CPENT Practice Test 14 — 15 Questions

Question 1

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restrict the NSG rule source IP to trusted administrative networks or implement Azure Bastion for secure management.. Exposing RDP directly to the internet is a high risk; remediation involves restricting the source IP range or using Azure Bastion.

Answer

Disable the Azure Key Vault service across the subscription.

Answer

Enable Azure Active Directory Pass-Through Authentication on the VM guest OS.

Answer

Attach an AWS IAM instance profile to the Azure Virtual Machine.

Question 2

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

Accepted Answer

-sS. The '-sS' flag instructs Nmap to perform a TCP SYN scan, which is the default and most popular stealth scan because it never completes the full 3-way handshake.

Answer

-sT

Answer

-sP

Answer

-sU

Question 3

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

Accepted Answer

SharpHound.exe -CollectionMethod LocalAdmin. SharpHound uses the Session and LocalAdmin collection methods by default or explicitly specified via the -CollectionMethod flag to enumerate local administrators via API calls.

Answer

SharpHound.exe -CollectionMethod GPOChanges

Answer

SharpHound.exe -CollectionMethod TrustList

Answer

SharpHound.exe -CollectionMethod DCOptions

Question 4

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

Accepted Answer

Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication. ESC1 occurs when a certificate template allows low-privileged users to enroll, permits client authentication, and allows the enrollee to supply an arbitrary Subject Alternative Name (SAN). An attacker can request a certificate with a SAN belonging to a high-privileged user (e.g., Domain Administrator) and use it for authentication.

Answer

Execute a DCSync attack directly against the Certification Authority web enrollment endpoint

Answer

Force the CA machine account to authenticate to an attacker-controlled SMB share using PetitPotam

Answer

Perform a Silver Ticket attack by decrypting the CA database with a captured machine hash

Question 5

An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?

Accepted Answer

The Enterprise Admins group in the forest root domain. Enterprise Admins is a forest-level group residing in the root domain that holds administrative control over all domains in the forest.

Answer

The Cert Publishers group on any workstation

Answer

The Domain Admins group of the subordinate domain

Answer

The Account Operators group in the builtin container

Question 6

Which TWO methods can an operator use to verify whether an account has successfully been granted DCSync privileges after modifying access control lists (ACLs)?

Accepted Answer

Query the domain object ACLs using PowerView's Get-DomainObjectAcl cmdlet.. After adding DCSync rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), an operator can test the capability using Impacket's secretsdump.py or check ACL modifications using PowerView (Get-DomainObjectAcl).

Answer

Inspect the local SAM database registry hive.

Answer

Run SharpHound with the LocalAdmin collection flag.

Answer

Run klist to check cached Kerberos ticket lifetimes.

Question 7

During an assessment of an Azure tenant, an attacker successfully exploits a user credential and enumerates enterprise applications. They identify a service principal with a high-privilege app role assignment (e.g., PrivilegedRoleAdministrator.ReadWrite.All). What is the primary attack path enabled by this misconfiguration?

Accepted Answer

The attacker can leverage the service principal credentials to assign high-privilege Azure AD roles to unauthorized user accounts.. A compromised service principal holding directory or role administration permissions can create new global administrators or modify role assignments.

Answer

The attacker can perform a Kerberoasting attack against the Azure Active Directory cloud database.

Answer

The attacker can extract the plaintext passwords of all cloud administrators from the Azure Key Vault logs.

Answer

The attacker can directly modify the underlying hypervisor configuration of Azure virtual machines.

Question 8

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

Accepted Answer

certipy req -u user@corp.local -p password -target ca.corp.local -template VulnerableTemplate -upn administrator@corp.local. Certipy is an industry-standard tool for auditing and abusing Active Directory Certificate Services. The 'certipy req' command handles certificate requests using specified templates and alternate subject names.

Answer

certipy shadow -username user -target dc01

Answer

certipy ca -backup -ca "corp-CA-1"

Answer

certipy template -update VulnerableTemplate -enrollee-supplies-subject True

Question 9

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Accepted Answer

AddMember. In BloodHound, the 'GenericAll', 'GenericWrite', 'WriteDACL', or 'WriteOwner' edges denote modification rights, while 'MemberOf' indicates group membership. Specifically, 'AddMember' or 'GenericAll'/'GenericWrite' on group objects indicates control over membership.

Answer

AllowedToDelegate

Answer

ReadLAPSPassword

Answer

CoerceTo

Question 10

In the context of AD CS abuse, which THREE vulnerabilities or template settings are categorized under certificate template misconfigurations that allow privilege escalation?

Accepted Answer

ESC1: Enrollee supplies subject and template permits client authentication for low-privileged users. AD CS misconfigurations like ESC1 (enrollee supplies subject), ESC2 (any purpose EKU), and ESC3 (enrollment agent templates) represent common template-based vulnerabilities.

Answer

ESC10: Strict certificate mapping and strong SID binding enforced

Answer

LDAP signing enforced across all domain controllers

Question 11

Which TWO Active Directory mechanisms or configurations are commonly targeted during lateral movement to bypass traditional perimeter security and leverage built-in domain trust relationships?

Accepted Answer

Kerberos Constrained and Unconstrained Delegation. Cross-trust attacks and Kerberos delegation abuse are primary vectors for lateral movement across complex enterprise environments without triggering host firewalls.

Answer

Local Administrator Password Solution (LAPS)

Answer

NTLMv2 hash signing enforcement

Answer

Account lockout threshold policies

Question 12

Which native Windows command-line tool can be used by a penetration tester to view cached Kerberos tickets currently loaded in the user session?

Accepted Answer

klist. klist is the built-in Windows utility used to query, display, and purge Kerberos tickets and ticket-granting tickets in the current logon session.

Answer

ticketmgr

Answer

winrm get tickets

Answer

kerbuse

Question 13

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

Accepted Answer

KRB5CCNAME. Impacket tools rely on the KRB5CCNAME environment variable to locate and parse the Kerberos credential cache file when performing operations with domain credentials via Kerberos.

Answer

KRB_TICKET_PATH

Answer

KERBEROS_CACHE

Answer

AD_TICKET_FILE

Question 14

An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?

Accepted Answer

ticketer.py. ticketer.py from the Impacket framework allows operators to forge custom Kerberos Golden and Silver tickets offline given the correct secret keys.

Answer

getTGT.py

Answer

goldenPac.py

Answer

raiseChild.py

Question 15

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

Accepted Answer

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. DCSync functionality requires the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights on the domain root object.

Answer

GenericAll over thekrbtgt account

Answer

FullControl over the Domain Controllers OU

Answer

WriteDACL on the builtin Administrators group