 1002200301
3. Command (1) will display all information about a domain and command (2) will provide only incremental updates up to SOA 1002200301
4. Command (1) will display all information about a domain and command (2) will provide only 1002200301 bytes of information

Question 40

A client with 7200 employees in 14 cities (all connected via high speed WAN connections) has suffered a major external security breach via a desktop which cost them more than $172,000 and the loss of a high profile client. They ask you to perform a desktop vulnerability assessment to identify everything that needs to be patched. Using Nessus you find tens of thousands of vulnerabilities that need to be patched. In the report you find workstations running several Windows OS versions and service pack levels, anti-virus software from multiple vendors, several major browser versions and different versions of Acrobat Reader.

Which of the following recommendations should you provide with the report?

1. The client should standardize their desktop software
2. The client should eliminate workstations to reduce workload
3. The client should hire more people to catch up on patches
4. The client should perform monthly vulnerability assessments

Question 41

An engagement places an intermediary host on the internet between compromised systems and the actual C2 server, so victim traffic terminates at the intermediary and is forwarded onward. What is the primary operational benefit of this design?

1. It encrypts C2 content that would otherwise be plaintext
2. It masks the true destination of C2 traffic and shields the back-end infrastructure
3. It removes the need for the implant to check in on a schedule
4. It converts an interactive session into an asynchronous beacon

Question 42

You have been contracted to penetration test an e-mail server for a client that wants to know for sure if the sendmail service is vulnerable to any known attacks.

You have permission to run any type of test, but the mail service must stay available. How will you proceed to give the client the most valid answer?

1. Run all known sendmail exploits against the server and see if you can compromise the service, even if it crashed the machine or service
2. Run a banner grabbing vulnerability checker to determine the sendmail version and patch level, then look up and report all the vulnerabilities that exist for that version and patch level
3. Run all sendmail exploits that will not crash the server and see if you can compromise the service
4. Log into the e-mail server and determine the sendmail version and patch level, then look up and report all the vulnerabilities that exist for that version and patch level

Question 43

During a penetration test you discover a valid set of SSH credentials to a remote system.

How can this be used to your advantage in a Nessus scan?

1. This information can be entered under the 'Hydra' tab to launch a brute-force password attack.
2. There isn't an advantage as Nessus will ultimately discover this information.
3. The 'SSH' box can be checked to let Nessus know the remote system is running
4. This information can be entered under the 'credentials' tab to allow Nessus to log into the system

Question 44

John works as an Ethical Hacker for Example Inc. He wants to find out the ports that are open in Example's server using a port scanner. However, he does not want to establish a full TCP connection.

Which of the following scanning techniques will he use to accomplish this task?

1. TCP FIN
2. Xmas tree
3. TCP SYN/ACK
4. TCP SYN

Question 45

A hybrid client has ruled out federation. They want Microsoft Entra ID to deny a cloud sign-in at once when the on-premises account is disabled, locked out, or outside its permitted logon hours. Which sign-in method meets this requirement?

1. Password hash synchronization
2. Pass-through authentication
3. Cloud-only accounts with no synchronization
4. Password hash synchronization with smart lockout enabled

Question 46

You are using the Nmap Scripting Engine and want detailed output of the script as it runs.

Which option do you include in the command string?

1. nmap --script-output --script=ssh-hostkey.nse 155.65.3.221 -p 22
2. nmap --script-trace --script=ssh-hostkey.nse 155.65.3.221 -p 22
3. nmap --script-verbose --script=ssh-hostkey.nse 155.65.3.221 -p 22
4. nmap -v --script=ssh-hostkey.nse 155.65.3.221 -p 22

Question 47

A defender who is hunting for DNS-based command and control builds analytics around which set of observable indicators?

1. TLS certificates signed by a public authority
2. Beacons that use the default HTTPS port
3. Short host names resolved by the system resolver
4. High query volume, unusually long subdomains, and high-entropy or encoded labels

Question 48

Before an engagement, the client's security operations team asks how analysts will tell test traffic apart from a real attack. According to NIST SP 800-115, what should the assessment plan include for this purpose?

1. The IP addresses of the machines from which assessment activity will be conducted
2. The passwords the testers plan to try against in-scope accounts
3. The full exploit code for each technique the testers might attempt
4. A guarantee that testing will trigger no intrusion detection alerts

Question 49

You are conducting a penetration test for a private contractor located in Singapore. The scope extends to all internal hosts controlled by the company, you have gathered necessary hold-harmless and nondisclosure agreements.

