CPENT Practice Exam 2 — 20 Questions

Question 1

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TheHarvester. TheHarvester is an OSINT reconnaissance tool that queries search engines (Google, Bing, Baidu), certificate transparency logs, PGP key servers, and public databases like Shodan and Hunter to enumerate emails, subdomains, hostnames, and employee names tied to a target domain. It is purpose-built for the passive reconnaissance phase of a penetration test.

Answer

Metasploit

Answer

Wireshark

Answer

Burp Suite

Question 2

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

Accepted Answer

Invoke-Command -ComputerName TargetHost -ScriptBlock { ... }. Invoke-Command allows running script blocks or scripts on local or remote computers using WinRM.

Answer

Get-WmiObject -ComputerName TargetHost -Class Win32_Process

Answer

Start-Process -FilePath "powershell.exe" -Credential ...

Answer

Enter-PSSession -ComputerName TargetHost

Question 3

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Accepted Answer

Set the 'Allow Blob public access' property to Disabled on the storage account.. Disabling public blob access on the storage account blocks anonymous requests globally.

Answer

Rotate the primary storage account access key every 24 hours.

Answer

Enable Azure Defender for Storage and configure automatic threat remediation.

Answer

Apply an Azure Firewall rule blocking port 443 inbound to the storage account.

Question 4

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Accepted Answer

-sX. Nmap's -sX flag performs the Xmas scan, which sets the FIN, PSH, and URG flags simultaneously in the TCP header. This unusual flag combination is designed to evade stateless firewalls and some IDS signatures that only look for SYN or common flag patterns. The name comes from the flags being 'lit up' like a Christmas tree in a packet analyzer.

Answer

-sN

Answer

-sF

Answer

-sW

Question 5

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

Accepted Answer

Use CrackMapExec or NetExec with the smb-signing module to enumerate signing configuration across the subnet in a single sweep.. SMB signing enforcement is advertised in the SMB2 negotiate response, so hosts that report signing enabled but not required are relay candidates. Nmap's smb2-security-mode script and CrackMapExec/NetExec's smb-signing module both retrieve this data across a subnet and let you build a precise target list. Machine account quota and NetBIOS name queries expose unrelated information, and modifying the target is out of scope.

Answer

Query Active Directory for the ms-DS-MachineAccountQuota attribute on the domain object to determine which machines allow unsigned SMB.

Answer

Enable the LanmanServer service on each target and set the RequireSecuritySignature registry value to 0 before testing.

Answer

Perform a broadcast NetBIOS name query for each host to read the SMB signing flag from the node status response.

Question 6

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Accepted Answer

Running the wafw00f enumeration tool. Option B is correct because wafw00f is a purpose-built fingerprinting tool that sends a series of benign and malicious HTTP requests and analyzes response headers, cookies, and status codes to identify the specific WAF product (e.g., Cloudflare, ModSecurity, AWS WAF) protecting a web server. Option E is correct because sending known malicious payloads such as SQL injection strings or XSS vectors and observing characteristic block responses (e.g., HTTP 403, 406, or 999, or vendor-specific error pages) is a reliable behavioral technique to confirm a WAF is inspecting and filtering traffic. Option A is not relevant because ARP cache tables only reveal layer-2 MAC-to-IP mappings on the local segment and cannot indicate the presence of a WAF, which operates at the application layer. Option C is incorrect because an ICMP ping sweep only tests host reachability and is typically blocked or answered by the origin server regardless of any WAF. Option D is incorrect because a DNS AXFR zone transfer enumerates DNS records and, even if permitted, reveals nothing about whether an application-layer firewall sits in front of the web server.

Answer

Reviewing local ARP cache tables

Answer

Performing a standard ICMP ping sweep

Answer

Running a DNS zone transfer (AXFR) query

Question 7

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

Accepted Answer

.kirbi. Mimikatz uses the .kirbi file extension to save exported Kerberos tickets.

Answer

.ntds

Answer

.sam

Answer

.pfx

Question 8

During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?

