GIAC Penetration Tester (GPEN) Practice Questions & Study Guide

Free GIAC Penetration Tester (GPEN) Practice Questions Preview

• Question 1

  ACME corporation has decided to setup wireless (IEEE 802.11) network in it's sales branch at Tokyo and found that channels 1, 6, 9,11 are in use by the neighboring offices. Which is the best channel they can use?
  

  • A. 4
  • B. 5
  • C. 10
  • D. 2

  Correct Answer: D

  Explanation:

  I disagree with the suggested answer D and agree with the community consensus of A. In 2.4 GHz 802.11 networking, channels are 22 MHz wide and spaced 5 MHz apart, meaning a channel overlaps with those ±4 channels away. To minimize Adjacent Channel Interference (ACI), one must select the channel with the least spectral overlap with the occupied channels (1, 6, 9, 11). Channel 4 is the most distant from the occupied centers in the largest available spectral gap.

  Reason

  Option A is correct because the existing channels are 1, 6, 9, and 11. The gaps between these are 1-6 (4 channels free), 6-9 (2 channels free), and 9-11 (1 channel free). The largest gap is between 1 and 6. Within this gap, Channel 4 provides the maximum possible buffer from both Channel 1 and Channel 6, resulting in lower interference than any other choice provided.

  Why the other options are not as suitable

  • Option B is incorrect because Channel 5 is immediately adjacent to the occupied Channel 6, leading to significant signal overlap and interference.
  • Option C is incorrect because Channel 10 sits directly between occupied Channels 9 and 11, causing Adjacent Channel Interference from both sides simultaneously.
  • Option D is incorrect because Channel 2 is immediately adjacent to the occupied Channel 1, which would result in heavy overlap and poor signal quality compared to the more centered Channel 4.

  Citations

  • https://www.ieee802.org/11/
  • https://learningnetwork.cisco.com/s/article/wi-fi-channels-and-antennas-deep-dive

• Question 2

  Which Metasploitvncinject stager will allow VNC communications from the attacker to a listening port of the attacker's choosing on the victim machine?
  

  • A. Vncinject/find.lag
  • B. Vncinject/reverse.tcp
  • C. Vncinject/reverse-http
  • D. Vncinject /bind.tcp

  Correct Answer: B

  Explanation:

  I disagree with the suggested answer B. While vncinject/reverse_tcp is a common payload, the question specifically asks for a stager that allows communications from the attacker to a listening port on the victim machine. This behavior describes a Bind connection, not a Reverse connection. Therefore, Option D (vncinject/bind_tcp) is the technically correct answer based on the functional requirements described.

  Reason

  Option D is correct because a bind_tcp stager instructs the victim machine to open a local port and listen for incoming connections. This allows the attacker to initiate communication directly to that specific port on the victim machine. In the context of vncinject, this setup establishes the VNC session by having the attacker connect to the victim's listener.

  Why the other options are not as suitable

  • Option A is incorrect because find_tag (often misspelled as find.lag in legacy materials) is a stager that attempts to find an existing established connection based on a specific tag rather than opening a new listening port for the attacker to choose.
  • Option B is incorrect because a reverse_tcp payload forces the victim to initiate an outbound connection to the attacker; it does not create a listening port on the victim for the attacker to connect to.
  • Option C is incorrect because reverse_http uses the HTTP protocol to tunnel data back to the attacker, which again follows the reverse connection model rather than the bind model requested in the prompt.

  Citations

  • https://www.offsec.com/metasploit-unleashed/payload-types/
  • https://docs.metasploit.com/docs/using-metasploit/basics/how-payloads-work.html

• Question 3

  What is the MOST important document to obtain before beginning any penetration testing?
  

  • A. Project plan
  • B. Exceptions document
  • C. Project contact list
  • D. A written statement of permission

  Correct Answer: A

  Explanation:

  I disagree with the suggested answer A and agree with the community consensus for D. In the context of the GIAC GPEN curriculum and general cybersecurity law, a written statement of permission is the absolute most important document because it provides the legal authorization required to conduct activities that would otherwise be considered illegal unauthorized access.

  Reason

  Option D is correct because written permission (also known as the Get Out of Jail Free card) is the primary legal defense for a penetration tester. It establishes that the activities were authorized by the asset owner, protecting the tester from prosecution under laws like the Computer Fraud and Abuse Act (CFAA). Without this document, none of the other planning materials matter as the engagement would be considered a criminal act.