Which action by your group can incur criminal liability under Chapter 50A, Computer Misuse Act?

1. Exploiting vulnerable web services on internal hosts
2. Attempts at social engineering employees via telephone calls
3. Testing denial-of-service tolerance of the communications provider
4. Cracking password hashes on the corporate domain server

Question 50

What command will correctly reformat the Unix passwdcopy and shadowcopy files for input to John the Ripper?

1. ./unshadow passwd copy shadowcopy > johnfile
2. ./unshadow passwdcopy shadowcopy > johnfile
3. ./unshadow shadowcopy passwdcopy > johnfile
4. ./unshadow shadowcopy > johnfile passwdcopy

Question 51

A technique puts one domain name in the TLS SNI field and a different domain name in the HTTP Host header, so the traffic appears to go to a trusted site while a shared content delivery network routes it elsewhere. What is this technique called?

1. Protocol tunneling
2. A domain generation algorithm
3. Domain fronting
4. Port knocking

Question 52

A tester evaluating delegation finds the help-desk team placed in the Account Operators group. Which statement correctly bounds what that group can do by default?

1. It can modify user rights assignments on domain controllers
2. It can change the membership of the Domain Admins group
3. It can take ownership of any object in the directory
4. It can create and modify ordinary accounts but cannot manage protected administrative groups

Question 53

A client enables the Microsoft Entra admin consent workflow and adds a help desk group as reviewers. The client believes this lets the group approve any app request. What does designating a reviewer actually do?

1. It grants the reviewers the Cloud Application Administrator role for the duration of each request
2. It lets reviewers approve any request, including Microsoft Graph application permissions
3. It routes requests to the reviewers, who can approve only if they already hold rights to grant that consent
4. It disables user consent so that every app request must pass through the reviewers

Question 54

During an authorized engagement a tester has an active session on a compromised Windows host and wants to run framework code that enumerates logged-on users and collects local configuration data from that session. Which Metasploit module type is designed for this work after access is gained?

1. An exploit module, which is required for any action taken on a host
2. A post module, built to run against an existing session
3. An encoder module, which reshapes an existing session
4. A nop module, which pads data gathered from a session

Question 55

While reviewing Active Directory with authorization, a tester lists the user accounts that have a service principal name (SPN) registered. What role does an SPN play in Kerberos authentication?

1. It stores the service account's password hash so the KDC can verify sign-ins
2. It lists the users who are permitted to request tickets for the service
3. It marks the account as trusted for delegation to any other service
4. It ties a service instance to the sign-in account whose key protects its tickets

Question 56

The scope of your engagement is to include a target organization located in California with a /24 block of addresses that they claim to completely own.

Which site could you utilize to confirm that you have been given accurate information before starting reconnaissance activities?

1. www.whois.net
2. www.arin.net
3. www.apnic.net
4. www.ripe.net

Question 57

Which of the following Nmap commands is used to perform a UDP port scan?

1. nmap -sS
2. nmap -sY
3. nmap -sN
4. nmap -sU

Question 58

You are conducting a penetration test for a private company located in the UK. The scope extends to all internal and external hosts controlled by the company.

You have gathered necessary hold-harmless and non-disclosure agreements.

Which action by your group can incur criminal liability under the Computer Misuse Act 1990?

1. Sending crafted packets to internal hosts in an attempt to fingerprint the operating systems
2. Recovering the SAM database of the domain server and attempting to crack passwords
3. Installing a password sniffing program on an employee's personal computer without consent
4. Scanning open ports on internal user workstations and exploiting vulnerable applications

Question 59

You are running a vulnerability scan on a remote network and the traffic is not making it to the target system. You investigate the connection issue and determine that the traffic is making it to the internal interface of your network firewall, but not making it to the external interface or to any systems outside your firewall.

What is the most likely problem?

1. Your network firewall is blocking the traffic
2. The NAT or PAT tables on your network based firewall are filling up and dropping the traffic
3. A host based firewall is blocking the traffic
4. Your ISP is blocking the traffic

Question 60

You have compromised a Windows XP system and injected the Meterpreter payload into the lsass process. While looking over the system you notice that there is a popular password management program on the system.

