FirstTry
GPENGIAC Penetration Tester Certification (GPEN)

Practice Exam 1

5 of this form’s 82 questions, drawn from across its domains, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 5

    Password Attacks and Hashes

    A defense team maps out where password guessing can happen against its estate. Which distinction separates an online attempt from an offline one?

  2. Question 2 of 5

    Reconnaissance, Scanning, and Vulnerability Discovery

    A UDP scan of a client host reports many ports as open or filtered. What does that classification tell the tester about those ports?

  3. Question 3 of 5

    Azure Attacks and AD Integration

    A company builds a rule stating that if a user wants to reach a cloud application, then that user must first complete multifactor authentication. Which Conditional Access construct is this?

  4. Question 4 of 5

    Exploitation and Privilege Escalation

    A tester overwrites a function pointer to redirect execution in a Windows application protected by Control Flow Guard. What happens when the CFG check fails at run time?

  5. Question 5 of 5

    Domain Escalation, Kerberos, and Persistence

    An application server authenticates Kerberos clients but has no challenge-response or server subkey scheme of its own. What does RFC 4120 require it to maintain against replayed authenticators?

0 of 82 completed

0%

The other 77 questions are the rest of this form: same 180 minute clock, same 73 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on GPEN.

What this exam covers

  • Penetration Test Planning8 questions / 10% of the exam
  • Reconnaissance, Scanning, and Vulnerability Discovery15 questions / 18% of the exam
  • Exploitation and Privilege Escalation16 questions / 20% of the exam
  • Password Attacks and Hashes18 questions / 22% of the exam
  • Domain Escalation, Kerberos, and Persistence15 questions / 18% of the exam
  • Azure Attacks and AD Integration10 questions / 12% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.