  Why the other options are not as suitable

  • Option A is incorrect because while a Project plan is essential for methodology and timing, it does not provide the legal 'authority to operate' or protection from criminal liability.
  • Option B is incorrect because an Exceptions document (or exclusions list) is a subset of the scoping process used to define what NOT to touch, rather than providing the fundamental right to test the environment.
  • Option C is incorrect because a Project contact list is a logistical tool used for communication during emergencies or status updates, but it carries no weight in establishing the legality of the penetration test.

  Citations

  • https://www.giac.org/certifications/penetration-tester-gpen/
  • https://www.sans.org/white-papers/33342/

• Question 4

  While reviewing traffic from a tcpdump capture, you notice the following commands being sent from a remote system to one of your web servers:
  C:\>sc winternet.host.com create ncservicebinpath- "c:\tools\ncexe -I -p 2222 -e cmd.exe"
  C:\>sc vJnternet.host.com query ncservice.
  What is the intent of the commands?
  

  • A. The first command creates a backdoor shell as a service. It is being started on TCP2222 using cmd.exe. The second command verifies the service is created and itsstatus.
  • B. The first command creates a backdoor shell as a service. It is being started on UDP2222 using cmd.exe. The second command verifies the service is created and itsstatus.
  • C. This creates a service called ncservice which is linked to the cmd.exe command andits designed to stop any instance of nc.exe being run. The second command verifiesthe service is created and its status.
  • D. The first command verifies the service is created and its status. The secondcommand creates a backdoor shell as a service. It is being started on TCP

  Correct Answer: A

  Explanation:

  I agree with the suggested answer A. The command sequence clearly demonstrates an attacker using the Windows Service Controller (sc.exe) to establish persistence on a remote host by creating a service that executes a Netcat (nc.exe) listener.

  Reason

  Option A is correct because the first command uses sc create to register a new service named ncservice. The binpath argument points to a Netcat executable (nc.exe) configured with the -l flag (listen), -p 2222 (port), and -e cmd.exe (execute shell upon connection). This setup creates a classic bind shell backdoor. The second command, sc query, is the standard method to check the status and existence of the newly created service. Since Netcat defaults to TCP unless specified otherwise, the shell is listening on TCP 2222.

  Why the other options are not as suitable

  • Option B is incorrect because Netcat uses TCP by default; a UDP listener would require the -u flag, which is absent from the command string.
  • Option C is incorrect because the command -e cmd.exe instructs Netcat to provide a command prompt to a remote connector, which is a feature for remote access, not a mechanism to stop other instances of Netcat.
  • Option D is incorrect because it reverses the logic of the commands; the first command shown is a create action, while the second is a query action, and it fails to complete the description of the service's functionality.

  Citations

  • https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
  • https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query

• Question 5

  Which of the following best describes a client side exploit?
  

  • A. Attack of a client application that retrieves content from the network
  • B. Attack that escalates user privileged to root or administrator
  • C. Attack of a service listening on a client system
  • D. Attack on the physical machine

  Correct Answer: C

  Explanation:

  I disagree with the suggested answer C and agree with the community consensus for A. In GPEN and general cybersecurity terminology, a client-side exploit specifically targets vulnerabilities in applications (like browsers or document viewers) that initiate outbound requests to fetch data, rather than attacking a service waiting for inbound connections.

  Reason

  Option A is correct because it defines the core mechanism of a client-side attack: the attacker provides malicious content (like a weaponized PDF or a malicious website) which the client application (the victim) actively retrieves and processes. This contrasts with server-side attacks where the attacker initiates the connection to a listening port.

  Why the other options are not as suitable

  • Option B is incorrect because escalating privileges to root or administrator describes Privilege Escalation, which can occur after any type of initial exploit, whether client-side or server-side.
  • Option C is incorrect because an attack on a service listening on a system is the definition of a Server-Side Exploit; client-side exploits are specifically used when there are no reachable listening services (e.g., due to a firewall).
  • Option D is incorrect because attacks on the physical machine refer to Physical Security or Hardware Hacking, such as using a Rubber Ducky or cold boot attack, which is a different domain than client-side software exploitation.

  Citations

  • https://www.sans.org/blog/client-side-attacks-on-the-rise/
  • https://www.giac.org/certification/penetration-tester-gpen

• Question 6

  Which of the following TCP packet sequences are common during a SYN (or half-open) scan?
  

