CPENT Practice Test 16 — 15 Questions

Question 1

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dnscat2. Dnscat2 is a purpose-built DNS tunneling tool that encapsulates arbitrary TCP traffic inside DNS queries and responses, allowing it to traverse egress filters that only permit port 53. It uses a client-server architecture where the server acts as an authoritative DNS server, and the client encodes data in DNS record types (TXT, CNAME, MX, etc.), effectively creating a covert command-and-control channel. Because the traffic appears as legitimate DNS queries, it bypasses firewalls that block all other outbound TCP/UDP ports.

Answer

Socat

Answer

Metasploit Meterpreter reverse_tcp

Answer

Netcat

Question 2

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

Accepted Answer

It allows unauthenticated invocation of the specific Azure Function endpoint associated with that key.. Azure Function keys are per-function (or per-host) shared secrets used only to authorize HTTP invocations of that function's endpoint. A leaked function-level key lets an unauthenticated attacker call that specific function URL, but it does not grant Azure RBAC permissions, Key Vault access, or subscription-level control. The blast radius is limited to whatever the function itself does.

Answer

It allows the attacker to decrypt all Azure Key Vault secrets in the tenant.

Answer

It provides direct SSH root access to the underlying Azure App Service worker nodes.

Answer

It grants full Owner-level administrative access to the entire Azure subscription.

Question 3

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

Accepted Answer

enip-info. Nmap includes the 'enip-info' NSE script specifically designed to query EtherNet/IP devices for identification and vendor details.

Answer

modbus-discover

Answer

bacnet-discover

Answer

dnp3-info

Question 4

You have gained access to a Linux host and escalated to root. You want to maintain persistence by creating a backdoor that will execute a reverse shell each time the system reboots. Which method would best achieve this while evading common detection mechanisms?

Accepted Answer

Modify an existing systemd service file to include an ExecStartPre directive that runs a reverse shell.. Persistence on Linux often involves startup scripts, but stealthy persistence requires blending into existing configurations. Modifying an existing systemd service file with an ExecStartPre directive allows the backdoor to run as part of a legitimate service's startup sequence. This avoids creating new files that might be flagged and leverages the trust associated with system services. It also ensures execution on reboot, maintaining access.

Answer

Add a reverse shell command to /etc/rc.local.

Answer

Add a cron job with @reboot that executes a reverse shell.

Answer

Create a systemd service unit file in /etc/systemd/system/ that runs a reverse shell.

Question 5

An assessment team is analyzing an embedded Linux firmware image for an industrial IoT gateway. They have successfully extracted the filesystem using Binwalk, but they need to statically analyze the compiled binaries for potential buffer overflows and insecure function calls. Which tool is specifically designed to perform static binary analysis and identify vulnerable functions likestrcpy within the extracted filesystem?

Accepted Answer

Ghidra. Ghidra is a reverse-engineering framework developed by the NSA that performs static binary analysis, disassembly, and decompilation. It can load extracted ELF binaries from a firmware filesystem and identify insecure function calls like strcpy, gets, and sprintf by examining the symbol table, imports, and decompiled code, making it ideal for finding buffer overflow candidates.

Answer

Aircrack-ng

Answer

Binwalk

Answer

John the Ripper

Question 6

A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?

Accepted Answer

Use the key to authenticate with gcloud auth activate-service-account and then list and access resources.. A leaked service account key file allows an attacker to authenticate as that service account. Using gcloud auth activate-service-account with the key file grants the tester the service account's permissions, which include the editor role. This provides broad access to the project's resources, enabling the tester to list, read, and modify data, and potentially escalate further.

Answer

Use the key to sign a JWT and impersonate a user with higher privileges.

Answer

Use the key to decrypt data in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK).

Answer

Use the key to access the GCP metadata server and retrieve instance credentials.

Question 7

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

Accepted Answer

The NTLM password hash of the specific service account. A Silver Ticket is forged for a specific service using the NTLM hash of the service account running that service (e.g., MSSQL or CIFS service account), rather than the KRBTGT hash.

