During a penetration test, you gain initial access to a Windows workstation as a standard domain user. You discover that the 'Vulnerable Service' runs with SYSTEM privileges and its executable path is writable by the Everyone group. You need to escalate privileges to SYSTEM. Which approach is most appropriate?

Modify the service's registry key to point to a malicious DLL

Use a kernel exploit targeting the Windows version to gain SYSTEM privileges

Replace the service executable with a reverse shell binary and restart the service

Add your user to the local Administrators group using net localgroup

You have a Meterpreter session on a Windows workstation as a local admin. You need to move laterally to a file server, but you only have the NTLM hash of a domain user who has access to the file server. The target has SMB signing enforced. Which technique is most appropriate?

Use pass-the-ticket with a Kerberos ticket for the domain user.

Use pass-the-hash with the NTLM hash to authenticate to the file server's SMB service.

Use a brute-force attack to crack the NTLM hash to obtain the plaintext password.

Disable SMB signing on the file server using a remote command.

After compromising a Linux server, you need to maintain access and also clean up any traces of your activity. Which sequence of actions best follows a structured post-exploitation methodology?

Clean up logs first, then establish persistence, then enumerate.

Establish persistence, then clean up logs, then enumerate.

Establish persistence, then perform enumeration, then clean up logs.

Enumerate, then clean up logs, then establish persistence.

You have a low-privilege shell on a Linux system. You find that the 'docker' group is enabled for your user, and the Docker daemon is running. You need to escalate privileges to root. Which of the following is the most appropriate technique?

Run a Docker container that mounts the host filesystem and chroot into it to access root

Use a kernel exploit to gain root

Use 'sudo' to run commands as root

GIAC Penetration Tester (GPEN)

Domain 2Objective 2

Escalation and Exploitation GPEN Practice Questions (Page 4)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 16–20

16application · medium
During a penetration test, you gain initial access to a Windows workstation as a standard domain user. You discover that the 'Vulnerable Service' runs with SYSTEM privileges and its executable path is writable by the Everyone group. You need to escalate privileges to SYSTEM. Which approach is most appropriate?
Select an answer first
17expert · hard
You have a Meterpreter session on a Windows workstation as a local admin. You need to move laterally to a file server, but you only have the NTLM hash of a domain user who has access to the file server. The target has SMB signing enforced. Which technique is most appropriate?
Select an answer first
18application · medium
After compromising a Linux server, you need to maintain access and also clean up any traces of your activity. Which sequence of actions best follows a structured post-exploitation methodology?
Select an answer first
19foundation · easy
Which lateral movement technique involves using captured password hashes to authenticate to other systems without knowing the plaintext password?
Select an answer first
20expert · hard
You have a low-privilege shell on a Linux system. You find that the 'docker' group is enabled for your user, and the Docker daemon is running. You need to escalate privileges to root. Which of the following is the most appropriate technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.

Escalation and Exploitation GPEN Practice Questions (Page 4)

Questions 16–20

You have a Meterpreter session on a Windows workstation as a local admin. You need to move laterally to a file server, but you only have the NTLM hash of a domain user who has access to the file server. The target has SMB signing enforced. Which technique is most appropriate?

After compromising a Linux server, you need to maintain access and also clean up any traces of your activity. Which sequence of actions best follows a structured post-exploitation methodology?

Which lateral movement technique involves using captured password hashes to authenticate to other systems without knowing the plaintext password?

You have a low-privilege shell on a Linux system. You find that the 'docker' group is enabled for your user, and the Docker daemon is running. You need to escalate privileges to root. Which of the following is the most appropriate technique?

Keep studying — Exploitation and Post-Exploitation