CPENT Practice Test 12 — 15 Questions

Question 1

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Accepted Answer

Using PowerShell to download and execute a script in memory.. LotL involves using pre-installed system tools (like PowerShell or WMI) to conduct malicious activities, minimizing the need for custom malware.

Answer

Installing a rootkit driver.

Answer

Deploying a custom C++ backdoor.

Answer

Using a known Metasploit payload.

Question 2

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. CrackMapExec (or NetExec) and nmap with the smb2-security-mode script are standard tools used to check SMB signing status across targets.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 3

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Accepted Answer

find / -type f -perm -4000 2>/dev/null. The command find / -perm -4000 2>/dev/null searches the entire filesystem for files with the SUID bit set (-4000) and redirects standard error to /dev/null to keep the output clean.

Answer

grep -r 'SUID' /etc/permissions.conf

Answer

getcap -r / 2>/dev/null

Answer

find / -name suid -exec ls -la {} \;

Question 4

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Accepted Answer

Chisel to establish a tunnel over HTTP.. Chisel is a fast TCP/UDP tunnel over HTTP that is ideal for bypassing firewalls by masquerading traffic as web requests.

Answer

ftp to a remote server.

Answer

scp using a custom port.

Answer

netcat with a simple pipe.

Question 5

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Accepted Answer

Compiling and loading a malicious Loadable Kernel Module (LKM) rootkit.. Loadable Kernel Modules (LKMs) allow attackers to run code in kernel space, hide processes, files, and network connections, and persist across reboots if loaded at boot time.

Answer

Modifying the SSH authorized_keys file for the root user.

Answer

Creating a systemd service unit file that executes a reverse shell.

Answer

Placing a persistent cron job in /etc/cron.d/

Question 6

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Accepted Answer

Adding a controlled user account to the Domain Admins or Enterprise Admins group.. SID History injection and adding members to privileged groups (like Administrators or Domain Admins) are common AD persistence methods.

Answer

Disabling Windows Defender real-time monitoring via PowerShell.

Answer

Configuring a local Windows scheduled task to run netsh.

Answer

Flushing the local ARP cache on the workstation.

Question 7

You are assessing a Linux privilege escalation path. Which THREE techniques would allow you to escalate to root if you have write access to the /etc/passwd or /etc/shadow file?

Accepted Answer

Creating a new user entry with UID 0. If you can write to these files, you can create a new user with UID 0, change the root password, or add a backdoor account.

Answer

Modifying /etc/hosts

Answer

Running a kernel exploit using gcc

Question 8

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

Accepted Answer

Invoke-Command -ComputerName TargetHost -ScriptBlock { ... }. Invoke-Command allows running script blocks or scripts on local or remote computers using WinRM.

Answer

Get-WmiObject -ComputerName TargetHost -Class Win32_Process

Answer

Start-Process -FilePath "powershell.exe" -Credential ...

Answer

Enter-PSSession -ComputerName TargetHost

Question 9

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. sudo -l, checking /etc/sudoers, and inspecting files within /etc/sudoers.d/ are essential checks for sudo misconfigurations.

Answer

arp -a

Answer

uname -r

Question 10

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

Accepted Answer

Create a __EventFilter monitoring Win32_OperatingSystem startup, a CommandLineEventConsumer executing the payload, and a __FilterToConsumerBinding object. WMI persistence involves creating an __EventFilter to trigger on system startup, an __EventConsumer (specifically CommandLineEventConsumer) to execute the payload, and a __FilterToConsumerBinding to link the two objects together.

Answer

Inject a DLL into winlogon.exe and configure a Group Policy Object to execute the payload upon user logon

Answer

Configure a new registry run key using reg add pointing to a VBScript payload in the Startup folder

Answer

Use PowerShell to create an EventFilter looking for Win32_NTLogEvent and a ScriptFileEventConsumer pointing to a scheduled task

Question 11

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Accepted Answer

A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.. DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Answer

Standard FTP client configured to use port 53 as the control channel.

Answer

Wget command pointing to an external HTTP server listening on port 53.

Answer

Netcat in listening mode on TCP port 53.

Question 12

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

Accepted Answer

It will alert the Security Operations Center (SOC) due to signature-based detection.. Windows Defender (and other EDRs) have specific signatures for Mimikatz and will trigger an alert or quarantine the file immediately upon execution.

Answer

It will cause the system to BSOD.

Answer

It will corrupt the LSASS process.

Answer

It requires a reboot to function.

Question 13

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

Accepted Answer

Mimikatz. Mimikatz is the standard tool used to parse LSASS dumps and extract authentication secrets.

Answer

Wireshark

Answer

Hashcat

Answer

Responder

Question 14

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

Accepted Answer

.kirbi. Mimikatz uses the .kirbi file extension to save exported Kerberos tickets.

Answer

.ntds

Answer

.sam

Answer

.pfx

Question 15

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Accepted Answer

tasklist /svc. Running 'whoami /priv' checks current privileges, 'systeminfo' identifies patches, and checking tasklist helps find running services.

Answer

dir /s /b config.php

Answer

netsh wlan show profiles