CPENT Practice Test 10 — 10 Questions

Question 1

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insecure Scheduled Task Permissions / Writable Task Executable. If a scheduled task runs as SYSTEM or an admin, and the underlying script or binary is writable by low-privileged users, it represents an insecure file permissions vulnerability leading to privilege escalation when the task triggers.

Answer

Unquoted service path exploitation involving spaces in service binary names.

Answer

DLL Hijacking via PATH environment variable manipulation.

Answer

Kerberoasting against domain service principal names.

Question 2

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Accepted Answer

scp. scp, sftp, and curl (using HTTPS) or rsync over ssh provide encrypted file transfers. Standard nc and ftp are unencrypted.

Answer

nc (Netcat)

Answer

ftp

Question 3

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Accepted Answer

-Pn. The -Pn option disables host discovery, forcing Nmap to proceed with port scanning every specified IP address as if it were online.

Answer

-R

Answer

-p-

Answer

-n

Question 4

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Accepted Answer

Ptunnel. Ptunnel (Ping Tunnel) is a specialized application that allows tunneling TCP connections reliably through ICMP echo request and reply packets.

Answer

Socat

Answer

Netcat

Answer

Iodine

Question 5

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Accepted Answer

-f. The -f option causes Nmap to split the IP packets into tiny fragments. Specifying it twice (-ff) sends 16-byte fragments instead of 8-byte fragments.

Answer

--mtu

Answer

--data-length

Answer

-D

Question 6

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Accepted Answer

Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.. DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.

Answer

Kerberoasting against computer accounts.

Answer

Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.

Answer

Running Responder on the local subnet to capture NTLMv2 hashes.

Question 7

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Accepted Answer

ARP ping discovery (-PR). ICMP Echo requests (-PE) and ARP ping scans (-PR) use ICMP and ARP protocols respectively to find live hosts without touching TCP ports.

Answer

TCP Connect scan (-sT)

Answer

TCP SYN port scan (-sS)

Answer

UDP port scan (-sU)

Question 8

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

Accepted Answer

Packet fragmentation (-f flag). Decoys (-D), source IP spoofing (-S), and packet fragmentation (-f) are classic Nmap evasion techniques.

Answer

Aggressive timing template (-T5)

Answer

OS fingerprinting (-O flag)

Question 9

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

Accepted Answer

smtp-user-enum. SMTP-User-Enum is a classic tool used for enumerating OS user accounts via the SMTP service (VRFY, EXPN, RCPT TO commands).

Answer

Enum4linux

Answer

Wpscan

Answer

Nikto

Question 10

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command. By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Answer

Append a new user account to the /etc/passwd file by leveraging a kernel exploit

Answer

Modify the /etc/sudoers file directly using a buffer overflow vulnerability

Answer

Inject shellcode into the target binary's memory space using GDB while running under sudo