When you attempt to access the file that contains the password you find it is locked. Further investigation reveals that it is locked by the passmgr process.

How can you use the Meterpreter to get access to this file?

1. Use the getuid command to determine the user context the process is running under, then use the imp command to impersonate that user.
2. Use the getpid command to determine the user context the process is running under, then use the imp command to impersonate that user.
3. Use the execute command to run the passmgr executable. That will give you access to the file.
4. Use the migrate command to jump to the passmgr process. That will give you access to the file.

Question 61

An operator examines an implant that connects to the C2 server asynchronously at intervals, retrieves whatever tasks are queued, executes them, and returns the output on a later connection. Which mode of operation does this describe?

1. Interactive session mode
2. A multi-hop proxy chain
3. Beacon mode
4. A staged payload download

Question 62

The rules of engagement state that no information about target addresses may be sent to any third-party service during the test. Which NSE script category should the tester review and exclude to honor that rule?

1. broadcast
2. external
3. version
4. default

Question 63

You are pen testing a network and have shell access to a machine via Netcat. You try to use ssh to access another machine from the first machine.

What is the expected result?

1. The ssh connection will succeed if you have root access on the intermediate machine
2. The ssh connection will fail
3. The ssh connection will succeed
4. The ssh connection will succeed if no password required

Question 64

A defender sees a burst of failed event 4768 entries on a domain controller, all from one internal host, each with Result Code 0x6 and a different account name. What does this evidence most likely indicate?

1. Service ticket requests that were issued with RC4 encryption
2. A client whose clock differs too much from the domain controller
3. Attempts against user names that do not exist, suggesting account enumeration
4. Successful TGT requests for accounts that skip pre-authentication

Question 65

You are sending a file to an FTP server. The file will be broken into several pieces of information packets (segments) and will be sent to the server.

The file will again be reassembled and reconstructed once the packets reach the FTP server.

Which of the following information should be used to maintain the correct order of information packets during the reconstruction of the file?

1. Acknowledge number
2. TTL
3. Checksum
4. Sequence number

Question 66

By default Active Directory Controllers store password representations in which file?

1. %systemroot%\system32\ntds.dit
2. %systemroot%\ntds\ntds.dit
3. %systemroot%\ntds\sam.dat
4. %systemroot%\ntds\sam.dit

Question 67

While reviewing group scoping, a tester notes that one built-in group exists only on domain controllers and its members can administer them. Which group is being described?

1. Group Policy Creator Owners
2. Server Operators
3. Cloneable Domain Controllers
4. Performance Monitor Users

Question 68

To keep the initial artifact small, a team arranges for the first program to run on the target to be a tiny component whose only job is to pull a larger implant from a staging server and load it into memory. What is this small initial component called?

1. A redirector
2. A listener
3. A fallback channel
4. A stager

Question 69

Midway through an authorized internal test, the team finds clear signs that a real intruder is active on two in-scope servers. According to NIST SP 800-115, what should the assessors do?

1. Keep testing those servers so the report captures the intruder's methods
2. Remove the intruder's tools themselves and then resume the planned tests
3. Contact outside incident response teams directly before telling the client
4. Report it immediately to the designated contact and stop assessing the affected systems

Question 70

A tester mapping an organization's Azure estate finds three subscriptions. Which statement correctly describes how those subscriptions relate to Microsoft Entra ID?

1. Each subscription can trust several Entra tenants at once and picks one for each sign-in
2. Subscriptions authenticate users with their own local accounts, independent of any Entra tenant
3. Each subscription must have its own dedicated Entra tenant that no other subscription can trust
4. Each subscription trusts exactly one Entra tenant, while one tenant can be trusted by many subscriptions

Question 71

Which of the following attacks allows an attacker to sniff data frames on a local area network (LAN) or stop the traffic altogether?

1. Man-in-the-middle
2. ARP spoofing
3. Port scanning
4. Session hijacking

Question 72

What is the purpose of the following command?

C:\>wmic /node:[target IP] /user:[admin-user] /password:[password] process call create [command]

1. Running a command on a remote Windows machine
2. Creating a service on a remote Windows machine
3. Creating an admin account on a remote Windows machine
4. Listing the running processes on a remote windows machine

Question 73

A report explains why compromising a single Domain Admins account effectively grants local administrator rights on every workstation and server in the domain. What membership relationship makes this true by default?

