CPENT Practice Test 18 — 15 Questions

Question 1

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unauthenticated clients can invoke the specific API method directly, bypassing the intended AWS IAM signature authentication.. Setting an API Gateway method to Authorization: None bypasses IAM authentication for that specific endpoint, allowing unauthenticated execution of the backend Lambda or HTTP integration.

Answer

AWS WAF will automatically block all traffic to the API Gateway.

Answer

CloudFront distribution logs will fail to record incoming requests.

Answer

The API Gateway becomes vulnerable to SQL injection attacks against its internal DynamoDB storage.

Question 2

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Accepted Answer

smb || smb2. SMB traffic relies heavily on SMB and SMB2 protocols. The display filter 'smb || smb2' isolates SMB protocol transactions.

Answer

kerberos

Answer

ldap

Answer

http.request or ftp.request

Question 3

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

Accepted Answer

Nbtscan. Nbtscan is a program that scans IP networks for NetBIOS name information.

Answer

Tcpdump

Answer

Hydra

Answer

Sqlmap

Question 4

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Accepted Answer

-PA80. The -PA flag in Nmap specifies a TCP ACK probe to determine if hosts are alive, as port 80 is frequently allowed through corporate firewalls.

Answer

-PS80

Answer

-PE

Answer

-PU80

Question 5

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Accepted Answer

Snmpwalk. Snmpwalk is a standard command-line utility used to query SNMP agents and walk the MIB tree to extract system information.

Answer

Rpcinfo

Answer

Smbclient

Answer

NFSstat

Question 6

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

Accepted Answer

arp -a. Windows provides several native commands for network enumeration, including 'netstat' for connections and ports, 'route print' for routing tables, and 'arp -a' for the ARP cache.

Answer

systeminfo

Answer

ipconfig /release

Question 7

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

Accepted Answer

The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.. The default compute service account with full cloud-platform scope grants broad access to GCP APIs unless further restricted by IAM roles.

Answer

Google Cloud automatically rotates the service account private key every 60 seconds.

Answer

The instance is automatically accessible via SSH from any external IP address without firewall rules.

Answer

The instance metadata server disables access tokens to prevent Server-Side Request Forgery.

Question 8

A penetration tester is auditing an AWS environment and investigating potential privilege escalation paths via IAM. Which TWO of the following IAM permission combinations represent classic privilege escalation vectors in AWS? (Choose two)

Accepted Answer

iam:CreatePolicyVersion combined with iam:SetDefaultPolicyVersion. Certain IAM permissions allow a user to escalate their privileges. Examples include iam:CreateAccessKey, iam:PutUserPolicy, iam:UpdateAssumeRolePolicy, and iam:CreatePolicyVersion. Let's evaluate the choices.

Answer

lambda:InvokeFunction and lambda:CreateFunctionUrl

Answer

s3:PutBucketPolicy and s3:GetObject

Answer

iam:CreateAccessKey and iam:PutUserPolicy

Question 9

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Accepted Answer

Responder. Responder is the standard tool used to poison LLMNR, NBT-NS, and mDNS requests, capturing authentication hashes or relaying them to other targets.

Answer

Cain & Abel

Answer

Ettercap

Answer

Wireshark

Question 10

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Accepted Answer

-O. Nmap provides OS fingerprinting using the -O flag, which sends a series of TCP and UDP packets to the target and compares the responses to a database of known OS signatures.

Answer

-A

Answer

-sV

Answer

--traceroute

Question 11

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Accepted Answer

The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.. A misconfigured trust policy trusting an external account without a mandatory ExternalID condition exposes the role to the 'Confused Deputy' problem or unauthorized assumption by actors in the trusted account.

Answer

The EC2 instance is vulnerable to local root privilege escalation via kernel module injection.

Answer

AWS CloudTrail logs for the instance are permanently deleted.

Answer

The third-party account gains direct SSH access to the EC2 instance filesystem.

Question 12

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

Accepted Answer

Disabling multi-factor authentication requirements for global administrator accounts during emergency maintenance windows.. Disabling MFA for privileged accounts and using never-expiring passwords for service accounts are insecure.

Answer

Enforcing strong password complexity and expiration policies for all cloud user accounts.

Answer

Implementing Microsoft Entra ID Protection to detect compromised credentials and risky sign-ins.

Answer

Utilizing Azure AD managed identities for Azure resources instead of hardcoded credentials.

Question 13

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

Accepted Answer

ssh -L 3306:10.0.0.50:3306 user@pivot_ip. ssh -L local_port:target_ip:target_port user@pivot_host establishes local port forwarding. Thus, ssh -L 3306:10.0.0.50:3306 user@pivot_ip is correct.

Answer

ssh -D 3306 user@pivot_ip

Answer

ssh -C -N user@pivot_ip

Answer

ssh -R 3306:10.0.0.50:3306 user@pivot_ip

Question 14

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

Accepted Answer

Netdiscover. netdiscover is an active/passive ARP reconnaissance tool designed specifically to scan live hosts on a local network segment using ARP requests.

Answer

Wireshark

Answer

Nikto

Answer

Sqlmap

Question 15

A penetration tester is reviewing an Azure Active Directory (Azure AD) tenant and finds that user writeback and device writeback are enabled in Azure AD Connect, but the service account lacks appropriate permissions in on-premises Active Directory. What security risk does misconfigured Azure AD Connect writeback pose?

Accepted Answer

If compromised, cloud-based attackers could potentially manipulate synchronized objects or abuse writeback channels to affect on-premises Active Directory integrity.. Misconfigured writeback permissions or insecure cloud-to-on-premises sync configurations can allow compromised cloud accounts to modify on-premises objects, potentially leading to privilege escalation in the local AD.

Answer

It automatically grants all Azure AD users Domain Admin privileges on the on-premises domain controllers.

Answer

It allows cloud-only users to bypass conditional access policies by syncing fake device objects.

Answer

It exposes the Azure AD global administrator password in plaintext via the Active Directory Recycle Bin.