CPENT Practice Test 16 — 15 Questions

Question 1

Which TWO methods can an operator use to mitigate or prevent detection while performing Kerberoasting during an internal penetration test?

Accepted Answer

Use AES encryption types exclusively to prevent RC4 weak encryption analysis. Kerberoasting generates standard TGS-REQ traffic that is difficult to stop without disabling RC4 or using strong passwords. Attackers minimize detection by requesting specific SPNs rather than bulk enumeration, or by using RC4/AES downgrades carefully.

Answer

Disable Kerberos pre-authentication on all service accounts

Answer

Export the NTDS.dit database directly over SMB

Answer

Perform offline cracking using dictionary and rule-based attacks against the retrieved TGS tickets

Question 2

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

Accepted Answer

All API requests are treated with full administrative privileges, allowing any compromised pod or user to execute arbitrary cluster-level commands.. Disabling Kubernetes RBAC means all requests to the Kubernetes API server are treated as cluster-admin with anonymous or unauthenticated/wildcard permissions, allowing full cluster compromise.

Answer

Azure Security Center deletes the cluster automatically.

Answer

Pods are automatically restricted from communicating with external IP addresses.

Answer

The AKS cluster control plane is automatically exposed to the public internet on port 22.

Question 3

Which TWO commands or tools are standard for performing AS-REP Roasting against an Active Directory domain from an external or internal position?

Accepted Answer

Rubeus.exe asreproast. GetNPUsers.py from Impacket and Rubeus (using 'rubeus asreproast') are the two primary tools used to request AS-REP responses for accounts without pre-auth.

Answer

secretsdump.py -asrep

Answer

SharpHound.exe -CollectionMethod ASREP

Answer

certipy asrep

Question 4

Which TWO configuration checks should a penetration tester perform when auditing an Active Directory domain for potential NTLM Relay vulnerabilities?

Accepted Answer

Verify if LDAP signing is disabled or set to 'Not Required' on domain controllers.. Auditing NTLM relay involves checking whether LDAP/SMB signing is required and whether Extended Protection for Authentication (EPA) is configured on IIS/AD CS web services.

Answer

Check if the domain functional level is set to Windows 2000 native.

Answer

Verify that all user accounts have Kerberos pre-authentication disabled.

Answer

Enumerate the total number of Service Principal Names registered to machine accounts.

Question 5

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

Accepted Answer

The user can attach an inline policy to their own IAM user granting full administrative access (AdministratorAccess).. An IAM user with iam:PutUserPolicy can attach an inline policy to their own user account or another user, granting themselves full administrative permissions.

Answer

The user can modify the AWS billing dashboard and delete all EC2 instances.

Answer

The user can decrypt all KMS keys in the AWS region.

Answer

The user can delete the AWS account root user credentials.

Question 6

An AWS penetration tester discovers that an Amazon DynamoDB table contains sensitive PII stored in plaintext, and the table is encrypted using the default AWS owned key rather than a customer managed KMS key. What is the security recommendation?

Accepted Answer

Migrate the table encryption to use AWS Customer Managed Keys (CMKs) in AWS KMS to gain granular auditing, rotation, and access control.. While AWS owned keys provide encryption at rest, migrating to customer-managed KMS keys provides finer access control, auditing, and key rotation capabilities.

Answer

Disable TLS for all connections to the DynamoDB table.

Answer

Convert the DynamoDB table into an unencrypted Amazon S3 bucket.

Answer

Enable AWS WAF web ACLs directly on the DynamoDB table endpoint.

Question 7

Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?

Accepted Answer

Sysinternals ProcDump.exe. Procdump (from Sysinternals) and Task Manager / comsvcs.dll or built-in tools likerundll32 with comsvcs.dll are common methods to dump LSASS. Tasklist is just for listing.

Answer

tasklist.exe /v

Answer

gpresult.exe /h report.html

Answer

netstat.exe -ano

Question 8

An AWS penetration tester identifies an EC2 instance configured with an IAM instance profile that grants broad s3:* permissions across all S3 buckets in the account. What AWS service feature should be recommended to restrict these permissions based on least privilege?

Accepted Answer

AWS IAM Access Analyzer and CloudTrail analysis to generate least-privilege IAM policies based on actual usage.. AWS IAM Access Analyzer helps identify unused permissions and allows policy generation based on actual access history.

