CPENT Practice Test 14 — 15 Questions

Question 1

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All API requests are treated with full administrative privileges, allowing any compromised pod or user to execute arbitrary cluster-level commands.. When RBAC and Microsoft Entra ID integration are disabled at AKS cluster creation, the cluster falls back to Kubernetes local accounts with certificate-based authentication, and any authenticated request effectively has full cluster-admin privileges. This means a compromised pod or user can execute arbitrary cluster-level commands, escalate privileges, and access secrets across namespaces.

Answer

Azure Security Center deletes the cluster automatically.

Answer

Pods are automatically restricted from communicating with external IP addresses.

Answer

The AKS cluster control plane is automatically exposed to the public internet on port 22.

Question 2

An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?

Accepted Answer

Wireshark. Wireshark natively dissects Modbus/TCP (port 502) and can display coil, register, and function-code fields; using its filter and IO Graph or Statistics features, the analyst can extract register values and visualize state changes over time from the PCAP. This makes it the correct tool for the described task.

Answer

John the Ripper

Answer

Hashcat

Answer

Dirb

Question 3

Which TWO configuration checks should a penetration tester perform when auditing an Active Directory domain for potential NTLM Relay vulnerabilities?

Accepted Answer

Verify if LDAP signing is disabled or set to 'Not Required' on domain controllers.. Option A is correct because when LDAP signing is disabled or set to 'Not Required' on domain controllers, an attacker who has coerced or relayed NTLM authentication can relay it to LDAP/LDAPS and perform operations such as adding a computer or modifying ACLs, which is a classic NTLM relay path. Option B is correct because SMB signing enforcement determines whether relayed NTLM authentication can be used against SMB services; if signing is not required on member workstations and servers, captured NTLM authentication can be relayed to those hosts to execute commands or access resources. Option C is not relevant because the domain functional level does not directly determine whether NTLM relay is possible; modern functional levels can still be vulnerable if signing and channel binding are not enforced. Option D is incorrect because disabling Kerberos pre-authentication enables AS-REP roasting, not NTLM relay, and it is not a standard NTLM relay audit check. Option E is incorrect because the number of SPNs on machine accounts relates to Kerberoasting and service account exposure, not directly to NTLM relay vulnerability.

Answer

Check if the domain functional level is set to Windows 2000 native.

Answer

Verify that all user accounts have Kerberos pre-authentication disabled.

Answer

Enumerate the total number of Service Principal Names registered to machine accounts.

Question 4

During an assessment of a smart manufacturing facility, a penetration tester discovers an unauthenticated MQTT broker allowing anonymous publishing and subscription. Which TWO actions should the tester perform to validate the security risks associated with this misconfiguration? (Choose TWO)

Accepted Answer

Publish arbitrary control messages to actuator topics to test if physical machinery responds to unauthorized commands. Option B is correct because an unauthenticated MQTT broker that permits anonymous publishing lets the tester send crafted payloads to actuator/control topics (e.g., factory/line1/actuator/cmd) and observe whether the physical machinery or PLC responds, directly validating the integrity and safety impact of the misconfiguration. Option E is correct because subscribing to the root wildcard '#' on an anonymous broker captures every published topic, including telemetry, sensor readings, and potentially sensitive operational data, validating the confidentiality impact of the exposure. Option A is not appropriate because an aggressive Nmap TCP scan only enumerates open ports and does not validate the anonymous MQTT publish/subscribe risk. Option C is unrelated because capturing WPA2 four-way handshakes targets Wi-Fi link-layer confidentiality, not the MQTT application-layer misconfiguration. Option D is also not applicable because the broker allows anonymous access, so brute-forcing a management interface with Hydra does not validate the anonymous publish/subscribe exposure.

