EC-Council · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?
Execute the docker-runc exploit directly against the Docker daemon socket mounted inside the container.
Query the local Kubernetes API server using the projected service account token mounted in the pod to extract AWS STS credentials if an IAM role is annotated.
Projected service account tokens are used in EKS for IAM roles for service accounts (IRSA), allowing cloud access.
Modify the kube-dns deployment manifest to redirect cloud control plane traffic to a local proxy.
Leverage the Azure Instance Metadata Service endpoint to retrieve subscription-level access tokens.
While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?
Pass-through authentication agents become vulnerable to remote code execution via the Azure service bus.
Password hashes for all synchronized accounts are stored in Azure AD, meaning compromise of the cloud tenant could expose on-premises credentials.
PHS replicates password hashes to Azure AD.
Azure AD Connect agents will automatically downgrade encryption standards for domain controller communications.
Kerberos ticket granting service requests are bypassed entirely for hybrid users.
An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?
AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.
Access is granted because any Allow permission supersedes bucket restrictions.
The explicit Deny in the bucket policy takes precedence, resulting in access being denied.
Explicit Deny overrides any Allow permissions.
The public ACL takes precedence because ACLs are evaluated before bucket policies.
A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?
Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.
Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.
CAP_SYS_ADMIN and write access to cgroups allow release_agent exploitation.
Using the ptrace system call to inject code into the host's systemd daemon process.
Issuing a mount command to repartition the host's primary storage block device.
During an Azure assessment, an auditor finds that a Logic App has an HTTP trigger with no authentication mechanism configured (Anonymous access). The Logic App has permissions to read sensitive Azure Blob Storage containers. What type of vulnerability does this represent?
Insecure Direct Object Reference and unauthenticated workflow execution leading to data exfiltration.
Anonymous HTTP triggers allow unauthorized invocation and potential data disclosure.
An OAuth token replay attack against the Azure Resource Manager control plane.
A Server-Side Request Forgery vulnerability within the Azure App Service sandbox.
A privilege escalation path from Contributor to Owner role.
During an assessment of an Azure tenant, an attacker successfully exploits a user credential and enumerates enterprise applications. They identify a service principal with a high-privilege app role assignment (e.g., PrivilegedRoleAdministrator.ReadWrite.All). What is the primary attack path enabled by this misconfiguration?
The attacker can leverage the service principal credentials to assign high-privilege Azure AD roles to unauthorized user accounts.
Service principals with role management permissions can elevate privileges inside Azure AD.
The attacker can perform a Kerberoasting attack against the Azure Active Directory cloud database.
The attacker can extract the plaintext passwords of all cloud administrators from the Azure Key Vault logs.
The attacker can directly modify the underlying hypervisor configuration of Azure virtual machines.
Want more Cloud And Hybrid Infrastructure Security practice?
Practice this domainA penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?
It allows remote attackers to execute system calls over ICMP tunneling.
Any local user can execute commands as root by passing malicious arguments to the SUID binary.
The system is immune to local privilege escalation because SUID is disabled by SELinux.
It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.
SUID binaries execute with the privileges of the file owner, presenting a privilege escalation risk if vulnerable.
During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?
Running mimikatz with the 'privilege::debug' command escalated via a service account.
Patching the lsass.exe executable on disk to disable security checks.
Over-Pass-the-Hash, which generates a full Kerberos ticket using extracted user AES keys instead of NTLM hashes.
Over-Pass-the-Hash converts an NTLM hash or AES key into a full Kerberos TGT, which works even when Credential Guard blocks standard NTLM pass-the-hash.
Injecting shellcode directly into the winlogon.exe process memory space.
A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?
Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.
Using sudo to mount allows root mapping, and chmod +s creates a functional SUID binary.
Modify the /etc/exports file on the remote target directly via standard FTP.
Mount the NFS share using standard user privileges and create a standard user shell script.
Log into the NFS server directly via SSH using the exported share credentials.
An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?
~/.bashrc of the current low-privileged user.
/etc/init.d/rc.local execution hook.
/etc/cron.d/custom_persistence with the format '* * * * * root /bin/nc ...'
Files placed in /etc/cron.d require specifying the username (e.g., root) and execute on the specified schedule.
/var/www/html/backdoor.php
A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?
Run a batch script that directly modifies the SAM database registry hive.
Execute a local exploit targeting the Print Spooler service via named pipes.
Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.
The msiexec command will install the MSI with elevated privileges when AlwaysInstallElevated is enabled.
Extract plaintext credentials from the lsass.exe process memory.
An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?
The NTLM hash (or AES keys) of the krbtgt service account.
The krbtgt hash is the cryptographic secret used to sign all TGTs in the domain.
The krbtgt account's public SSH key stored in Active Directory.
The global catalog server IP address and LDAP bind credentials.
