CPENT Practice Test 15 — 15 Questions

Question 1

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

Accepted Answer

Configure msDS-AllowedToActOnBehalfOfOtherIdentity to point to a controlled account, enabling Resource-Based Constrained Delegation.. GenericAll on a computer object allows full control, including the ability to write to the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. By setting this attribute to a controlled account, an attacker can configure Resource-Based Constrained Delegation (RBCD), enabling that account to impersonate any user to the target computer and achieve code execution via Kerberos delegation. This is a well-known privilege escalation path in Active Directory.

Answer

Modify the user's PrimaryGroupID to map to Domain Admins directly.

Answer

Execute a DCSync attack against the computer object's registry hive.

Answer

Directly modify the local SAM database of the target computer over RPC without credentials.

Question 2

Which TWO Active Directory mechanisms or configurations are commonly targeted during lateral movement to bypass traditional perimeter security and leverage built-in domain trust relationships?

Accepted Answer

Kerberos Constrained and Unconstrained Delegation. Option B is correct because Kerberos delegation — both unconstrained (where a service can impersonate users to any service) and constrained (where it is limited to specified services) — is a classic lateral-movement and privilege-escalation target: an attacker who compromises a delegation-enabled service account can obtain forwardable TGTs or service tickets and impersonate high-privileged users across the domain without touching perimeter defenses. Option E is correct because external and forest trust relationships extend authentication across domain/forest boundaries, and when SID filtering is disabled or trusts are misconfigured, attackers can abuse SIDHistory injection or cross-trust Kerberos referrals to move laterally into trusted domains while appearing as legitimate internal authentication traffic. Option A (LAPS) is not a lateral-movement bypass mechanism; it is a defensive control that randomizes local administrator passwords to prevent pass-the-hash reuse. Option C (NTLMv2 hash signing enforcement) is a hardening measure that restricts NTLM relay/credential reuse rather than a trust-abuse vector. Option D (account lockout threshold policies) is a defensive policy that limits brute-force attempts and does not itself enable lateral movement or trust abuse.

Answer

Local Administrator Password Solution (LAPS)

Answer

NTLMv2 hash signing enforcement

Answer

Account lockout threshold policies

Question 3

Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?

Accepted Answer

Sysinternals ProcDump.exe. Sysinternals ProcDump.exe (option B) is correct because it can create a memory dump of a running process, including lsass.exe, using syntax such as procdump -ma lsass.exe lsass.dmp, which can then be parsed offline with Mimikatz to extract credentials. Option D is also correct because rundll32.exe can invoke the native comsvcs.dll MiniDump export, e.g. rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\lsass.dmp full, producing an LSASS memory dump without external tooling. Option A (tasklist.exe /v) only lists running processes with verbose details and cannot dump memory. Option C (gpresult.exe /h report.html) generates a Group Policy Resultant Set of Policy HTML report and has no credential-dumping capability. Option E (netstat.exe -ano) only displays network connections with owning PIDs and cannot read LSASS memory.

Answer

tasklist.exe /v

Answer

gpresult.exe /h report.html

Answer

netstat.exe -ano

Question 4

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

Accepted Answer

DHCP Spoofing / Rogue DHCP Server. DHCP Spoofing / Rogue DHCP Server (B) is correct because an attacker can stand up an unauthorized DHCP server that answers client DISCOVER/REQUEST messages with malicious OFFER/ACK leases, supplying a rogue default gateway and DNS server so the victim's traffic is redirected through the attacker for interception (a man-in-the-middle). DHCP Starvation / Exhaustion (C) is correct because the attacker floods the DHCP server with forged DHCP DISCOVER requests using spoofed/changing MAC addresses (e.g., via tools like Yersinia or dhcpstarv), consuming the entire DHCP address pool so legitimate clients cannot obtain a lease, causing a denial of service. DNS Zone Transfer (AXFR) (A) is a DNS misconfiguration attack that copies zone records and does not target DHCP. Kerberoasting (D) is an Active Directory attack that requests Kerberos service tickets (TGS) for accounts with SPNs to crack their passwords offline, unrelated to DHCP. ARP Cache Poisoning (E) manipulates ARP tables at Layer 2 to intercept traffic but does not attack the DHCP infrastructure itself.

Answer

DNS Zone Transfer (AXFR)

Answer

Kerberoasting

Answer

ARP Cache Poisoning

Question 5

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

Accepted Answer

Metasploit auxiliary/server/socks_proxy. Option C, Metasploit's auxiliary/server/socks_proxy module, is correct because it starts a SOCKS4a/SOCKS5 proxy server inside Metasploit that can route arbitrary TCP traffic through an existing Meterpreter or shell session, enabling pivoting into deeper network segments. Option E, SSH dynamic port forwarding with the -D flag, is correct because it creates a local SOCKS4/SOCKS5 proxy that tunnels arbitrary TCP connections through the SSH server (the compromised host if SSH access is available), which is a classic pivoting technique. Option A, Netcat's -e flag, is wrong because it binds a shell to a port rather than providing a SOCKS proxy for arbitrary TCP traffic. Option B, a Wireshark display filter, is wrong because it only filters captured packets for analysis and provides no tunneling capability. Option D, Nmap's -sS flag, is wrong because it performs a TCP SYN stealth scan and does not establish any proxy or tunnel.

