EC-Council · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?
-A
-O
Nmap's -O flag enables OS fingerprinting by comparing the target's TCP/IP stack responses, such as initial window size and TTL, against its signature database. This directly satisfies the requirement to identify the operating system from stack behaviour.
-sV
--traceroute
A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?
-PS80
-PA80
TCP ACK pings (-PA80) bypass the ICMP-blocking perimeter firewall because they are sent as bare TCP ACK segments, which many stateless firewalls pass and which elicit RST replies from live hosts. This satisfies the stem's constraint of discovering hosts when ICMP echo requests are filtered.
-PE
-PU80
An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?
-sN
-sF
-sX
The -sX flag sets FIN, PSH and URG simultaneously, producing the Xmas tree scan. Because these flags are meaningless on a normal open port, compliant stacks drop the packet, letting Nmap infer state while evading payload-flag inspection.
-sW
A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?
-sA
-sU
-sT
-sS
The -sS flag performs a half-open TCP SYN scan, sending SYN packets and never completing the three-way handshake. This satisfies the stealth requirement because no full connection is established, so stateless packet filters see only unsolicited SYNs rather than completed sessions, reducing logging and detection compared with a full connect scan.
During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?
Cain & Abel
Ettercap
Responder
Responder poisons LLMNR, NBT-NS and mDNS queries, answering the broadcast so the victim authenticates to the attacker and surrenders its NTLMv2 hash. This directly satisfies the stem's requirement to spoof the response and capture credentials.
Wireshark
An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?
Socat
Metasploit Meterpreter reverse_tcp
Netcat
Dnscat2
Dnscat2 encapsulates arbitrary TCP traffic within DNS query and response records, so it traverses the egress filter that permits only port 53. It provides an encrypted command-and-control channel over the DNS protocol, satisfying the constraint of tunnelling TCP through DNS.
Want more Network And Perimeter Exploitation practice?
Practice this domainA pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?
KRB_TICKET_PATH
KERBEROS_CACHE
KRB5CCNAME
KRB5CCNAME tells Kerberos client libraries which credential cache file to use. Exporting it to point at the stolen .ccache lets Impacket tools such as psexec.py authenticate with the TGT for lateral movement, satisfying the stem's requirement.
AD_TICKET_FILE
An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?
getTGT.py
goldenPac.py
ticketer.py
ticketer.py forges Kerberos tickets offline from a supplied key or hash, including Golden Tickets built from the KRBTGT hash, then writes the ticket to a ccache file for injection. It requires no live domain controller interaction.
raiseChild.py
When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?
SharpHound.exe -CollectionMethod LocalAdmin
The LocalAdmin collection method queries each computer's local Administrators group via SAM-R, harvesting local admin mappings without needing Domain Admin rights. This directly satisfies the stem's constraint of gathering local admin rights non-privileged, since SAM-R reads rely on standard remote access rather than elevated directory permissions.
SharpHound.exe -CollectionMethod GPOChanges
SharpHound.exe -CollectionMethod TrustList
SharpHound.exe -CollectionMethod DCOptions
During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?
The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.
The template publishes certificates to Active Directory user objects automatically.
The template has Manager Approval enabled and requires enterprise admin signatures.
The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.
ESC1 requires a template flag permitting the requester to specify subjectAltName plus enrolment rights for low-privileged users, combined with a client authentication EKU. That combination lets any enrolled user request a certificate impersonating a domain administrator.
During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?
Pass-the-Ticket
Kerberoasting
Over-Pass-the-Hash
Pass-the-Hash
Pass-the-Hash exploits NTLM's design, where the password hash itself authenticates without needing the plaintext. CrackMapExec submits the captured NTLM hash directly to SMB or other services, granting access to remote workstations, which matches the described post-exploitation behaviour.
An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?
Modify the user's PrimaryGroupID to map to Domain Admins directly.
Execute a DCSync attack against the computer object's registry hive.
Directly modify the local SAM database of the target computer over RPC without credentials.
Configure msDS-AllowedToActOnBehalfOfOtherIdentity to point to a controlled account, enabling Resource-Based Constrained Delegation.
Writing msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer object grants a controlled account resource-based constrained delegation, letting it impersonate any user to that host's service. Combined with GenericAll's write access, the operator obtains a service ticket as a privileged user, then executes code via SMB or WinRM on the target.
