GIAC GPEN Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Penetration Tester (GPEN) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GPEN certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GPEN Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Penetration Tester (GPEN) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Penetration Tester exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GPEN Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GPEN Sample Questions:
01. As an ordinary authenticated domain user with no special rights, you want offline-crackable material for accounts that run services, without needing those accounts' credentials.
Which technique fits, and why is it available to any authenticated user?
a) AS-REP roasting: request material for accounts with pre-authentication disabled.
b) Kerberoasting: request service tickets for accounts with a service principal name, then crack them offline.
c) Overpass-the-hash: exchange an existing NT hash for a ticket-granting ticket.
d) DCSync: use replication rights to request the account's credential material.
02. On a short, time-boxed engagement the operator must drive the implant through many follow-up actions before the window closes.
How should the operator set the beacon's sleep, and what is the trade-off?
a) Fix the sleep to a constant interval, since steady timing is harder to detect.
b) Use a very long sleep to stay quiet, even though tasking would then complete too slowly.
c) Use a shorter sleep so tasking finishes in time, accepting more detectable check-ins.
d) Set the sleep to zero so the implant streams continuously and stays quietest.
03. An initial execution primitive on a foothold can launch only a very small first stage in memory, but the host has unrestricted outbound HTTPS.
Which payload design fits this constraint, and what does it cost the operator?
a) A staged payload whose stager pulls the second stage over the permitted HTTPS path.
b) A stageless payload encoded to look benign, keeping delivery to a single step.
c) A stageless payload delivering the complete implant in a single self-contained blob.
d) A staged payload whose stager retrieves the second stage over a raw high port.
04. During an engagement you recover a file of password hashes and also have network access to the live login service those accounts use.
Why is attacking the recovered hashes offline generally preferable to guessing against the live service?
a) Offline guessing works only where the stored hashes are unsalted.
b) Offline guessing removes any need to know which usernames or accounts are valid.
c) Offline guessing is guaranteed to recover every password eventually.
d) Offline guessing faces no rate limit or lockout and leaves no authentication logs.
05. You know the target organization forces passwords to be exactly eight characters, beginning with an uppercase letter and ending with two digits. You have their hashes offline.
Which cracking approach exploits this known structure most efficiently?
a) A mask attack matching the known per-position character classes.
b) A dictionary attack drawing candidates from a common-password wordlist.
c) A rule-based attack mutating wordlist entries with appends and substitutions.
d) A full brute-force attack over the entire eight-character keyspace.
06. A compromised host sits behind NAT on a firewall that blocks unsolicited inbound traffic while allowing established outbound HTTPS. The operator needs an interactive session.
Which connection model will establish the session here, and why?
a) A bind connection: the payload listens on the host for the operator to connect in.
b) A reverse connection initiated by the operator's host toward the target.
c) A reverse connection: the compromised host dials outbound to the operator's handler.
d) A bind connection on a port the firewall already permits outbound from the host.
07. The operator's implant runs on host-A in a DMZ. A database segment is routable only from host-A and cannot be reached from the operator's external position. The operator needs to interact with a host in that segment.
Which approach lets the operator reach the database segment?
a) Scan the segment from the operator's host using decoy source addresses.
b) Tunnel through the existing session on host-A, pivoting into the reachable segment.
c) Add a static route on the operator's external host toward the isolated segment.
d) Broadcast ARP requests from the operator's network to resolve the segment's hosts.
08. A configuration backup contains stored password values in the following form:
$2b$12$Km0aB.../qE9y8k2R... (60 characters)
What does this stored representation indicate?
a) A bcrypt hash whose cost factor sets a deliberately slow iteration count.
b) An MD5-crypt hash, identified by its distinctive algorithm prefix and its fast computation.
c) A NetNTLMv2 challenge-response captured from the network.
d) A raw NT hash as stored in the Windows SAM database.
09. On a Windows host where you hold local administrator rights, you want to obtain the NT hashes and Kerberos tickets of accounts that have authenticated since the machine booted.
Which source most directly holds this material for extraction?
a) The local SAM registry hive, which stores only this machine's own account hashes.
b) The memory of the LSASS process, which caches logon credential material.
c) The /etc/shadow file, which stores hashed credentials on Unix systems.
d) The NTDS.dit database, which resides on the domain controllers.
10. An operator places a redirector between deployed implants and the team server during an engagement.
What does fronting the team server with a redirector primarily achieve?
a) It signs each issued task so an implant can verify the operator's identity.
b) It encrypts the C2 session end to end so an inline proxy cannot read its contents.
c) It conceals the team server's address, so a burned node never exposes the backend.
d) It balances implant check-ins so one busy beacon cannot slow the others down.
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: c |
Question: 03 Answer: a |
Question: 04 Answer: d |
Question: 05 Answer: a |
|
Question: 06 Answer: c |
Question: 07 Answer: b |
Question: 08 Answer: a |
Question: 09 Answer: b |
Question: 10 Answer: c |
Note: For any error in GIAC Penetration Tester (GPEN) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