1. Domain Admins is nested inside the Schema Admins group in the forest root domain
2. Domain Admins is a member of the local Administrators group on every computer joined to the domain
3. Domain Admins inherits its rights from the Account Operators group
4. Domain Admins is added to the Backup Operators group on each member server

Question 74

You are pen testing a Windows system remotely via a raw netcat shell. You want to get a listing of all the local users in the administrators group, what command would you use?

1. Net account administrators
2. Net user administrators
3. Net localgroup administrators
4. Net localuser administrators

Question 75

A tester wants Nmap Scripting Engine checks limited to scripts that look for specific known vulnerabilities and generally report something only when the vulnerability is found. Which script category fits?

1. vuln
2. discovery
3. auth
4. malware

Question 76

A defender asks what the AdminSDHolder object is for when hardening Active Directory. Which description is accurate?

1. It is a replica of the KRBTGT account used to sign Kerberos tickets
2. It stores the recovery password for each domain controller
3. It provides template permissions that are enforced onto protected accounts and groups
4. It caches the membership of every security group for faster logon

Question 77

A team selects a C2 channel that encodes operator commands and their responses inside query names and record fields of a name-resolution protocol, which is often permitted outbound even before a host has authenticated to the network. Which channel is described?

1. An SMB named-pipe peer-to-peer link
2. ICMP tunneling
3. DNS tunneling
4. A WebSocket channel

Question 78

A defender reviewing Microsoft Entra sign-in logs notices that a user typed the same wrong password twelve times, yet the account was never locked by smart lockout. The tenant uses password hash synchronization. What explains this?

1. Smart lockout tracks recent bad password hashes and does not increment the counter for a repeated identical password
2. Smart lockout is disabled by default and must be licensed before it counts any failures
3. The default Azure Public lockout threshold is 50 failed attempts
4. Smart lockout applies only to accounts that hold an administrative role

Question 79

A domain user already holds a valid ticket-granting ticket and now opens a file share on a member server. Which statement correctly describes how the client obtains access to the share?

1. It repeats the AS exchange, protecting a new request with the user's password-derived key
2. It sends the TGT directly to the file server, which forwards it to a domain controller
3. It presents the TGT to the KDC in a TGS exchange and receives a service ticket for the server
4. It answers a challenge from the file server with a response computed from the user's NT hash

Question 80

The resulting business impact of the penetration test or ethical hacking engagement is explained in what section of the final report?

1. Problems
2. Findings
3. Impact Assessment
4. Executive Summary

Question 81

During an authorized test, an exploit gives the tester elevated privileges on one server and exposes in-scope network segments that were not reachable before. In the NIST SP 800-115 methodology, what happens next?

1. The tester loops back to discovery to gather information from the new position
2. The tester moves straight to reporting, because one successful exploit ends the attack phase
3. The tester returns to planning to rewrite the testing goals before any further action
4. The tester stops, because privilege escalation is outside a standard penetration test

Question 82

During an authorized internal test, a tester observes the first Kerberos exchange a domain workstation performs when a user signs in, which returns a ticket-granting ticket (TGT). Which Kerberos service handles this exchange?

1. The ticket-granting service, which accepts an existing service ticket
2. The authentication service, which returns the TGT in reply to an AS request
3. The application server, which checks the user's password locally
4. The Global Catalog, which issues tickets for resources across the forest

Question 83

What happens when you scan a broadcast IP address of a network?

Each correct answer represents a complete solution.

Choose all that apply.

1. It may show smurf DoS attack in the network IDS of the victim.
2. It leads to scanning of all the IP addresses on that subnet at the same time.
3. It will show an error in the scanning process.
4. Scanning of the broadcast IP address cannot be performed.

Question 84

You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the we-are-secure.com Web site. For this, you want to perform the idle scan so that you can get the ports open in the we-are-secure.com server. You are using Hping tool to perform the idle scan by using a zombie computer. While scanning, you notice that every IPID is being incremented on every query, regardless of whether the ports are open or closed. Sometimes, IPID is being incremented by more than one value.

What may be the reason?

1. The zombie computer is not connected to the we-are-secure.com Web server.
2. The zombie computer is the system interacting with some other system besides your computer.
3. Hping does not perform idle scanning.
4. The firewall is blocking the scanning process.

