You are performing a penetration test on a Windows environment. You have gained access to a service account that has the 'SeImpersonatePrivilege' enabled. You need to escalate privileges to SYSTEM. Which technique is most appropriate?

Use a kernel exploit targeting the Windows version

Use a potato attack (e.g., JuicyPotato) to exploit the SeImpersonatePrivilege and gain SYSTEM privileges

Use a DLL hijacking attack on a running service

Modify the service configuration to run as SYSTEM

You have compromised a Windows machine and obtained a Kerberos ticket for a domain admin. You want to use this ticket to access a file server. Which technique is most appropriate?

Use pass-the-ticket with tools like Mimikatz to inject the ticket into your session and access the file server

Use pass-the-hash with the NTLM hash of the domain admin

Use PsExec with the domain admin's password

Use RDP to log into the file server with the domain admin's credentials

You have a low-privilege Meterpreter session on a Windows 10 host. You want to identify potential kernel exploits. Which Metasploit command would you use?

run post/multi/recon/local_exploit_suggester

use post/multi/manage/shell_to_meterpreter

run post/windows/gather/win_privs

use exploit/windows/smb/ms17_010_eternalblue

You have a low-privilege shell on a Linux server. During enumeration, you find a SUID binary owned by root that is not a standard system utility. You need to escalate privileges to root. What is the most appropriate next step?

Search for kernel exploits matching the kernel version

Run the SUID binary and observe its behavior, then check if it can be exploited to execute commands as root

Attempt to read /etc/shadow to crack root's password

Check for world-writable cron scripts and wait for the next scheduled run

GIAC Penetration Tester (GPEN)

Domain 2Objective 2

Escalation and Exploitation GPEN Practice Questions (Page 1)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 1–5

1application · medium
You are performing a penetration test on a Windows environment. You have gained access to a service account that has the 'SeImpersonatePrivilege' enabled. You need to escalate privileges to SYSTEM. Which technique is most appropriate?
Select an answer first
2foundation · easy
Which of the following is a common Windows persistence mechanism that involves modifying the registry to run a program at user logon?
Select an answer first
3application · medium
You have compromised a Windows machine and obtained a Kerberos ticket for a domain admin. You want to use this ticket to access a file server. Which technique is most appropriate?
Select an answer first
4application · medium
You have a low-privilege Meterpreter session on a Windows 10 host. You want to identify potential kernel exploits. Which Metasploit command would you use?
Select an answer first
5application · medium
You have a low-privilege shell on a Linux server. During enumeration, you find a SUID binary owned by root that is not a standard system utility. You need to escalate privileges to root. What is the most appropriate next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.