Most Up-to-date GIAC Certified Penetration Tester GPEN Free Exam

NEW QUESTION 1

One of the sales people in your company complains that sometimes he gets a lot of unsolicited messages on his PDA. After asking a few questions, you determine that the issue only occurs in crowded areas like airports. What is the most likely problem?

• A. A virus
• B. Spam
• C. Blue jacking
• D. Blue snarfing

Answer: C

NEW QUESTION 2

Adam works as a professional Computer Hacking Forensic Investigator. He wants to investigate a suspicious email that is sent using a Microsoft Exchange server. Which of the following files will he review to accomplish the task?
Each correct answer represents a part of the solution. Choose all that apply.

• A. Checkpoint files
• B. cookie files
• C. Temporary files
• D. EDB and STM database files

Answer: ACD

NEW QUESTION 3

Which of the following is a web ripping tool?

• A. Netcat
• B. NetBus
• C. SuperScan
• D. Black Widow

Answer: D

NEW QUESTION 4

You are concerned about war driving bringing hackers attention to your wireless network.
What is the most basic step you can take to mitigate this risk?

• A. Implement WEP
• B. Implement WPA
• C. Don't broadcast SSID
• D. Implement MAC filtering

Answer: C

NEW QUESTION 5

Which of the following are the drawbacks of the NTLM Web authentication scheme?
Each correct answer represents a complete solution. Choose all that apply.

• A. It can be brute forced easil
• B. It works only with Microsoft Internet Explore
• C. The password is sent in clear text format to the Web serve
• D. The password is sent in hashed format to the Web serve

Answer: AB

NEW QUESTION 6

You have forgotten your password of an online shop. The web application of that online shop asks you to enter your email so that they can send you a new password. You enter your email you@gmail.com' and press the submit button. The Web application displays the server error.
What can be the reason of the error?

• A. The remote server is dow
• B. You have entered any special character in emai
• C. Your internet connection is slo
• D. Email entered is not vali

Answer: B

NEW QUESTION 7

Which of the following tools can be used to find a username from a SID?

• A. SNMPENUM
• B. SID
• C. SID2User
• D. SIDENUM

Answer: C

NEW QUESTION 8

Which of the following is a method of gathering user names from a Linux system?

• A. Displaying the owner information of system-specific binaries
• B. Reviewing the contents of the system log files
• C. Gathering listening services from the xinetd configuration files
• D. Extracting text strings from the system password file

Answer: C

Explanation:
Reference:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/pdf/Security_Guide/Red_Hat_Enterprise_Linux-6-Security_Guide-en-US.pdf

NEW QUESTION 9

Which of the following are the countermeasures against WEP cracking?
Each correct answer represents a part of the solution. Choose all that apply.

• A. Using the longest key supported by hardwar
• B. Using a 16 bit SSI
• C. Changing keys ofte
• D. Using a non-obvious ke

Answer: ACD

NEW QUESTION 10

Which of the following is the frequency range to tune IEEE 802.11a network?

• A. 1.15-3.825 GHz
• B. 5.15-5.825 GHz
• C. 5.25-9.825 GHz
• D. 6.25-9.825 GHz

Answer: B

NEW QUESTION 11

You have been contracted to perform a black box pen test against the Internet facing servers for a company. They want to know, with a high level of confidence, if their servers are vulnerable to external attacks. Your contract states that you can use all tools available to you to pen test the systems. What course of action would you use to generate a report with the lowest false positive rate?

• A. Use a port scanner to find open service ports and generate a report listing allvulnerabilities associated with those listening service
• B. Use a vulnerability or port scanner to find listening services and then try to exploitthose service
• C. Use a vulnerability scanner to generate a report of vulnerable service
• D. Log into the system and record the patch levels of each service then generate areport that lists known vulnerabilities for all the running service

Answer: B

NEW QUESTION 12

Which of the following tools is an example of HIDS?

• A. Anti-Spector
• B. Auditpol.exe
• C. Elsave
• D. Log File Monitor

Answer: D

NEW QUESTION 13

The employees of EWS Inc. require remote access to the company's Web servers. In order to provide solid wireless security, the company uses EAP-TLS as the authentication protocol. Which of the following statements are true about EAP-TLS?
Each correct answer represents a complete solution. Choose all that apply.

• A. It is supported by all manufacturers of wireless LAN hardware and softwar
• B. It uses a public key certificate for server authenticatio
• C. It uses password hash for client authenticatio
• D. It provides a moderate level of securit

Answer: AB

NEW QUESTION 14

A pen tester is able to pull credential information from memory on a Windows system. Based on the command and output below, what advantage does this technique give a penetration tester when trying to access another windows system on the network?

• A. The technique is more effective through perimeter firewalls than otherauthentication attack
• B. It allows the tester to escalate the privilege level of the account,
• C. Access to the system can be gained without password guessing or crackin
• D. Salts are removed from the hashes to allow for faster, offline cracking

Answer: A

NEW QUESTION 15
168.116.9 Is an IP address forvvww.scanned-server.com. Why are the results from the two scans, shown below, different?

• A. John.pot
• B. John conf
• C. John.rec
• D. John.ini

Answer: C

NEW QUESTION 16

Which of the following is the most common method for an attacker to spoof email?

• A. Back door
• B. Replay attack
• C. Man in the middle attack
• D. Open relay

Answer: D

NEW QUESTION 17

What is the main difference between LAN MAN and NTLMv1 challenge/responses?

• A. NTLMv1 only pads IS bytes, whereas LANMAN pads to 21 bytes
• B. NTLMv1 starts with the NT hash, whereas LANMAN starts with the LANMAN hash
• C. NTLMv1utilizes DES, whereas LANMAN utilizes MD4
• D. NTLMv1 splits the hash into 3 eight-byte pieces, whereas LAN MAN splits the hash Into 3 seven-byte pieces

Answer: A

NEW QUESTION 18

Which of the following tools is a wireless sniffer and analyzer that works on the Windows operating system?

• A. Void11
• B. Airsnort
• C. Kismet
• D. Aeropeek

Answer: D

NEW QUESTION 19
......