GIAC GPEN Practice Test

GPEN practice test: what's covered

• Pentest Planning
• Recon & OSINT
• Scanning
• Exploitation
• Metasploit
• Password & Hash Attacks
• Kerberos & AD
• Azure/Entra ID
• Pivoting
• C2

Free GPEN sample questions

1. During a penetration testing engagement, before a penetration test begins, both parties must agree on which systems are in scope, what testing times are permitted, and how to handle accidental damage. Which document captures these agreed boundaries and authorizes the testing activity?

   • A. Rules of Engagement (RoE)
   • B. The final penetration test report
   • C. A vulnerability scan baseline
   • D. The Nmap output of the target range
   Show answer

   Correct: A. The Rules of Engagement document scope, timing, permitted techniques, emergency contacts, and authorization (the get-out-of-jail letter). The report comes at the end; scan output and baselines are test artifacts, not authorization. Incorrect options are wrong because they either address different phases of testing, utilize invalid command parameters, or execute completely unrelated tasks.

2. A client signs a contract that limits testing strictly to a /24 range and forbids any social-engineering or denial-of-service activity. During testing the engineer discovers an out-of-scope host with an obvious critical flaw. What is the correct action?

   • A. Stop, document the finding, and contact the client point of contact before doing anything to the out-of-scope host
   • B. Exploit it immediately because it is a critical flaw the client would want fixed
   • C. Add it to the report as exploited and move on quietly
   • D. Run a DoS to prove it is exploitable
   Show answer

   Correct: A. Scope is contractual and legal. Acting on an out-of-scope system exceeds authorization; the tester must pause and seek written approval before touching it. DoS is explicitly forbidden here regardless. Incorrect options are wrong because they either address different phases of testing, utilize invalid command parameters, or execute completely unrelated tasks.

3. An assessor gathers employee names, email-address format, and technology hints purely from search engines, job postings, and public DNS records without sending any packet to the target's own infrastructure. What is this technique called?

   • A. Passive reconnaissance (open-source intelligence / OSINT)
   • B. Active scanning with Nmap
   • C. Vulnerability validation
   • D. Privilege escalation
   Show answer

   Correct: A. Passive recon / OSINT collects information from third-party and public sources without interacting with the target's systems, so it leaves no trace on the target. Nmap scanning is active recon that touches the target directly. Incorrect options are wrong because they either address different phases of testing, utilize invalid command parameters, or execute completely unrelated tasks.

4. During reconnaissance an analyst wants to enumerate all DNS records for a domain, including attempting a full zone transfer to dump every host name a misconfigured name server will hand out. Which command attempts the zone transfer?

   • A. dig axfr @ns1.target.com target.com
   • B. dig +short A target.com
   • C. nslookup -type=mx target.com
   • D. host -t soa target.com
   Show answer

   Correct: A. AXFR is the zone-transfer query type; querying the name server directly with dig axfr dumps the full zone if transfers are not restricted. The other queries return single record types (A, MX, SOA), not the whole zone.

5. A tester uses a search engine with advanced operators to find a target's exposed configuration files and login portals, for example searching site:target.com filetype:env. What is the common name for this OSINT technique?

   • A. Google dorking (search-engine hacking)
   • B. DNS cache poisoning
   • C. ARP spoofing
   • D. Banner grabbing
   Show answer

   Correct: A. Google dorking uses advanced search operators (site:, filetype:, intitle:, inurl:) to surface sensitive files and pages indexed by search engines. It is passive recon that never touches the target directly. Incorrect options are wrong because they either address different phases of testing, utilize invalid command parameters, or execute completely unrelated tasks.

Last updated: 2026-10-19

GPEN practice test FAQ

Related practice tests

• GIAC GCFA practice test
• GIAC GCIA practice test
• GIAC GCIH practice test