CPENT Practice Test 20 — 15 Questions

Question 1

Which THREE tactics or actions are effective in defending against or detecting Golden Ticket attacks in an enterprise Active Directory environment?

Accepted Answer

Enforcing Tiered Administration models to protect domain controller access. Option B is correct because enforcing Tiered Administration models restricts who can log on to and administer Tier 0 assets such as domain controllers, limiting the credential exposure that enables an attacker to obtain the KRBTGT hash needed to forge a Golden Ticket. Option D is correct because Golden Tickets are forged TGTs, and their abuse surfaces in Kerberos service ticket activity; monitoring TGS requests (Event ID 4769) for anomalous ticket lifetimes, encryption types, or account patterns helps detect forged tickets that bypass normal TGT issuance. Option E is correct because the KRBTGT account's password hash signs all TGTs, so a double-rotation (resetting the password twice, with replication in between) invalidates existing Golden Tickets and prevents their continued use. Option A is wrong because enabling unconstrained delegation on workstations expands attack surface and lets compromised hosts impersonate users to services, which aids attackers rather than defending against Golden Tickets. Option C is wrong because disabling LDAP channel binding weakens protection against relay and credential-theft attacks on domain controllers, making the environment less secure, not more.

Answer

Enabling unconstrained delegation on all workstation computer objects

Answer

Disabling LDAP channel binding on all domain controllers

Question 2

During a penetration test, you have compromised a workstation and obtained the NTLM hash of a domain user who is logged in. You want to move laterally to a server where this user has administrative rights. Which technique would allow you to authenticate to the server without knowing the plaintext password?

Accepted Answer

Pass-the-Hash (PtH) using the NTLM hash.. Pass-the-Hash is the most direct method to authenticate using an NTLM hash without the plaintext password. It exploits the NTLM challenge-response protocol, allowing the hash to be used as a credential. This technique is widely used in lateral movement when administrative rights are present on the target.

Answer

Pass-the-Ticket (PtT) using the user's Kerberos TGT.

Answer

Overpass-the-Hash to convert the NTLM hash into a Kerberos ticket.

Answer

Kerberoasting to obtain a service ticket for the server.

Question 3

A penetration tester has obtained a low-privileged shell on a Windows 10 workstation that is part of an Active Directory domain. The tester discovers that the workstation has Credential Guard enabled and that the current user has local admin rights on a different server. The tester wants to move laterally to the server using the current user's credentials without knowing the plaintext password. Which technique should the tester use to extract the user's Kerberos ticket from memory and reuse it on the target server?

Accepted Answer

Use Mimikatz with the 'sekurlsa::tickets /export' command to export all Kerberos tickets from memory, then inject the relevant ticket using 'kerberos::ptt'.. When Credential Guard is enabled, clear-text passwords and NTLM hashes are protected, but Kerberos tickets may still reside in memory and can be exported and reused. The tester should extract tickets using Mimikatz's sekurlsa::tickets /export, then inject the appropriate ticket with kerberos::ptt to authenticate to the target server. This pass-the-ticket approach allows lateral movement without knowing the plaintext password, directly addressing the scenario's constraints.

Answer

Use 'net use \server\share /user:domain\user' to authenticate to the server with an empty password, relying on cached credentials.

Answer

Use Mimikatz with the 'sekurlsa::logonpasswords' command to dump clear-text credentials from LSASS memory.

Answer

Use the Windows built-in 'runas /savecred' command to launch a new process with saved credentials from the Credential Manager.

Question 4

During a CPENT engagement against a Microsoft 365 tenant, you obtain a low-privileged user's credentials and successfully authenticate. You need to determine whether the tenant has enabled Security Defaults or configured custom Conditional Access policies, because this affects your ability to perform password spraying and legacy authentication attacks. Which Microsoft Graph endpoint should you query to retrieve the tenant's Conditional Access policy configuration?

Accepted Answer

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies. Conditional Access policy objects are exposed through the Microsoft Graph identity namespace, and enumerating them reveals the enabled state, included/excluded users and apps, client app types (such as legacy authentication), and grant controls like MFA. This directly determines whether password spraying or legacy protocol attacks will succeed. Security Defaults is a separate object, named locations are only conditions, and sign-in logs are historical rather than configuration data.