Want more Active Directory Attacks practice?
Practice this domainAn IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?
tftp 0x80000000 kernel.bin
printenv mtdparts
setenv bootargs ${bootargs} init=/bin/sh
U-Boot's `setenv bootargs` rewrites the kernel command line passed at boot, and appending `init=/bin/sh` replaces the default init process with a shell running as root. This directly satisfies the stem's requirement to override kernel boot arguments via the serial console and spawn a root shell.
run flash_os_image
A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?
s7-info
The `s7-info` NSE script queries Siemens S7 PLCs over the S7comm protocol on TCP port 102, extracting module identification, rack and slot configuration, firmware version, and hardware order numbers. This directly satisfies the stem's requirement for detailed device information via the S7 communication protocol against the S7-1200.
modbus-discover
bacnet-info
enip-info
An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?
TCP 102
TCP 20000
TCP 502
Modbus/TCP reserves TCP 502 as its registered port, and PLCs answer function-code requests there by default. Scanning 502 with tools such as Nmap's modbus-display script enumerates slave IDs and device identity, satisfying the native-protocol discovery requirement.
UDP 44818
During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?
UART (Universal Asynchronous Receiver-Transmitter)
UART transmits asynchronously over two data lines: one for transmit, one for receive, with no shared clock. Ground and 3.3V on the outer pins supply reference and power, while the fluctuating middle pins carry serial data during boot, matching UART's idle-high signalling.
JTAG (Joint Test Action Group)
I2C (Inter-Integrated Circuit)
SPI (Serial Peripheral Interface)
A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?
strings -k squashfs-root/
grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/
Recursive grep scans every file under squashfs-root, matching the literal PEM header that precedes hardcoded private RSA keys in firmware. The -r flag satisfies the requirement to search the entire extracted directory tree, while -n reports line numbers for locating each key within its file.
firmadyne -s squashfs-root/
binwalk -A squashfs-root/
A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?
ettercap
bacpypes (using scripts like whois.py / iam.py)
bacpypes is a Python BACnet stack whose whois.py and iam.py scripts broadcast Who-Is and parse I-Am replies, enumerating devices and object properties on the subnet. This directly satisfies the requirement for a BACnet-specific discovery tool.
sqlmap
msfvenom
Want more Iot And OT Exploitation practice?
Practice this domainAn auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?
AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.
Access is granted because any Allow permission supersedes bucket restrictions.
The explicit Deny in the bucket policy takes precedence, resulting in access being denied.
AWS evaluates all applicable policies together, and any explicit Deny overrides every Allow, whether from an ACL, bucket policy or identity policy. The public-read ACL grant is therefore negated by the bucket policy's explicit Deny, so anonymous requests receive Access Denied.
The public ACL takes precedence because ACLs are evaluated before bucket policies.
A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?
Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.
Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.
CAP_SYS_ADMIN plus a read-write cgroup v1 mount lets the tester write to the release_agent file, which the host kernel executes outside the container's namespace. This directly satisfies the escape precondition the stem describes, yielding host-level command execution.
Using the ptrace system call to inject code into the host's systemd daemon process.
Issuing a mount command to repartition the host's primary storage block device.
A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?
Modify the IAM role trust policy to include a Condition block restricting the principal or requiring multi-factor authentication.
The trust policy's Principal element is what permits any account user to call sts:AssumeRole. Adding a Condition block — restricting the principal or demanding MFA via aws:MultiFactorAuthPresent — closes that gap while preserving legitimate role assumption, directly addressing the overly permissive trust relationship.
Rotate the AWS account root user access keys immediately.
Attach an explicit Deny policy to the EC2 instance metadata service version 2 configuration.
Disable the AWS Security Token Service endpoint globally across the AWS organization.
In a hybrid enterprise environment, an organization uses Microsoft Entra ID Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?
It requires all users to store their plaintext Active Directory passwords in Azure Key Vault.
It bypasses all Conditional Access policies for users connecting from corporate networks.
It forces the domain controllers to export NTLMv1 hashes to the Azure cloud directory.
It uses a computer account (AZUREADSSOACC$) in on-premises AD to generate Kerberos tickets for users authenticating to cloud services via browser redirection.
