10 free GIAC Penetration Tester GPEN practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 385 questions. Work through them, then open each answer to check your reasoning.
Get all 385 questions (US$39) · Download these 10 as a PDF
Question 1
ACME corporation has decided to setup wireless (IEEE 802.11) network in it's sales branch at Tokyo and found that channels 1, 6, 9,11 are in use by the neighboring offices.
Which is the best channel they can use?
Show answer and explanation
Correct answer: A. 4
In IEEE 802.11b/g the US non-overlapping channels are 1, 6, and 11. With channels 1, 6, 9, and 11 already occupied, no truly clean channel remains, so the goal is the least overlap. Channel 4 sits farthest from the busy channels, giving the most separation available. It is the best remaining choice among the options offered.
Why the other options are wrong
- B. Channel 5 is too close to channel 6, which is already in use.
- C. Channel 10 is too close to channel 9 and 11, both occupied.
- D. Channel 2 is too close to channel 1, which is already in use.
Question 2
Which Metasploitvncinject stager will allow VNC communications from the attacker to a listening port of the attacker's choosing on the victim machine?
Show answer and explanation
Correct answer: D. Vncinject /bind.tcp
The vncinject/bind.tcp stager creates a listening port on the victim machine that the attacker connects to, allowing VNC communication from attacker to victim on a port of the attacker's choosing. This matches the requirement of 'VNC communications from the attacker to a listening port of the attacker's choosing on the victim machine.'
Why the other options are wrong
- A. The option 'vncinject/find.lag' is not a valid Metasploit stager.
- B. The reverse.tcp stager creates a connection from victim back to attacker, opposite of the requirement.
- C. The reverse-http stager uses HTTP for communication and reverses the connection direction.
Question 3
What is the MOST important document to obtain before beginning any penetration testing?
Show answer and explanation
Correct answer: D. A written statement of permission
A written statement of permission is the most critical document before beginning any penetration testing. This legal authorization protects both the tester and the organization, clearly defines scope, and ensures that all testing activities are legitimate and authorized. Without this, any testing could be considered unauthorized access and illegal.
Why the other options are wrong
- A. A project plan is important but secondary to obtaining explicit written permission first.
- B. An exceptions document is useful but not obtained before testing begins.
- C. A project contact list is administrative but not as critical as written authorization.
Question 4
While reviewing traffic from a tcpdump capture, you notice the following commands being sent from a remote system to one of your web servers:
C:>sc winternet.host.com create ncservicebinpath- "c:toolsncexe -I -p 2222 -e cmd.exe"
C:>sc vJnternet.host.com query ncservice.
What is the intent of the commands?
Show answer and explanation
Correct answer: A. The first command creates a backdoor shell as a service. It is being started on TCP2222 using cmd.exe. The second command verifies the service is created and itsstatus.
service. It is being started on TCP2222 using cmd.exe. The second command verifies the service is created and itsstatus. The first command uses 'sc create' to create a Windows service called 'ncservice' that executes netcat (nc.exe) with parameters '-l -p 2222 -e cmd.exe', which creates a listening backdoor on TCP port 2222 that spawns cmd.exe for remote command execution. The second command 'sc query' verifies the service was created successfully and checks its status. This is a classic persistence mechanism.
Why the other options are wrong
- B. The port specified is TCP 2222, not UDP 2222, as netcat defaults to TCP unless specified otherwise.
- C. The service does not stop instances of nc.exe; it executes nc.exe to create a backdoor listener.
- D. The command sequence order is incorrect; the first command creates the backdoor, and the second verifies it.
Question 5
Which of the following best describes a client side exploit?
Show answer and explanation
Correct answer: A. Attack of a client application that retrieves content from the network
from the network A client-side exploit targets client applications that retrieve content from the network, such as web browsers, email clients, or document readers. The attack works by delivering malicious content that the client application processes, rather than attacking a service listening on the client system. This is the most accurate definition of client-side exploitation.
Why the other options are wrong
- B. Privilege escalation is a post-exploitation technique, not the defining characteristic of a client-side exploit.
- C. Attacking services listening on a client is typically server-side or local privilege escalation, not client-side exploitation.
