CPENT Practice Test 18 — 15 Questions

Question 1

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Netcat. Netcat can open a raw TCP connection to the FTP port and display the server's banner immediately upon connection, revealing the FTP software and version without performing a login. A simple nc target 21 returns the 220 service-ready banner, which is exactly the lightweight banner grab the question asks for.

Answer

Wpscan

Answer

Hashcat

Answer

Airbase-ng

Question 2

You are conducting an external penetration test against a company that uses a Cisco ASA firewall. You have identified that the firewall is running an older firmware version. Which technique would best allow you to bypass the firewall's access control lists to reach an internal web server on port 80?

Accepted Answer

Exploiting a known vulnerability in the ASA firmware to gain access. Exploiting a known vulnerability in outdated Cisco ASA firmware can yield direct access or the ability to bypass ACLs, enabling reach to internal resources. The scenario emphasizes older firmware, signaling that a vulnerability exploit is the most effective route. Other techniques like fragmentation or source routing are typically mitigated by modern firewalls and do not provide a reliable ACL bypass in this context.

Answer

Fragmented packet attack using overlapping IP fragments

Answer

TCP port redirection using a compromised external host

Answer

Source routing with the IP Record Route option

Question 3

During an internal penetration test, an operator gains access to a domain-joined Windows workstation and discovers that the current user has local administrator rights on that machine. The operator wants to extract the NTLM hash of the domain administrator who previously logged into this workstation. Which of the following locations is MOST likely to contain this credential material?

Accepted Answer

LSASS process memory. LSASS memory is the primary location where Windows caches credential material for logged-on users, including NTLM hashes and Kerberos tickets. When a domain administrator logs into a workstation, their credentials are cached in LSASS, allowing tools like Mimikatz to extract them if the operator has local admin rights and can access LSASS. This is a common privilege escalation path in Active Directory environments.

Answer

Group Policy Preferences XML files

Answer

SAM registry hive

Answer

NTDS.dit file

Question 4

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

Accepted Answer

By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.. A ClusterRole granting get/list/watch on secrets, bound cluster-wide to a service account in a public namespace, means any holder of that SA token can read every secret in every namespace via the API server. An external attacker who exploits an application vulnerability (e.g., SSRF, RCE, or a leaked token) to obtain the mounted service account token can then call the Kubernetes API with that bearer token and dump cluster-wide secrets, including database credentials, TLS keys, and other service account tokens.

Answer

By executing a kernel-level exploit against the etcd database directly from outside the cluster.

Answer

By generating a self-signed certificate authority to impersonate the kube-apiserver.

Answer

By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.

Question 5

During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?

Accepted Answer

Retrieve a secret from the Key Vault that contains credentials for a service principal with higher privileges, then authenticate as that service principal.. The managed identity can read secrets from Key Vault. Secrets often contain credentials for other identities. By retrieving a secret that holds higher-privileged credentials, the tester can authenticate as that identity and escalate privileges. This is a common lateral movement technique in Azure.

Answer

Modify the Key Vault's firewall rules to allow the tester's IP address, then access the Key Vault directly with the managed identity token.

Answer

Use the managed identity to add a new access policy to the Key Vault that grants the tester's own Azure AD user full permissions.

Answer

Use the managed identity to export the Key Vault's private keys and then forge a token for an Azure AD administrator.

Question 6

An operator has obtained a valid Kerberos Ticket Granting Ticket (TGT) in the form of a .kirbi file from a compromised domain-joined Linux host. They want to convert this .kirbi file into a .ccache file so that it can be used with Impacket tools on their attack VM. Which of the following tools is specifically designed for this conversion?

Accepted Answer

ticketConverter.py. When an operator has a TGT in .kirbi format and needs to use it with Impacket tools on Linux, they must convert it to .ccache format. ticketConverter.py is specifically built for this conversion, accepting a .kirbi file as input and outputting a .ccache file. This enables the use of tools like psexec.py or wmiexec.py with the -k -no-pass option and the KRB5CCNAME environment variable pointing to the converted cache.

Answer

secretsdump.py

Answer

getTGT.py

Answer

kekeo.exe

Question 7

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

Accepted Answer

The user can launch a new EC2 instance and attach a privileged IAM role via iam:PassRole, then access the instance to obtain temporary security credentials.. The combination of ec2:RunInstances, iam:PassRole, and iam:CreateRole allows a user to launch an EC2 instance with an attached IAM role that has higher privileges. By passing a privileged role to the instance (iam:PassRole), the user can then access the instance (e.g., via SSH or SSM) and retrieve temporary credentials from the instance metadata, effectively escalating privileges. The iam:CreateRole permission can be used to create a new role with elevated permissions if needed.

Answer

The user can modify the trust policy of the root user account using iam:CreateRole.

Answer

The user can inject malicious code into the AWS Nitro Enclave hypervisor layer.

Answer

The user can escalate privileges by updating their own MFA device via the EC2 metadata service.

