GIAC Penetration Tester GPEN Practice Questions with Explanations

Correct answer: A

In IEEE 802.11b/g, non-overlapping channels in the US are 1, 6, and 11 (with 3-channel spacing required to avoid interference). Since channels 1, 6, 9, and 11 are occupied, channel 4 is the best choice as it falls between the occupied channels with minimal overlap potential. Channel 4 would have the least interference compared to the other options when channels 1, 6, 9, and 11 are in use.

Why the other options are wrong:

• B. Channel 5 is too close to channel 6, which is already in use.
• C. Channel 10 is too close to channel 9 and 11, both occupied.
• D. Channel 2 is too close to channel 1, which is already in use.

Correct answer: D

The vncinject/bind.tcp stager creates a listening port on the victim machine that the attacker connects to, allowing VNC communication from attacker to victim on a port of the attacker's choosing. This matches the requirement of 'VNC communications from the attacker to a listening port of the attacker's choosing on the victim machine.'

Why the other options are wrong:

• A. The option 'vncinject/find.lag' is not a valid Metasploit stager.
• B. The reverse.tcp stager creates a connection from victim back to attacker, opposite of the requirement.
• C. The reverse-http stager uses HTTP for communication and reverses the connection direction.

Correct answer: D

A written statement of permission is the most critical document before beginning any penetration testing. This legal authorization protects both the tester and the organization, clearly defines scope, and ensures that all testing activities are legitimate and authorized. Without this, any testing could be considered unauthorized access and illegal.

Why the other options are wrong:

• A. A project plan is important but secondary to obtaining explicit written permission first.
• B. An exceptions document is useful but not obtained before testing begins.
• C. A project contact list is administrative but not as critical as written authorization.

Correct answer: A

The first command uses 'sc create' to create a Windows service called 'ncservice' that executes netcat (nc.exe) with parameters '-l -p 2222 -e cmd.exe', which creates a listening backdoor on TCP port 2222 that spawns cmd.exe for remote command execution. The second command 'sc query' verifies the service was created successfully and checks its status. This is a classic persistence mechanism.

Why the other options are wrong:

• B. The port specified is TCP 2222, not UDP 2222, as netcat defaults to TCP unless specified otherwise.
• C. The service does not stop instances of nc.exe; it executes nc.exe to create a backdoor listener.
• D. The command sequence order is incorrect; the first command creates the backdoor, and the second verifies it.

Correct answer: A

A client-side exploit targets client applications that retrieve content from the network, such as web browsers, email clients, or document readers. The attack works by delivering malicious content that the client application processes, rather than attacking a service listening on the client system. This is the most accurate definition of client-side exploitation.

Why the other options are wrong:

• B. Privilege escalation is a post-exploitation technique, not the defining characteristic of a client-side exploit.
• C. Attacking services listening on a client is typically server-side or local privilege escalation, not client-side exploitation.
• D. Physical machine attacks are hardware-level attacks, unrelated to application-level client-side exploits.

Correct answer: B

SYN sent, SYN-ACK returned, RST sent by the scanner; and SYN sent, RST-ACK returned. A SYN or half-open scan never completes the three-way handshake. The scanner sends a SYN to each target port. If the port is open, the target replies with SYN-ACK and the scanner immediately sends an RST to tear the connection down before it is established, which is why the scan is called half-open. If the port is closed, the target replies with RST- ACK and no further packets are needed. Option B lists exactly those two exchanges. Option A completes the handshake with an ACK, which is a full connect scan rather than a SYN scan. Option C starts with a SYN-ACK that no scanner would send as an opening packet, and option D describes FIN and ACK behaviour that belongs to other scan types, not to a half-open scan.

Why the other options are wrong:

• C. While C may contain valid sequences, it is incomplete without A, which represents open port responses.
• D. This appears to be a duplicate of option C and does not represent the full range of SYN scan responses.

Correct answer: D

IEEE 802.11 uses a two-way challenge-response authentication mechanism where both the client and the access point challenge each other. This mutual authentication ensures both parties are legitimate before establishing a connection. This bidirectional challenge is fundamental to 802.11 security protocols.

