CPENT Practice Test 13 — 15 Questions

Question 1

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ptunnel. Ptunnel (Ping Tunnel) is a specialized application that allows tunneling TCP connections reliably through ICMP echo request and reply packets.

Answer

Socat

Answer

Netcat

Answer

Iodine

Question 2

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

Accepted Answer

Cross-account confused deputy vulnerability; remediate by adding a Condition block requiring an 'sts:ExternalId'.. Allowing external accounts to assume a role without an ExternalId leaves the configuration vulnerable to the 'Confused Deputy' problem. Remediation involves adding a condition using 'sts:ExternalId' to the trust policy.

Answer

Access Key exposure; remediate by rotating the static credentials associated with the IAM role.

Answer

Resource-based policy escalation; remediate by disabling cross-account access entirely in AWS Organizations.

Answer

IAM privilege escalation via PassRole; remediate by removing iam:PassRole permissions from the instance profile.

Question 3

An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?

Accepted Answer

The HTTP-based Web Enrollment (certsrv/) or Certificate Enrollment Web Service endpoints. ESC8 exploits AD CS HTTP enrollment endpoints — specifically the Web Enrollment interface (certsrv/) and the Certificate Enrollment Web Service (CES) — which are vulnerable to NTLM relay when they accept HTTP-based authentication without requiring HTTPS or Extended Protection for Authentication (EPA). An attacker relays a coerced machine account authentication to these endpoints to obtain a certificate for that machine, enabling domain privilege escalation.

Answer

The Kerberos Key Distribution Center service on port 88

Answer

The LDAP signing and LDAP channel binding endpoints on port 636

Answer

The RPC-based DCOM interface on port 135

Question 4

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

Accepted Answer

The database can be reached from the internet; the security group should be restricted to trusted CIDR blocks and public accessibility disabled.. The database is exposed to the public internet, requiring network ACLs, security group restriction, and disabling public accessibility.

Answer

S3 bucket policies will automatically override database access controls.

Answer

The database is vulnerable to container escape via Docker socket exposure.

Answer

IAM role trust policies are bypassed by external SQL injection attacks.

Question 5

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

Accepted Answer

Run the built-in command rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:	emp\lsass.dmp full. The comsvcs.dll MiniDump export can be invoked via rundll32.exe to dump the memory of any process by PID, including lsass.exe, producing a full memory dump for offline credential extraction. Because rundll32 and comsvcs.dll are signed Microsoft binaries, this technique (often called 'comsvcs MiniDump' or 'rundll32 LSASS dump') is a living-off-the-land method that evades many application-whitelisting controls.

Answer

Invoke PowerShell with the Get-WmiObject Win32_Process cmdlet specifying the LSASS process handle

Answer

Execute the native net accounts command with the /dump flag to extract password hashes from the SAM registry hive

Answer

Use the tasklist /m lsass.exe command to output the active directory database credentials to the console

Question 6

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster is a Go-based brute-forcing tool purpose-built for directory and file discovery on web servers, using wordlists to enumerate hidden paths, backup files, and administrative directories via HTTP requests. Its speed and multi-threaded design make it the standard choice for this task.

Answer

Nmap

Answer

Netcat

Answer

Hping3

Question 7

A penetration tester is evaluating network security controls and wants to check for insecure or plaintext authentication protocols in use across the network. Which TWO protocols transmit credentials or session tokens in cleartext and can be easily sniffed? (Choose TWO)

Accepted Answer

Telnet. Telnet (D) is correct because it operates over TCP port 23 and transmits all data, including usernames and passwords, in cleartext with no encryption, making credentials trivially recoverable via packet sniffing. FTP (E) is correct because its control channel on TCP port 21 sends USER and PASS commands in plaintext, so authentication credentials can be captured by any sniffer on the path. SSH v2 (A) is not correct because it negotiates encrypted sessions using strong ciphers and key exchange, protecting credentials from sniffing. SFTP (B) is not correct because it runs over the SSH transport, inheriting its encryption and integrity protections. HTTPS (C) is not correct because it wraps HTTP inside TLS, encrypting credentials and session tokens in transit.

Answer

SSH v2

Answer

SFTP (SSH File Transfer Protocol)

Answer

HTTPS

Question 8

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

Accepted Answer

Adding an entry to the Run registry key in the current user hive.. The Run registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) is a documented Windows autostart extensibility point that executes programs automatically when the current user logs in. Adding an entry here provides user-level persistence that survives reboots and requires no special privileges, making it one of the most common and reliable persistence mechanisms.

Answer

Creating a hidden scheduled task.

Answer

Modifying the default shell via Winlogon.

Answer

Replacing the utilman.exe binary with cmd.exe.

Question 9

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Accepted Answer

The bucket is public; the allUsers or allAuthenticatedUsers IAM binding must be removed to secure the data.. Granting allUsers IAM role bindings on a Cloud Storage bucket makes its objects publicly readable over the internet. Remediation requires removing the allUsers binding.