Question 85

You are conducting a penetration test for a private company located in Canada. The scope extends to all internal-facing hosts controlled by the company. You have gathered necessary hold-harmless and non-disclosure agreements.

Which action by your group can incur criminal liability under Criminal Code of Canada Sections 184 and 342.1?

1. Analyzing internal firewall router software for vulnerabilities
2. Exploiting application vulnerabilities on end-user workstations
3. Attempting to crack passwords on a development server
4. Capturing a VoIP call to a third party without prior notice

Question 86

A tester learns that a client's verified domain is configured for federated authentication with an on-premises AD FS farm. Where is a user's password validated when the user signs in to a Microsoft 365 application?

1. By Microsoft Entra ID against a synchronized password hash
2. By a pass-through authentication agent that retrieves requests from a cloud queue
3. By the Microsoft 365 application itself, using its own user store
4. By the on-premises federation service that Entra ID trusts to authenticate users

Question 87

A defender searches the Microsoft Purview audit log for signs of an illicit consent grant and finds a Consent to application activity with IsAdminConsent set to True. How should this entry be interpreted?

1. An account with administrative rights may have granted the app broad access to organization data
2. A user consented for their own data only, so the impact is limited to one mailbox
3. The consent attempt was blocked by the tenant's user consent settings
4. The app's request is still waiting for a reviewer in the admin consent workflow

Question 88

Which of the following statements are true about NTLMv1?

Each correct answer represents a complete solution.

Choose all that apply.

1. It uses the LANMAN hash of the user's password.
2. It is mostly used when no Active Directory domain exists.
3. It is a challenge-response authentication protocol.
4. It uses the MD5 hash of the user's password.

Question 89

Even when C2 traffic is wrapped in TLS and the payload cannot be read, a defender can still flag a suspicious client. Which approach lets them do so without decrypting the session?

1. Reading the Base64 body of each request
2. Fingerprinting the TLS handshake and the certificate characteristics the client presents
3. Inspecting the cleartext of DNS TXT records
4. Counting how many operators are connected to the server

Question 90

Over ten minutes, a domain controller logs event 4771 with failure code 0x18 for 300 different user accounts, with one or two attempts each, all from the same client address. Which MITRE ATT&CK technique does this pattern most likely indicate?

1. Kerberoasting
2. AS-REP Roasting
3. Golden Ticket
4. Password Spraying

Question 91

RFC 4120 strongly encourages randomly generated keys, rather than password-derived keys, for any principal that can be the target of a ticket request. Which property of Kerberos makes this recommendation necessary?

1. Any client can request a ticket for any server principal and attack that principal's key offline
2. Service tickets travel in cleartext, so a password-derived key would be exposed on the network
3. The KDC rejects password-derived keys for service principals unless they are random
4. Random keys let service tickets be renewed indefinitely without contacting the KDC

Question 92

You send SYN packets with the exact TTL of the target system starting at port 1 and going up to port 1024 using hping2 utility. This attack is known as __________.

1. Port scanning
2. Spoofing
3. Cloaking
4. Firewalking

Question 93

Which of the following file transfer programs will automatically convert end-of-line characters between different platforms when placed in ASCII Mode?

1. ftp
2. nc
3. tftp
4. scp

Question 94

All of the following are advantages of using the Metasploit priv module for dumping hashes from a local Windows machine EXCEPT:

1. Doesn't require SMB or NetBIOS access to the target machine
2. Can run inside of a process owned by any user
3. Provides less evidence for forensic investigators to recover
4. LSASS related reboot problems aren't an issue

Question 95

You have been contracted to map the network and try to compromise the servers for a client.

Which of the following would be an example of 'scope creep' with respect to this penetration testing project?

1. Disclosing information forbidden in the NDA
2. Compromising a server then escalating privileges
3. Being asked to compromise workstations
4. Scanning network systems slowly so you are not detected

Question 96

What is the impact on pre-calculated Rainbow Tables of adding multiple salts to a set of passwords?

1. Salts increase the time to crack the original password by increasing the number of tables that must be calculated.
2. Salts double the total size of a rainbow table database.
3. Salts can be reversed or removed from encoding quickly to produce unsalted hashes.
4. Salts have little effect because they can be calculated on the fly with applications such as Ophcrack.