1 | Page
SANS 560 GPEN STUDY SET 2026/2027 | QUESTIONS
WITH CORRECT ANSWERS | LATEST UPDATE
2026/2027 (GRADED A+)
Which of the following correctly defines the Nmap Scripting Engine "intrusive"
category?
Detects network-accessible backdoors
Looks for a vulnerability
Detects the version of a target's services
May leave logs, guess passwords, or otherwise impact the target -
correctanswerMay leave logs, guess passwords, or otherwise impact the target
While performing TCP SYN scanning to identify targets, a pen tester receives an
ICMP port unreachable response to a TCP SYN scan of a particular port. What does
this likely indicate?
The port is only accessible via UDP.
,2 | Page
The port is blocked by a firewall.
The port is accessible via ACK scanning.
The port is allowed by the firewall. - correct-answer-The port is only accessible via
UDP.
As part of a penetration test, a user is sent a file with a .docm extension. Which of
the following attacks is most likely underway?
Exploitation of a known vulnerability in a web server software
Use of JavaScript-based files to deploy RATs
Use of Macro-enabled office files for phishing
Scanning of the environment from the target machine - correct-answer-Use of
Macro-enabled office files for phishing
,3 | Page
Thank you for Purchasing this exam
Study Guide. We provide high-quality
academic materials to help students
excel in exams. Our other Services
include but not limited to: academic
research, University & College
assignments writing, essay writing,
Online Classes, and research projects.
Our services are reliable, affordable,
and plagiarism-free. All the Best in your
Exam. For more information; Contact us
at: or
0R +254
741484450
Which of the following Linux files is world readable and can be viewed to see a list
of user accounts?
, 4 | Page
/root/bash.rc
/etc/shadow
/root/.ssh/known_hosts
/etc/passwd - correct-answer-/etc/passwd
Within the context of Metasploit, which of the following best describes the
purpose of stages and stagers?
Stagers and stages are interchangeable, but stagers tend to be more flexible.
Stages focus on flexible communications, including binding on a TCP port, making
reverse connections, and more; stagers implement shell, Meterpreter, or VNC
access.
Stagers perform functions such as port scans, fuzzing, and denial of service; stages
focus on remote shell access.
Stagers load a stage into a target's memory and provide communications with it;
stages provide functionality when running on the target system. -
SANS 560 GPEN STUDY SET 2026/2027 | QUESTIONS
WITH CORRECT ANSWERS | LATEST UPDATE
2026/2027 (GRADED A+)
Which of the following correctly defines the Nmap Scripting Engine "intrusive"
category?
Detects network-accessible backdoors
Looks for a vulnerability
Detects the version of a target's services
May leave logs, guess passwords, or otherwise impact the target -
correctanswerMay leave logs, guess passwords, or otherwise impact the target
While performing TCP SYN scanning to identify targets, a pen tester receives an
ICMP port unreachable response to a TCP SYN scan of a particular port. What does
this likely indicate?
The port is only accessible via UDP.
,2 | Page
The port is blocked by a firewall.
The port is accessible via ACK scanning.
The port is allowed by the firewall. - correct-answer-The port is only accessible via
UDP.
As part of a penetration test, a user is sent a file with a .docm extension. Which of
the following attacks is most likely underway?
Exploitation of a known vulnerability in a web server software
Use of JavaScript-based files to deploy RATs
Use of Macro-enabled office files for phishing
Scanning of the environment from the target machine - correct-answer-Use of
Macro-enabled office files for phishing
,3 | Page
Thank you for Purchasing this exam
Study Guide. We provide high-quality
academic materials to help students
excel in exams. Our other Services
include but not limited to: academic
research, University & College
assignments writing, essay writing,
Online Classes, and research projects.
Our services are reliable, affordable,
and plagiarism-free. All the Best in your
Exam. For more information; Contact us
at: or
0R +254
741484450
Which of the following Linux files is world readable and can be viewed to see a list
of user accounts?
, 4 | Page
/root/bash.rc
/etc/shadow
/root/.ssh/known_hosts
/etc/passwd - correct-answer-/etc/passwd
Within the context of Metasploit, which of the following best describes the
purpose of stages and stagers?
Stagers and stages are interchangeable, but stagers tend to be more flexible.
Stages focus on flexible communications, including binding on a TCP port, making
reverse connections, and more; stagers implement shell, Meterpreter, or VNC
access.
Stagers perform functions such as port scans, fuzzing, and denial of service; stages
focus on remote shell access.
Stagers load a stage into a target's memory and provide communications with it;
stages provide functionality when running on the target system. -