  • A. A,B and C
  • B. A and C
  • C. C and D
  • D. C and D

  Correct Answer: C

  Explanation:

  I agree with the community consensus (Option B) rather than the hidden suggested answer (Option C). A SYN scan, also known as a half-open scan, is defined by its two primary outcomes: receiving a SYN/ACK and responding with a RST (indicating an open port), or receiving a RST/ACK (indicating a closed port). The hidden suggested answer points to sequences that are either redundant or illogical in the context of standard TCP scanning techniques.

  Reason

  Option B is correct because it encompasses the two fundamental packet sequences of a SYN scan. Sequence A (SYN -> SYN/ACK -> RST) occurs when a port is open; the scanner sends a SYN, receives a SYN/ACK, and immediately tears down the connection with a RST to avoid completing the three-way handshake. Sequence C (SYN -> RST/ACK) occurs when a port is closed; the target operating system responds to the initial SYN with a RST/ACK to signal that no service is listening.

  Why the other options are not as suitable

  • Option A is incorrect because it includes Sequence B, which is generally not part of a standard SYN scan logic compared to the primary indicators of open/closed ports.
  • Option C is incorrect because it suggests sequences C and D; while C is a valid 'closed' response, Sequence D (often involving unexpected flag combinations or timeouts) is not a primary 'common' sequence used to define the half-open scanning method.
  • Option D is incorrect for the same reasons as
  • Option C, focusing on less standard or repetitive sequences rather than the definitive open/closed indicators found in A and C.

  Citations

  • https://nmap.org/book/man-port-scanning-techniques.html
  • https://www.giac.org/certifications/penetration-tester-gpen/

• Question 7

  Which of the following describes the direction of the challenges issued when establishing a wireless (IEEE 802.11) connection?
  

  • A. One-way, the client challenges the access point
  • B. One-way, the access point challenges the client
  • C. No challenges occur (or wireless connection
  • D. Two-way, both the client and the access point challenge each other

  Correct Answer: D

  Explanation:

  I disagree with the suggested answer D and agree with the community choice B. In standard 802.11 Shared Key Authentication (based on WEP), the process is a four-step handshake where the Access Point (AP) issues a challenge text to the client to prove knowledge of the key. It is a one-way authentication process where the infrastructure authenticates the station, but the station does not authenticate the infrastructure.

  Reason

  Option B is correct because 802.11 Shared Key Authentication utilizes a challenge-response mechanism where the Access Point sends a cleartext challenge to the client. The client then encrypts this challenge with the shared WEP key and returns it. If the AP can successfully decrypt it and match the original text, the client is authenticated. This direction is strictly one-way (AP to Client).

  Why the other options are not as suitable

  • Option A is incorrect because the client does not initiate a challenge to the Access Point in the 802.11 legacy authentication framework; the burden of proof lies with the connecting station.
  • Option C is incorrect because Shared Key Authentication explicitly uses a challenge-response handshake, unlike Open System Authentication which involves no cryptographic challenge.
  • Option D is incorrect because IEEE 802.11 legacy authentication (WEP-based) is not mutual; it lacks the 'two-way' verification found in more modern protocols like 802.11i (WPA2/WPA3) using 802.1X or Simultaneous Authentication of Equals (SAE).

  Citations

  • https://standards.ieee.org/ieee/802.11/7030/
  • https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/wireless/technology/ap80211/80211_concepts.html.xml

• Question 8

  You have gained shell on a Windows host and want to find other machines to pivot to, but the rules of engagement state that you can only use tools that are already available. How could you find other machines on the target network?
  

  • A. Use the "ping" utility to automatically discover other hosts
  • B. Use the "ping" utility in a for loop to sweep the network.
  • C. Use the "edit" utility to read the target's HOSTS file.
  • D. Use the "net share" utility to see who is connected to local shared drives.

  Correct Answer: B

  Explanation:

  I agree with the suggested answer B. In a restricted Living off the Land (LotL) scenario where external scanners like Nmap are unavailable, using native binary built-ins like ping.exe within a FOR loop is the standard method for performing a ping sweep to discover active hosts on a subnet.