Why the other options are wrong:

• A. Authentication is not one-way from client to access point only.
• B. Authentication is not one-way from access point to client only; it is mutual.
• C. Challenges absolutely occur as part of 802.11 authentication and association.

Correct answer: B

Using the 'ping' utility in a for loop to perform a network sweep is a standard technique to discover active hosts on a network using only built-in Windows tools. This method sends ICMP echo requests to a range of IP addresses and identifies which hosts respond, revealing other machines on the target network without requiring external tools.

Why the other options are wrong:

• A. The ping utility by itself does not automatically discover other hosts; it requires manual iteration or a loop.
• C. The 'edit' utility reads static host files but only reveals previously known mappings, not active network discovery.
• D. The 'net share' utility shows shared resources but does not discover other machines on the network as effectively as network sweeping.

Correct answer: B

SCP with SSHv2 provides encrypted file transfer that bypasses network-based IDS detection better than unencrypted protocols. SSH encrypts the entire session including the file transfer, making payload inspection by IDS difficult. FTP passive mode (option D) still uses unencrypted data channels that IDS can inspect. HTTP PUT (A) and telnet ECHO (C) are also unencrypted and easily detected.

Why the other options are wrong:

• A. HTTP PUT sends unencrypted data that IDS can easily inspect and detect malicious payloads.
• C. Telnet ECHO is unencrypted and the slowest method; IDS would still detect the payload.
• D. FTP passive mode, while less obvious than active mode, still transmits unencrypted data that IDS can inspect.

Correct answer: D

The Findings section is where detailed vulnerability and risk results are documented and prioritized by severity level. This is the core technical section that lists all discovered issues with their risk ratings and remediation guidance. The Executive Summary provides high-level overview for management, Methodology describes how testing was performed, and Conclusions summarizes recommendations.

Why the other options are wrong:

• A. Methodology describes the testing approach and scope, not the detailed results.
• B. Conclusions provide summary recommendations, not the detailed prioritized listing of findings.
• C. Executive Summary is a high-level overview for non-technical stakeholders, not detailed technical prioritization.

Correct answer: D

The %systemroot% syntax uses Windows environment variables that expand to the Windows installation directory (typically C:\Windows). This is the correct Windows command syntax when working in a netcat shell or command prompt. Options A and C use Unix-style paths that won't work on Windows, and option B is invalid syntax.

Why the other options are wrong:

• A. "systemroot" without percent signs is not recognized as a Windows environment variable.
• B. "cd-" is not valid Windows command syntax for any directory navigation.
• C. "/systemroot/" uses Unix forward slashes which Windows command prompt does not interpret correctly.

Correct answer: A

The presence of tens of thousands of vulnerabilities stems from heterogeneous systems running multiple OS versions, service pack levels, antivirus vendors, browser versions, and Acrobat versions. Standardizing on approved desktop configurations reduces the attack surface and management overhead significantly. This is a long-term strategic recommendation that addresses the root cause of the vulnerability proliferation.

Why the other options are wrong:

• B. Eliminating workstations is impractical and doesn't address the actual security issue.
• C. Hiring more staff to patch doesn't solve the fundamental problem of managing heterogeneous systems.
• D. Monthly assessments identify vulnerabilities but don't address the underlying cause of proliferation.

Correct answer: C

Meterpreter is the advanced payload in Metasploit that provides extensive post- exploitation functionality including upload and download commands ("upload" and "download") for file transfer to and from compromised systems. It offers a full interactive shell environment with these capabilities. The other options are either shellcode injection methods or VNC-specific payloads without general file transfer functionality.

Why the other options are wrong:

• A. DLL inject is used for injecting code into process memory, not for file operations.
• B. Upexec is not a standard Metasploit payload name or recognized payload.
• D. Vncinject provides VNC remote desktop functionality, not generic file upload/download.