Accepted Answer

It does not require interaction with the Domain Controller to generate and does not alert the KDC for a TGT request. A Silver Ticket is forged for a specific service using the NTLM hash of that specific service account (or computer account), meaning it does not require interaction with the Domain Controller's KDC for creation, and it does not generate a TGT request that might alert domain-level monitoring.

Answer

It can only be detected by physically inspecting the NTDS.dit file on the Domain Controller

Answer

It grants full Domain Administrator privileges across all domain controllers

Answer

It automatically updates the KRBTGT password to maintain persistence

Question 9

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

Accepted Answer

The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.. ESC1 is defined by a certificate template that permits the enrollee to specify a Subject Alternative Name (SAN) and is enrollable by low-privileged users, while also including a client authentication EKU (e.g., Client Authentication, Smart Card Logon). This lets an attacker request a certificate with an arbitrary SAN (e.g., a Domain Admin's UPN) and authenticate as that user via PKINIT.

Answer

The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.

Answer

The template publishes certificates to Active Directory user objects automatically.

Answer

The template has Manager Approval enabled and requires enterprise admin signatures.

Question 10

During an assessment of an Operational Technology (OT) network, a tester discovers a Programmable Logic Controller (PLC) using the Modbus TCP protocol. The tester needs to query holding registers to understand the operational state of the industrial process. Which default TCP port should the tester target for Modbus communications?

Accepted Answer

Port 502. Modbus TCP uses port 502 by default. Port 80 is HTTP, port 443 is HTTPS, and port 1883 is MQTT.

Answer

Port 80

Answer

Port 443

Answer

Port 1883

Question 11

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Accepted Answer

tasklist /svc. Option A (tasklist /svc) is correct because it enumerates running processes along with the services hosted in each process, revealing service accounts, potentially privileged processes, and unquoted service paths or vulnerable services that can be leveraged for escalation. Option C (whoami /priv) is correct because it lists the privileges assigned to the current token, such as SeImpersonatePrivilege, SeDebugPrivilege, or SeBackupPrivilege, which directly indicate escalation vectors like token impersonation or Potato-style attacks. Option D (systeminfo) is correct because it returns OS version, build number, hotfix level, and patch information, allowing an attacker to identify missing patches and known kernel or local privilege escalation exploits. Option B (dir /s /b config.php) is not a Windows local enumeration technique for privilege escalation—it targets a PHP configuration file and is more relevant to web application reconnaissance. Option E (netsh wlan show profiles) only reveals saved wireless network profiles and their SSIDs, which is useful for credential or network discovery but not for local privilege escalation.

Answer

dir /s /b config.php

Answer

netsh wlan show profiles

Question 12

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark

Question 13

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Accepted Answer

Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.. Disabling secure transfer allows unencrypted HTTP connections to the storage account, enabling potential Man-in-the-Middle (MitM) attacks to intercept data in transit.

Answer

Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.

Answer

Shared Access Signatures (SAS) tokens expire immediately upon generation.

Answer

Blob storage data at rest is stored without AES-256 encryption.

Question 14

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Accepted Answer

RIP. RIP (Routing Information Protocol) uses cleartext, unauthenticated updates by default and a hop-count metric with a maximum of 15 hops (16 = unreachable), making it trivially vulnerable to route injection and poisoning attacks. This matches the description exactly.

Answer

BGP

Answer

EIGRP

Answer

OSPF

Question 15

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee (A) is correct because it is a Python-based framework specifically designed for sniffing, injecting, and exploiting Zigbee and IEEE 802.15.4 networks, making it a core tool for assessing smart lighting installations that use these protocols. Wireshark (C) is correct because, when supplied with the captured Zigbee network key, it can decrypt and dissect 802.15.4 application-layer traffic (e.g., Zigbee APS/ZCL payloads), which is essential for analyzing the security of the lighting network. Aircrack-ng (B) targets Wi-Fi WPA-PSK handshakes and is irrelevant to 802.15.4/Zigbee, Metasploit's msfvenom (D) generates Windows Meterpreter payloads for host/AD attacks rather than RF-layer Zigbee assessment, and Burp Suite (E) intercepts HTTP(S) web traffic, none of which apply to Zigbee wireless security testing.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 16

