CPENT Practice Exam 4 — 20 Questions

Question 1

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application layer function codes specifying operations like Read, Write, Select, and Operate. DNP3 features application layer functions, object headers, and Secure Authentication extensions (IEC 62351-5) to prevent spoofing of control commands.

Answer

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Answer

HTTP Authorization Bearer tokens used for REST API authentication

Question 2

An auditor is reviewing an ICS network architecture and notes that a Supervisory Control and Data Acquisition (SCADA) server communicates with remote terminal units (RTUs) via DNP3 over serial-to-ethernet terminal servers. The auditor wants to test if unauthenticated DNP3 control commands can be accepted. Which default port should the auditor probe for DNP3 traffic?

Accepted Answer

TCP/UDP 20000. DNP3 (Distributed Network Protocol) is heavily used in electric and water utilities and operates by default on TCP/UDP port 20000.

Answer

TCP 443

Answer

TCP 2404

Answer

TCP 44818

Question 3

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

Accepted Answer

Lua. Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Answer

Bash

Answer

PowerShell

Answer

Ruby

Question 4

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Common container security issues include mounting the Docker socket, running containers in privileged mode, and exposing sensitive host paths.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 5

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

Accepted Answer

enip-info. Nmap includes the 'enip-info' NSE script specifically designed to query EtherNet/IP devices for identification and vendor details.

Answer

modbus-discover

Answer

bacnet-discover

Answer

dnp3-info

Question 6

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark

Question 7

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

Accepted Answer

Snap7 library scripts. Snap7 is an open-source Siemens S7 communication library that allows developers and testers to interact with Siemens PLCs. Wireshark is passive, Metasploit has limited industrial modules, and Scapy can craft raw packets but Snap7 is the standard library for S7comm manipulation.

Answer

Aircrack-ng

Answer

Hydra

Answer

Wireshark

Question 8

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Accepted Answer

Hostapd-mana. EAPHammer or Hostapd-mana are specialized tools used to execute rogue access point attacks and evil twin attacks against WPA2/WPA3 Enterprise networks to capture credentials.

Answer

Aircrack-ng

Answer

Reaver

Answer

Kismet

Question 9

An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?

Accepted Answer

KillerBee. KillerBee is a popular Python framework and toolset for security auditing and exploiting Zigbee and IEEE 802.15.4 networks.

Answer

Impacket

Answer

Airgeddon

Answer

Bettercap

Question 10

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

Accepted Answer

QEMU_LD_PREFIX. When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Answer

QEMU_ROOTFS

Answer

LD_LIBRARY_PATH

Answer

PATH

Question 11

An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)

Accepted Answer

Populating a PostgreSQL database with image metadata and utilizing Firmadyne helper scripts to extract the file system. Firmadyne emulation requires extracting the file system, initializing a PostgreSQL database to store image metadata, and running specialized QEMU system emulators with a modified kernel.

Answer

Brute-forcing SSH passwords using Hydra against the host machine

Answer

Executing an SQL injection payload against the web server running on port 80

Answer

Sniffing 802.11 wireless beacons with an external USB Wi-Fi adapter in monitor mode

Question 12

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

Accepted Answer

iec104. IEC 60870-5-104 operates over TCP port 2404. Wireshark decodes this under the 'iec104' protocol filter.

Answer

s7comm

Answer

mms

Answer

bacnet

Question 13

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN scan, which sends a SYN packet and waits for a SYN-ACK response, never completing the full 3-way handshake, thus remaining stealthier.

Answer

-sA

Answer

-sU

Answer

-sT

Question 14

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. MQTT security assessments focus heavily on authentication, authorization (ACLs), and transport encryption (TLS).

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 15

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

Accepted Answer

SMB / NetBIOS service enumeration. LDAP (without signing/anonymous binds) and SNMP (with default community strings) or SMB/RPC often expose information. Specifically, SNMP and LDAP or SMB NetBIOS services. Let's choose SNMP and SMB.

Answer

HTTPS with modern TLS 1.3

Answer

IPsec VPN tunnels

Answer

SSH v2 with public key authentication

Question 16

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Accepted Answer

Get-WmiObject win32_service | select Name, PathName | where { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }. Unquoted service paths can be queried via WMI or PowerShell without admin rights. The Get-WmiObject command querying Win32_Service can filter for paths containing spaces and not enclosed in quotes.

Answer

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command

Answer

sc query state= all | findstr /i "binpath"

Answer

Get-Service | Where-Object { $_.Status -eq 'Running' -and $_.Path -notmatch '"' }

Question 17

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Accepted Answer

Adding a scheduled task or cron job in /etc/crontab or user crontabs to periodically execute a reverse shell. Linux persistence can be achieved via Cron jobs (scheduled tasks), modifying initialization scripts like /etc/rc.local or systemd service units, and adding SSH authorized keys to user profiles.

Answer

Modifying the Windows Registry Run key using winereg

Answer

Injecting shellcode into the BIOS/UEFI firmware via flashrom without user interaction

Question 18

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Accepted Answer

WMI (Windows Management Instrumentation). PsExec and WMI are standard tools for executing remote commands across an AD domain.

Answer

DHCP spoofing

Answer

DNS poisoning

Answer

ARP cache poisoning

Question 19

When conducting a firmware security review of an embedded IoT device, a tester extracts the root filesystem and wants to identify potential memory corruption vulnerabilities introduced by compiler hardening settings. Which THREE security hardening flags or mechanisms should the tester verify are missing from the compiled binaries using tools like checksec? (Choose THREE)

Accepted Answer

Stack Canaries (Canary / GS). Checksec identifies binary protections such as RELRO, Stack Canaries, NX (No-Execute / DEP), and PIE (Position Independent Executable). ASLR is an OS-level feature, not a binary compilation flag. Therefore, Stack Canaries, NX, and RELRO are the correct binary compilation mitigations.

Answer

Address Space Layout Randomization (ASLR)

Answer

Bandwidth Throttling

Question 20

A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)

Accepted Answer

Using TFTP to load and execute an unauthorized custom kernel image into device RAM. Via the U-Boot serial prompt, an attacker can interrupt the boot sequence, override kernel command line arguments (e.g., init=/bin/sh), or boot a custom kernel image via TFTP.

Answer

Cracking WPA2 Pre-Shared Keys using a dictionary attack and Aircrack-ng

Answer

Executing an ARP spoofing attack to intercept printer traffic on the corporate IT network

Answer

Injecting an SQL injection payload into the device's Bluetooth GATT profile characteristic