  Reason

  Option B is correct because it utilizes a native Windows command-line technique to automate discovery. By wrapping the ping command in a FOR /L loop (e.g., for /L %i in (1,1,254) do @ping -n 1 -w 100 192.168.1.%i), an attacker can systematically probe an entire Class C subnet for live targets using only native OS tools.

  Why the other options are not as suitable

  • Option A is incorrect because the ping utility by itself does not have an 'automatic discovery' or 'sweep' mode; it requires a specific destination target to be manually defined.
  • Option C is incorrect because edit.com is a legacy 16-bit DOS editor often missing from modern 64-bit Windows environments, and the HOSTS file typically only contains static mappings for the local machine, not a comprehensive list of all live hosts on a network.
  • Option D is incorrect because net share displays the shares configured on the local machine; while it can show active sessions, it is a reactive tool that does not actively discover new, unassociated machines across the network range.

  Citations

  • https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/for
  • https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ping

• Question 9

  A penetration tester obtains telnet access to a target machine using a captured credential. While trying to transfer her exploit to the target machine, the network intrusion detection systems keeps detecting her exploit and terminating her connection. Which of the following actions will help the penetration tester transfer an exploit and compile it in the target system?
  

  • A. Use the http service's PUT command to push the file onto the target machine.
  • B. Use the scp service, protocol SSHv2 to pull the file onto the target machine.
  • C. Use the telnet service's ECHO option to pull the file onto the target machine
  • D. Use the ftp service in passive mode to push the file onto the target machine.

  Correct Answer: D

  Explanation:

  I agree with the Community Vote (B) and disagree with the Suggested Answer (D). The core issue is that the NIDS is performing deep packet inspection on a cleartext Telnet stream and identifying the exploit signature. To bypass this, the penetration tester needs an encrypted channel. SSH/SCP provides this encryption, masking the payload from the NIDS, whereas FTP and HTTP are typically cleartext and would still be subject to detection.

  Reason

  Option B is correct because SCP (Secure Copy) runs over SSHv2, which provides robust encryption for the data in transit. Since the NIDS is currently detecting the exploit in a cleartext Telnet session, switching to an encrypted protocol prevents the NIDS from inspecting the packet payloads and seeing the exploit signatures. This allows the file to be transferred and subsequently compiled on the target without the connection being terminated.

  Why the other options are not as suitable

  • Option A is incorrect because the HTTP PUT method is typically unencrypted (unless using HTTPS) and often disabled on web servers for security reasons; furthermore, it would not hide the exploit signature from the NIDS.
  • Option C is incorrect because Telnet ECHO is not a standard file transfer mechanism and remains a cleartext protocol, meaning the NIDS would still detect the exploit strings as they are typed or echoed.
  • Option D is incorrect because standard FTP is a cleartext protocol; while passive mode helps with firewall traversal, it does not provide encryption, so the NIDS would still identify and block the exploit payload during the transfer.

  Citations

  • https://www.giac.org/certifications/penetration-tester-gpen/
  • https://content.sans.org/incidents/ssh-tunneling-for-fun-and-profit-279

• Question 10

  What section of the penetration test or ethical hacking engagement final report is used to detail and prioritize the results of your testing?
  

  • A. Methodology
  • B. Conclusions
  • C. Executive Summary
  • D. Findings

  Correct Answer: C

  Explanation:

  I disagree with the suggested answer C and agree with the community choice D. While an Executive Summary might summarize risks, the Findings section is the specific area of a GPEN report dedicated to the granular detail, categorization, and prioritization (often via CVSS or risk ratings) of every discovered vulnerability.

  Reason

  Option D is correct because the Findings section (also referred to as Technical Findings) contains the comprehensive list of security issues identified during the engagement. This section includes the technical details, evidence, and the prioritization of those results based on their potential impact and likelihood, allowing the technical team to address the most critical issues first.

  Why the other options are not as suitable

  • Option A is incorrect because the Methodology section describes the frameworks, tools, and processes used during the test (such as PTES or NIST standards) rather than the results themselves.
  • Option B is incorrect because Conclusions typically provide a high-level closing statement on the overall security posture and strategic recommendations rather than a prioritized list of individual results.
  • Option C is incorrect because, although it may highlight major risks for a non-technical audience, it does not contain the full detail and exhaustive prioritization of all testing results found in the technical findings.

  Citations

  • https://www.giac.org/focus-areas/penetration-testing
  • https://www.sans.org/white-papers/34242/