Privilege Escalation & Lateral Movement Quiz

1. What is the primary goal of privilege escalation in a post-exploitation scenario?

Gain administrative or higher-level access on a compromised system

Install antivirus software

Create new user accounts

Delete system logs

2. What is a potential risk of storing credentials in environment variables or configuration files?

They become harder to access

They are easily discovered during post-exploitation

They are automatically encrypted

They expire more quickly

3. What is token impersonation in the context of Windows privilege escalation?

Creating fake authentication tokens

Using an existing user's token to execute commands with their privileges

Stealing login credentials from memory

Bypassing NTLM authentication

4. What does UAC (User Account Control) prevent by default on Windows systems?

Remote desktop connections

Non-administrator applications from making system-level changes

Network file sharing

Software installation

5. In lateral movement, what is the primary purpose of credential harvesting?

To identify weak passwords

To obtain valid credentials for accessing other systems on the network

To trigger security alerts

To document user behavior

6. Which Windows credential storage mechanism can be exploited to retrieve plaintext passwords?

LSASS (Local Security Authority Subsystem)

SAM database

Credential Manager

All of the above

7. What is Pass-the-Hash (PtH) in Windows post-exploitation?

Using a captured NTLM hash to authenticate without knowing the plaintext password

Creating a hash of a stolen password

Modifying hash values in memory

Exporting hashes to a file

8. What is the purpose of using Mimikatz in post-exploitation scenarios?

To scan network vulnerabilities

To extract credentials and authentication tickets from memory

To perform port scanning

To enumerate file systems

9. In the context of lateral movement, what is a Kerberos Golden Ticket?

A forged authentication ticket granting access to multiple systems

A legitimate domain admin ticket

A temporary guest access token

A certificate used for SSL/TLS connections

10. What is the purpose of establishing persistence during post-exploitation?

To maintain long-term access even after system reboots

To delete forensic evidence

To encrypt all system files

To disable all security software

11. What is the primary advantage of using SSH keys for lateral movement in Linux environments?

They are easier to crack than passwords

They allow password-less authentication to remote systems

They are stored in plaintext by default

They bypass firewall rules

12. In Windows Active Directory, what does a Silver Ticket allow an attacker to do?

Access any resource in the entire domain

Forge tickets for specific services without domain admin privileges

Bypass all authentication mechanisms

Modify the domain controller directly

13. Which post-exploitation technique involves creating a backdoor account with hidden privileges?

Privilege escalation

Credential dumping

Persistence mechanism

Lateral movement

14. In Linux, which command allows a user to execute commands with elevated privileges if properly configured?

Su

Sudo

Chmod

Chown

15. Which technique involves injecting malicious code into a running process to avoid detection?

DLL injection

Registry injection

Kernel injection

File injection

16. Which persistence technique involves modifying the Windows Registry to execute code at startup?

Scheduled tasks

Run/RunOnce keys

Startup folder modification

Service creation

17. Which tool is commonly used to enumerate Windows privileges and identify escalation paths?

BloodHound

WinPEAS

LinEnum

Nmap

18. In Linux systems, which file typically contains stored password hashes?

/etc/passwd

/etc/shadow

/root/.ssh/id_rsa

/var/log/auth.log

19. Which Windows privilege escalation technique exploits the fact that certain services run with SYSTEM privileges and allow DLL injection?

Token impersonation

DLL hijacking

UAC bypass

Registry modification

20. Which Linux privilege escalation vector involves misconfigured SUID binaries?

Kernel exploits

Sudo misconfigurations

Exploiting binaries with execute permissions set for all users

Weak file permissions on cron jobs

PenTest+ Privilege Escalation Techniques Overview Quiz