Answer

Netcat -e flag

Answer

Wireshark display filter

Answer

Nmap -sS scan flag

Question 6

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

Accepted Answer

smb-os-discovery. Option D, smb-os-discovery, is correct because it safely queries SMB to extract the remote host's OS, computer name, domain, and SMB version information without performing intrusive actions. Option E, smb-protocols, is correct because it enumerates which SMB dialects (e.g., NT LM 0.12, SMB 2.02, SMB 3.0) the server supports, directly revealing SMB version details in a non-destructive manner. Option A, smb-brute, is incorrect because it performs credential brute-forcing, which is intrusive and can lock accounts, not a safe version/OS discovery method. Option B, smb-vuln-ms08-067, is incorrect because it actively checks for a specific vulnerability and may crash or disrupt the target, so it is not a safe discovery script. Option C, smb-enum-users, is incorrect because it enumerates user accounts, which is information gathering beyond SMB version/OS details and can be noisy or trigger alerts.

Answer

smb-brute

Answer

smb-vuln-ms08-067

Answer

smb-enum-users

Question 7

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

Accepted Answer

SMB / NetBIOS service enumeration. Option A (SMB / NetBIOS service enumeration) is correct because legacy SMB/NetBIOS services allow unauthenticated enumeration of shares, users, groups, domain membership, and OS details via null sessions (e.g., net view /domain, rpcclient, or enum4linux), frequently exposing sensitive domain information. Option E (SNMP with default community strings) is correct because SNMPv1/v2c uses cleartext community strings such as 'public' or 'private' for authentication, and if defaults are unchanged, an attacker can query MIB objects (e.g., snmpwalk -v2c -c public) to extract system, interface, and sometimes user/process information without real authentication. Option B (HTTPS with modern TLS 1.3) does not belong because it provides encrypted, authenticated transport and does not expose domain or system information unauthenticated. Option C (IPsec VPN tunnels) does not belong because IPsec is an encrypted, authenticated tunnel mechanism, not an information-disclosure enumeration service. Option D (SSH v2 with public key authentication) does not belong because SSHv2 with key-based auth is a secure, authenticated remote-access protocol that does not leak domain or system information without credentials.

Answer

HTTPS with modern TLS 1.3

Answer

IPsec VPN tunnels

Answer

SSH v2 with public key authentication

Question 8

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Accepted Answer

Exposing the Kubernetes API server endpoint directly to the public internet (0.0.0.0/0) without IP whitelisting or robust authentication.. Option A is correct because exposing the Kubernetes API server to 0.0.0.0/0 removes network-level protection, allowing unauthenticated or brute-forced access to the control plane; the API server is the cluster's most sensitive endpoint, so public exposure without IP whitelisting or strong authentication is a high-risk misconfiguration. Option D is correct because binding the cluster-admin ClusterRole to the default service account in the default namespace grants every pod running under that service account full cluster-wide administrative privileges, enabling trivial privilege escalation and lateral movement if any such pod is compromised. Option B is not a flaw — enabling the Restricted Pod Security Standard hardens workloads by enforcing least-privilege pod settings. Option C is not a flaw — network policies that isolate database pods from frontend pods implement proper microsegmentation. Option E is not a flaw — enabling RBAC across all API groups is the recommended secure default, not a misconfiguration.

Answer

Enabling Pod Security Standards (e.g., Restricted profile) across all namespaces.

Answer

Using network policies to isolate sensitive database pods from frontend web pods.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) across all API groups.

Question 9

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Accepted Answer

Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing. Option B is correct because many BLE IoT devices ship with fixed or hardcoded pairing PINs such as '0000' or '1234'; since these values are predictable and often transmitted or used during the pairing exchange, an attacker within radio range can brute-force them or capture them via sniffing to complete pairing and gain access. Option E is correct because the Generic Attribute Profile (GATT) defines how services and characteristics are exposed, and if the device permits read/write operations on characteristics without requiring authentication or encryption, an attacker can use tools like gatttool or nRF Connect to read sensitive medical data or write malicious values to the sensor. Option A is not correct because it describes an 802.11 Wi-Fi kernel buffer overflow, which is unrelated to the BLE radio and protocol stack. Option C is not correct because BLE advertising packets carry structured data (flags, UUIDs, TX power, etc.) and are not interpreted as SQL by any backend, so SQL injection is not a BLE attack vector. Option D is not correct because ARP cache poisoning targets IP/Ethernet LAN switching, whereas BLE is a point-to-point wireless protocol with no ARP or switch port involvement.