Correct answer: A

He should change the PORT: value to match the port used by the non-transparentproxy. The junior penetration tester installed a non-transparent proxy on his machine but the browser is not sending traffic through it. The current configuration shows HTTP Proxy set to 'localhost' with port 80, but the non-transparent proxy is likely running on a different port (the default is often 8080 or 3128). Since nothing is showing up in the proxy logs, the browser traffic is not being intercepted. Changing the PORT value to match the actual port where the non-transparent proxy is listening will correctly route the browser's HTTP traffic through the proxy, allowing him to see the web requests and responses in the proxy tool.

Why the other options are wrong:

• B. The checkbox 'use this proxy server for all protocols' is helpful for routing all traffic but won't solve the core issue when the port number itself is incorrect.
• C. The HTTP PROXY value is already set to 'localhost' (127.0.0.1), which is correct for a proxy running on the same machine; the problem is the port number, not the hostname.
• D. Selecting 'NO PROXY' would disable proxy functionality entirely, which is the opposite of what's needed to use the non-transparent proxy.

Correct answer: C

Pass-the-hash attacks avoid account lockout by not triggering failed authentication attempts, allow attackers to operate with the privileges of the captured hash, and leverage native Windows file and print sharing tools already present on systems. This combination represents the practical advantages of the attack method over traditional cracking.

Why the other options are wrong:

• A. While it doesn't trigger excessive IDS signatures, it does grant privileges at the hash level and doesn't involve LSASS corruption as a stated benefit.
• B. Pass-the-hash can still trigger some IDS signatures, and LSASS corruption isn't directly prevented by the technique.
• D. While technically close, it includes LSASS process protection which isn't a primary benefit of pass-the-hash attacks.

Correct answer: B

Windows uses CRLF (carriage return + line feed) for line endings while Linux uses LF (line feed) only. When a script transfers from Windows to Linux without conversion, the CR characters cause parsing issues and execution failures. This is the most common incompatibility when moving text-based scripts between platforms.

Why the other options are wrong:

• A. Byte length is the same between Windows and Linux systems for the same character.
• C. File corruption during transfer is unlikely with modern transfer protocols which include error checking.
• D. Both Windows and Linux systems primarily use ASCII character sets; encoding differences would present differently.

Correct answer: C

The correct JavaScript syntax for accessing cookies is "document.cookie". This is the standard Document Object Model (DOM) property that allows reading and writing cookies in the browser. The other options use incorrect property names that don't exist in JavaScript.

Why the other options are wrong:

• A. "Browsercookie" is not a valid JavaScript property or object.
• B. "Windowcookie" is not a valid JavaScript property; the window object doesn't have this property.
• D. "Session cookie" describes a type of cookie but is not a JavaScript variable name.

Correct answer: D

The Nmap scan reveals port 139/tcp (netbios-ssn) is open on the target Windows XP system. This port is used for NetBIOS session service and file sharing. The appropriate next step in a penetration test is to enumerate network shares using tools like `net view` or `smbclient` to identify available resources and potential attack vectors. This is a standard part of the exploitation workflow after reconnaissance.

Why the other options are wrong:

• A. The MAC address is already visible in the scan output; determining it provides no additional value for exploitation.
• B. Sending a single SYN packet to an already-open port serves no tactical purpose; the tester should move to active exploitation.
• C. Spoofing packets is unnecessary when you have a direct connection to the target and would complicate the assessment.

Correct answer: D

The Executive Summary section of a penetration test report is designed for executive and management-level stakeholders who need to understand the overall business impact, risk level, and strategic implications of the findings. This section provides high-level context about how vulnerabilities affect the organization's operations, compliance, and security posture, without technical details.

Why the other options are wrong:

• A. Problems section typically lists technical issues but doesn't contextualize business impact.
• B. Findings list individual vulnerabilities with technical details, not their aggregated business consequences.
• C. Impact Assessment may exist in some report formats but Executive Summary is the standard section for business impact in professional penetration test reports.

Correct answer: C

Scope creep occurs when work expands beyond the original contract terms. The engagement was contracted to 'map the network and try to compromise the servers.' Being asked to compromise workstations is a task outside the original scope-it represents an expansion of deliverables without corresponding contract modification or authorization. This violates project boundaries.