Answer

AWS Shield Advanced to inspect and block unauthorized S3 API requests at the network layer.

Answer

AWS Trusted Advisor to enforce mandatory multi-factor authentication on all S3 API calls.

Answer

Amazon GuardDuty to automatically quarantine the EC2 instance upon detecting broad S3 access.

Question 9

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

Accepted Answer

Query 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01' with the header 'Metadata: true' to obtain an Azure access token using the managed identity.. Azure functions with managed identities can query the local IMDS endpoint (http://169.254.169.254/metadata/identity/oauth2/token) using a specific header (Metadata: true) to retrieve OAuth 2.0 access tokens for Azure resources.

Answer

Send a crafted SOAP request to the Azure Resource Manager endpoint to extract the storage account account key.

Answer

Extract the master deployment credentials from the Azure Web Job environment variables via port 443.

Answer

Exploit the Azure Function proxy configuration to read the /etc/passwd file from the underlying hypervisor.

Question 10

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

Accepted Answer

The user can launch a new EC2 instance and attach a privileged IAM role via iam:PassRole, then access the instance to obtain temporary security credentials.. An attacker with iam:PassRole and ec2:RunInstances can spin up an EC2 instance passing an elevated IAM role, then log into the instance via SSH or session manager to extract the role's temporary credentials.

Answer

The user can modify the trust policy of the root user account using iam:CreateRole.

Answer

The user can inject malicious code into the AWS Nitro Enclave hypervisor layer.

Answer

The user can escalate privileges by updating their own MFA device via the EC2 metadata service.

Question 11

A penetration tester is assessing a Kubernetes cluster deployment. Which THREE of the following container or cluster configurations represent severe container escape or privilege escalation risks? (Choose THREE)

Accepted Answer

Mounting the host filesystem root directory via a hostPath volume (hostPath: path: /).. Running containers as root, mounting the Docker socket, and mounting sensitive host paths like / or /etc allow direct host compromise.

Answer

Using NetworkPolicies to restrict ingress and egress traffic between namespaces.

Answer

Enabling automountServiceAccountToken: false on non-privileged application pods.

Question 12

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

Accepted Answer

Dnscat2. Dnscat2 or Iodine are prominent DNS tunneling tools used to route TCP traffic over DNS queries and responses, bypassing strict outbound port filters.

Answer

Socat

Answer

Metasploit Meterpreter reverse_tcp

Answer

Netcat

Question 13

Which TWO tools are commonly used for analyzing BloodHound database outputs or querying attack paths during an Active Directory penetration test?

Accepted Answer

The BloodHound graphical user interface application. BloodHound supports both the official BloodHound GUI (Electron app / web interface) and automated analysis tools like BloodHound Python (bloodhound-python) for collection, as well as Cypher queries within the GUI.

Answer

Mimikatz sekurlsa::logonpasswords

Answer

Impacket's GetUserSPNs.py

Answer

Certipy find

Question 14

During an Active Directory assessment, an operator discovers that the KRBTGT account password has not been rotated in over ten years. They decide to craft a Golden Ticket to maintain persistent domain-wide access. Which critical piece of information, in addition to the KRBTGT NTLM hash and domain SID, is strictly required to generate a fully valid Golden Ticket that includes group membership and privilege attributes?

Accepted Answer

The NTLM hash of the KRBTGT account and the Domain SID. When forging a Golden Ticket using Impacket's ticketer or Mimikatz, specifying the target user's RID (Relative Identifier) and valid Group RIDs (such as Domain Admins RID 512) is necessary, but the foundational secret required is the KRBTGT NTLM hash and the Domain SID. Additionally, the FQDN and domain GUID are needed, but the primary cryptographic key is the KRBTGT NTLM hash.

Answer

The Enterprise Admin public key certificate stored in the NTDS.dit

Answer

An active session token issued by the Active Directory Certificate Services (AD CS)

Answer

The plaintext password of the Domain Administrator and SYSVOL shared secret

Question 15

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Accepted Answer

By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.. If the namespace is exposed or pods running the default service account are compromised via an RCE vulnerability, the attacker can harvest sensitive application secrets across the entire cluster.

Answer

By executing a kernel-level exploit against the etcd database directly from outside the cluster.

Answer

By generating a self-signed certificate authority to impersonate the kube-apiserver.

Answer

By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.