Answer

GET https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy

Answer

GET https://graph.microsoft.com/v1.0/auditLogs/signIns

Answer

GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations

Question 5

A penetration tester is assessing a Microsoft Azure environment and finds that a virtual machine has a system-assigned managed identity. The tester has obtained a shell on the VM and wants to use the managed identity to access an Azure Key Vault. Which endpoint should the tester query to obtain an access token for the Key Vault?

Accepted Answer

http://169.254.169.254/metadata/identity/oauth2/token. Azure managed identities obtain tokens from the Instance Metadata Service (IMDS) at 169.254.169.254. The correct endpoint is http://169.254.169.254/metadata/identity/oauth2/token, where you specify the resource parameter as the target service, such as https://vault.azure.net. The token returned can then be used to authenticate to Key Vault.

Answer

https://login.microsoftonline.com/<tenant-id>/oauth2/token

Answer

http://localhost:8080/identity/token

Answer

http://169.254.169.254/latest/meta-data/iam/security-credentials/

Question 6

A CPENT tester is engaged to assess a municipal water utility's OT network. After passively mapping the environment, the tester identifies a Siemens SIMATIC S7-1200 PLC on VLAN 20 and wants to read the current state of its process image inputs and outputs without altering the running program. Which approach is MOST appropriate for this objective?

Accepted Answer

Use an S7comm Read Variable (0x04) request against the process image input and output areas of the PLC.. Reading the current process image inputs and outputs on a Siemens S7-1200 requires an S7comm Read Variable request, which queries the PLC's PE and PA areas without changing execution. Write Variable, Stop CPU, and full program Upload either alter state, halt the process, or return logic rather than live I/O, so they fail the read-only requirement on a live water utility.

Answer

Replay a captured S7comm Stop CPU request to place the PLC in STOP mode and inspect its diagnostic buffer.

Answer

Perform an S7comm Upload (0x1D) of the entire program block to the tester's workstation to infer I/O values.

Answer

Send S7comm Write Variable (0x05) requests to the PLC's memory areas to force input and output values.

Question 7

A penetration tester is assessing an IoT device that uses MQTT for communication. The tester has captured MQTT traffic and notices that the CONNECT packets do not include a username or password. Which of the following best describes the security implication of this observation?

Accepted Answer

The MQTT broker allows anonymous connections, which may permit unauthorized clients to publish or subscribe to topics.. MQTT CONNECT packets without a username and password often indicate that the broker permits anonymous connections. This misconfiguration allows any client to connect and potentially access or manipulate MQTT topics, leading to data breaches or unauthorized control of IoT devices. It is a critical finding in a penetration test, as it directly impacts the confidentiality and integrity of the system.

Answer

The MQTT protocol inherently does not support authentication, so this is expected behavior.

Answer

The MQTT traffic is encrypted with TLS, so the absence of credentials is not a concern.

Answer

The MQTT broker is using certificate-based authentication, which replaces username and password.

Question 8

You have compromised a domain user account and discovered that the user has 'WriteDACL' permission on a sensitive Organizational Unit (OU). You want to escalate privileges by modifying the OU's ACL to grant yourself full control. Which built-in Windows command-line utility can you use to modify the ACL of the OU?

Accepted Answer

dsacls. dsacls is the correct tool because it is specifically designed to manage ACLs on Active Directory objects, including OUs. With WriteDACL permission, you can use dsacls to grant yourself Full Control on the OU, enabling further privilege escalation. The other tools either target file system ACLs or are not command-line utilities.

Answer

set-acl

Answer

icacls

Answer

cacls

Question 9

During a perimeter penetration test, you need to identify live hosts on a target network without performing a full port scan. You have no prior knowledge of the network and want to minimize the chance of triggering intrusion detection systems. Which Nmap command is best suited for this task?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn option in Nmap performs a ping scan, which discovers live hosts without scanning ports. It uses a combination of ICMP echo, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to determine if a host is up. This is the least intrusive method for host discovery and is ideal for minimizing IDS alerts while mapping a network.

Answer

nmap -O 192.168.1.0/24

Answer

nmap -sU -p 53 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 10

During an internal penetration test, you compromise a domain-joined Windows 10 workstation and obtain a SYSTEM-level shell. You extract the NTLM hash of a domain user from LSASS but cannot crack it. Which technique allows you to authenticate to a remote server as that domain user without knowing the plaintext password?