Why the other options are wrong:

• A. Disclosing information violates the NDA but is a compliance/ethics violation, not scope creep.
• B. Compromising a server then escalating privileges is a natural progression within server compromise activities already authorized.
• D. Scanning slowly for stealth is a methodological choice within the authorized scope of network mapping.

Correct answer: A

The traffic successfully reaches the internal interface of your firewall but does not pass through the external interface. This indicates the firewall itself is the blocking point-it is filtering the outbound traffic to the remote network. The firewall's rules are preventing the vulnerability scan traffic from exiting to reach the target systems.

Why the other options are wrong:

• B. NAT/PAT table exhaustion would cause drops, but the question states traffic reaches the internal interface, so table fill-up would manifest differently.
• C. A host-based firewall on your own scanning machine would block traffic before it reaches your network firewall's internal interface.
• D. ISP blocking would not prevent traffic from reaching your firewall's external interface; the ISP issue would manifest beyond that point.

Correct answer: C

The Stdapi (Standard API) module provides functionality for file system operations, including the ability to modify file timestamps (modified time and access time). This is essential for covering tracks after backdoor installation. Stdapi contains commands like `touch` equivalent operations that allow manipulation of file metadata.

Why the other options are wrong:

• A. Core module handles basic session management and scripting, not file timestamp manipulation.
• B. Priv module handles privilege escalation techniques, not file metadata operations.
• D. Browser module is used for browser exploitation and data harvesting, not file operations.

Correct answer: C

When web server logs are viewed through a web-based console or web application, XSS payloads injected into logs can execute in the administrator's browser context. An attacker can craft requests containing JavaScript that gets logged, and when an admin views the logs through a web interface, the JavaScript executes, potentially compromising the admin's session or credentials.

Why the other options are wrong:

• A. XSS in logs viewed in a text browser does not execute shell scripts; this confuses XSS with command injection.
• B. XSS does not make logs unreadable; it executes in the viewer's browser, not as a denial of service mechanism.
• D. XSS in terminal-based log viewing does not escape to the shell; it would be displayed as text only.

Correct answer: A

Adding salts to passwords dramatically increases the computational burden for rainbow table attacks. Each unique salt requires a separate set of pre-calculated tables, and with multiple salts per password set, the attacker must either calculate tables for each salt value (exponentially increasing time and storage) or generate hashes on-the-fly, defeating the speed advantage of pre-calculation.

Why the other options are wrong:

• B. Salts increase computational requirements and table proliferation, but doubling is an oversimplification; the impact grows exponentially with salt variety.
• C. Salts cannot be reliably reversed or removed from proper cryptographic implementations; they are integral to the hashing process.
• D. While tools like Ophcrack can calculate on-the-fly, this negates the primary advantage of rainbow tables (speed), making salts highly effective as a defense.

Correct answer: A

The correct Windows command syntax for deleting a user account is `net user pentester /del`. The `net user` command is the standard utility for managing local user accounts on Windows systems, and the `/del` flag specifies deletion of the account.

Why the other options are wrong:

• B. `Net name` is used for computer and printer naming, not user account management.
• C. `Net localuser` is not the correct command syntax; it should be `net user` for local user management.
• D. `Net account` manages global account policies, not individual user deletion.

Correct answer: D

When penetration testing is deemed too risky, configuration reviews provide a direct way to identify vulnerabilities by examining system settings, security controls, and deviations from secure baselines without the active testing that creates operational risk. This is a legitimate vulnerability identification method that avoids the dangers of live penetration testing.

Why the other options are wrong:

• A. Network scope analysis identifies what systems exist but does not inherently reveal vulnerabilities in those systems.
• B. Baseline data reviews compare current state to historical state but require a baseline to already exist and may not identify new vulnerability classes.
• C. Patch policy review only addresses known vulnerabilities that patches cover, missing configuration-based weaknesses and zero-days.

Correct answer: C

The command output shows the result of querying a remote system (192.168.116.101) using what appears to be a user enumeration tool (likely enum or similar). The output explicitly states 'getting user list (pass 1, index 0)... success, got 5' followed by a list of valid user accounts discovered on the system: Administrator, Guest, ksmith, dlaw, and IUSR_Anonymous. This demonstrates active discovery of valid user accounts through enumeration, which is a reconnaissance technique used to identify legitimate user accounts on a target system.

