CPENT Practice Test 15 — 15 Questions

Question 1

An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?

Accepted Answer

The HTTP-based Web Enrollment (certsrv/) or Certificate Enrollment Web Service endpoints. ESC8 exploits AD CS Web Enrollment or Certificate Enrollment Web Services endpoints that have HTTP enabled and permit NTLM authentication, allowing NTLM relay from coerced machine accounts.

Answer

The Kerberos Key Distribution Center service on port 88

Answer

The LDAP signing and LDAP channel binding endpoints on port 636

Answer

The RPC-based DCOM interface on port 135

Question 2

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

Accepted Answer

The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.. ESC1 occurs when a certificate template permits enrollment by low-privileged users, allows supply of an alternate subject (ENROLLEE_SUPPLIES_SUBJECT), and includes client authentication EKUs.

Answer

The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.

Answer

The template publishes certificates to Active Directory user objects automatically.

Answer

The template has Manager Approval enabled and requires enterprise admin signatures.

Question 3

A penetration tester is attempting to perform Kerberoasting using Impacket. Which specific service principal name (SPN) format must be requested against the target domain controller to successfully extract TGS-AEAD tickets that can be cracked offline?

Accepted Answer

MSSQLSvc/sqlserver01.corp.local:1433. Kerberoasting targets service principal names mapped to user accounts rather than machine accounts. Impacket's GetUserSPNs.py queries the Global Catalog for user accounts with a non-null servicePrincipalName attribute.

Answer

CIFS/dc01.corp.local

Answer

LDAP/dc01.corp.local

Answer

HOST/dc01.corp.local

Question 4

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

Accepted Answer

WriteProperty, GenericAll, or GenericWrite over the msDS-KeyCredentialLink attribute / target object. Shadow credentials involve writing to the msDS-KeyCredentialLink attribute of an Active Directory object. Therefore, the attacker must have WriteProperty, GenericAll, or GenericWrite privileges over the target object.

Answer

ReadLAPSPassword extended right

Answer

DS-Replication-Get-Changes-All domain right

Answer

SeEnableDelegationPrivilege on the domain controller

Question 5

During an internal penetration test, an operator compromises a low-privileged domain user account and wishes to perform a Kerberoasting attack to harvest service principal name (SPN) tickets. Which standard utility included with Windows PowerShell or Sysinternals can be used to request these tickets without administrative privileges?

Accepted Answer

Invoke-Kerberoast via PowerView. Kerberoasting targets service accounts with registered SPNs. Any authenticated domain user can request a TGS-SPN ticket for these services from the Domain Controller. The built-in .NET class System.IdentityModel.Tokens.KerberosRequestorSecurityToken or PowerShell scripts like PowerView use standard Windows APIs to request these tickets.

Answer

Mimikatz lsadump::dcsync

Answer

Get-ADDefaultDomainPasswordPolicy

Answer

ntdsutil.vbs snapshot

Question 6

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

Accepted Answer

Examine Azure AD Connect synchronization rules and connector filters for misconfigurations or export rules that might inadvertently expose directory objects or allow rule manipulation.. If Azure AD Connect synchronization rules or filtering configurations are misconfigured, attackers can sometimes modify object attributes or take advantage of synchronization sync cycles to escalate privileges.

Answer

Use the Azure AD Connect database password stored in the local SQL Express instance to perform a DCShadow attack.

Answer

Force Azure AD Connect to disable multi-factor authentication for all cloud administrators.

Answer

Inject a malicious DLL into the Azure AD Connect health agent service to execute arbitrary code on the Azure cloud domain controller.

Question 7

An AWS administrator wants to ensure that all data stored in newly created Amazon S3 buckets is automatically encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). What is the most scalable way to enforce this?

Accepted Answer

Configure S3 bucket default encryption with SSE-KMS on all buckets or enforce it via AWS Organizations Service Control Policies (SCPs).. Enforcing SSE-KMS via S3 bucket default encryption or AWS Organizations SCPs ensures compliance across accounts and new buckets.

Answer

Manually run an AWS CLI script daily to apply KMS encryption to every individual object.

Answer

Enable AWS Shield Standard on each individual S3 object.

Answer

Attach an Amazon CloudWatch alarm to detect unencrypted PUT requests.