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Accepted Answer

smbclient -L //target-ip. Option A (smbclient -L //target-ip) is correct because smbclient is an SMB/CIFS client that, with the -L flag, lists the shares and their comments/type on a remote Windows host over TCP 445/139, directly satisfying the share-enumeration requirement. Option C (enum4linux -a target-ip) is correct because enum4linux is a wrapper around Samba tools (smbclient, rpcclient, net) that with -a performs all simple enumeration, including share listing and permission/ACL information via SMB and RPC. Option B (sqlmap -u target-url) is wrong because sqlmap automates SQL-injection testing against web applications, not SMB share enumeration. Option D (nmap --script http-enum) is wrong because http-enum enumerates web server directories and files over HTTP, not SMB shares. Option E (aircrack-ng target.cap) is wrong because aircrack-ng cracks Wi-Fi (WEP/WPA) keys from captured 802.11 frames, which is unrelated to SMB share querying.

Answer

sqlmap -u target-url

Answer

nmap --script http-enum

Answer

aircrack-ng target.cap

Question 17

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Accepted Answer

Dig. Dig is the standard DNS query utility, and issuing a query of type AXFR against a name server (dig AXFR @ns target.com) directly tests whether that server permits an unauthorized zone transfer. If the server responds with the full zone contents, the AXFR vulnerability is confirmed. This makes dig the purpose-built tool for the task.

Answer

Nbtscan

Answer

DirBuster

Answer

Snort

Question 18

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Accepted Answer

-PA80. Nmap's -PA option performs a TCP ACK ping, sending an empty TCP packet with the ACK flag set to the specified port (default 80). Because a TCP ACK packet to a closed port elicits an RST from a live host and nothing from a filtered/blocked host, it can discover live hosts even when ICMP echo is blocked. Using -PA80 sends the ACK probe to port 80, which is the option the question requires.

Answer

-PS80

Answer

-PE

Answer

-PU80

Question 19

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Accepted Answer

Wireshark. Wireshark (B) is correct because it is a protocol analyzer that captures live packets on an interface and includes dissectors that can parse authentication protocols such as HTTP Basic, FTP, Telnet, and Kerberos pre-authentication data, exposing credentials in cleartext or crackable form. Bettercap (D) is correct because it is a MITM framework with built-in ARP spoofing, sniffing, and credential-sniffing modules (e.g., net.sniff) that actively capture and parse credentials such as HTTP POST logins, FTP, and NTLM hashes from the wire. Tcpdump (E) is correct because it captures raw packets on the segment and, with the -A or -X flags, prints payload contents in ASCII/hex so cleartext credentials in protocols like FTP, Telnet, or HTTP can be read directly. John the Ripper (A) is a password-cracking tool that operates on captured hash files offline and does not capture or parse live network traffic, and Sqlmap (C) is a SQL injection exploitation tool that targets web application databases rather than sniffing credentials off a network segment.

Answer

John the Ripper

Answer

Sqlmap

Question 20

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Accepted Answer

It uses a computer account (AZUREADSSOACC$) in on-premises AD to generate Kerberos tickets for users authenticating to cloud services via browser redirection.. Seamless SSO uses a computer account named AZUREADSSOACC$ in on-premises AD whose Kerberos decryption key is shared with Microsoft Entra ID. When a user on a domain-joined machine accesses a Microsoft 365 resource, the browser is redirected to Microsoft Entra ID, which returns a Kerberos challenge; the local machine requests a service ticket for AZUREADSSOACC$ from the on-prem DC, and the browser presents it to Microsoft Entra ID, which decrypts it with the shared key to authenticate the user without re-entering credentials.

Answer

It requires all users to store their plaintext Active Directory passwords in Azure Key Vault.

Answer

It bypasses all Conditional Access policies for users connecting from corporate networks.

Answer

It forces the domain controllers to export NTLMv1 hashes to the Azure cloud directory.