CPENT Practice Test 12 — 15 Questions

Question 1

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

iec104. IEC 60870-5-104 operates over TCP port 2404. Wireshark decodes this under the 'iec104' protocol filter.

Answer

s7comm

Answer

mms

Answer

bacnet

Question 2

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

Accepted Answer

Gobuster. Gobuster is a Go-based command-line tool purpose-built for brute-forcing URIs (directories and files), DNS subdomains, and virtual hosts on web servers. It uses wordlists to enumerate hidden paths such as /admin, /backup, and configuration files, making it the correct choice for discovering hidden administrative directories on the PLC's web interface.

Answer

Wifite

Answer

Nbtscan

Answer

Hping3

Question 3

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN (half-open) scan: it sends a SYN, waits for SYN/ACK (open) or RST (closed), then sends RST instead of completing the three-way handshake. This is faster and stealthier than a full connect scan because no session is ever established, so application-layer logs on the target typically never record the probe. It requires raw-socket privileges (root/SYSTEM or CAP_NET_RAW).

Answer

-sT

Answer

-sP

Answer

-sU

Question 4

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Accepted Answer

A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.. DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Answer

Standard FTP client configured to use port 53 as the control channel.

Answer

Wget command pointing to an external HTTP server listening on port 53.

Answer

Netcat in listening mode on TCP port 53.

Question 5

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Accepted Answer

Hping3. Hping3 is a command-line packet crafter that allows fine-grained control over TCP/IP header fields, including the IPv4 LSRR (Loose Source and Record Route) and SSRR (Strict Source and Record Route) options. It can send custom packets with source routing enabled to test whether routers honor or drop these options, making it the correct tool for this assessment.

Answer

Wget

Answer

Netcat

Answer

Nmap

Question 6

An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)

Accepted Answer

Populating a PostgreSQL database with image metadata and utilizing Firmadyne helper scripts to extract the file system. Option B is correct because Firmadyne relies on a PostgreSQL database (typically the 'firmadyne' database) to store image metadata such as the image ID, hash, and architecture, and its helper scripts like extractor.py and getArch.py depend on this data to extract the firmware filesystem and determine the correct architecture. Option E is correct because Firmadyne emulates the firmware's kernel and filesystem using QEMU in system mode (e.g., qemu-system-mips, qemu-system-arm) with a custom patched initrd (often built via the console/inferKernel scripts) that boots the extracted filesystem and sets up networking for analysis. Option A is not relevant because Hydra SSH brute-forcing is a credential attack, not a step in emulating firmware. Option C is not relevant because SQL injection against a web server is an exploitation technique, not part of the emulation setup. Option D is not relevant because sniffing 802.11 beacons requires monitor-mode Wi-Fi hardware and pertains to wireless traffic capture, not Firmadyne's QEMU-based emulation workflow.

Answer

Brute-forcing SSH passwords using Hydra against the host machine

Answer

Executing an SQL injection payload against the web server running on port 80

Answer

Sniffing 802.11 wireless beacons with an external USB Wi-Fi adapter in monitor mode

Question 7

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Accepted Answer

wmic useraccount get name. Option A, `wmic useraccount get name`, is correct because the WMIC `useraccount` alias queries the Win32_UserAccount WMI class and returns the names of all local user accounts, which is exactly what the tester needs for enumeration. Option C, `net user`, is correct because running it without arguments lists every local user account on the system, a classic built-in method for identifying accounts including privileged ones. Option B, `ipconfig /all`, only displays network adapter configuration such as IP addresses, MAC addresses, and DNS servers, so it does not enumerate users. Option D, `tasklist /v`, lists running processes with verbose details and has nothing to do with local account enumeration. Option E, `systeminfo`, shows OS version, hotfixes, and hardware information but does not list local users or groups.

Answer

ipconfig /all

Answer

tasklist /v

Answer

systeminfo

Question 8

During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?

Accepted Answer

UART (Universal Asynchronous Receiver-Transmitter). UART (Universal Asynchronous Receiver-Transmitter) interfaces typically consist of 4 pins: VCC, GND, TX, and RX, where TX and RX show fluctuating voltage activity during transmission upon boot.

Answer

JTAG (Joint Test Action Group)

Answer

I2C (Inter-Integrated Circuit)

Answer

SPI (Serial Peripheral Interface)

Question 9

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

Accepted Answer

Packet fragmentation (-f flag). Packet fragmentation (-f flag) is correct because it splits probe packets into smaller IP fragments, making it harder for IDS signature engines to reassemble and match the scan payload. Source IP spoofing (-S flag) is correct because it lets Nmap forge the source address of scan packets, hiding the true origin of the scan from the target and its IDS. Decoy scanning (-D flag) is correct because it injects spoofed decoy source addresses alongside the real scan, obscuring which packets originate from the actual tester. The aggressive timing template (-T5) only speeds up scanning and actually increases detectability, while OS fingerprinting (-O flag) is a detection/identification feature that does not obscure origin or payload.

