CPENT Practice Test 13 — 15 Questions

Question 1

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

Accepted Answer

Appending a public key to ~/.ssh/authorized_keys. Modifying crontabs, adding SSH keys, and using systemd services are primary Linux persistence methods.

Answer

Replacing the default bash shell

Answer

Modifying the kernel source code

Question 2

Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?

Accepted Answer

Adding a startup script or service configuration within the GPO file share path in SYSVOL. GPO abuse with GenericAll permissions allows modifying startup/shutdown scripts, injecting immediate tasks via Group Policy Preferences, or modifying registry.xml files containing credentials.

Answer

Modifying the KRBTGT account password directly through Group Policy settings

Answer

Directly modifying the NTDS.dit database via unauthenticated LDAP write operations

Question 3

A penetration tester is analyzing a Kubernetes cluster deployed on AWS (EKS) where a compromised pod is running with a service account that has access to the AWS IAM OIDC provider endpoint. The pod's container is running as root and has the host network namespace enabled. Which technique allows the tester to pivot from the container to the underlying cloud infrastructure?

Accepted Answer

Query the local Kubernetes API server using the projected service account token mounted in the pod to extract AWS STS credentials if an IAM role is annotated.. Accessing the container metadata or using the token exchange via the IAM OIDC provider allows the tester to obtain cloud credentials.

Answer

Execute the docker-runc exploit directly against the Docker daemon socket mounted inside the container.

Answer

Modify the kube-dns deployment manifest to redirect cloud control plane traffic to a local proxy.

Answer

Leverage the Azure Instance Metadata Service endpoint to retrieve subscription-level access tokens.

Question 4

An advanced adversary has gained Domain Administrator privileges and wants to establish stealthy, long-term persistence in Active Directory without relying solely on traditional user accounts or standard scheduled tasks. Which THREE advanced persistence mechanisms can be deployed in an Active Directory environment? (Choose THREE)

Accepted Answer

AD CS Certificate Mapping (mapping a rogue certificate to a domain account for persistent PKINIT authentication). Advanced AD persistence mechanisms include SID History injection, Skeleton Key (patching LSASS on DCs), DCShadow (registering a rogue DC), and AD CS certificate mapping.

Answer

Running the standard Windows Disk Defragmenter (defrag.exe) on the Domain Controller C: drive

Answer

Modifying the Windows TCP/IP stack registry keys to disable DHCP client notifications

Question 5

When analyzing a compromised Active Directory environment using BloodHound, which THREE common node properties or paths typically signify a high-value target or an immediate path to Domain Admin?

Accepted Answer

Principals with GenericAll or WriteDACL over the Domain object. BloodHound highlights high-value targets like Domain Admins, Enterprise Admins, and paths involving Group Policy Creator Owners, Domain Controllers, or WriteDACL/GenericAll permissions over administrative objects.

Answer

Standard users with 'MemberOf' a departmental security group

Answer

Standard domain user accounts with default password policies

Question 6

During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?

Accepted Answer

Pass-the-Hash. Pass-the-Hash (PtH) involves using a captured NTLM hash directly for authentication without needing the plaintext password, leveraging the challenge-response mechanism of the NTLM protocol.

Answer

Pass-the-Ticket

Answer

Kerberoasting

Answer

Over-Pass-the-Hash

Question 7

A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?

Accepted Answer

getST.py. Impacket's getST.py (GetServiceName / Get-ServiceTicket) implements Service for User (S4U) extensions to impersonate arbitrary users to targeted services using constrained delegation.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

addcomputer.py

Question 8

An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?

Accepted Answer

Capture the coerced Domain Admin's TGT from the machine's memory to impersonate them across the domain.. When unconstrained delegation is enabled, any service ticket sent to the machine caches the authenticating user's TGT in memory. If a Domain Admin authenticates (e.g., via PrinterBug), the operator can extract the cached TGT and perform DCSync.

Answer

Extract the NTLM hash of the domain controller directly from the SYSVOL share.

Answer

Forge a Kerberos ticket using the machine account's local SAM database.

Answer

Modify group policy objects via unauthenticated LDAP queries.

Question 9

A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?

Accepted Answer

AS-REP Roasting. AS-REP Roasting targets accounts where pre-authentication is disabled, allowing an attacker to request an AS-REP response containing ticket material encrypted with the user's password hash and crack it offline.

Answer

Silver Ticket Attack

Answer

DCShadow

Answer

Kerberoasting

Question 10

A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?

Accepted Answer

To coerce the domain controller's machine account to authenticate to an NTLM relay listener targeting AD CS.. PetitPotam coerces an authenticating machine (like a DC) to connect to an attacker-controlled listener via SMB or HTTP, which can then be relayed to Active Directory Certificate Services (AD CS) HTTP enrollment endpoints (ESC8) for NTLM relay attacks.

Answer

To corrupt the NTDS.dit database file on the remote domain controller.

Answer

To extract the plaintext password of the domain administrator from the LSASS process memory.

Answer

To bypass Kerberos pre-authentication requirements on user accounts.

Question 11

When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?

Accepted Answer

It connects via RPC and invokes the DRSUAPI protocol (DsGetNCChanges) to request replication data.. secretsdump.py uses the DRSUAPI (Directory Replication Service Remote Protocol) via RPC, specifically calling methods like DsGetNCChanges, simulating a domain controller replication request.

Answer

It executes an LDAP search request asking for the plaintext password attribute.

Answer

It queries the Active Directory Web Services (ADWS) REST API on port 9389.

Answer

It reads the NTDS.dit file directly over standard SMB file shares using administrator credentials.

Question 12

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The pods/exec permission allows a user to execute commands inside running pods, effectively granting arbitrary code execution in any pod where they can target execution.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 13

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

Accepted Answer

Publishing retained messages with empty payloads to critical command topics. In MQTT, if ACLs are missing, any authenticated client can publish to any topic. A malicious publisher can flood or retain empty messages on critical command topics to cause a denial-of-service.

Answer

Executing an MQTT-specific TCP SYN flood against port 1883

Answer

Subscribing to the '$SYS/#' system topic hierarchy using wildcard expansion

Answer

Sending a CONNECT packet with an invalid keep-alive timer value of zero

Question 14

Which THREE tactics or actions are effective in defending against or detecting Golden Ticket attacks in an enterprise Active Directory environment?

Accepted Answer

Enforcing Tiered Administration models to protect domain controller access. Golden Tickets rely on the KRBTGT secret key. Rotating the KRBTGT password twice invalidates existing golden tickets. Monitoring for abnormal ticket lifetimes (Event ID 4769/4768) and implementing Tiered Administration also help.

Answer

Enabling unconstrained delegation on all workstation computer objects

Answer

Disabling LDAP channel binding on all domain controllers

Question 15

While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?

Accepted Answer

Password hashes for all synchronized accounts are stored in Azure AD, meaning compromise of the cloud tenant could expose on-premises credentials.. When PHS is enabled, synchronized password hashes reside in Azure AD, meaning a complete on-premises compromise exposes the hashes of all synced accounts to cloud credential dumping if Azure AD is later targeted.

Answer

Pass-through authentication agents become vulnerable to remote code execution via the Azure service bus.

Answer

Azure AD Connect agents will automatically downgrade encryption standards for domain controller communications.

Answer

Kerberos ticket granting service requests are bypassed entirely for hybrid users.