Question 8

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

Accepted Answer

Configure msDS-AllowedToActOnBehalfOfOtherIdentity to point to a controlled account, enabling Resource-Based Constrained Delegation.. GenericAll permissions on a computer object allow an attacker to modify the servicePrincipalName attribute or reset the computer password, but more commonly allows writing explicit delegation or adding user rights. Alternatively, adding a user to local groups via WinRM or modifying msDS-AllowedToActOnBehalfOfOtherIdentity enables constrained delegation abuse.

Answer

Modify the user's PrimaryGroupID to map to Domain Admins directly.

Answer

Execute a DCSync attack against the computer object's registry hive.

Answer

Directly modify the local SAM database of the target computer over RPC without credentials.

Question 9

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

Accepted Answer

Any user or service principal with read access to the App Service configuration can extract plaintext database credentials.. Storing secrets in plaintext in App Service configuration settings allows any user or service principal with Reader or Contributor access to the App Service to harvest sensitive credentials.

Answer

The attacker can perform a Golden Ticket attack against the Azure Active Directory Domain Services.

Answer

Azure Firewall automatically terminates the web application due to compliance violations.

Answer

The App Service hypervisor becomes vulnerable to guest-to-host breakout.

Question 10

A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?

Accepted Answer

LDAP NTLM Relay. Lack of LDAP signing allows attackers to perform NTLM relay attacks against LDAP endpoints (port 389), potentially granting privileges like object creation or group modifications.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

Golden Ticket forgery

Question 11

Which TWO of the following Impacket tools can be utilized to perform credential dumping or secret extraction from Active Directory or target systems when valid administrator credentials are known?

Accepted Answer

goldenPac.py. secretsdump.py extracts password hashes, Kerberos keys, and NTDS.dit data. smbexec.py and psexec.py execute remote commands, but secretsdump.py and mspacify/mimikatz-equivalents in Impacket focus on dumping secrets. Specifically, secretsdump.py is the primary secret extraction tool.

Answer

ntlmrelayx.py

Answer

GetUserSPNs.py

Answer

lookupsid.py

Question 12

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

Accepted Answer

Use the token in HTTP Authorization Bearer headers to query the Kubernetes API server and inspect or manipulate cluster resources based on the service account's RBAC privileges.. The mounted service account token can be used to authenticate to the Kubernetes API server, allowing the tester to query resources or create malicious pods (e.g., privileged pods) based on the service account's RBAC permissions.

Answer

Convert the token into an Azure AD refresh token using Microsoft Graph API.

Answer

Submit the token to the AWS IAM STS assume-role API to gain root access to the underlying AWS cloud account.

Answer

Inject the token into the Linux kernel keyring to escalate the container to host root privileges.

Question 13

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Accepted Answer

Modify the IAM role trust policy to include a Condition block restricting the principal or requiring multi-factor authentication.. Restricting the trust policy with conditions such as aws:PrincipalTag or source ARN ensures only authorized entities can assume the role.

Answer

Rotate the AWS account root user access keys immediately.

Answer

Attach an explicit Deny policy to the EC2 instance metadata service version 2 configuration.

Answer

Disable the AWS Security Token Service endpoint globally across the AWS organization.

Question 14

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

Accepted Answer

Exploiting user consent settings that allow any user to grant application permissions to third-party multi-tenant apps.. Unrestricted user consent settings allowing apps to access tenant data and legacy authentication protocols lacking MFA enforcement are major Azure AD security risks.

Answer

Configuring Azure AD Connect with Password Hash Sync disabled for cloud-only users.

Answer

Implementing Azure Key Vault access policies with strict RBAC permissions.

Answer

Enforcing Azure Multi-Factor Authentication for all administrative and privileged roles.

Question 15

During a hybrid cloud assessment, a penetration tester discovers that an organization uses Azure Arc to manage on-premises Windows servers. Which THREE security risks or attack vectors are associated with a compromised Azure Arc Connected Machine Agent (azcmagent) on an on-premises server? (Choose three)

Accepted Answer

The attacker can utilize the established communication channel (outbound HTTPS port 443) to maintain persistent command and control (C2) mimicking legitimate Azure management traffic.. Azure Arc allows management of on-premises servers via Azure. Compromising the agent or its managed identity can allow attackers to execute extensions, query local metadata, or leverage Azure-managed policies to pivot into the cloud.

Answer

The attacker can directly perform a DCSync attack against Azure AD Connect to extract thekrbtgt hash of the cloud tenant.

Answer

The attacker can bypass on-premises Group Policy Objects (GPOs) entirely by converting the local Active Directory domain into an Azure AD Domain Services instance.