CPENT Practice Exam 3 — 20 Questions

Question 1

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bettercap. Bettercap is a modular network attack framework that includes an ARP spoofing module capable of selective, low-frequency poisoning. Unlike tools that flood the network with ARP replies, Bettercap allows the attacker to target specific hosts and control the rate of spoofed frames, maintaining a stealthy man-in-the-middle position. This makes it ideal for environments where repetitive ARP traffic would trigger IDS/IPS alerts.

Answer

FTP

Answer

Ping

Answer

Telnet

Question 2

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

Accepted Answer

Deploy industrial Intrusion Detection Systems (IDS) tuned for OT protocol anomalies. Option B is correct because an industrial IDS tuned for OT protocol anomalies (e.g., Modbus, DNP3, IEC 61850) provides passive monitoring and detection of malicious or abnormal commands without requiring the legacy protocols to support encryption or authentication. Option C is correct because ISA/IEC 62443 zones and conduits segmentation limits lateral movement and restricts access to SCADA devices, effectively compensating for the lack of native security in the protocols. Option D is correct because industrial firewalls with SCADA-aware Deep Packet Inspection can enforce protocol-level allowlisting and filter malformed or unauthorized function codes (e.g., Modbus write commands) that legacy protocols cannot authenticate. Option A is incorrect because disabling all TCP/UDP ports would break the SCADA network's required communications and is not a viable compensating control. Option E is incorrect because PLCs typically run real-time operating systems that cannot host traditional endpoint antivirus, and such software is not designed for OT environments.

Answer

Disable all TCP and UDP ports on the SCADA network switches

Answer

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Question 3

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

Accepted Answer

uname -r. The command uname -r displays the specific kernel release version, which is critical for identifying applicable kernel-level vulnerabilities.

Answer

whoami

Answer

env

Answer

cat /etc/issue

Question 4

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Accepted Answer

It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.. The SUID bit causes /bin/ping to execute with the effective UID of its owner (root) rather than the invoking user, which is why unprivileged users can open raw ICMP sockets. If the binary contains a vulnerability — buffer overflow, command injection, or an unsafe system()/exec() call — or if it can be coerced into spawning a shell, the attacker inherits root privileges, making it a classic local privilege escalation vector.

Answer

It allows remote attackers to execute system calls over ICMP tunneling.

Answer

Any local user can execute commands as root by passing malicious arguments to the SUID binary.

Answer

The system is immune to local privilege escalation because SUID is disabled by SELinux.

Question 5

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Accepted Answer

Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.. SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow an attacker to impersonate tokens. Tools like Rotten Potato, RoguePotato, or PrintSpoofer leverage this to escalate to NT AUTHORITY\SYSTEM.

Answer

Mimikatz credential dumper via direct LSASS memory injection.

Answer

PowerView domain enumeration modules.

Answer

Windows Subsystem for Linux (WSL) container breakouts.

Question 6

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Accepted Answer

Modify the IAM role trust policy to include a Condition block restricting the principal or requiring multi-factor authentication.. The overly permissive trust policy allows any user in the account to assume the role, which is a significant risk. The remediation is to modify the trust policy to include a Condition block that restricts the principal (e.g., specific IAM users or roles) or requires multi-factor authentication. This ensures that only authorized entities can assume the role, following the principle of least privilege.

Answer

Rotate the AWS account root user access keys immediately.

Answer

Attach an explicit Deny policy to the EC2 instance metadata service version 2 configuration.

Answer

Disable the AWS Security Token Service endpoint globally across the AWS organization.

Question 7

You have compromised a dual-homed Linux host that sits between a DMZ and an internal network. From this host you need to reach internal web servers on TCP/8080 that are not routable from your attack machine, and you want to route all your tooling traffic through the pivot using SOCKS. Which approach correctly establishes the pivot?

Accepted Answer

Run ssh -D 1080 user@pivot and configure your tools to use the local SOCKS5 proxy on port 1080.. A dynamic SSH forward with -D creates a SOCKS proxy on the attack machine that tunnels arbitrary TCP connections through the dual-homed host. Because the pivot has an internal interface, those connections reach internal web servers that are otherwise unroutable. Static local forwards reach only one destination, reverse forwards run in the wrong direction, and a proxy option alone does not establish the tunnel.