Answer

Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

Answer

Injecting malicious SQL statements into the BLE radio frequency advertising packets

Answer

Performing an ARP cache poisoning attack against the target device's switch port

Question 10

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

Accepted Answer

The target account's NTLM password hash must be known to the attacker. Option A is correct because Pass-the-Hash fundamentally requires the attacker to possess the target account's NTLM hash (the NT hash, i.e., the MD4 of the password) so it can be submitted directly in the NTLM authentication exchange without ever knowing the plaintext password. Option C is correct because PtH abuses the NTLM challenge/response protocol, so the target must still accept NTLM authentication; if NTLM is fully disabled via Group Policy (e.g., Network security: Restrict NTLM settings), the hash cannot be used and the attack fails. Option B is wrong because SMB signing does not need to be disabled forest-wide for PtH to work — signing only prevents relay/tampering, and even with signing enabled a valid NTLM hash can still authenticate (though it may hinder relay scenarios). Option D is wrong because Kerberos pre-authentication is unrelated to NTLM-based PtH; disabling it enables AS-REP roasting, not hash-based NTLM logon. Option E is wrong because the domain controller's local firewall has no bearing on whether NTLM hash authentication succeeds against target hosts.

Answer

SMB signing must be globally disabled across the entire Active Directory forest

Answer

The target user account must have Kerberos pre-authentication disabled

Answer

The local Windows Firewall on the domain controller must be completely disabled

Question 11

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

Accepted Answer

Unauthenticated clients can invoke the specific API method directly, bypassing the intended AWS IAM signature authentication.. Setting a method's authorization type to 'None' (also called 'Open') on an API Gateway REST API removes the AWS_IAM SigV4 requirement for that specific method. Any unauthenticated client on the internet can then invoke that method's integration endpoint directly, bypassing the IAM-signed request flow the rest of the API enforces. This is a classic broken-access-control misconfiguration that exposes backend Lambda functions, DynamoDB operations, or internal services to anonymous abuse.

Answer

AWS WAF will automatically block all traffic to the API Gateway.

Answer

CloudFront distribution logs will fail to record incoming requests.

Answer

The API Gateway becomes vulnerable to SQL injection attacks against its internal DynamoDB storage.

Question 12

Which native Windows command-line tool can be used by a penetration tester to view cached Kerberos tickets currently loaded in the user session?

Accepted Answer

klist. klist is the native Windows command-line utility that displays currently cached Kerberos tickets (TGTs and service tickets) for the logged-on user session. Penetration testers use it to enumerate available tickets before attempting pass-the-ticket or Kerberoasting. It is built into Windows and requires no additional tooling.

Answer

ticketmgr

Answer

winrm get tickets

Answer

kerbuse

Question 13

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

Accepted Answer

cmdkey /list. The cmdkey utility is a built-in Windows command-line tool that manages stored credentials in the Credential Manager. Running 'cmdkey /list' enumerates all saved credentials (including domain, generic, and certificate-based) for the current user, showing target names and types. This is the standard way a penetration tester checks for cached credentials that could be reused for lateral movement.

Answer

gpresult /r

Answer

net user /domain

Answer

whoami /priv

Question 14

During an internal engagement, a penetration tester gains access to a Linux host that has multiple network interfaces. The tester needs to determine which interface can route to the 10.10.10.0/24 subnet and what the next-hop gateway is. Which command provides this information most directly?

Accepted Answer

ip route get 10.10.10.1. The ip route get command performs a routing table lookup for a specific destination and reports the exact outgoing interface, source address, and gateway that the kernel would use. This directly answers both parts of the question: which interface can reach the subnet and what the next hop is. Other commands list interfaces or routes but do not resolve the path for a given target address.

Answer

ifconfig -a

Answer

arp -a

Answer

netstat -rn

Question 15

An advanced adversary has gained Domain Administrator privileges and wants to establish stealthy, long-term persistence in Active Directory without relying solely on traditional user accounts or standard scheduled tasks. Which THREE advanced persistence mechanisms can be deployed in an Active Directory environment? (Choose THREE)

Accepted Answer

AD CS Certificate Mapping (mapping a rogue certificate to a domain account for persistent PKINIT authentication). Option A is correct because AD CS certificate mapping lets an attacker who controls a rogue CA or template map a certificate to a domain account, enabling persistent PKINIT authentication that survives password resets and is hard to detect. Option B is correct because SID History Injection appends a high-privileged SID (e.g., Domain Admins) to a standard user's sIDHistory attribute, granting that account privileged access that persists across sessions and is often overlooked by standard account reviews. Option C is correct because DCShadow registers a rogue Domain Controller via replication (using DRSUAPI) to inject objects and attribute changes directly into the AD database, bypassing normal change-tracking and many standard event logs. Option D is not a persistence mechanism—defrag.exe is a routine disk maintenance utility with no security or persistence impact on AD. Option E is also unrelated to persistence; modifying TCP/IP registry keys to disable DHCP client notifications is a network configuration tweak, not an Active Directory persistence technique.

Answer

Running the standard Windows Disk Defragmenter (defrag.exe) on the Domain Controller C: drive

Answer

Modifying the Windows TCP/IP stack registry keys to disable DHCP client notifications