A penetration tester is planning an engagement against a client's internal network. The tester has already performed passive reconnaissance and identified potential targets. According to the exploitation lifecycle, what should the tester do next before attempting to exploit any vulnerabilities?

Perform active scanning and enumeration to identify specific services and versions.

Write a detailed report of the reconnaissance findings and conclude the engagement.

Immediately launch Metasploit exploits against all identified targets.

Begin post-exploitation activities to establish persistence on the network.

What is the key difference between a bind shell and a reverse shell?

A bind shell is used only on Windows, while a reverse shell is used only on Linux

A bind shell listens on the target for an incoming connection, while a reverse shell connects back to the attacker

A bind shell is encrypted, while a reverse shell is not

A bind shell connects to the attacker, while a reverse shell listens on the target

A penetration tester is engaged to test a client's external web application. The rules of engagement specify that the tester must not access or exfiltrate any production data. During testing, the tester finds a critical remote code execution vulnerability. To prove the impact without violating the rules, which action is most appropriate?

Read the contents of the production database to show the severity of the vulnerability.

Install a backdoor for persistent access to demonstrate long-term impact.

Immediately stop testing and report the vulnerability without any proof of exploitation.

Execute a benign command such as 'whoami' on the target server to demonstrate code execution.

What is the primary purpose of exploitation frameworks like Metasploit?

To replace the need for manual penetration testing entirely

To provide a collection of exploits, payloads, and tools to streamline penetration testing

To patch vulnerabilities in target systems

To automate vulnerability scanning and reporting

A penetration tester has completed the exploitation phase and gained administrative access to a domain controller. The next step in the exploitation lifecycle is to maintain access. Which action is most appropriate?

Delete all event logs to avoid detection.

Exfiltrate the Active Directory database.

Create a new domain admin account and add it to the Domain Admins group.

Run a network scan to find other hosts.

GIAC Penetration Tester (GPEN)

Domain 2Objective 1

Exploitation Fundamentals GPEN Practice Questions (Page 6)

Part of the Exploitation and Post-Exploitation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

Questions 26–30

26application · medium
A penetration tester is planning an engagement against a client's internal network. The tester has already performed passive reconnaissance and identified potential targets. According to the exploitation lifecycle, what should the tester do next before attempting to exploit any vulnerabilities?
Select an answer first
27foundation · easy
What is the key difference between a bind shell and a reverse shell?
Select an answer first
28application · medium
A penetration tester is engaged to test a client's external web application. The rules of engagement specify that the tester must not access or exfiltrate any production data. During testing, the tester finds a critical remote code execution vulnerability. To prove the impact without violating the rules, which action is most appropriate?
Select an answer first
29foundation · easy
What is the primary purpose of exploitation frameworks like Metasploit?
Select an answer first
30application · medium
A penetration tester has completed the exploitation phase and gained administrative access to a domain controller. The next step in the exploitation lifecycle is to maintain access. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPEN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPEN” is a trademark of its owner, used for identification only.