Question 8

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

Accepted Answer

ProcDump. ProcDump, part of the Sysinternals suite, can create a memory dump of a running process by name or PID, so running it against lsass.exe produces a dump file that can later be parsed offline with Mimikatz or similar tools to recover cached credentials and hashes. It is frequently abused by red teams because it is a legitimate, signed Microsoft utility that is less likely to trigger antivirus than custom dumpers.

Answer

Process Explorer

Answer

TCPView

Answer

Autoruns

Question 9

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

Accepted Answer

Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'. Option D is correct because Nmap's NSE script engine includes ICS-specific scripts like modbus-discover, s7-info, and enip-info that actively probe Modbus/TCP (port 502), Siemens S7comm (port 102), and EtherNet/IP (port 44818) to identify and fingerprint PLCs, RTUs, and other industrial devices. Option E is correct because dedicated OT asset-discovery platforms such as Nozomi Guardian, Claroty, and Dragos Platform passively and/or actively inventory ICS/SCADA assets, extracting vendor, model, firmware, and protocol details across industrial networks. Option A is wrong because Aircrack-ng is a Wi-Fi auditing suite and does not inject BLE advertisements into smart meters. Option B is wrong because sqlmap targets SQL injection in web applications and has nothing to do with ICS device fingerprinting. Option C is wrong because Hashcat cracking WPA2-Enterprise handshakes is a wireless credential attack, not OT asset discovery.

Answer

Using 'Aircrack-ng' to inject Bluetooth Low Energy advertisements into nearby smart meters

Answer

Running 'sqlmap' against TCP port 80 to extract database schemas from the corporate ERP

Answer

Cracking WPA2 enterprise handshakes using Hashcat and a dictionary list

Question 10

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Accepted Answer

Insecure Scheduled Task Permissions / Writable Task Executable. If a scheduled task runs as SYSTEM or an admin, and the underlying script or binary is writable by low-privileged users, it represents an insecure file permissions vulnerability leading to privilege escalation when the task triggers.

Answer

Unquoted service path exploitation involving spaces in service binary names.

Answer

DLL Hijacking via PATH environment variable manipulation.

Answer

Kerberoasting against domain service principal names.

Question 11

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

Accepted Answer

setenv bootargs ${bootargs} init=/bin/sh. U-Boot uses environment variables to define boot parameters. Appending 'init=/bin/sh' or 'init=/bin/bash' to the 'bootargs' variable forces the kernel to launch a shell instead of the standard init process.

Answer

tftp 0x80000000 kernel.bin

Answer

printenv mtdparts

Answer

run flash_os_image

Question 12

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

Accepted Answer

The port is closed.. An ICMP Port Unreachable message (Type 3, Code 3) is returned by the target host when a UDP packet is sent to a port with no listening service. This indicates the port is closed — the host is reachable and actively responding, but no application is bound to that UDP port. It is a definitive sign that the port is not open.

Answer

The host is offline.

Answer

The port is filtered by a firewall.

Answer

The port is open and active.

Question 13

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

Accepted Answer

Appending a public key to ~/.ssh/authorized_keys. Option C is correct because appending an attacker-controlled public key to ~/.ssh/authorized_keys grants persistent SSH access to the compromised account without needing the user's password, a classic Linux persistence technique. Option D is correct because adding a job to /etc/crontab (or /etc/cron.d, user crontabs) causes the scheduled command to execute repeatedly, re-establishing access or running malicious code on a recurring basis. Option E is correct because creating a custom systemd service (e.g., a unit file in /etc/systemd/system enabled with systemctl enable) causes the malicious process to start automatically at boot, providing durable persistence. Option A is not a standard persistence technique: replacing the default bash shell would break normal login behavior and is not a recognized method for maintaining covert access. Option B is not practical for persistence: modifying kernel source code requires recompiling and reinstalling the kernel, which is far too invasive and disruptive compared to typical persistence mechanisms.

Answer

Replacing the default bash shell

Answer

Modifying the kernel source code

Question 14

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Accepted Answer

scp. Option A (scp) is correct because it runs over SSH and encrypts the entire file transfer session, making it a standard encrypted exfiltration channel out of the box. Option B (curl using HTTPS) is correct because HTTPS wraps HTTP in TLS, so uploading the archive to an HTTPS endpoint encrypts the data in transit without additional tooling. Option C (sftp) is correct because it is the SSH File Transfer Protocol, tunneling file operations through SSH for encryption by default. Option D (nc/Netcat) is not correct because it transmits raw data with no built-in encryption, so the archive would cross the network in cleartext. Option E (ftp) is not correct because standard FTP sends credentials and data unencrypted, requiring FTPS or SFTP for any confidentiality.

Answer

nc (Netcat)

Answer

ftp

Question 15

A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?

Accepted Answer

Binwalk. Binwalk is the industry-standard tool for searching binary images for embedded file systems and executable code signatures.

Answer

Wireshark

Answer

Metasploit Framework

Answer

Aircrack-ng