Answer

Perform an aggressive TCP port scan using Nmap to identify non-standard service ports

Answer

Capture WPA2 four-way handshakes to crack the underlying Wi-Fi pre-shared key

Answer

Execute a brute-force dictionary attack against the MQTT broker management interface using Hydra

Question 5

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

Accepted Answer

An IAM role trust policy that permits assumption by any AWS account across the entire AWS partition without external ID checks.. Option A is insecure because an IAM role trust policy whose Principal allows any AWS account in the partition (for example, "AWS": "arn:aws:iam::*:root" or a wildcard account) lets arbitrary external accounts assume the role; without a sts:ExternalId condition, this enables the confused deputy problem and unauthorized cross-account access. Option E is insecure because an S3 bucket policy with "Principal": "*" and an Allow effect lacking restrictive conditions (such as aws:SourceArn, aws:SourceAccount, or aws:PrincipalOrgID) exposes the bucket to anonymous or unintended public access. Option B is not insecure: enabling S3 Object Versioning protects against overwrites and deletions and aids recovery, so it is a security best practice. Option C is not insecure: annual AWS KMS key rotation for customer-managed keys is a recommended practice that limits the blast radius of key compromise. Option D is not insecure: granting kms:* to the account root and trusted admin roles is the standard KMS key policy pattern, since the root principal is constrained by IAM policies and does not by itself grant broad access.

Answer

Enabling Amazon S3 Object Versioning on critical document storage buckets.

Answer

Enabling AWS KMS key rotation for all customer-managed cryptographic keys annually.

Answer

An AWS KMS key policy granting kms:* permissions to the root user and trusted admin roles only.

Question 6

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Accepted Answer

Write to coils and holding registers to manipulate actuator states and setpoints. Options A, B, and D are correct because Modbus/TCP is an unauthenticated industrial protocol whose function codes allow these operations once an attacker reaches the PLC. A: Function codes such as 0x05 (Write Single Coil), 0x06 (Write Single Register), 0x0F (Write Multiple Coils), and 0x10 (Write Multiple Registers) let an attacker change actuator states and setpoints, directly manipulating physical processes. B: Diagnostic function code 0x08 (Diagnostics) includes sub-functions like 0x01 (Restart Communications Option) and 0x04 (Force Listen Only Mode), and vendor-specific reset commands can force controller reboots or halt communications. D: Function codes 0x03 (Read Holding Registers) and 0x04 (Read Input Registers) allow unauthenticated reading of process variables and sensor data, enabling reconnaissance and process-value harvesting. Option C is wrong because Modbus/TCP PLCs do not store or process Active Directory Kerberos ticket-granting tickets, and Kerberos TGTs are encrypted with the KDC's secret key, not something an OT attacker decrypts via Modbus. Option E is wrong because Modbus/TCP PLCs do not run a browser rendering engine, so cross-site scripting is not applicable to them.

Answer

Automatically decrypt Active Directory Kerberos ticket-granting tickets stored on the PLC

Answer

Execute cross-site scripting (XSS) attacks against the PLC's internal browser rendering engine

Question 7

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Accepted Answer

WMI (Windows Management Instrumentation). WMI (Windows Management Instrumentation) is correct because attackers can use it remotely via DCOM/RPC (typically over TCP 135 plus dynamic RPC ports) to execute commands or spawn processes on a target server using valid domain credentials, making it a standard lateral movement technique in Active Directory environments. PsExec is also correct because it authenticates to the target's ADMIN$/SMB service (TCP 445), copies a service binary, and creates/remotely starts a Windows service to execute code as SYSTEM, which is a classic workstation-to-server lateral movement method. DHCP spoofing is not correct here because it is a rogue DHCP server attack used for initial access, traffic interception, or man-in-the-middle on a local segment, not for authenticated remote code execution on a server. DNS poisoning is not correct because it redirects name resolution to malicious hosts and does not by itself provide code execution or administrative access on a target server. ARP cache poisoning is not correct because it is a layer-2 man-in-the-middle technique for intercepting or altering local traffic, not a technique for moving laterally by executing code on a remote server.