Accepted Answer

Pass-the-Hash. Pass-the-Hash is the correct technique because it allows authentication using the NTLM hash directly, without needing the plaintext password. This is particularly useful when you have extracted a hash from LSASS but cannot crack it. The other options either require different credential material (Kerberos tickets) or are more complex and less direct.

Answer

Overpass-the-Hash

Answer

Pass-the-Ticket

Answer

Kerberoasting

Question 11

During a CPENT engagement against a pharmaceutical manufacturer's OT environment, the tester captures Modbus/TCP traffic between a human-machine interface (HMI) and several PLCs. The tester wants to demonstrate that an attacker on the IT network could manipulate coil states on a specific PLC without authentication. Which action BEST demonstrates this risk while minimizing impact on the production line?

Accepted Answer

Craft a Modbus/TCP Write Single Coil (function code 0x05) packet targeting an unused coil address on the PLC.. Modbus/TCP lacks authentication, so a Write Single Coil (0x05) to an unused coil proves an attacker can manipulate coil states without credentials while avoiding disruption to active production logic. Broadcasting writes, reading only, or clearing diagnostics either endanger the line or fail to demonstrate the write capability that the scenario requires.

Answer

Initiate a Modbus/TCP Diagnose (0x08) request to clear counters and diagnostic registers on the PLC.

Answer

Send a Modbus/TCP Read Coils (0x01) request to the PLC and capture the response to prove unauthenticated access.

Answer

Broadcast a Modbus/TCP Write Multiple Coils (0x0F) packet to all PLCs on the subnet to change every coil.

Question 12

You are conducting an external penetration test against a company's web server. You discover that the server is vulnerable to a buffer overflow in a custom CGI script. You want to exploit it to gain a reverse shell. Which Metasploit payload should you use to establish a Meterpreter session?

Accepted Answer

linux/x86/meterpreter/reverse_tcp. For a Linux-based web server with a vulnerable CGI script, the appropriate Meterpreter payload is linux/x86/meterpreter/reverse_tcp. This payload provides a reverse shell with Meterpreter capabilities, assuming the target architecture is x86. It is essential to match the payload to the target OS and architecture to ensure successful exploitation.

Answer

php/meterpreter/reverse_tcp

Answer

java/meterpreter/reverse_tcp

Answer

windows/meterpreter/reverse_tcp

Question 13

A CPENT tester is evaluating an industrial control system that uses the DNP3 protocol for communication between a master station and remote terminal units (RTUs). The tester wants to determine whether the RTUs enforce any authentication on critical control functions. Which method is MOST appropriate to assess this without causing an outage?

Accepted Answer

Capture DNP3 traffic and analyze the application layer for Secure Authentication (IEEE 1815) challenge-response exchanges.. Passively analyzing captured DNP3 traffic for Secure Authentication challenge-response exchanges reveals whether the RTU enforces authentication on critical functions without sending control commands. Active Operate, Cold Restart, and Disable Unsolicited Responses either risk an outage or fail to answer the authentication question, so passive inspection is the safest and most direct method.

Answer

Send DNP3 Operate (function code 0x04) commands to the RTU's control points to see if they are rejected.

Answer

Issue DNP3 Cold Restart (function code 0x0D) to the RTU and observe whether the device reboots successfully.

Answer

Use DNP3 Disable Unsolicited Responses (function code 0x15) to suppress event reporting and check for errors.

Question 14

During a post-exploitation phase, you have obtained domain administrator credentials. You want to extract all password hashes from the domain controller's Active Directory database without installing additional software. Which built-in Windows utility should you use?

Accepted Answer

ntdsutil. ntdsutil is a native Windows utility that allows domain administrators to create and mount snapshots of the Active Directory database. By using ntdsutil, a tester can obtain a copy of ntds.dit and the SYSTEM registry hive, which can then be used offline to extract password hashes with tools like secretsdump.py or mimikatz. This method avoids installing additional software on the domain controller.

Answer

vssadmin

Answer

secretsdump.py

Answer

wmic

Question 15

You have compromised a Windows workstation and want to maintain persistence by ensuring your malicious executable runs every time a user logs on. You have local administrator rights. Which registry key should you modify?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The HKLM\Software\Microsoft\Windows\CurrentVersion\Run key is a standard location for programs that should run at startup for all users. With local administrator rights, a tester can add an entry here to ensure their executable runs every time any user logs on. This provides system-wide persistence and survives reboots. It is a common technique used by malware and penetration testers alike.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\System\CurrentControlSet\Services