You have compromised a Windows service that runs with the `SeImpersonatePrivilege` privilege. You want to escalate to SYSTEM. Which tool is specifically designed for this?

Use a tool like JuicyPotato or PrintSpoofer to exploit the privilege

Use Hashcat to crack the service account's password

Use Mimikatz to perform a pass-the-hash attack

Use Rubeus to perform a pass-the-ticket attack

You have a captured NTLM hash and a very large wordlist. The password policy requires 8+ characters with complexity. Your GPU can test 10 billion hashes per second. Which strategy is most efficient to crack the hash?

Run a dictionary attack without rules

Run a mask attack with `?u?l?l?l?l?l?l?d`

Run a pure brute-force attack over 8 characters

Run a rule-based attack with a comprehensive ruleset like best64

You have captured a NetNTLMv2 hash from a network capture. The password policy enforces 12-character passwords with at least one uppercase letter and one digit. You have a wordlist of common passwords and a ruleset that appends digits and capitalizes the first letter. Which approach is most likely to crack the hash quickly?

Run a pure brute-force attack over all 12-character combinations

Run John the Ripper in single mode only

Use a mask attack with `?u?l?l?l?l?l?l?l?l?l?d`

Run Hashcat with the wordlist and the best64 ruleset

GIAC Penetration Tester (GPEN)

Domain 3Objective 3

Attacking Password Hashes GPEN Practice Questions (Page 1)

Part of the Password Attacks and Credential Attacks domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–34 in this domain), expect 5–9 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

Questions 1–5

1application · medium
You have compromised a Windows service that runs with the `SeImpersonatePrivilege` privilege. You want to escalate to SYSTEM. Which tool is specifically designed for this?
Select an answer first
2application · easy
You have captured a hash from a Linux system that appears to be a SHA-512 crypt hash (format: $6$salt$hash). You need to crack it using Hashcat. Which Hashcat mode should you use?
Select an answer first
3foundation · easy
Which tool is commonly used to perform a pass-the-hash attack on Windows systems?
Select an answer first
4expert · hard
You have a captured NTLM hash and a very large wordlist. The password policy requires 8+ characters with complexity. Your GPU can test 10 billion hashes per second. Which strategy is most efficient to crack the hash?
Select an answer first
5application · medium
You have captured a NetNTLMv2 hash from a network capture. The password policy enforces 12-character passwords with at least one uppercase letter and one digit. You have a wordlist of common passwords and a ruleset that appends digits and capitalizes the first letter. Which approach is most likely to crack the hash quickly?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Attacking Password Hashes GPEN Practice Questions (Page 1)

Questions 1–5

You have compromised a Windows service that runs with the `SeImpersonatePrivilege` privilege. You want to escalate to SYSTEM. Which tool is specifically designed for this?

You have captured a hash from a Linux system that appears to be a SHA-512 crypt hash (format: $6$salt$hash). You need to crack it using Hashcat. Which Hashcat mode should you use?

Which tool is commonly used to perform a pass-the-hash attack on Windows systems?

You have a captured NTLM hash and a very large wordlist. The password policy requires 8+ characters with complexity. Your GPU can test 10 billion hashes per second. Which strategy is most efficient to crack the hash?

Keep studying — Password Attacks and Credential Attacks