Answer

The plaintext password of the Domain Administrator

Answer

The Domain Controller's computer account machine password

Answer

The domain root CA private key (.pfx)

Question 8

During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?

Accepted Answer

Pass-the-Hash. Pass-the-Hash (PtH) abuses the NTLM authentication protocol by replaying a captured NTLM hash directly to authenticate to remote systems without ever cracking it to plaintext. CrackMapExec's smb/wmi/winrm modules accept the -H flag to inject the hash into the NTLM challenge-response, which is exactly the technique described. Because NTLMv1/NTLMv2 authentication only requires knowledge of the hash (not the password), the tester gains access to other workstations.

Answer

Pass-the-Ticket

Answer

Kerberoasting

Answer

Over-Pass-the-Hash

Question 9

During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?

Accepted Answer

mitmproxy. mitmproxy is an interactive HTTPS/TLS interception proxy that can be configured with a custom CA certificate; because the IoT client has certificate validation disabled, it will accept mitmproxy's forged certificate and the analyst can decrypt and inspect the MQTT-over-TLS traffic. This makes it the right tool for transparently proxying TLS-wrapped MQTT.

Answer

Airodump-ng

Answer

Ncat

Answer

Hping3

Question 10

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

Accepted Answer

Iodine. Iodine is a specialized tunneling tool designed specifically to tunnel IPv4 traffic through a DNS server, making it ideal for bypassing networks that only allow outgoing DNS traffic.

Answer

Socat

Answer

Chisel

Answer

Netcat

Question 11

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Accepted Answer

/etc/passwd. Option A, /etc/passwd, is correct because it enumerates local user accounts (UIDs, GIDs, home directories, and login shells), which is essential for identifying valid usernames for credential attacks or privilege-escalation targets. Option C, ~/.ssh/, is correct because this directory typically holds private keys (id_rsa), authorized_keys, and known_hosts, which can yield reusable credentials for lateral movement or persistence. Option D, /etc/crontab, is correct because it defines system-wide scheduled tasks, revealing scripts or binaries that may run as root and can be abused for privilege escalation. Option B, /proc/version, is not among the selected answers because it only discloses kernel and compiler version information, which is useful for exploit matching but not for locating configuration data, credentials, or cron jobs. Option E, /var/log/syslog, is not among the selected answers because it contains system event logs rather than the sensitive configuration files, credential stores, or scheduled-task definitions the question asks for.

Answer

/proc/version

Answer

/var/log/syslog

Question 12

During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?

Accepted Answer

Nikto. Nikto is a web server scanner that includes a comprehensive database of checks for CGI vulnerabilities, including OS command injection flaws in CGI scripts. It specifically tests for known CGI issues like Shellshock, default CGI scripts, and parameter injection points. The tool sends crafted HTTP requests to CGI endpoints and analyzes responses for signs of command execution, making it the correct choice for detecting web-based CGI vulnerabilities and command injection.

Answer

Reaver

Answer

Masscan

Answer

Aircrack-ng

Question 13

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

Accepted Answer

smtp-user-enum. SMTP-User-Enum is a classic tool used for enumerating OS user accounts via the SMTP service (VRFY, EXPN, RCPT TO commands).

Answer

Enum4linux

Answer

Wpscan

Answer

Nikto

Question 14

A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?

Accepted Answer

LDAP NTLM Relay. When LDAP signing is not enforced, an attacker can perform an NTLM relay attack against the LDAP service. By relaying NTLM authentication attempts to a domain controller's LDAP endpoint, the attacker can gain access to directory services, potentially creating or modifying objects, and escalating privileges. This is because without signing, the LDAP server accepts unsigned authentication requests, making it vulnerable to relay.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

Golden Ticket forgery

Question 15

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

Accepted Answer

John the Ripper. John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Answer

Binwalk

Answer

Nmap

Answer

Tcpdump