- D. Physical machine attacks are hardware-level attacks, unrelated to application-level client-side exploits.
Question 6
Which of the following TCP packet sequences are common during a SYN (or half-open) scan?
Show answer and explanation
Correct answer: B. SYN sent, SYN-ACK returned, RST sent by the scanner; and SYN sent, RST- ACK returned.
and SYN sent, RST- ACK returned. A SYN or half-open scan never completes the three-way handshake. The scanner sends a SYN to each target port. If the port is open, the target replies with SYN-ACK and the scanner immediately sends an RST to tear the connection down before it is established, which is why the scan is called half-open. If the port is closed, the target replies with RST-ACK and no further packets are needed. Option B lists exactly those two exchanges.
Why the other options are wrong
- A. Completing the handshake with an ACK is a full connect scan, not a SYN scan.
- C. A SYN-ACK is never sent as an opening packet by a scanner.
- D. FIN and ACK behavior belongs to other scan types, not a half-open scan.
Question 7
Which of the following describes the direction of the challenges issued when establishing a wireless (IEEE 802.11) connection?
Show answer and explanation
Correct answer: B. One-way, the access point challenges the client
In IEEE 802.11 shared key authentication the challenge is one-way: the access point sends a plaintext challenge and the client must return it encrypted with the shared WEP key to prove it holds the key. The direction of the challenge runs from the access point to the client. There is no mutual challenge in the 802.11 shared key exchange.
Why the other options are wrong
- A. The client does not challenge the access point in shared key authentication.
- C. Challenges do occur; shared key authentication uses a challenge-response.
- D. 802.11 shared key authentication is one-way, not a mutual challenge.
Question 8
You have gained shell on a Windows host and want to find other machines to pivot to, but the rules of engagement state that you can only use tools that are already available.
How could you find other machines on the target network?
Show answer and explanation
Correct answer: B. Use the "ping" utility in a for loop to sweep the network.
network. Using the built-in 'ping' utility inside a for loop is a standard way to sweep a range of IP addresses using only tools already present on a Windows host. The loop iterates through the addresses, sends ICMP echo requests, and identifies which hosts respond, revealing other machines on the target network without introducing external tools.
Why the other options are wrong
- A. Ping by itself pings one host and does not iterate a range automatically.
- C. The HOSTS file only lists static, previously known mappings, not live hosts.
- D. 'net share' shows local shares, not other machines on the network.
Question 9
A penetration tester obtains telnet access to a target machine using a captured credential. While trying to transfer her exploit to the target machine, the network intrusion detection systems keeps detecting her exploit and terminating her connection.
Which of the following actions will help the penetration tester transfer an exploit and compile it in the target system?
Show answer and explanation
Correct answer: B. Use the scp service, protocol SSHv2 to pull the file onto the target machine.
onto the target machine. SCP over SSHv2 encrypts the entire session, including the transferred file, so a network IDS cannot inspect the payload and match it against signatures. The other options all move data in cleartext, which is exactly what triggered the earlier detections. Encrypting the transfer is the reliable way to get the exploit onto the target without tripping the IDS.
Why the other options are wrong
- A. HTTP PUT sends the file in cleartext that the IDS can inspect and flag.
- C. Telnet ECHO is cleartext, so the payload remains visible to the IDS.
- D. FTP passive mode still uses an unencrypted data channel the IDS can read.
Question 10
What section of the penetration test or ethical hacking engagement final report is used to detail and prioritize the results of your testing?
Show answer and explanation
Correct answer: D. Findings
The Findings section is where detailed vulnerability and risk results are documented and prioritized by severity level. This is the core technical section that lists all discovered issues with their risk ratings and remediation guidance. The Executive Summary provides high-level overview for management, Methodology describes how testing was performed, and Conclusions summarizes recommendations.
Why the other options are wrong
- A. Methodology describes the testing approach and scope, not the detailed results.
- B. Conclusions provide summary recommendations, not the detailed prioritized listing of findings.
- C. Executive Summary is a high-level overview for non-technical stakeholders, not detailed technical prioritization.
That was 10 of 385.
The full GIAC Penetration Tester GPEN pack has all 385 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.