CPENT Practice Test 19 — 15 Questions

Question 1

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Neo-reGeorg. Neo-reGeorg is a tunneling tool that encapsulates TCP traffic within HTTP/HTTPS requests, allowing a compromised host to relay traffic through web servers even when only port 443 egress is permitted. It is designed specifically for egress bypass in restricted environments.

Answer

Netcat

Answer

Traceroute

Answer

DNS2TCP

Question 2

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Accepted Answer

Using PowerShell to download and execute a script in memory.. LotL involves using pre-installed system tools (like PowerShell or WMI) to conduct malicious activities, minimizing the need for custom malware.

Answer

Installing a rootkit driver.

Answer

Deploying a custom C++ backdoor.

Answer

Using a known Metasploit payload.

Question 3

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

Accepted Answer

Nmap Xmas Tree Scan (-sX). The Xmas Tree scan (-sX) is named for the three flags it sets — FIN, PSH, and URG — which 'light up' the TCP header like a Christmas tree. Per RFC 793, a closed port must respond to a packet with no SYN/ACK/RST with an RST, while an open port silently discards it, so the scan infers port state from the presence or absence of an RST.

Answer

Nmap Null Scan (-sN)

Answer

Nmap Window Scan (-sW)

Answer

Nmap FIN Scan (-sF)

Question 4

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Accepted Answer

Compiling and loading a malicious Loadable Kernel Module (LKM) rootkit.. Loadable Kernel Modules (LKMs) allow attackers to run code in kernel space, hide processes, files, and network connections, and persist across reboots if loaded at boot time.

Answer

Modifying the SSH authorized_keys file for the root user.

Answer

Creating a systemd service unit file that executes a reverse shell.

Answer

Placing a persistent cron job in /etc/cron.d/

Question 5

A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?

Accepted Answer

A UDP broadcast packet containing a BACnet Who-Is request sent to port 47808. BACnet's Who-Is service is a broadcast request used for device discovery; it is sent as a UDP datagram to the BACnet/IP broadcast address on port 47808 (0xBAC0). Any BACnet device on the subnet responds with an I-Am message containing its device instance and address, allowing discovery without prior IP knowledge.

Answer

An ICMP ping sweep to identify all live IP addresses on the local network segment

Answer

An SNMP GETBULK request using the default private community string

Answer

A TCP SYN scan directed at port 47808 across the entire subnet

Question 6

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Accepted Answer

Executing a DCSync attack using tools like Mimikatz to request replication data from a Domain Controller.. DCSync is an attack technique that abuses the Directory Replication Service (DRS) remote protocol to simulate a domain controller and request password data (hashes) for user accounts from another domain controller.

Answer

Kerberoasting against computer accounts.

Answer

Performing an AS-REP Roasting attack on users with Kerberos pre-authentication disabled.

Answer

Running Responder on the local subnet to capture NTLMv2 hashes.

Question 7

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Accepted Answer

AWS VPC Endpoints powered by AWS PrivateLink.. AWS VPC Endpoints (powered by AWS PrivateLink) allow private connections between VPCs and AWS services or other VPCs without internet gateways.

Answer

Amazon CloudFront origin access control (OAC).

Answer

AWS Web Application Firewall (WAF) rule groups.

Answer

AWS Identity and Access Management resource-based policies.

Question 8

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

Accepted Answer

smb-vuln-ms17-010. The NSE script smb-vuln-ms17-010 is specifically designed to detect whether a Windows host is vulnerable to the MS17-010 (EternalBlue) SMBv1 vulnerability. It sends a crafted SMB packet to check for the presence of the vulnerability without exploiting it, thus avoiding service crashes. This script is part of the standard Nmap Scripting Engine and is the correct tool for non-intrusive vulnerability verification.

Answer

smb-brute

Answer

smb-enum-shares

Answer

smb-os-discovery

Question 9

You have compromised a Linux server and want to exfiltrate sensitive data to an external server. The network egress filtering only allows DNS traffic (UDP port 53) to a specific internal DNS resolver. Which technique would best allow you to exfiltrate data over DNS while evading detection?

Accepted Answer

Use dnscat2 with a custom domain and encode data in DNS queries.. DNS tunneling is a reliable method for data exfiltration when only DNS traffic is allowed. dnscat2 establishes a command-and-control channel over DNS by encoding data in DNS queries and responses. It can use various record types and is designed to evade detection by blending with legitimate DNS traffic. Since the scenario permits DNS to a specific resolver, the attacker can configure dnscat2 to use that resolver, ensuring the traffic is not blocked.

Answer

Use SSH tunneling to forward data through the internal DNS resolver.

Answer

Use HTTP GET requests to a web server with data encoded in the URL.

Answer

Use ICMP tunneling with ptunnel to encapsulate data in ping packets.

Question 10

A client asks you to verify that their perimeter router does not leak internal topology information to the internet. You want to send crafted probe packets with varying TTL values and observe the ICMP responses to map the path and infer router interfaces. Which technique should you use?

