After compromising a Windows domain controller, you need to maintain access and avoid detection. You have domain admin credentials. You want to establish persistence that is not easily detected by standard security tools. Which of the following is the most appropriate persistence mechanism?

Create a new domain admin account and use it for persistence

Install a service that runs a payload and is set to start automatically

Add a run key in the registry to execute a payload at logon

Use a Golden Ticket to forge a Kerberos ticket for any user

A penetration tester discovers that a Windows service is configured to run with SYSTEM privileges and the service's executable file is writable by the current low-privileged user. Which technique would most directly leverage this misconfiguration?

Replacing the service executable with a malicious binary

Performing a DLL search order hijack

Exploiting a kernel vulnerability

You have access to a Linux server as the 'webapp' user. You find that the 'webapp' user is a member of the 'docker' group. You need to gain root access. Which action is most appropriate?

Use 'sudo -l' to list sudo privileges and exploit a misconfiguration.

Run a Docker container that mounts the host filesystem and executes commands as root.

Search for SUID binaries and exploit one.

Modify the /etc/passwd file to change the root password.

During a red team exercise, you need to exfiltrate data from a Windows host without being detected by network monitoring. Which technique is most appropriate?

Use FTP to transfer files to an external server.

Send data via email attachments.

Use DNS tunneling to encode data in DNS queries.

Use HTTP POST requests to a web server.

GIAC Penetration Tester (GPEN)

Domain 2Objective 2

Escalation and Exploitation GPEN Practice Questions (Page 2)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 6–10

6expert · hard
After compromising a Windows domain controller, you need to maintain access and avoid detection. You have domain admin credentials. You want to establish persistence that is not easily detected by standard security tools. Which of the following is the most appropriate persistence mechanism?
Select an answer first
7foundation · easy
A penetration tester discovers that a Windows service is configured to run with SYSTEM privileges and the service's executable file is writable by the current low-privileged user. Which technique would most directly leverage this misconfiguration?
Select an answer first
8application · medium
You have access to a Linux server as the 'webapp' user. You find that the 'webapp' user is a member of the 'docker' group. You need to gain root access. Which action is most appropriate?
Select an answer first
9foundation · easy
Which of the following is a common persistence mechanism on Linux that involves creating a script that runs at specified times?
Select an answer first
10application · medium
During a red team exercise, you need to exfiltrate data from a Windows host without being detected by network monitoring. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.