Reinforce CPENT concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For CPENT preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the CPENT question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your CPENT flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real CPENT exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass CPENT.
Sample cards from the CPENT flashcard bank. Read the question, think of the answer, then read the explanation below.
An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?
-O
Nmap's -O option enables OS detection by analyzing TCP/IP stack fingerprinting, such as initial TTL values, TCP window sizes, and responses to specific probes. This allows Nmap to guess the operating system of the target host. The other options serve different purposes: -A enables aggressive scanning (including OS detection, version detection, script scanning, and traceroute), -sV performs service version detection, and --traceroute maps the network path.
A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?
KRB5CCNAME
KRB5CCNAME is the standard MIT Kerberos environment variable that tells Kerberos-aware tools where to find the credential cache (ccache) file. Exporting it to point at the stolen .ccache lets Impacket tools like psexec.py, wmiexec.py, and smbclient.py authenticate using the ticket. This is the canonical pass-the-ticket workflow on Linux.
An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?
setenv bootargs ${bootargs} init=/bin/sh
U-Boot uses environment variables to define boot parameters. Appending 'init=/bin/sh' or 'init=/bin/bash' to the 'bootargs' variable forces the kernel to launch a shell instead of the standard init process.
An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?
The explicit Deny in the bucket policy takes precedence, resulting in access being denied.
AWS evaluates all applicable policies (identity-based, resource-based, ACLs, SCPs, permission boundaries) together, and any explicit Deny anywhere in the evaluation chain overrides every Allow. Because the bucket policy contains an explicit Deny for public read, that Deny wins over the ACL's public-read grant, and the request is denied. This is the fundamental 'explicit deny always wins' rule in AWS IAM policy evaluation logic.
A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?
It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.
The SUID bit causes /bin/ping to execute with the effective UID of its owner (root) rather than the invoking user, which is why unprivileged users can open raw ICMP sockets. If the binary contains a vulnerability — buffer overflow, command injection, or an unsafe system()/exec() call — or if it can be coerced into spawning a shell, the attacker inherits root privileges, making it a classic local privilege escalation vector.
A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?
grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/
The grep command with the -r (recursive) and -n (line number) flags searches through all files in the squashfs-root directory for the string 'BEGIN RSA PRIVATE KEY'. This pattern is the standard header for PEM-encoded RSA private keys, making it an effective way to locate hardcoded keys in extracted firmware. The command is simple, fast, and does not require additional tools.
A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?
Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.
With CAP_SYS_ADMIN and a read-write cgroup v1 mount, the attacker can write a path to the release_agent file and then trigger a cgroup release, causing the kernel to execute that path as root in the host's initial namespace. This is the canonical cgroup v1 container escape (CVE-2022-0492 is a related kernel-side variant). No other listed vector is available from inside a standard container without additional host misconfigurations.
An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?
SharpHound
SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.
During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?
By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.
An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.
When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?
AddMember
In BloodHound, the 'AddMember' edge indicates that a user or group has the ability to add members to a group. This is a direct privilege escalation path because adding a user to a high-privileged group (e.g., Domain Admins) grants that user the group's privileges. Therefore, the visual edge that indicates user 'A' can modify the membership of group 'B' is 'AddMember'.
A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?
Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command
By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.
A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?
UDP 5683
CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.
You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?
The target must have NTLM authentication enabled in the local security policy.
Pass-the-Hash (PtH) works by using the NTLM hash of a user's password to authenticate via NTLM, bypassing the need for the plaintext password. For this to succeed, the target system must accept NTLM authentication. If NTLM is disabled in the local security policy (e.g., via 'Network security: Restrict NTLM' settings), the attack fails because the hash cannot be used. Thus, the mandatory prerequisite is that NTLM authentication is enabled on the target.
An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?
The MQTT connection is not using TLS encryption.
MQTT does not encrypt traffic by default. Without TLS, the CONNECT packet, which contains username and password, is transmitted in cleartext. The observation of cleartext credentials directly points to the absence of TLS encryption on the MQTT connection. Other options describe scenarios that would either prevent connection or are specific subsets of the same root cause.
A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?
curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api
cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.
An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?
-sn
The -sn parameter tells Nmap to perform host discovery only (formerly known as a ping scan using -sP) and disables port scanning entirely.
An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?
Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker
DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.
A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?
A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.
The create verb on pods/exec in Kubernetes RBAC allows a user to invoke the exec subresource, which runs arbitrary commands inside a running container. This is effectively remote code execution within the pod's namespace, and if the pod has a mounted service account token or hostPath volume, the attacker can pivot to the node or cluster.
An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?
TheHarvester
TheHarvester is an OSINT reconnaissance tool that queries search engines (Google, Bing, Baidu), certificate transparency logs, PGP key servers, and public databases like Shodan and Hunter to enumerate emails, subdomains, hostnames, and employee names tied to a target domain. It is purpose-built for the passive reconnaissance phase of a penetration test.
A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?
Invoke-Command -ComputerName TargetHost -ScriptBlock { ... }
Invoke-Command allows running script blocks or scripts on local or remote computers using WinRM.
An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?
Set the 'Allow Blob public access' property to Disabled on the storage account.
Disabling public blob access on the storage account blocks anonymous requests globally.
An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?
-sX
Nmap's -sX flag performs the Xmas scan, which sets the FIN, PSH, and URG flags simultaneously in the TCP header. This unusual flag combination is designed to evade stateless firewalls and some IDS signatures that only look for SYN or common flag patterns. The name comes from the flags being 'lit up' like a Christmas tree in a packet analyzer.
During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?
.kirbi
Mimikatz uses the .kirbi file extension to save exported Kerberos tickets.
The CPENT flashcard bank covers all 5 official blueprint domains published by EC-Council. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Network And Perimeter Exploitation
Active Directory Attacks
Iot And OT Exploitation
Cloud And Hybrid Infrastructure Security
Privilege Escalation Lateral Movement And Post Exploitation
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that CPENT questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.CPENT questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective CPENT study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free CPENT flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 254+ original CPENT flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official EC-Council exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official CPENT exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included