Free GPEN Practice Questions

Question 1

Before an external engagement begins, a penetration tester wants a single document that authorizes the testing activity and provides legal protection if their activity is questioned by law enforcement or a third party. Which document serves this purpose?

Accepted Answer

A signed authorization / permission memo, often called a "get-out-of-jail-free" letter

Answer

The Statement of Work, which fixes the deliverables, schedule, and pricing for the engagement

Answer

The Master Service Agreement, which governs the ongoing legal relationship between the parties

Answer

The mutual Non-Disclosure Agreement, which binds both sides to protect confidential findings

Question 2

During reconnaissance, a tester issues a DNS AXFR request to a target's name server and receives a complete list of the domain's host records. What has the tester discovered?

Accepted Answer

A misconfigured server that permits an unauthorized full zone transfer of records

Answer

A resolver cache-poisoning weakness that lets forged records be injected downstream

Answer

A DNS amplification vector that could be abused to flood a third party with traffic

Answer

A dynamic-update endpoint that accepts unauthenticated changes to the zone data

Question 3

A tester runs `nmap -sn 10.10.0.0/24` against a target range. What does this command do?

Accepted Answer

Discovers which hosts are alive without scanning any of their ports

Answer

Scans all 65,535 TCP ports on every host that responds in the range

Answer

Skips the discovery phase and port-scans hosts assumed to be up

Answer

Runs a stealth half-open SYN scan against only the 1,000 most common ports

Question 4

An Nmap scan returns a port in the `filtered` state. What is the most accurate interpretation of this result?

Accepted Answer

A packet filter is likely dropping the probes, so Nmap cannot tell if it is open

Answer

A service is actively listening on the port and completed the probe exchange

Answer

The port is closed because the target host actively replied to the probe with a TCP reset

Answer

The host is entirely unreachable, so none of Nmap's probes were ever delivered

Question 5

A vulnerability scanner reports a critical finding on a host, but manual verification shows the affected service is not actually exploitable in this environment. Separately, the team notes that authenticated scans of the same host consistently reveal far more issues than unauthenticated ones. Which pair of concepts do these two observations illustrate?

Accepted Answer

A false positive requiring validation, and the greater depth of credentialed scanning

Answer

A newly disclosed zero-day finding, and the importance of frequent signature updates

Answer

A correctly identified true positive, and the inherent limits of passive fingerprinting

Answer

A missed false negative result, and the need for more aggressive scan timing options

Question 6

A tester compromises a host that sits behind a firewall blocking all inbound connections, though outbound traffic is permitted. To obtain interactive shell access, which approach will work?

Accepted Answer

A reverse shell that connects outbound from the host back to the tester's listener

Answer

A bind shell that opens a new listening port directly on the compromised host

Answer

An ARP-spoofing attack on the gateway to move the compromised host outside the firewall boundary

Answer

A UDP bind payload, on the assumption that UDP bypasses inbound filtering rules

Question 7

Within the Metasploit Framework, which module category is used to perform tasks such as port scanning, service enumeration, and login brute-forcing without delivering a payload to the target?

Accepted Answer

Auxiliary

Answer

Exploit

Answer

Post

Answer

Encoder

Question 8

A tester is choosing between the payloads `windows/meterpreter/reverse_tcp` and `windows/meterpreter_reverse_tcp`. What is the practical difference signaled by the slash versus the underscore?

Accepted Answer

The slash version is staged and sent in parts; the underscore version is stageless

Answer

The slash version targets 32-bit Windows while the underscore version targets 64-bit hosts

Answer

The slash version speaks TCP while the underscore version silently falls back to UDP

Answer

The slash version encrypts its traffic while the underscore version is sent in cleartext

Question 9

After compromising a dual-homed host, a tester needs their local tools to reach an internal subnet that is only routable from that host. They want to tunnel arbitrary tools through the foothold using a proxy. Which SSH option sets up the dynamic SOCKS proxy needed for this?

Accepted Answer

The `-D` option, which stands up a dynamic SOCKS proxy for pivoting to many hosts

Answer

The `-L` option, which forwards one local port to a single fixed remote destination

Answer

The `-R` option, which forwards a port on the remote server back to the SSH client

Answer

The `-N` option, which holds the tunnel open but runs no command on the remote host

Question 10

A tester wants to attack Active Directory accounts over the network but must avoid triggering account lockouts. Which password attack is specifically designed to stay under lockout thresholds?

Accepted Answer

Password spraying, which tries one common password across many different accounts

Answer

Brute forcing, which systematically tries every possible password against one account

Answer

A dictionary attack, which runs an entire wordlist against each individual account

Answer

Credential stuffing, which replays many breached passwords against a single account

Free GPEN Practice Questions

Domain 1: Advanced Password Attacks

Question 1

Domain 2: Attacking Password Hashes

Question 2

Domain 3: Azure Applications and Attack Strategies

Question 3

Question 4

Domain 4: Azure Overview, Attacks, and AD Integration

Question 5

Domain 5: Command and Control (C2)

Question 6

Domain 6: Domain Escalation and Persistence Attacks

Question 7

Question 8

Domain 7: Escalation and Exploitation

Question 9

Domain 8: Exploitation Fundamentals

Question 10

The rest of the GPEN blueprint

That's 10 of 1,050