CPENT Practice Test 17 — 15 Questions

Question 1

During an Active Directory assessment, an operator discovers that the KRBTGT account password has not been rotated in over ten years. They decide to craft a Golden Ticket to maintain persistent domain-wide access. Which critical piece of information, in addition to the KRBTGT NTLM hash and domain SID, is strictly required to generate a fully valid Golden Ticket that includes group membership and privilege attributes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NTLM hash of the KRBTGT account and the Domain SID. When forging a Golden Ticket using Impacket's ticketer or Mimikatz, specifying the target user's RID (Relative Identifier) and valid Group RIDs (such as Domain Admins RID 512) is necessary, but the foundational secret required is the KRBTGT NTLM hash and the Domain SID. Additionally, the FQDN and domain GUID are needed, but the primary cryptographic key is the KRBTGT NTLM hash.

Answer

The Enterprise Admin public key certificate stored in the NTDS.dit

Answer

An active session token issued by the Active Directory Certificate Services (AD CS)

Answer

The plaintext password of the Domain Administrator and SYSVOL shared secret

Question 2

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Accepted Answer

By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.. If the namespace is exposed or pods running the default service account are compromised via an RCE vulnerability, the attacker can harvest sensitive application secrets across the entire cluster.

Answer

By executing a kernel-level exploit against the etcd database directly from outside the cluster.

Answer

By generating a self-signed certificate authority to impersonate the kube-apiserver.

Answer

By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.

Question 3

A penetration tester is performing a container escape on a Kubernetes cluster. The tester gains remote code execution inside a pod and discovers that the container is running with privileged mode disabled, but the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has permissions to create new Pods using the cluster-admin cluster role. Which kubectl command or API call pattern should the tester use to achieve a container escape to the underlying host?

Accepted Answer

Create a pod specification with 'hostNetwork: true' and a 'hostPath' volume mounting '/' from the node to the container, then execute 'chroot /host' inside the new pod.. Since the container can create pods, it can use the Kubernetes API to create a new pod with hostPath volumes (e.g., mounting / on the host to /host inside the container) and hostNetwork: true, then chrooting into /host to execute commands on the underlying node.

Answer

Execute 'kubectl exec -it' using the token to attach to the kube-apiserver directly and modify the container runtime socket.

Answer

Modify the local /etc/shadow file inside the container to grant root access to the node kernel.

Answer

Send a malicious payload to the container runtime socket at /var/run/docker.sock to trigger a runC vulnerability.

Question 4

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Securing AD CS involves disabling NTLM authentication on web enrollment endpoints, enabling Extended Protection for Authentication (EPA), disabling enrollee-supplied SANs on vulnerable templates, and auditing templates using tools like Certipy.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 5

During an Azure assessment, an auditor finds that a Logic App has an HTTP trigger with no authentication mechanism configured (Anonymous access). The Logic App has permissions to read sensitive Azure Blob Storage containers. What type of vulnerability does this represent?

Accepted Answer

Insecure Direct Object Reference and unauthenticated workflow execution leading to data exfiltration.. Unauthenticated HTTP triggers in Azure Logic Apps allow external unauthenticated actors to invoke workflows, leading to unauthorized data access.

Answer

An OAuth token replay attack against the Azure Resource Manager control plane.

Answer

A Server-Side Request Forgery vulnerability within the Azure App Service sandbox.

Answer

A privilege escalation path from Contributor to Owner role.

Question 6

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Accepted Answer

It uses a computer account (AZUREADSSOACC$) in on-premises AD to generate Kerberos tickets for users authenticating to cloud services via browser redirection.. Seamless SSO uses a Kerberos computer account (AZUREADSSOACC$) registered in on-premises AD; if compromised or poorly managed, it can be targeted for Kerberoasting or ticket manipulation.

Answer

It requires all users to store their plaintext Active Directory passwords in Azure Key Vault.

Answer

It bypasses all Conditional Access policies for users connecting from corporate networks.

Answer

It forces the domain controllers to export NTLMv1 hashes to the Azure cloud directory.

Question 7

A penetration tester is assessing an AWS environment where an AWS Lambda function has an execution role with permissions to invoke other Lambda functions and update IAM policies. The function code is vulnerable to command injection. How can this be leveraged for persistence or privilege escalation?

Accepted Answer

Exploit the command injection vulnerability to execute AWS CLI commands using the Lambda execution role, allowing privilege escalation or creation of persistent IAM backdoors.. Command injection in a Lambda function allows an attacker to execute arbitrary commands, using the execution role to modify IAM policies or create new administrative users.

Answer

Trigger a buffer overflow in the AWS Lambda microVM hypervisor to gain root access to the underlying physical server.

Answer

Modify the Lambda function's VPC security group to expose the host kernel to the internet.

Answer

Inject malicious kernel modules into the Lambda execution container.