Answer

DHCP spoofing

Answer

DNS poisoning

Answer

ARP cache poisoning

Question 8

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

Accepted Answer

Airodump-ng. Airodump-ng is the premier tool included in the Aircrack-ng suite for capturing 802.11 wireless frames in monitor mode.

Answer

Hydra

Answer

Sqlmap

Answer

Nbtscan

Question 9

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

Accepted Answer

HTTPS (Port 443). DNS, HTTPS (port 443), and ICMP are frequently allowed outbound through corporate firewalls and are heavily used for tunneling.

Answer

SMB (Port 445)

Answer

BGP (Port 179)

Question 10

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Accepted Answer

-O. Nmap's -O option enables OS detection by analyzing TCP/IP stack fingerprinting, such as initial TTL values, TCP window sizes, and responses to specific probes. This allows Nmap to guess the operating system of the target host. The other options serve different purposes: -A enables aggressive scanning (including OS detection, version detection, script scanning, and traceroute), -sV performs service version detection, and --traceroute maps the network path.

Answer

-A

Answer

-sV

Answer

--traceroute

Question 11

An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?

Accepted Answer

TCP 502. Modbus/TCP is an open protocol widely used in SCADA environments and operates natively over TCP port 502.

Answer

TCP 102

Answer

TCP 20000

Answer

UDP 44818

Question 12

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

Accepted Answer

--data-length. The --data-length option tells Nmap to append a random number of bytes to the sent packets, altering their length signature and evading simple signature-based Nmap detection rules.

Answer

--mtu

Answer

--badsum

Answer

-f

Question 13

A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)

Accepted Answer

Using TFTP to load and execute an unauthorized custom kernel image into device RAM. Option D is correct because U-Boot provides built-in tftp and bootm commands, so an attacker at the serial prompt can pull a malicious kernel image from a TFTP server into RAM and boot it, bypassing secure boot and any signed firmware enforcement. Option E is correct because interrupting the U-Boot countdown and editing the bootargs environment variable to append init=/bin/sh causes the Linux kernel to launch a root shell instead of the normal init process, granting immediate privileged access. Option A is wrong because cracking WPA2 PSKs with Aircrack-ng is a wireless-layer attack performed from a NIC in monitor mode, not from a U-Boot serial console. Option B is wrong because ARP spoofing is a layer-2 network attack executed from a running OS with tools like arpspoof, which U-Boot does not provide. Option C is wrong because SQL injection into a Bluetooth GATT characteristic is an application-layer attack against a running Bluetooth stack, not something achievable from the U-Boot bootloader prompt.

Answer

Cracking WPA2 Pre-Shared Keys using a dictionary attack and Aircrack-ng

Answer

Executing an ARP spoofing attack to intercept printer traffic on the corporate IT network

Answer

Injecting an SQL injection payload into the device's Bluetooth GATT profile characteristic

Question 14

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

Accepted Answer

IPv6 RA Guard. IPv6 RA Guard (Router Advertisement Guard) is a switch feature defined in RFC 6105 that inspects and blocks rogue ICMPv6 Router Advertisement and Redirect messages on access ports. It prevents an attacker from spoofing as an IPv6 router to redirect or intercept local traffic via NDP spoofing. RA Guard classifies ports as trusted (uplink to legitimate router) or untrusted (host-facing), dropping RAs received on untrusted ports.

Answer

Dynamic ARP Inspection (DAI)

Answer

DHCP Snooping

Answer

Port Security

Question 15

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

Accepted Answer

Run 'docker run -v /:/hostfs --rm -it alpine chroot /hostfs' to mount the host root directory inside a new container.. Access to /var/run/docker.sock allows the container to interact with the host's Docker daemon. The tester can spin up a new container that mounts the host's root filesystem (/) and provides a chroot or direct execution shell on the host.

Answer

Modify /etc/passwd inside the container to add a root user.

Answer

Send a SIGKILL signal to the docker daemon process via kill -9 1.

Answer

Execute 'sudo su' inside the container environment.