Answer

Run ssh -L 8080:internal-web:8080 user@pivot and point your tools at localhost:8080.

Answer

Use nmap --proxies socks4://pivot:1080 to route scans through the pivot's SOCKS service.

Answer

Run ssh -R 1080:localhost:1080 user@pivot to create a reverse SOCKS proxy on the pivot host.

Question 8

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Accepted Answer

Application layer function codes specifying operations like Read, Write, Select, and Operate. Option A is correct because DNP3's application layer defines function codes such as Read (1), Write (2), Select (3), Operate (4), and Direct Operate (5), which are used to request data and control outstations in SCADA/ICS environments. Option C is correct because DNP3's data link layer frames include a CRC checksum in each data block (and header) to detect transmission errors, providing integrity at the link layer. Option E is correct because DNP3 Secure Authentication (SAv2/v5, defined in IEEE 1815) adds challenge-response authentication using HMAC to prevent unauthorized command injection, spoofing, and replay attacks. Option B is incorrect because the WPA2 four-way handshake belongs to IEEE 802.11 wireless LAN security, not DNP3, which is a serial/TCP-IP SCADA protocol. Option D is incorrect because HTTP Bearer tokens are used for REST API authentication over HTTP, which is unrelated to the DNP3 protocol structure.

Answer

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Answer

HTTP Authorization Bearer tokens used for REST API authentication

Question 9

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

Accepted Answer

WriteProperty, GenericAll, or GenericWrite over the msDS-KeyCredentialLink attribute / target object. Shadow Credentials abuse requires write access to the target object's msDS-KeyCredentialLink attribute. Permissions such as GenericAll, GenericWrite, or the specific WriteProperty right over that attribute allow an attacker to inject a Key Credential, which can then be used with PKINIT to obtain a TGT for the target account without knowing its password.

Answer

ReadLAPSPassword extended right

Answer

DS-Replication-Get-Changes-All domain right

Answer

SeEnableDelegationPrivilege on the domain controller

Question 10

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Accepted Answer

The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.. When an IAM role trust policy allows an external AWS account to assume the role without an ExternalID condition, any principal in that account with sts:AssumeRole permissions can assume the role. If the external account ID is mistyped or overly broad, it could allow unintended accounts to assume the role, leading to unauthorized access. The ExternalID is a best practice to prevent the confused deputy problem, especially when third-party vendors are involved.

Answer

The EC2 instance is vulnerable to local root privilege escalation via kernel module injection.

Answer

AWS CloudTrail logs for the instance are permanently deleted.

Answer

The third-party account gains direct SSH access to the EC2 instance filesystem.

Question 11

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

Accepted Answer

Lua. Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Answer

Bash

Answer

PowerShell

Answer

Ruby

Question 12

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

Accepted Answer

QEMU_LD_PREFIX. When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Answer

QEMU_ROOTFS

Answer

LD_LIBRARY_PATH

Answer

PATH

Question 13

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Option B is correct because assigning the Owner role to external guest users at the root management group level grants them full control over every subscription and resource in the tenant, violating least-privilege and creating a severe privilege-escalation and data-exfiltration risk. Option E is correct because long-lived, unchanged storage account access keys with broad data access effectively act as permanent shared secrets; if leaked, they allow full access to the storage account's data, and key rotation is a core configuration best practice. Option A is not a risk but a recommended defense, since Azure Defender for SQL provides threat detection and vulnerability assessment for Azure SQL databases. Option C is not a risk because Azure Monitor alerts on failed sign-in attempts improve detection of brute-force or credential-stuffing activity. Option D is not a risk because soft-delete and purge protection on Azure Key Vaults are recommended safeguards that prevent accidental or malicious permanent deletion of secrets, keys, and certificates.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 14