Why the other options are wrong:

• A. The output shows enumerated user accounts from a remote system, not a local Windows SAM database dump which would display hashes and additional credential information.
• B. The command is enumerating user accounts and workgroup memberships, not listing available services; the workgroup references are incidental to user discovery.
• D. There is no indication of locked-out accounts in this output; the lockout policy is shown at the beginning (lockout threshold: none), but the user listing does not indicate lock status for any accounts.

Correct answer: A

Both raw netcat shells and telnet terminals share the fundamental ability to send commands to a target machine and receive responses. This is their primary shared characteristic as basic command-execution interfaces.

Why the other options are wrong:

• B. Neither raw netcat nor telnet adapts output to display window size; they lack terminal control features.
• C. Shells and terminals are not the same-terminals provide enhanced features like line editing and signal handling that shells lack.
• D. Raw shells do not process control sequences like cursor positioning or formatting that full terminals handle.

Correct answer: A

When shadow passwords are enabled, the /etc/passwd file shows 'x' or similar placeholder in the password field (second colon-delimited field) instead of actual hashes, indicating passwords are stored separately in /etc/shadow. A non-privileged user can read /etc/passwd but cannot read /etc/shadow, making this the only detectable method.

Why the other options are wrong:

• B. Non-privileged users cannot read /etc/shadow, so this check is not possible from an unprivileged account.
• C. The /etc/password file is not replaced; it still exists and is used alongside /etc/shadow.
• D. The shadow file uses colon delimiters, not commas, and NULL values would not indicate shadow password usage.

Correct answer: D

In DNS-based load balancing, a single domain name maps to multiple IP addresses (different servers in the pool). By targeting a specific IP address rather than the hostname, a penetration tester scans an individual server in the load-balanced cluster rather than letting DNS round-robin potentially across multiple targets.

Why the other options are wrong:

• A. While a single IP may host multiple domains via virtual hosting, this is not the load balancing issue described.
• B. This is false; domain names regularly resolve to multiple IP addresses, especially in load-balanced environments.
• C. Modern scanning tools work with both hostnames and IP addresses equally well.

Correct answer: D

Raw netcat shells lack proper terminal emulation (PTY allocation), so when sudo prompts for a password, the input stream cannot handle the password prompt's special terminal handling. The keystrokes are sent but not processed by the sudo password prompt mechanism, making authentication impossible.

Why the other options are wrong:

• A. Sudo can work in shells; the issue is specific to raw netcat's lack of terminal features.
• B. Even if properly configured in sudoers, the password prompt cannot be satisfied in a raw netcat shell.
• C. The display does not necessarily blank; the real issue is that the password input mechanism fails silently.

Correct answer: C

The 'net localgroup administrators' command lists all members of the local administrators group on a Windows system. The 'localgroup' parameter is specifically designed to enumerate group membership.

Why the other options are wrong:

• A. net account shows user account policies, not group membership.
• B. net user displays individual user properties, not group membership listings.
• D. net localuser does not exist as a standard Windows command.

Correct answer: A

The screenshot shows an exploit for ms08_067_netapi, which is a critical vulnerability in the Windows Server service (specifically the NetAPI service). The output indicates automatic targeting detected Windows XP SP3 and successfully triggered the vulnerability. The ms08_067 exploit specifically targets the NetAPI32.dll in the Windows Server service, which handles RPC (Remote Procedure Call) communications. This is a well-known remote code execution vulnerability in the Windows Server service, not in Internet Explorer, PowerShell, or the Local Security Authority.

Why the other options are wrong:

• B. Internet Explorer is a browser and was not the target of the ms08_067 exploit; the vulnerability is in the Windows Server service NetAPI component.
• C. Windows PowerShell is a command-line shell that was not involved in this particular ms08_067 vulnerability exploitation.
• D. The Local Security Authority is a system component not targeted by the ms08_067 netapi exploit, which specifically targets the RPC service interface.

