CPENT Practice Test 19 — 15 Questions

Question 1

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

Accepted Answer

An IAM role trust policy that permits assumption by any AWS account across the entire AWS partition without external ID checks.. Wildcard principal in resource policies and overly broad KMS key policies are insecure.

Answer

Enabling Amazon S3 Object Versioning on critical document storage buckets.

Answer

Enabling AWS KMS key rotation for all customer-managed cryptographic keys annually.

Answer

An AWS KMS key policy granting kms:* permissions to the root user and trusted admin roles only.

Question 2

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster or Dirb are standard tools for brute-forcing directories and files on web servers. Gobuster is written in Go and is very fast.

Answer

Nmap

Answer

Netcat

Answer

Hping3

Question 3

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Accepted Answer

Bettercap. Bettercap or Ettercap support ARP spoofing, but Bettercap is modern and allows fine-grained module control for network attacks. Alternatively, customized arpspoof can be tuned.

Answer

FTP

Answer

Ping

Answer

Telnet

Question 4

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

Accepted Answer

The target account's NTLM password hash must be known to the attacker. Pass-the-Hash requires the target account's NTLM hash (or LM hash) and requires the target machine to either have UAC network restrictions mitigated (LocalAccountTokenFilterPolicy set) when using local accounts, or to target domain accounts where Kerberos is not strictly enforced over NTLM.

Answer

SMB signing must be globally disabled across the entire Active Directory forest

Answer

The target user account must have Kerberos pre-authentication disabled

Answer

The local Windows Firewall on the domain controller must be completely disabled

Question 5

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Accepted Answer

winrs -r:TargetServer -u:Administrator -p:Password cmd.exe. WinRM uses port 5985 for HTTP (and 5986 for HTTPS). The native Windows tool designed to interact with remote systems via WinRM is Winrs (Windows Remote Shell) or PowerShell Remoting (Enter-PSSession).

Answer

rpcclient -U Administrator TargetServer

Answer

nbtstat -A TargetServer -winrm

Answer

mstv -target:TargetServer -port:5985

Question 6

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

Accepted Answer

grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/. Binwalk is great for extraction, but searching the file system for specific file signatures like private keys is effectively done using grep with regular expressions or specialized tools like 'find' combined with cryptographic headers.

Answer

strings -k squashfs-root/

Answer

firmadyne -s squashfs-root/

Answer

binwalk -A squashfs-root/

Question 7

A penetration tester is assessing an MQTT-based industrial monitoring system where brokers communicate over unencrypted TCP ports. The tester wants to discover hidden topics that are not actively publishing data by brute-forcing topic names. Which tool natively supports MQTT fuzzing and topic discovery through automated subscription testing?

Accepted Answer

MQTT-Miner. MQTT-Miner or specialized tools like the MQTTSA (MQTT Security Assessment) framework or Metasploit modules are used. Specifically, MQTT-Miner is designed for testing and discovering topics. Nmap performs port scanning, Nikto targets web servers, and DirBuster targets HTTP directories, not MQTT brokers.

Answer

DirBuster

Answer

Nmap

Answer

Nikto

Question 8

During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?

Accepted Answer

Nikto. Nikto is a comprehensive web server scanner that checks for dangerous files, outdated software, and CGI scripts, while Metasploit contains specific modules for exploitation.

Answer

Reaver

Answer

Masscan

Answer

Aircrack-ng

Question 9

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

Accepted Answer

TCP port 135 (RPC Endpoint Mapper). WMI relies on DCOM, which uses RPC. The initial connection to the RPC Endpoint Mapper is made on TCP port 135, after which dynamic high ports are negotiated.

Answer

UDP port 53 (DNS)

Answer

TCP port 445 (SMB)

Answer

TCP port 3389 (RDP)

Question 10

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

Accepted Answer

TheHarvester. TheHarvester is a popular tool designed to gather emails, subdomains, and names from public sources like search engines and PGP key servers.

Answer

Metasploit

Answer

Wireshark

Answer

Burp Suite

Question 11

During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?

Accepted Answer

mitmproxy. Burp Suite or mitmproxy can act as transparent or explicit proxies, terminating the TLS connection using a rogue CA certificate, allowing inspection and modification of MQTT-over-TLS traffic.

Answer

Airodump-ng

Answer

Ncat

Answer

Hping3

Question 12

An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?

Accepted Answer

Wireshark. Wireshark includes built-in dissectors for Modbus/TCP and filters that allow inspecting every register read/write operation, making it the primary tool for packet-level ICS analysis.

Answer

John the Ripper

Answer

Hashcat

Answer

Dirb

Question 13

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

Accepted Answer

Neo-reGeorg. Neo-reGeorg or HTTPTunnel are tunneling tools, but reGeorg / Neo-reGeorg tunnels TCP traffic through a web server script (PHP/ASPX) inside HTTP/HTTPS requests. Alternatively, CNTLM or Proxifier manage proxy authentication. For raw TCP tunneling over HTTP, HTTPTunnel or Neo-reGeorg are standard.

Answer

Netcat

Answer

Traceroute

Answer

DNS2TCP

Question 14

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Accepted Answer

RIP. Routing Information Protocol (RIP) uses hop counts up to 15 (16 being infinity) and traditionally lacks authentication, making it susceptible to injection attacks.

Answer

BGP

Answer

EIGRP

Answer

OSPF

Question 15

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

Accepted Answer

Metasploit auxiliary/server/socks_proxy. Metasploit's auxiliary/server/socks_proxy and SSH dynamic port forwarding (-D) are primary methods for establishing SOCKS proxies during pivoting.

Answer

Netcat -e flag

Answer

Wireshark display filter

Answer

Nmap -sS scan flag