A penetration tester has gained access to a domain controller and wants to demonstrate the impact of the compromise by extracting password hashes. The tester's goal is to prove the risk without causing a denial of service. Which technique is most appropriate?

Use a tool like Mimikatz to extract password hashes from memory

Enumerate all domain users and their group memberships

Run a password cracking tool against the extracted hashes

Disable the domain controller's security policies to show control

After exploiting a vulnerability in a web server, a penetration tester gains access as the 'www-data' user. The tester's goal is to move laterally to a database server on the internal network. Which post-exploitation technique is most appropriate for this objective?

Attempt to use the 'www-data' account to SSH directly to the database server

Upload a web shell to the database server's web directory

Search the web server's configuration files for database credentials

Run a vulnerability scanner against the database server to find an exploitable service

A penetration tester has successfully exploited a vulnerability in a web server and gained a low-privileged shell. The tester's objective is to demonstrate the impact of the compromise by accessing a sensitive file stored on a database server in a different subnet. The tester has credentials for a service account that can access the database server but the account is not a domain administrator. What should the tester do next to achieve the objective?

Run a vulnerability scan against the database server to find a new exploit.

Use the service account credentials to authenticate to the database server and retrieve the sensitive file.

Exfiltrate the web server's local password hashes and crack them offline.

Attempt to escalate privileges on the web server to root or SYSTEM.

A penetration tester is performing reconnaissance on a target that has a strict no-active-scanning policy during business hours. The tester has a limited window after hours for active scanning. The tester needs to identify the target's technology stack and potential entry points. Which approach is most effective?

Perform passive reconnaissance during business hours and schedule active scanning for the after-hours window.

Use only passive reconnaissance and avoid active scanning entirely.

Perform active scanning during business hours despite the policy to save time.

Skip reconnaissance and proceed directly to exploitation.

GIAC Certified Enterprise Defender

Domain 4Objective 2

Penetration Testing Application GCED Practice Questions (Page 1)

Part of the Penetration Testing domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 1–5

1expert · hard
A penetration tester has gained access to a domain controller and wants to demonstrate the impact of the compromise by extracting password hashes. The tester's goal is to prove the risk without causing a denial of service. Which technique is most appropriate?
Select an answer first
2application · medium
After exploiting a vulnerability in a web server, a penetration tester gains access as the 'www-data' user. The tester's goal is to move laterally to a database server on the internal network. Which post-exploitation technique is most appropriate for this objective?
Select an answer first
3application · medium
A penetration tester has successfully exploited a vulnerability in a web server and gained a low-privileged shell. The tester's objective is to demonstrate the impact of the compromise by accessing a sensitive file stored on a database server in a different subnet. The tester has credentials for a service account that can access the database server but the account is not a domain administrator. What should the tester do next to achieve the objective?
Select an answer first
4foundation · easy
Which tool is commonly used to identify vulnerabilities in web applications by sending malicious payloads to detect input validation flaws?
Select an answer first
5expert · hard
A penetration tester is performing reconnaissance on a target that has a strict no-active-scanning policy during business hours. The tester has a limited window after hours for active scanning. The tester needs to identify the target's technology stack and potential entry points. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Penetration Testing Application GCED Practice Questions (Page 1)

Questions 1–5

A penetration tester has gained access to a domain controller and wants to demonstrate the impact of the compromise by extracting password hashes. The tester's goal is to prove the risk without causing a denial of service. Which technique is most appropriate?

After exploiting a vulnerability in a web server, a penetration tester gains access as the 'www-data' user. The tester's goal is to move laterally to a database server on the internal network. Which post-exploitation technique is most appropriate for this objective?

Which tool is commonly used to identify vulnerabilities in web applications by sending malicious payloads to detect input validation flaws?

Keep studying — Penetration Testing