Answer

The bucket is vulnerable to GCP IAM privilege escalation via service account impersonation.

Answer

Google Cloud Armor automatically deletes the bucket objects.

Answer

Compute Engine instances can no longer mount the bucket as a persistent disk.

Question 10

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Accepted Answer

Any user or service principal with read access to the App Service configuration can extract plaintext database credentials.. Storing connection strings and passwords in plaintext within App Service configuration settings means that anyone with read access to the App Service's configuration can retrieve these secrets. This includes users or service principals with Reader role or higher on the App Service resource. The attack path is straightforward: extract credentials and use them to access backend databases or other services, potentially leading to data breach or further compromise.

Answer

The attacker can perform a Golden Ticket attack against the Azure Active Directory Domain Services.

Answer

Azure Firewall automatically terminates the web application due to compliance violations.

Answer

The App Service hypervisor becomes vulnerable to guest-to-host breakout.

Question 11

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

Accepted Answer

The NTLM hash (or AES keys) of the krbtgt service account.. A Golden Ticket is forged using the KRBTGT account's NTLM hash (or AES keys), which allows the attacker to generate valid Kerberos Ticket Granting Tickets (TGTs) for any user.

Answer

The krbtgt account's public SSH key stored in Active Directory.

Answer

The global catalog server IP address and LDAP bind credentials.

Answer

The Domain Administrator's plaintext password.

Question 12

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

Accepted Answer

Exploiting user consent settings that allow any user to grant application permissions to third-party multi-tenant apps.. Option A is correct because when Microsoft Entra ID user consent settings permit all users to consent to third-party multi-tenant applications, attackers can register a malicious multi-tenant app and trick users into granting OAuth permissions (e.g., Mail.Read, offline_access), enabling persistent access and data exfiltration without stealing credentials. Option D is correct because legacy authentication protocols such as POP3, IMAP, and SMTP AUTH do not support modern authentication and therefore bypass Conditional Access policies and MFA, making them a prime vector for password-spray and credential-stuffing attacks. Option B is not a misconfiguration attack vector: disabling Password Hash Sync for cloud-only users is irrelevant since cloud-only accounts have no on-premises password to synchronize, and PHS is a defensive feature rather than an exposure. Option C is not an attack vector because strict RBAC access policies on Key Vault are a security best practice that reduces, not expands, the attack surface. Option E is not a misconfiguration because enforcing MFA for all administrative and privileged roles is a recommended hardening control that mitigates credential-based attacks.

Answer

Configuring Azure AD Connect with Password Hash Sync disabled for cloud-only users.

Answer

Implementing Azure Key Vault access policies with strict RBAC permissions.

Answer

Enforcing Azure Multi-Factor Authentication for all administrative and privileged roles.

Question 13

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Accepted Answer

Adding a scheduled task or cron job in /etc/crontab or user crontabs to periodically execute a reverse shell. Option A is correct because cron jobs placed in /etc/crontab or user crontabs (e.g., via crontab -e) are executed automatically by the cron daemon at scheduled intervals, and they persist across reboots since the crontab files are stored on disk and reloaded at boot. Option B is correct because appending an attacker-controlled public key to ~/.ssh/authorized_keys grants passwordless SSH login as that user, and the file persists on disk across reboots, providing a stealthy, standard-protocol backdoor. Option E is correct because a custom systemd unit file (e.g., in /etc/systemd/system/ with WantedBy=multi-user.target) is started by systemd at boot, giving reliable persistent execution of a backdoor script. Option C is incorrect because winereg is not a real Linux tool and the Windows Registry Run key is a Windows persistence mechanism, not applicable to a Linux target. Option D is incorrect because injecting shellcode into BIOS/UEFI via flashrom requires physical access or firmware write privileges, is highly risky and hardware-specific, and is not a commonly implemented Linux persistence method.

Answer

Modifying the Windows Registry Run key using winereg

Answer

Injecting shellcode into the BIOS/UEFI firmware via flashrom without user interaction

Question 14

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

Accepted Answer

HackRF One / RTL-SDR. HackRF One, RTL-SDR, and similar software-defined radios are used for capturing RF signals. Specifically, devices like RTL-SDR or HackRF paired with GNU Radio or Universal Radio Hacker (URH) cover the 433 MHz band.

Answer

JTAGulator

Answer

Bus Pirate

Answer

Rubber Ducky

Question 15

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

Accepted Answer

KRB5CCNAME. KRB5CCNAME is the standard MIT Kerberos environment variable that tells Kerberos-aware tools where to find the credential cache (ccache) file. Exporting it to point at the stolen .ccache lets Impacket tools like psexec.py, wmiexec.py, and smbclient.py authenticate using the ticket. This is the canonical pass-the-ticket workflow on Linux.

Answer

KRB_TICKET_PATH

Answer

KERBEROS_CACHE

Answer

AD_TICKET_FILE