GIAC Certification GIAC Certified Penetration Tester 2

Question 1

What type of scan does Nmap perform when using the -sS flag?

Accepted Answer

SYN stealth scan

Answer

The -sS flag performs a SYN scan (half-open scan) which sends SYN packets and analyzes responses without completing the TCP handshake.

Question 2

During a penetration test, which phase involves gathering information about the target without actively probing systems?

Accepted Answer

Passive reconnaissance

Answer

Passive reconnaissance collects target information from public sources like OSINT without directly interacting with target systems.

Question 3

Which attack exploits NTLM authentication by responding to broadcast name-resolution requests with the attacker's IP address?

Accepted Answer

LLMNR Poisoning

Answer

LLMNR poisoning responds to Link-Local Multicast Name Resolution requests to capture NTLMv2 hashes from Windows hosts.

Question 4

What is the GPEN exam format in terms of question count and passing score?

Accepted Answer

115 questions, 71% passing

Answer

The GPEN exam consists of 115 questions with a passing score of 71%, with a 3-hour time limit.

Question 5

Which post-exploitation technique involves extracting credentials from Windows memory using a tool like Mimikatz?

Accepted Answer

Credential dumping

Answer

Credential dumping extracts plaintext passwords, hashes, and Kerberos tickets from Windows LSASS memory using tools like Mimikatz.

GIAC Certification Practice Test