Question 8

A penetration tester is evaluating AWS IAM policies for privilege escalation paths. Which THREE of the following IAM action combinations enable direct or indirect privilege escalation in an AWS environment? (Choose THREE)

Accepted Answer

ec2:RunInstances combined with iam:PassRole allowing assignment of high-privilege IAM roles to newly launched instances.. iam:CreateAccessKey, iam:PutUserPolicy, and iam:PassRole combined with compute actions allow privilege escalation.

Answer

cloudwatch:PutMetricData combined with logs:CreateLogGroup.

Answer

s3:GetObject combined with s3:PutObject on non-sensitive S3 buckets.

Answer

rds:DescribeDBInstances combined with ec2:DescribeSecurityGroups.

Question 9

A penetration tester is evaluating cloud container security and hybrid orchestration platforms. Which THREE of the following techniques or conditions facilitate container escapes or host compromise? (Choose THREE)

Accepted Answer

Running a container with the --privileged flag, which disables nearly all kernel namespace and capability isolation.. Privileged mode, host PID/IPC namespaces, and write access to kernel release_agent files enable container escapes.

Answer

Enabling read-only root filesystems (readOnlyRootFilesystem: true) on container deployment manifests.

Answer

Using distroless container images that omit package managers and shells.

Answer

Implementing container image vulnerability scanning in the CI/CD pipeline.

Question 10

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. Writing a malicious payload to the release_agent file in cgroups combined with triggering a notification via the notify_on_release mechanism allows executing commands on the host as root.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 11

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

Accepted Answer

It allows unauthenticated invocation of the specific Azure Function endpoint associated with that key.. A leaked function key allows any external actor to invoke the specific Azure Function endpoint associated with that key, potentially triggering unauthorized backend logic or data access.

Answer

It allows the attacker to decrypt all Azure Key Vault secrets in the tenant.

Answer

It provides direct SSH root access to the underlying Azure App Service worker nodes.

Answer

It grants full Owner-level administrative access to the entire Azure subscription.

Question 12

An organization stores sensitive application backups in an Amazon S3 bucket. During a cloud penetration test, the tester finds that the S3 bucket policy explicitly allows 's3:GetObject' to '*' without any AWS:SourceIp or aws:SourceArn conditions, but the bucket is marked with 'Block Public Access' enabled at the account level. What is the impact of this configuration?

Accepted Answer

Public access is successfully blocked because S3 Account-level Block Public Access settings override individual bucket policies.. AWS S3 Account-level Block Public Access overrides all bucket policies and ACLs, ensuring that public access is blocked regardless of the overly permissive policy.

Answer

Anyone on the internet can read the objects because the bucket policy takes precedence over account settings.

Answer

An error occurs during S3 bucket creation, preventing the policy from being applied.

Answer

The bucket becomes completely inaccessible even to internal authenticated AWS IAM users.

Question 13

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Accepted Answer

post/multi/manage/autoroute. auxiliary/server/socks_proxy combined with autoroute (run autoroute -s <subnet>) or ssh_login allows pivoting through an SSH session. Specifically, post/multi/manage/autoroute is commonly used to add routes through a session.

Answer

auxiliary/server/socks4a

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/unix/ssh/libssh_auth_bypass

Question 14

During an assessment of a smart manufacturing facility, a penetration tester discovers an unauthenticated MQTT broker allowing anonymous publishing and subscription. Which TWO actions should the tester perform to validate the security risks associated with this misconfiguration? (Choose TWO)

Accepted Answer

Publish arbitrary control messages to actuator topics to test if physical machinery responds to unauthorized commands. An unauthenticated MQTT broker allows anyone to subscribe to all topics (# wildcard) to intercept sensitive telemetry, or publish malicious commands to actuator topics. Therefore, subscribing to all topics and testing command injection via unauthorized publishing are the correct validation steps. Port scanning and password cracking are unnecessary when authentication is already known to be absent.

Answer

Perform an aggressive TCP port scan using Nmap to identify non-standard service ports

Answer

Capture WPA2 four-way handshakes to crack the underlying Wi-Fi pre-shared key

Answer

Execute a brute-force dictionary attack against the MQTT broker management interface using Hydra

Question 15

A penetration tester is analyzing a Kubernetes cluster where a pod has the hostPath volume configured to mount the host's /var/run/docker.sock file. The container runs a standard Linux distribution without tools installed. How can the tester leverage this configuration to achieve a full cluster takeover?

Accepted Answer

Use the Docker CLI or API via the mounted socket to spin up a new container with the host root filesystem mounted at /mnt, then chroot into /mnt.. Mounting the Docker socket inside a container allows the container to interact with the host Docker daemon, enabling the creation of new containers with arbitrary host paths mounted.

Answer

Execute a container breakout by exploiting CVE-2019-5736 against the containerd runtime socket.

Answer

Extract the kube-apiserver TLS private key from the Docker daemon cache.

Answer

Send crafted HTTP requests to the Kubernetes API server using the Docker socket as a proxy.