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Accepted Answer

ARP ping discovery (-PR). Option D, ARP ping discovery (-PR), is correct because Nmap's ARP scan operates at the data link/network layer by broadcasting ARP requests ("who has this IP?") and identifying live hosts from ARP replies, without generating any TCP or UDP port traffic, making it fast and quiet on a local subnet. Option E, ICMP Echo request ping (-PE), is correct because it uses the network-layer ICMP protocol (type 8 Echo Request, expecting type 0 Echo Reply) to determine host liveness, again without sending TCP or UDP port probes. Option A, TCP Connect scan (-sT), is wrong because it completes full TCP three-way handshakes to target ports, which is exactly the TCP port traffic the tester must avoid. Option B, TCP SYN port scan (-sS), is wrong because it sends TCP SYN packets to ports (half-open scanning), still TCP port traffic. Option C, UDP port scan (-sU), is wrong because it sends UDP datagrams to target ports, which is UDP port traffic and also slow and noisy.

Answer

TCP Connect scan (-sT)

Answer

TCP SYN port scan (-sS)

Answer

UDP port scan (-sU)

Question 15

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

Accepted Answer

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. DCSync abuses the Directory Replication Service (DRS) Remote Protocol by impersonating a domain controller and requesting replication of directory changes. The specific rights required are the extended rights DS-Replication-Get-Changes and DS-Replication-Get-Changes-All (GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), typically granted to Domain Admins, Enterprise Admins, and the DC computer accounts themselves.

Answer

GenericAll over thekrbtgt account

Answer

FullControl over the Domain Controllers OU

Answer

WriteDACL on the builtin Administrators group

Question 16

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN scan, which sends a SYN packet and waits for a SYN-ACK response, never completing the full 3-way handshake, thus remaining stealthier.

Answer

-sA

Answer

-sU

Answer

-sT

Question 17

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Accepted Answer

-f. The -f option causes Nmap to split the IP packets into tiny fragments. Specifying it twice (-ff) sends 16-byte fragments instead of 8-byte fragments.

Answer

--mtu

Answer

--data-length

Answer

-D

Question 18

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

Accepted Answer

Using the -D option to launch a decoy scan with multiple fake source IP addresses. Option B is correct because Nmap's -D (decoy) option injects multiple spoofed source IP addresses into the scan, so packet inspection filters and IDS/IPS sensors see traffic from many apparent senders and cannot easily attribute or block the real scanning host. Option E is correct because --source-port (or -g) sets the TCP/UDP source port to a chosen value such as 53 (DNS) or 20 (FTP-data), which can slip past poorly written firewall or ACL rules that trust traffic originating from those well-known ports. Option A is not an evasion technique; -p- simply expands the port range to all 65,535 TCP ports and affects coverage, not header or timing manipulation. Option C is not an evasion feature; --script runs NSE scripts for discovery or vulnerability detection against open ports. Option D is not an evasion feature; -oA only writes scan output in normal, XML, and Grepable formats for reporting.

Answer

Using the -p- option to scan all 65,535 TCP ports on the target host

Answer

Using the --script option to execute NSE vulnerability scripts against open ports

Answer

Using the -oA option to output scan results simultaneously in normal, XML, and Grepable formats

Question 19

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

Accepted Answer

Snap7 library scripts. Snap7 is an open-source Siemens S7 communication library that allows developers and testers to interact with Siemens PLCs. Wireshark is passive, Metasploit has limited industrial modules, and Scapy can craft raw packets but Snap7 is the standard library for S7comm manipulation.

Answer

Aircrack-ng

Answer

Hydra

Answer

Wireshark

Question 20

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. Option C is correct because the Nmap NSE script smb2-security-mode queries SMB2 on port 445 and reports the message signing configuration, explicitly showing whether signing is required or not, which directly identifies hosts vulnerable to NTLM relay. Option E is correct because CrackMapExec/NetExec's smb module enumerates SMB hosts across a subnet and reports signing status (e.g., 'signing:False') in its output, making it ideal for quickly sweeping an internal range. Option A (tracert) only maps the network path to a target via ICMP TTL expiry and reveals nothing about SMB configuration. Option B (ping -t) merely sends continuous ICMP echo requests to test reachability and cannot detect SMB signing. Option D (nslookup -type=mx) queries DNS mail exchanger records and is unrelated to SMB security settings.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>