Exploitation Fundamentals GPEN Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which sequence correctly represents the typical exploitation lifecycle in a penetration test?

   • AReconnaissance → Scanning → Exploitation → Post-exploitation
   • BPost-exploitation → Exploitation → Scanning → Reconnaissance
   • CExploitation → Reconnaissance → Scanning → Post-exploitation
   • DScanning → Reconnaissance → Exploitation → Post-exploitation
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A penetration tester is using Metasploit to exploit a known vulnerability in a client's internal web server. The tester has already completed reconnaissance and identified the target service and version. The next step is to gain a foothold on the system. Which Metasploit component is specifically designed to deliver a payload to the target after a successful exploit?

   • AExploit module
   • BPayload module
   • CAuxiliary module
   • DEncoder module
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is using Metasploit to exploit a vulnerable service on a Windows target. The tester has selected an exploit module and needs to configure the payload to establish a reverse TCP connection. Which Metasploit command is used to set the payload and its associated options?

   • Aexploit
   • Buse exploit/multi/handler
   • Cset LHOST 192.168.1.100
   • Dset PAYLOAD windows/meterpreter/reverse_tcp
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester has exploited a vulnerability and needs to maintain access to the target system. The tester wants to use a payload that establishes a persistent connection that reconnects automatically if the connection drops. Which type of payload is most suitable?

   • AA staged payload that downloads a second stage from the network.
   • BA single-shot payload that executes a command and exits.
   • CA bind shell payload that opens a port on the target.
   • DA Meterpreter payload with auto-reconnect functionality.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is using Metasploit to exploit a Windows server. The tester wants to migrate the Meterpreter session to a more stable process to avoid detection. Which command should be used?

   • Arun post/multi/recon/local_exploit_suggester
   • Buse exploit/multi/handler
   • Crun post/windows/manage/migrate
   • Dmigrate -P <PID>
   Reveal Solution Discussion Select an answer first