CPENT Practice Test 10 — 10 Questions

Question 1

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hostapd-mana. EAPHammer or Hostapd-mana are specialized tools used to execute rogue access point attacks and evil twin attacks against WPA2/WPA3 Enterprise networks to capture credentials.

Answer

Aircrack-ng

Answer

Reaver

Answer

Kismet

Question 2

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Accepted Answer

Snmpwalk. Snmpwalk is a command-line tool from the Net-SNMP suite that queries SNMP-enabled devices using GETNEXT requests to retrieve a subtree of management information. It can walk the MIB tree to extract data such as user accounts (via OIDs like 1.3.6.1.4.1.77.1.2.25 for Windows), routing tables (1.3.6.1.2.1.4.21), and running processes (1.3.6.1.2.1.25.4.2.1.2). With a default community string like 'public', an attacker can enumerate this information without authentication.

Answer

Rpcinfo

Answer

Smbclient

Answer

NFSstat

Question 3

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

Accepted Answer

Use the token in HTTP Authorization Bearer headers to query the Kubernetes API server and inspect or manipulate cluster resources based on the service account's RBAC privileges.. A Kubernetes service account token is a JWT that authenticates to the Kubernetes API server when presented as a Bearer token in the HTTP Authorization header. The API server validates the token's signature and expiry, then maps it to the service account's identity and enforces RBAC policies. With a high-privilege service account, the tester can list, create, or delete resources (e.g., secrets, pods) permitted by that account's RoleBindings or ClusterRoleBindings. This is the standard method for exploiting a compromised service account token in a cluster.

Answer

Convert the token into an Azure AD refresh token using Microsoft Graph API.

Answer

Submit the token to the AWS IAM STS assume-role API to gain root access to the underlying AWS cloud account.

Answer

Inject the token into the Linux kernel keyring to escalate the container to host root privileges.

Question 4

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

Accepted Answer

SharpHound.exe -CollectionMethod LocalAdmin. SharpHound's LocalAdmin collection method enumerates local administrator rights on computers by querying each machine (via SAM-R, remote registry, or NetSessionEnum depending on privileges) and records which principals have admin access. This data feeds BloodHound's 'AdminTo' edges, which are essential for finding privilege-escalation paths from a low-privileged user to Domain Admin — and it can be collected with only the rights of the invoking user, not Domain Admin.

Answer

SharpHound.exe -CollectionMethod GPOChanges

Answer

SharpHound.exe -CollectionMethod TrustList

Answer

SharpHound.exe -CollectionMethod DCOptions

Question 5

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

Accepted Answer

certipy req -u user@corp.local -p password -target ca.corp.local -template VulnerableTemplate -upn administrator@corp.local. The Certipy tool's 'req' command is used to request a certificate from a Certificate Authority (CA). By specifying the vulnerable template and the '-upn' flag with a high-privileged user's UPN (e.g., administrator@corp.local), the pentester can request a certificate that allows authentication as that privileged user. This exploits the ESC1 misconfiguration where the template allows the enrollee to supply the subject and permits client authentication. The other options do not perform this specific action.

Answer

certipy shadow -username user -target dc01

Answer

certipy ca -backup -ca "corp-CA-1"

Answer

certipy template -update VulnerableTemplate -enrollee-supplies-subject True

Question 6

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

Accepted Answer

Nbtscan. Nbtscan sends NetBIOS Name Service (NBNS) status queries (UDP port 137) to a range of IP addresses and parses the responses to reveal registered NetBIOS names, workgroup/domain names, and often the logged-in username via the Messenger service. It is purpose-built for exactly this enumeration task on legacy Windows hosts. Running 'nbtscan 192.168.1.0/24' produces a table of IP, NetBIOS name, server, user, and MAC address.

Answer

Tcpdump

Answer

Hydra

Answer

Sqlmap

Question 7

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

Accepted Answer

The user can attach an inline policy to their own IAM user granting full administrative access (AdministratorAccess).. The IAM action iam:PutUserPolicy allows a principal to create or replace an inline policy on any IAM user (when Resource is '*'). Because the policy can be attached to the attacker's own user, they can inject a policy granting themselves AdministratorAccess or any other privileged permissions, achieving full privilege escalation. This is a classic self-escalation path documented by Rhino Security Labs and others.

Answer

The user can modify the AWS billing dashboard and delete all EC2 instances.

Answer

The user can decrypt all KMS keys in the AWS region.

Answer

The user can delete the AWS account root user credentials.

Question 8

During a CPENT engagement, a tester gains a low-privileged shell on a Windows Server 2019 host. The tester runs 'whoami /priv' and sees SeImpersonatePrivilege enabled. The host is running IIS with a service account that has this privilege. Which tool is most appropriate to escalate privileges by leveraging this token privilege?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows a process to impersonate a token, and PrintSpoofer leverages this by coercing the Print Spooler service to authenticate to a controlled named pipe, resulting in SYSTEM impersonation. Unlike older tools, it does not rely on port binding or remote redirects, making it highly effective on modern Windows Server 2019.

Answer

Juicy Potato

Answer

RoguePotato

Answer

Sweet Potato

Question 9

An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?

Accepted Answer

Capture the coerced Domain Admin's TGT from the machine's memory to impersonate them across the domain.. When Unconstrained Delegation is enabled on a computer, the machine caches the TGT of any user who authenticates to it in LSASS memory so it can reuse that TGT for downstream services. If a Domain Admin is coerced (e.g., via PrinterBug/SpoolSample or PetitPotam) into authenticating to that host, the attacker can extract the DA's TGT and inject it to impersonate the administrator domain-wide.

Answer

Extract the NTLM hash of the domain controller directly from the SYSVOL share.

Answer

Forge a Kerberos ticket using the machine account's local SAM database.

Answer

Modify group policy objects via unauthenticated LDAP queries.

Question 10

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Accepted Answer

Copying an executable to the ADMIN$ share and creating a remote Windows service via the Service Control Manager (SCM).. PsExec connects to the remote ADMIN$ share, uploads a service executable (such as Psexecsvc.exe), and then creates and starts a Windows service using the Service Control Manager (SCM) via RPC.

Answer

Initiating an RDP cliprdr channel file transfer.

Answer

Writing a payload to the target's startup folder via FTP.

Answer

Injecting shellcode into the lsass.exe process over WinRM.