Seamless SSO creates the AZUREADSSOACC$ computer account in on-premises AD, whose Kerberos decryption key Microsoft Entra ID shares. Domain-joined users obtain a Kerberos service ticket for that account, which the browser presents for cloud authentication. Compromising the account's key enables forging tickets for any user, satisfying the hybrid SSO constraint.
An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?
Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.
Shared Access Signatures (SAS) tokens expire immediately upon generation.
Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.
With Secure transfer required disabled, the storage account accepts requests over plain HTTP, so credentials, tokens and object data travel unencrypted. An attacker positioned on the network path can capture that traffic, satisfying the question's focus on interception of data in transit.
Blob storage data at rest is stored without AES-256 encryption.
During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?
Google Cloud automatically rotates the service account private key every 60 seconds.
The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.
The cloud-platform scope grants OAuth access tokens covering every GCP API, so the default service account can call any service; IAM bindings are the only remaining restriction, meaning over-privileged tokens widen the blast radius if the instance is compromised.
The instance is automatically accessible via SSH from any external IP address without firewall rules.
The instance metadata server disables access tokens to prevent Server-Side Request Forgery.
Want more Cloud And Hybrid Infrastructure Security practice?
Practice this domainA penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?
It allows remote attackers to execute system calls over ICMP tunneling.
Any local user can execute commands as root by passing malicious arguments to the SUID binary.
The system is immune to local privilege escalation because SUID is disabled by SELinux.
It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.
The SUID bit makes /bin/ping run as root regardless of the invoking user, so any flaw permitting command execution or shell escape yields a root shell. This satisfies the scenario's implication: privilege escalation risk from owner-privilege execution.
A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?
Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.
With no_root_squash, the client's root UID is preserved on the share, so mounting as root and copying bash lets the tester chmod +s it, creating a root-owned SUID binary. This satisfies the requirement to write a SUID shell to the NFS export.
Modify the /etc/exports file on the remote target directly via standard FTP.
Mount the NFS share using standard user privileges and create a standard user shell script.
Log into the NFS server directly via SSH using the exported share credentials.
A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?
Run a batch script that directly modifies the SAM database registry hive.
Execute a local exploit targeting the Print Spooler service via named pipes.
Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.
AlwaysInstallElevated set in both HKCU and HKLM lets any user install MSI packages with SYSTEM privileges. A crafted MSI executed via msiexec with /quiet /qn runs its payload as SYSTEM, escalating from the current user to full administrative control.
Extract plaintext credentials from the lsass.exe process memory.
An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?
The NTLM hash (or AES keys) of the krbtgt service account.
Forging a Golden Ticket requires encrypting the forged TGT with the krbtgt account's key, so possessing its NTLM hash or AES keys lets the attacker mint valid tickets offline, granting domain-wide persistence without further authentication.
The krbtgt account's public SSH key stored in Active Directory.
The global catalog server IP address and LDAP bind credentials.
The Domain Administrator's plaintext password.
During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?
Mimikatz credential dumper via direct LSASS memory injection.
Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.
Potato exploits abuse SeImpersonatePrivilege by coercing a privileged account into authenticating over a named pipe or COM server, then capturing that token via ImpersonateNamedPipeClient. PrintSpoofer and RoguePotato target the specific Windows token-impersonation mechanism this privilege grants, satisfying the stem's enabled SeImpersonatePrivilege constraint directly.
PowerView domain enumeration modules.
Windows Subsystem for Linux (WSL) container breakouts.
A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?
Unquoted service path exploitation involving spaces in service binary names.
DLL Hijacking via PATH environment variable manipulation.
Insecure Scheduled Task Permissions / Writable Task Executable
A privileged scheduled task running a script writable by standard users lets any low-privileged account replace the script's contents, which then execute as administrator at the next trigger. The weakness is the writable executable referenced by the task, not the task's own configuration.
Kerberoasting against domain service principal names.
Want more Privilege Escalation Lateral Movement And Post Exploitation practice?
Practice this domainThe vendor does not publish an exact question count for the CPENT. The passing score is 60–85% (cut score varies by exam form); 90%+ also earns LPT (Master). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Network And Perimeter Exploitation, Active Directory Attacks, Iot And OT Exploitation, Cloud And Hybrid Infrastructure Security, Privilege Escalation Lateral Movement And Post Exploitation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official EC-Council CPENT exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.