Answer

Aggressive timing template (-T5)

Answer

OS fingerprinting (-O flag)

Question 10

An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?

Accepted Answer

ticketer.py. ticketer.py from Impacket forges Kerberos tickets offline, including Golden Tickets (using the KRBTGT hash) and Silver Tickets (using a service account hash). It accepts the domain SID, krbtgt NTLM hash, and target username to produce a valid .ccache that can be injected via KRB5CCNAME. This is the standard tool for offline Golden Ticket creation.

Answer

getTGT.py

Answer

goldenPac.py

Answer

raiseChild.py

Question 11

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

Accepted Answer

Remote Procedure Calls (RPC) over SMB. enum4linux is a wrapper around tools like rpcclient, net, and nmblookup that primarily uses MS-RPC over SMB (typically via the IPC$ share and the SAMR/LSARPC interfaces) to enumerate users, groups, shares, and password policies. This RPC-over-SMB approach queries domain information without brute-forcing credentials, avoiding account lockouts. It targets ports 139/445 and leverages null or authenticated SMB sessions.

Answer

Lightweight Directory Access Protocol (LDAP) over port 389

Answer

NetBIOS Name Service (NBNS) over UDP port 137

Answer

Simple Network Management Protocol (SNMP)

Question 12

An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)

Accepted Answer

Reviewing sudo privileges using 'sudo -l'. Finding privilege escalation vectors involves searching for SUID/SGID binaries, inspecting sudo permissions, and checking cron jobs.

Answer

Analyzing Modbus holding registers for unauthorized register modifications

Answer

Checking Bluetooth GATT profile characteristics using nRF Connect

Question 13

Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?

Accepted Answer

Adding a startup script or service configuration within the GPO file share path in SYSVOL. With GenericAll over a GPO, an attacker can edit the GPO's contents and have them applied to all linked OUs, computers, or users. Option A is correct because writing a startup script or service configuration into the GPO's SYSVOL path (\\SYSVOL\\Policies\{GUID}\Machine\Scripts\Startup or the GptTmpl.inf service section) causes the script/service to execute as SYSTEM on every affected machine at boot. Option B is correct because GPO security settings (e.g., Restricted Groups or Group Policy Preferences local users/groups) can add a controlled account to the local Administrators group or create local users across all machines in the linked OU, yielding broad local admin and lateral movement. Option D is correct because Group Policy Preferences support Immediate Scheduled Tasks (ScheduledTasks.xml in SYSVOL), which execute on the next policy refresh as SYSTEM, giving code execution on target hosts. Option C is wrong because the KRBTGT password is stored in AD (NTDS.dit) and cannot be changed through GPO settings; GPOs do not manage domain account credentials. Option E is wrong because NTDS.dit is not writable via unauthenticated LDAP, and LDAP writes require authenticated, authorized access to AD objects, not merely GPO GenericAll.

Answer

Modifying the KRBTGT account password directly through Group Policy settings

Answer

Directly modifying the NTDS.dit database via unauthenticated LDAP write operations

Question 14

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

Accepted Answer

Use PrintSpoofer to trigger a pipe connection from the spooler service.. PrintSpoofer exploits the SeImpersonatePrivilege by coercing the Print Spooler service to connect to a named pipe controlled by the attacker, then impersonating the resulting SYSTEM token. This is a well-known privilege escalation technique on Windows when SeImpersonatePrivilege is available. It directly achieves NT AUTHORITY\SYSTEM escalation.

Answer

Use GPP-decrypt to extract credentials from cached XML files.

Answer

Run Invoke-TokenManipulation to steal a process token.

Answer

Execute reg add to modify the ImagePath of a system service.

Question 15

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

Accepted Answer

Examine Azure AD Connect synchronization rules and connector filters for misconfigurations or export rules that might inadvertently expose directory objects or allow rule manipulation.. Microsoft Entra Connect synchronization rules and connector filters determine which on-premises objects and attributes flow to Microsoft Entra ID. Misconfigurations — such as overly broad scoping filters, custom sync rules, or export rules — can inadvertently expose high-privilege objects or allow an attacker to manipulate rules to sync a privileged account into the cloud, enabling privilege escalation in Microsoft Entra ID.

Answer

Use the Azure AD Connect database password stored in the local SQL Express instance to perform a DCShadow attack.

Answer

Force Azure AD Connect to disable multi-factor authentication for all cloud administrators.

Answer

Inject a malicious DLL into the Azure AD Connect health agent service to execute arbitrary code on the Azure cloud domain controller.