CPENT Practice Test 20 — 15 Questions

Question 1

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DHCP Spoofing / Rogue DHCP Server. DHCP starvation (exhausting the IP pool) and DHCP spoofing (supplying a rogue gateway/DNS) are primary attacks against DHCP infrastructure.

Answer

DNS Zone Transfer (AXFR)

Answer

Kerberoasting

Answer

ARP Cache Poisoning

Question 2

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

Accepted Answer

ProcDump. Procdump, a Sysinternals utility, can be used to generate a memory dump of lsass.exe, which can then be transferred offline to extract NTLM hashes or cleartext passwords using Mimikatz.

Answer

Process Explorer

Answer

TCPView

Answer

Autoruns

Question 3

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Accepted Answer

Dig. Dig or host can perform zone transfers, but Fierce or dnsrecon are specialized DNS enumeration scripts, and 'dig @ns-server domain axfr' is the direct command.

Answer

Nbtscan

Answer

DirBuster

Answer

Snort

Question 4

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

Accepted Answer

Netcat. Netcat or Nmap service version detection can grab banners. Netcat allows manual connection to port 21 to view the greeting banner.

Answer

Wpscan

Answer

Hashcat

Answer

Airbase-ng

Question 5

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

Accepted Answer

SPAN (Switched Port Analyzer) / Port Mirroring. Port Mirroring, also known as Switched Port Analyzer (SPAN), copies traffic from one or more switch ports to a destination monitoring port where a tool like Wireshark is connected.

Answer

802.1X Authentication

Answer

VLAN Trunking Protocol

Answer

Port Security

Question 6

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Accepted Answer

Wireshark. Wireshark, Bettercap, and Tcpdump (or Ettercap) are standard tools used for sniffing network traffic and capturing cleartext credentials.

Answer

John the Ripper

Answer

Sqlmap

Question 7

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Accepted Answer

Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.. Because no_root_squash allows root access from remote clients to map to root on the NFS server, the attacker must mount the share as local root (using sudo) and compile a SUID binary or copy /bin/bash with the SUID bit set.

Answer

Modify the /etc/exports file on the remote target directly via standard FTP.

Answer

Mount the NFS share using standard user privileges and create a standard user shell script.

Answer

Log into the NFS server directly via SSH using the exported share credentials.

Question 8

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Accepted Answer

-sX. The -sX flag instructs Nmap to perform a Xmas tree scan, setting the FIN, PSH, and URG flags, which can bypass certain stateless firewalls or exploit RFC compliance quirks in TCP stacks.

Answer

-sN

Answer

-sF

Answer

-sW

Question 9

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

Accepted Answer

Gobuster. Gobuster or Dirb/Dirbuster are standard directory brute-forcing tools used to find hidden web resources.

Answer

Wifite

Answer

Nbtscan

Answer

Hping3

Question 10

An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?

Accepted Answer

Scapy. Scapy is a powerful Python-based packet manipulation library that allows building custom packets for industrial protocols like Modbus, DNP3, and IEC 104.

Answer

BeautifulSoup

Answer

Pandas

Answer

Pygame

Question 11

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Accepted Answer

Hping3. Hping3 or Scapy can craft custom IP packets with IP options such as loose or strict source routing (LSR/SSR).

Answer

Wget

Answer

Netcat

Answer

Nmap

Question 12

A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?

Accepted Answer

bacpypes (using scripts like whois.py / iam.py). The 'bacpypes' Python library and its associated command-line scripts are widely used by testers to interact with and enumerate BACnet devices.

Answer

ettercap

Answer

sqlmap

Answer

msfvenom

Question 13

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Accepted Answer

Use PsExec or WinRM with the valid credentials to execute commands interactively on domain-joined member servers. With Domain Administrator credentials, an attacker can generate a Golden Ticket using Mimikatz (requiring the krbtgt hash) or perform a Session Hijacking / PsExec execution to access remote systems. Alternatively, creating a scheduled task or using WinRM are also valid options. A Golden Ticket requires the krbtgt hash, which is obtainable via DCSync, but interactive logon and PsExec/WinRM directly utilize the DA credentials.

Answer

Modify the Windows Boot Configuration Data (BCD) store to disable PatchGuard on all domain controllers

Answer

Change the password of the local Administrator account on a single workstation via SAM-R or RPC

Answer

Inject shellcode directly into the Active Directory database file (ntds.dit) while the database is offline

Question 14

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Accepted Answer

--unprivileged. The --unprivileged flag tells Nmap to assume the user lacks raw socket privileges, forcing Nmap to use connect() system calls instead of raw packet generation.

Answer

-sP

Answer

--privileged

Answer

-Pn

Question 15

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

Accepted Answer

Hydra. Hydra is a versatile, parallelized login cracker supporting numerous network authentication protocols, including Telnet.

Answer

Sqlmap

Answer

Nikto

Answer

Wpscan