CPENT Practice Exam 1 — 20 Questions

Question 1

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Accepted Answer

The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).. ESC3 involves a certificate template configured as an Enrollment Agent (containing the Certificate Request Agent EKU), allowing enrollment by low-privileged users, and permitting issuance of certificates on behalf of other users.

Answer

The CA requires Manager Approval for all issued certificates.

Answer

The domain functional level is set to Windows Server 2003.

Question 2

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Accepted Answer

The explicit Deny in the bucket policy takes precedence, resulting in access being denied.. AWS evaluation logic states that an explicit Deny anywhere in the policy evaluation overrides all allows.

Answer

AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.

Answer

Access is granted because any Allow permission supersedes bucket restrictions.

Answer

The public ACL takes precedence because ACLs are evaluated before bucket policies.

Question 3

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 4

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.

Question 5

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Accepted Answer

The bucket is public; the allUsers or allAuthenticatedUsers IAM binding must be removed to secure the data.. Granting allUsers IAM role bindings on a Cloud Storage bucket makes its objects publicly readable over the internet. Remediation requires removing the allUsers binding.

Answer

The bucket is vulnerable to GCP IAM privilege escalation via service account impersonation.

Answer

Google Cloud Armor automatically deletes the bucket objects.

Answer

Compute Engine instances can no longer mount the bucket as a persistent disk.

Question 6

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Accepted Answer

AWS VPC Endpoints powered by AWS PrivateLink.. AWS VPC Endpoints (powered by AWS PrivateLink) allow private connections between VPCs and AWS services or other VPCs without internet gateways.

Answer

Amazon CloudFront origin access control (OAC).

Answer

AWS Web Application Firewall (WAF) rule groups.

Answer

AWS Identity and Access Management resource-based policies.

Question 7

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

Accepted Answer

The NTLM password hash of the specific service account. A Silver Ticket is forged for a specific service using the NTLM hash of the service account running that service (e.g., MSSQL or CIFS service account), rather than the KRBTGT hash.

Answer

The plaintext password of the Domain Administrator

Answer

The Domain Controller's computer account machine password

Answer

The domain root CA private key (.pfx)

Question 8

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Accepted Answer

The Active Directory domain functional level must be Windows Server 2012 or higher.. RBCD requires permission to modify msDS-AllowedToActOnBehalfOfOtherIdentity on the target object, control over a computer or user object to act as the delegating entity, and Active Directory running at Windows Server 2012 or higher functional level.

Answer

Domain controllers must have SMB signing disabled globally.

Answer

The KRBTGT account password must be reset twice to invalidate existing tickets.

Question 9

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

Accepted Answer

psexec.py from the Impacket toolkit. Pass-the-Hash relies on injecting or using the NTLM hash directly in place of the user's password during authentication. Impacket's psexec.py (or crackmapexec / netexec) natively supports NTLM hash authentication.

Answer

Windows Remote Desktop Connection (mstsc.exe)

Answer

Standard Windows net use command

Answer

WinRM standard client via browser

Question 10

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder

Question 11

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service

Question 12

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Accepted Answer

Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.. Disabling secure transfer allows unencrypted HTTP connections to the storage account, enabling potential Man-in-the-Middle (MitM) attacks to intercept data in transit.

Answer

Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.

Answer

Shared Access Signatures (SAS) tokens expire immediately upon generation.

Answer

Blob storage data at rest is stored without AES-256 encryption.

Question 13

During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?

Accepted Answer

It does not require interaction with the Domain Controller to generate and does not alert the KDC for a TGT request. A Silver Ticket is forged for a specific service using the NTLM hash of that specific service account (or computer account), meaning it does not require interaction with the Domain Controller's KDC for creation, and it does not generate a TGT request that might alert domain-level monitoring.

Answer

It can only be detected by physically inspecting the NTDS.dit file on the Domain Controller

Answer

It grants full Domain Administrator privileges across all domain controllers

Answer

It automatically updates the KRBTGT password to maintain persistence

Question 14

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). AS-REP Roasting targets accounts where Kerberos pre-authentication is disabled. Unprivileged users can query LDAP directly or use automated tools like Rubeus or PowerView to find these accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 15

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

Accepted Answer

Add a compromised or attacker-controlled user account to the privileged group using PowerView or net group. Having write access or GenericAll over a group allows an attacker to add a controlled user to that privileged group (e.g., via Add-DomainGroupMember) or modify the ACLs to grant themselves full control over the group object.

Answer

Execute a Kerberoasting attack against the Active Directory Web Services endpoint

Answer

Extract plaintext passwords from the Windows Registry SAM hive remotely using ping.exe

Answer

Force an immediate password reset of the krbtgt account via Group Policy Preferences

Question 16

A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?

Accepted Answer

Modify the GPO's SYSVOL folder contents to inject a malicious Immediate Task or startup script. Having GenericAll or WriteProperty rights over a GPO allows an attacker to modify the GPO settings, such as adding a Scheduled Task or an Immediate Task via 'Preferences -> Control Panel Settings -> Scheduled Tasks', which will execute commands on targets processing that GPO.

Answer

Extract domain administrator password hashes directly from the GPO ACL metadata

Answer

Request a TGT ticket with custom PAC extensions via Kerberos delegation

Question 17

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Accepted Answer

Mimikatz: kerberos::ptt ticket.kirbi. Pass-the-Ticket involves injecting exported ticket files (such as .kirbi or .ccache format) into memory. Mimikatz uses the 'kerberos::ptt' command to inject a ticket into the current Windows logon session.

Answer

Rubeus: golden /ticket:ticket.kirbi

Answer

PowerView: Invoke-TicketInjection -Path ticket.kirbi

Answer

Impacket: ticketer.py -nthash ...

Question 18

An AWS administrator wants to prevent users from accidentally creating public Amazon S3 buckets across the entire AWS account. Which specific AWS feature should be enabled?

Accepted Answer

S3 Block Public Access at the AWS account level.. S3 Block Public Access at the account level blocks the creation of public buckets and modification of public policies organization-wide.

Answer

AWS Web Application Firewall rules attached to the S3 global endpoint.

Answer

AWS Organizations Service Control Policies blocking the s3:PutBucketAcl action.

Answer

Amazon Macie to automatically encrypt all public buckets.

Question 19

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

Accepted Answer

Storing application secrets and database connection strings in plaintext within Azure App Service configuration settings.. Over-privileged sync accounts, storing secrets in plaintext, and unmitigated PHS/PTA risks are major hybrid threats.

Answer

Enforcing Azure AD Conditional Access policies requiring compliant devices for access.

Answer

Using Azure Key Vault with managed hardware security modules (HSMs) for cryptographic keys.

Answer

Configuring Azure Bastion for secure administrative RDP and SSH connectivity.

Question 20

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

Accepted Answer

0x88B8. GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Answer

0x0800

Answer

0x86DD

Answer

0x88E5