Correct answer: B

The Priv module provides privilege-related functionality including the hashdump command, which extracts the SAM database from Windows systems. This elevated module is required beyond the default Meterpreter modules to access and dump SAM hashes.

Why the other options are wrong:

• A. Core handles basic shell operations but lacks SAM dumping capability.
• C. Stdapi provides standard system interaction but does not include privilege escalation or SAM dump features.
• D. Hashdump is a command within the Priv module, not a module itself.

Correct answer: D

Raw hashed passwords are compared to pre- calculated hash tables. Rainbow tables use pre-calculated hash tables where raw passwords have been hashed in advance. The defining feature is comparing observed hashes against massive pre- computed databases rather than computing hashes in real-time like traditional crackers do, trading storage for speed.

Why the other options are wrong:

• A. Rainbow tables actually require unsalted passwords to be effective; salts defeat pre- computed tables.
• B. Multi-threading and 64-bit CPU usage applies equally to modern John the Ripper and Cain implementations.
• C. While alignment optimizations may exist, the distinguishing characteristic is pre- calculation, not data alignment.

Correct answer: A

Unannounced tests prevent administrators from deliberately circumventing the assessment by shutting down systems. If tests are unannounced, admins cannot time their shutdown activities to avoid detection. Telling response personnel the exact time (B) defeats the purpose, testing after hours (C) may miss the issue during business operations, and limiting to business hours (D) allows the problematic behavior to continue undetected.

Why the other options are wrong:

• B. Announcing the exact test time enables the suspicious admins to shut down systems precisely during the announced window.
• C. Testing after business hours won't catch administrators turning off systems during business hours when tests are scheduled.
• D. Limiting tests to business hours guarantees the suspicious behavior can continue undetected if admins shut down during those hours.

Correct answer: C

Under Singapore's Computer Misuse and Cybersecurity Act (Chapter 50a), conducting denial-of-service attacks against third-party systems (the communications provider) without their explicit authorization incurs criminal liability. While the hold-harmless agreements cover the contractor's internal systems, they do not extend to testing the communications provider's infrastructure. Options A, B, and D are authorized activities against the in-scope internal systems covered by the agreements.

Why the other options are wrong:

• A. Exploiting vulnerable web services on authorized internal hosts is within the scope of the authorized penetration test.
• B. Social engineering employees via telephone is a standard authorized penetration testing technique within the agreed scope.
• D. Cracking password hashes on the corporate domain server is an authorized activity covered by the rules of engagement.

Correct answer: B

WEP uses CRC32 for integrity checking, which is cryptographically weak and not secure against modification. An attacker can modify encrypted packets and recalculate the CRC32 checksum to inject arbitrary cleartext packets onto the network. While the other options represent WEP weaknesses, the CRC32 weakness specifically enables packet injection. The small key space (D) affects brute force attacks, RC4 (C) has general weaknesses but doesn't directly enable injection, and reversible hash IVs (A) is not a primary WEP mechanism.

Why the other options are wrong:

• A. WEP does not use reversible hashes for IVs; this is not a primary WEP vulnerability.
• C. While RC4 has weaknesses, it is not the specific weakness that makes packet injection easy.
• D. Small key space relates to key recovery attacks, not the ability to inject arbitrary cleartext packets.

Correct answer: A

Version scanning probes open ports to identify the actual service and version running on them by analyzing service banners and responses. This would have revealed that Apache was running on port 22 rather than SSHD. Port scanning (B) only identifies open ports, not what service is behind them. Network sweeping (C) finds active hosts, not services. OS fingerprinting (D) identifies the operating system, not specific services on ports.

Why the other options are wrong:

• B. Port scanning only determines if a port is open or closed, not what service is listening on it.
• C. Network sweeping identifies which hosts are active on a network, not what services run on specific ports.
• D. OS fingerprinting identifies the target operating system, not the specific services listening on individual ports.

