PEN-200 practice examsUpdate in progress
Offensive Security Certified Professional
The gold standard in penetration testing certifications. Validates hands-on ability to identify vulnerabilities, execute exploits, and perform privilege escalation in a controlled 24-hour practical exam environment using real-world techniques.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Information Gathering | N/A |
| Vulnerability Scanning | N/A |
| Web Application Attacks | N/A |
| Fixing Memory Corruption Exploits | N/A |
| Client-Side Attacks | N/A |
| Privilege Escalation | N/A |
| Port Redirection and Tunneling | N/A |
| Active Directory Attacks | N/A |
| Password Attacks | N/A |
| Metasploit Framework | N/A |
Two sample questions
1. What is a Domain Controller (DC) in Active Directory?
- A firewall that protects the domain
- A DNS server for the domain
- A file server that stores user documents
- A server that authenticates users, stores the AD database (NTDS.dit), handles Kerberos ticket requests, enforces Group Policy, and manages trust relationships — compromising the DC gives complete control over the entire domain — correct
Why: The Domain Controller is the central authority in Active Directory. It hosts the NTDS.dit database (containing all user accounts and password hashes), runs the KDC (Key Distribution Center) for Kerberos, processes LDAP queries, applies Group Policy Objects, and manages inter-domain trusts. Compromising a DC (via DCSync, ntds.dit extraction, or interactive access) gives complete domain control. Typical DC services: LDAP (389/636), Kerberos (88), DNS (53), SMB (445), RPC (135).
2. You have a Meterpreter session on a compromised Windows machine. You need to extract all stored credentials from the system. What Meterpreter commands and modules should you use?
- Use the screenshot command to capture the user's desktop and look for password managers or sticky notes containing credentials that may be visible on the screen during the session
- Run the shell command to drop to a Windows command prompt and manually navigate to the SAM file location at C:\Windows\System32\config\SAM to copy it for offline hash extraction
- Run the sysinfo command to identify the OS version, then use the hashdump command for SAM hashes and load kiwi (mimikatz) to run creds_all for extracting all credential types including Kerberos tickets, NTLM hashes, and plaintext passwords from LSASS memory — correct
- Execute the post/windows/gather/enum_chrome module exclusively, since most users store all their passwords in the Chrome browser password manager on corporate workstations
Why: A comprehensive credential extraction approach: hashdump extracts local SAM database hashes. Loading kiwi (Meterpreter's built-in mimikatz) and running creds_all extracts credentials from LSASS memory including NTLM hashes, Kerberos tickets, and sometimes plaintext passwords (on older systems or with WDigest enabled). Checking sysinfo first ensures you use the right techniques for the OS version. Screenshots may reveal credentials but it's unreliable. SAM file is locked while Windows runs. Chrome passwords are supplementary, not primary.
The real PEN-200 exam
| Length | 23 hours 45 minutes (exam) + 24 hours (report) |
|---|---|
| Questions | 3 standalone machines + 1 Active Directory set (3 machines) |
| Pass mark | 70 points out of 100 |
| Price | $1,749 USD (Learn One subscription with 90 days lab access) |
| Recommended before you sit it | None officially required; strong networking, Linux, and scripting knowledge recommended |
| Valid for | Does not expire |
Exam facts as published by OffSec; always check the vendor’s page before you book.
Study PEN-200 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.