The Domain Administrator's plaintext password.
Want more Privilege Escalation Lateral Movement And Post Exploitation practice?
Practice this domainAn IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?
tftp 0x80000000 kernel.bin
printenv mtdparts
setenv bootargs ${bootargs} init=/bin/sh
Modifying the 'bootargs' environment variable in U-Boot to include 'init=/bin/sh' bypasses standard authentication and provides a direct root shell upon boot.
run flash_os_image
A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?
Executing an MQTT-specific TCP SYN flood against port 1883
Subscribing to the '$SYS/#' system topic hierarchy using wildcard expansion
Sending a CONNECT packet with an invalid keep-alive timer value of zero
Publishing retained messages with empty payloads to critical command topics
Retained messages are stored by the broker. Sending an empty payload as a retained message to a critical topic forces subscribers to instantly receive a null/cleared state, disrupting operational control.
A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?
s7-info
The 's7-info' NSE script connects to TCP port 102 and retrieves Siemens S7 controller identification details.
modbus-discover
bacnet-info
enip-info
An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?
TCP 102
TCP 20000
TCP 502
Port 502 is the official registered TCP port for Modbus communications.
UDP 44818
A penetration tester is analyzing an IoT mobile companion app that communicates with a smart thermostat via BLE (Bluetooth Low Energy). Which tool can the tester use on a rooted Android device to intercept and inspect BLE GATT characteristics and descriptors?
Hydra
Sqlmap
Aircrack-ng
nRF Connect for Mobile
nRF Connect allows testers to scan, read, write, and subscribe to BLE GATT characteristics and descriptors on Android and iOS.
During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?
UART (Universal Asynchronous Receiver-Transmitter)
UART interfaces commonly feature VCC, GND, TX, and RX pins, presenting active data signal fluctuations during device bootup.
JTAG (Joint Test Action Group)
I2C (Inter-Integrated Circuit)
SPI (Serial Peripheral Interface)
Want more Iot And OT Exploitation practice?
Practice this domainDuring an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?
kerberos
ldap
smb || smb2
This filter isolates both version 1 and version 2 Server Message Block traffic.
http.request or ftp.request
An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?
-A
-O
-O enables remote operating system detection via TCP/IP fingerprinting.
-sV
--traceroute
A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?
-PS80
-PA80
-PA uses a TCP ACK probe targeting the specified port.
-PE
-PU80
During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?
post/multi/manage/autoroute
This post-exploitation module adds a route to the Metasploit routing table to pivot through a session.
auxiliary/server/socks4a
auxiliary/scanner/portscan/tcp
exploit/unix/ssh/libssh_auth_bypass
An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?
-sN
-sF
-sX
-sX enables the Xmas tree scan setting FIN, PSH, and URG.
-sW
An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?
Enum4linux
Enum4linux is a specialized tool for enumerating information from Windows and Samba hosts, including users and shares.
Aircrack-ng
John the Ripper
Hydra
Want more Network And Perimeter Exploitation practice?
Practice this domainA pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?
KRB_TICKET_PATH
KERBEROS_CACHE
KRB5CCNAME
Setting KRB5CCNAME to the path of the .ccache file instructs Impacket to use the injected Kerberos ticket.
AD_TICKET_FILE
An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?
getTGT.py
goldenPac.py
ticketer.py
ticketer.py creates valid Golden or Silver Kerberos tickets given the KRBTGT or service NTLM hash.
raiseChild.py
When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?
SharpHound.exe -CollectionMethod LocalAdmin
The LocalAdmin collection method queries SAM/RPC/WMI on domain computers to find local group memberships.
SharpHound.exe -CollectionMethod GPOChanges
SharpHound.exe -CollectionMethod TrustList
SharpHound.exe -CollectionMethod DCOptions
A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?
AS-REP Roasting
AS-REP Roasting exploits accounts lacking pre-auth requirements to capture encryptable ticket material.
Silver Ticket Attack
DCShadow
Kerberoasting
During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?
The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.
The template publishes certificates to Active Directory user objects automatically.
The template has Manager Approval enabled and requires enterprise admin signatures.
The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.
This combination allows an attacker to request a certificate for any user (e.g., Domain Admin) and authenticate as them.
During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?
Pass-the-Ticket
Kerberoasting
Over-Pass-the-Hash
Pass-the-Hash
Pass-the-Hash utilizes the NTLM hash directly for SMB/WinRM authentication without plaintext conversion.
Want more Active Directory Attacks practice?
Practice this domainThe CPENT exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Cloud And Hybrid Infrastructure Security, Privilege Escalation Lateral Movement And Post Exploitation, Iot And OT Exploitation, Network And Perimeter Exploitation, Active Directory Attacks. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official EC-Council CPENT exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.