Correct answer: A

Stored XSS is hardest to detect because the malicious payload can be injected anywhere within the application's static or dynamic content and may only execute under specific conditions or for certain users. Automated tools struggle to comprehensively map all storage locations and execution contexts. Reflected XSS is easier to detect because it follows a direct request-response pattern that automated tools can trace. Email and instant messaging (B) are not the primary reason for detection difficulty. Server log analysis (D) is not the limiting factor for Reflected XSS detection.

Why the other options are wrong:

• B. While emails and messaging systems may be involved in some stored XSS scenarios, this is not the primary reason for detection difficulty.
• C. Reflected XSS is actually easier for automated tools to detect because the payload flows directly in request-response cycles.
• D. The difficulty is not in analyzing server logs; it's in identifying where stored payloads exist within the application structure.

Correct answer: B

The --script-trace option in Nmap provides detailed output showing script execution details as the script runs. This flag displays debugging information and verbose output specific to NSE script execution. Option A uses invalid syntax (--script-output). Option C contains typos and invalid syntax (--scrlpr). Option D uses -v for general verbosity which is less detailed than script-specific tracing.

Why the other options are wrong:

• A. The --script-output flag is not the correct Nmap option for detailed script execution output.
• C. This option contains syntax errors (--scrlpr is not a valid flag) and does not properly request detailed script output.
• D. The -v flag provides general verbosity but is not as detailed as --script-trace for NSE script-specific output.

Correct answer: A

The wmic command with process call create executes a command on a remote Windows machine by creating a new process remotely. The /node parameter specifies the target system, /user and /password provide credentials, and 'process call create' instantiates the specified command. This is a remote code execution technique. Creating a service (B) would use different syntax. Creating an admin account (C) would require different parameters. Listing processes (D) would use 'process list' rather than 'process call create'.

Why the other options are wrong:

• B. Creating a service requires different WMIC syntax, not the 'process call create' method.
• C. Creating an admin account would use different WMIC commands targeting user account creation, not process execution.
• D. Listing running processes uses 'process list' syntax, not 'process call create', which actually executes a new process.

Correct answer: A

The Fluhrer, Mantin, and Shamir (FMS) attack against WEP typically requires approximately 250,000 packets to successfully recover the WEP key. This is based on the statistical analysis of weak IVs in the WEP protocol. While weak IVs (D) can be exploited more easily when found, the FMS attack in general requires the larger packet count. 20,000 packets (B) is too few for most successful attacks, and 10,000,000 (C) is unnecessarily high.

Why the other options are wrong:

• B. 20,000 packets is generally insufficient for a reliable FMS attack against WEP.
• C. 10,000,000 packets represents an unnecessarily large number; FMS attacks succeed with far fewer packets.
• D. While a single weak IV can be exploited, the FMS attack methodology as typically executed requires substantially more packets to statistically succeed.

Correct answer: D

In traceroute, when asterisks (***) appear on a line, it means that no response was received within the timeout period for those probe packets. Lines 10 and 11 show '* * *' which indicates that the devices at those hops did not return ICMP TTL Exceeded messages. This is the normal behavior of traceroute when a hop either doesn't respond or filters ICMP responses. The fact that hops 1-9 returned responses successfully, and the trace attempted hops 10-11, demonstrates that the local network connection is intact and the utility itself is functioning properly. Hops 10 and 11 simply failed to send back the expected ICMP Time Exceeded messages that traceroute relies upon to identify each hop in the path.

Why the other options are wrong:

• A. Traceroute uses ICMP, not UDP with destination ports, so port-based filtering is not the mechanism at play here.
• B. If hop 10 were completely down, it would not silently fail-the device would drop packets, but subsequent hops could still respond (and traceroute would continue trying higher hop counts).
• C. The network connection is clearly functional since earlier hops (1-9) returned responses successfully during the same trace execution.

Correct answer: B

The command output shows '[SC] ControlService FAILED 1062' which is error code 1062 (ERROR_SERVICE_NOT_ACTIVE in some contexts, but more accurately indicates insufficient privileges). The user 'Owner-net use Z' connects to a network share and attempts to stop MpsSvc (Windows Firewall) remotely, but fails due to insufficient access level. Even though the net use command succeeded in mapping the drive, the sc stop command requires administrative privileges to control services on the remote host. The user does not have the necessary elevated permissions (admin rights) needed to stop the Windows Firewall service.