Accepted Answer

Use traceroute with incrementing TTL values to elicit ICMP time-exceeded messages from each hop.. Traceroute manipulates the TTL field so that each successive router discards the packet and returns an ICMP time-exceeded message bearing its own address. Analyzing these replies maps the path and reveals which router interfaces respond, showing whether internal topology is exposed at the perimeter. Port scanning, Nmap's traceroute complement, and IGMP queries do not elicit hop-by-hop interface responses.

Answer

Run a TCP SYN scan with the --traceroute option to enumerate open ports on each hop.

Answer

Send IGMP membership reports to the perimeter router to enumerate its multicast routing interfaces.

Answer

Perform a UDP scan against high ports on the perimeter router to read its routing table.

Question 11

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Accepted Answer

Adding a controlled user account to the Domain Admins or Enterprise Admins group.. Option B is correct because adding a controlled account to Domain Admins or Enterprise Admins grants it persistent, high-privilege domain-wide access that survives reboots and is a classic AD persistence technique (e.g., via net group "Domain Admins" user /add /domain or Add-ADGroupMember). Option E is correct because injecting a privileged SID (such as the Domain Admins or Enterprise Admins SID) into the sIDHistory attribute of a controlled account lets that account inherit the privileges of the injected SID during token creation, providing stealthy persistence that is not visible through normal group membership. Option A is not an AD persistence mechanism; disabling Defender real-time monitoring is a host-level defense evasion action that does not survive as a directory-based persistence foothold. Option C is a local scheduled task, which is host persistence rather than an Active Directory mechanism. Option D is merely a local ARP cache flush, a network troubleshooting action with no persistence value.

Answer

Disabling Windows Defender real-time monitoring via PowerShell.

Answer

Configuring a local Windows scheduled task to run netsh.

Answer

Flushing the local ARP cache on the workstation.

Question 12

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Accepted Answer

winrs -r:TargetServer -u:Administrator -p:Password cmd.exe. The winrs utility is the built-in Windows Remote Shell client that uses WinRM (Windows Remote Management) over HTTP (port 5985) or HTTPS (port 5986). It allows an attacker with valid credentials to execute commands interactively on a remote system when SMB is blocked but WinRM is open. The syntax '-r:TargetServer' specifies the remote host, and the command to run (e.g., cmd.exe) is provided at the end.

Answer

rpcclient -U Administrator TargetServer

Answer

nbtstat -A TargetServer -winrm

Answer

mstv -target:TargetServer -port:5985

Question 13

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

Accepted Answer

Null scan (-sN). Xmas scan (-sX), FIN scan (-sF), and Null scan (-sN) rely on non-standard or empty TCP flag combinations that modern stateful firewalls drop automatically.

Answer

TCP SYN scan (-sS)

Answer

TCP Connect scan (-sT)

Question 14

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Accepted Answer

A security group allowing inbound TCP port 3389 (RDP) from 0.0.0.0/0.. Option A is correct because a security group permitting inbound TCP 3389 (RDP) from 0.0.0.0/0 exposes Windows Remote Desktop to the entire internet, inviting brute-force and ransomware attacks. Option D is correct because allowing inbound TCP 22 (SSH) from 0.0.0.0/0 exposes Linux/Unix remote shell access to all source IPs, enabling credential brute-forcing and exploitation of SSH vulnerabilities. Option B is not a risk but a mitigation, since AWS Shield Advanced provides enhanced DDoS protection for Application Load Balancers. Option C is not a risk because AWS PrivateLink privately connects VPCs to endpoint services without exposing traffic to the public internet. Option E is not a risk because VPC Flow Logs to an encrypted S3 bucket is a secure, recommended monitoring practice.

Answer

Enabling AWS Shield Advanced for DDoS protection on Application Load Balancers.

Answer

Using AWS PrivateLink to connect securely to VPC endpoint services.

Answer

A VPC Flow Log enabled and streaming traffic data to an encrypted S3 bucket.

Question 15

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Accepted Answer

wevtutil cl . Option A, `wevtutil cl `, is correct because wevtutil is the built-in Windows command-line utility for managing event logs, and the `cl` (clear-log) subcommand clears the specified log (e.g., `wevtutil cl Security`), directly serving the goal of erasing log evidence. Option E, `Clear-EventLog -LogName `, is correct because it is the native PowerShell cmdlet that clears a specified event log on the local or remote computer, providing the same log-clearing capability through PowerShell. Option B, `netsh advfirewall reset`, is incorrect because it restores Windows Firewall configuration to default, which is unrelated to event log management. Option C, `taskkill /f /im lsass.exe`, is incorrect because it force-terminates the LSASS process, which would crash the system and does not manage event logs. Option D, `ipconfig /flushdns`, is incorrect because it only clears the DNS resolver cache and has no effect on Windows Event Logs.

Answer

netsh advfirewall reset

Answer

taskkill /f /im lsass.exe

Answer

ipconfig /flushdns