Why the other options are wrong:

• A. The kernel would not prevent the command from executing; error 1062 is a service control error, not a kernel-level access denial.
• C. The sc command uses the net use mapped drive connection and does not require an explicit IP address parameter when accessing remote services through established network connections.
• D. The timeout would produce a different error message; error 1062 specifically indicates a service control failure, not a network timeout.

Correct answer: A

Active Directory Domain Controllers store password hashes in the ntds.dit file located in %systemroot%\ntds\. This is the directory database file that contains all AD objects including user accounts and their password representations. The ntds.dit file is the primary database for Active Directory and is protected by default permissions.

Why the other options are wrong:

• B. Incorrect path syntax mixing forward and backward slashes; ntds.dit location is correct but path formatting is wrong.
• C. sam.dat is not the correct filename; Active Directory uses ntds.dit, not sam.dat.
• D. sam.dit does not exist; Active Directory uses ntds.dit for storing password representations, not sam.dit.

Correct answer: B

To achieve the lowest false positive rate in a black box penetration test, you must actually attempt exploitation of discovered services rather than rely solely on scanner reports. Vulnerability scanners frequently generate false positives by identifying services based on banners or ports without confirming actual exploitability. By using a scanner to identify services and then attempting actual exploitation, you confirm vulnerabilities are real and exploitable, providing high confidence results.

Why the other options are wrong:

• A. Port scanning alone identifies listening services but generates numerous false positives by associating all known vulnerabilities with those services without confirmation of actual exploitability.
• C. Vulnerability scanner reports alone typically have high false positive rates and don't confirm whether vulnerabilities are actually exploitable on the target system.
• D. Logging into systems violates black box testing constraints, which explicitly require testing from an external perspective without internal access or credentials.

Correct answer: C

In blind command injection, you cannot see the direct output of the injected command. However, by injecting a ping command to your own machine and monitoring with a network sniffer, you can confirm code execution by observing the resulting ICMP traffic. The ping -n 1 command on Windows sends exactly one ICMP Echo Request, and if successful, you would capture the response showing 'Packets: Sent = 1, Received = 1, Loss = 0%' in the sniffer output, confirming the injection worked.

Why the other options are wrong:

• A. In blind command injection, the output is not displayed to the attacker; this would only be visible in stored/time-based blind scenarios where output is echoed back.
• B. A destination host unreachable error would only occur if the host was actually unreachable; pinging your own machine should succeed.
• D. While ICMP packets would appear on the sniffer, the sniffer would capture the ping response from the target to your machine (source = target, not target as source receiving your ping).

Correct answer: A

DNS zone transfers use TCP port 53, not UDP. While DNS queries typically use UDP port 53 for speed, zone file transfers between DNS servers require the reliability guarantee of TCP. This is a fundamental DNS protocol requirement where zone transfers (AXFR requests) must use TCP/53 to ensure complete and accurate transfer of the zone database.

Why the other options are wrong:

• B. Port 153/UDP is not a valid DNS port and does not exist in standard DNS specifications.
• C. Port 35/TCP is not associated with DNS services; this port is not used for DNS zone transfers.
• D. DNS zone transfers use TCP, not UDP; while UDP/53 is used for standard DNS queries, zone transfers require TCP/53 for reliability.

Correct answer: A

Monitor Mode is the wireless interface configuration that allows passive capture of wireless frames from a single channel without associating with an access point. In Monitor Mode, the wireless interface operates independently, capturing all traffic on the selected channel and passing raw frames to the operating system for analysis with tools like Wireshark or aircrack-ng.

Why the other options are wrong:

• B. Promiscuous Mode is not specific to wireless; it's a general network interface mode that captures frames on wired networks but doesn't describe wireless passive frame capture.
• C. Managed Mode is the standard operating mode where the wireless interface connects to and associates with an access point; it does not passively grab frames.
• D. Master Mode is used when a wireless interface operates as an access point; it does not passively capture frames from a channel.