CPENT Practice Test 21 — 15 Questions

Question 1

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'. Fingerprinting ICS equipment involves using Nmap NSE scripts tailored for industrial protocols or specialized asset discovery tools like Shodan/Industrial Defender tools.

Answer

Using 'Aircrack-ng' to inject Bluetooth Low Energy advertisements into nearby smart meters

Answer

Running 'sqlmap' against TCP port 80 to extract database schemas from the corporate ERP

Answer

Cracking WPA2 enterprise handshakes using Hashcat and a dictionary list

Question 2

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

Accepted Answer

smb-os-discovery. smb-os-discovery and smb-protocols (or smb-enum-shares) gather SMB and OS details. Specifically, smb-os-discovery and smb-security-mode or smb-protocols are standard discovery scripts.

Answer

smb-brute

Answer

smb-vuln-ms08-067

Answer

smb-enum-users

Question 3

A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?

Accepted Answer

A UDP broadcast packet containing a BACnet Who-Is request sent to port 47808. BACnet/IP uses a global broadcast UDP packet sent to port 47808 (0xBAC0) with a Who-Is service request to discover devices. Unicast TCP requests require prior IP knowledge, ICMP echo requests only show active hosts not BACnet services, and SNMP queries require a known community string.

Answer

An ICMP ping sweep to identify all live IP addresses on the local network segment

Answer

An SNMP GETBULK request using the default private community string

Answer

A TCP SYN scan directed at port 47808 across the entire subnet

Question 4

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

Accepted Answer

Run the built-in command rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:	emp\lsass.dmp full. Comsvcs.dll exports an undocumented function (MiniDumpW) that can be invoked via rundll32.exe to create a minidump of the lsass.exe process, a common Living off the Land technique used by attackers to bypass basic detection mechanisms.

Answer

Invoke PowerShell with the Get-WmiObject Win32_Process cmdlet specifying the LSASS process handle

Answer

Execute the native net accounts command with the /dump flag to extract password hashes from the SAM registry hive

Answer

Use the tasklist /m lsass.exe command to output the active directory database credentials to the console

Question 5

An assessment team is analyzing an embedded Linux firmware image for an industrial IoT gateway. They have successfully extracted the filesystem using Binwalk, but they need to statically analyze the compiled binaries for potential buffer overflows and insecure function calls. Which tool is specifically designed to perform static binary analysis and identify vulnerable functions likestrcpy within the extracted filesystem?

Accepted Answer

Ghidra. Checksec or a tool like IDA Pro / Ghidra can analyze binaries, but Ghidra or Radare2 are specifically suited for deep reverse engineering and identifying insecure function imports within extracted firmware binaries. Binwalk extracts files, aircrack-ng is for Wi-Fi, and John the Ripper is for password cracking.

Answer

Aircrack-ng

Answer

Binwalk

Answer

John the Ripper

Question 6

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

Accepted Answer

smb-vuln-ms17-010. smb-vuln-ms17-010 is the specific NSE script designed to safely check for the EternalBlue vulnerability.

Answer

smb-brute

Answer

smb-enum-shares

Answer

smb-os-discovery

Question 7

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

Accepted Answer

IPv6 RA Guard. IPv6 Neighbor Discovery Inspection (ND Inspection) or RA Guard is a layer 2 security feature on switches that validates IPv6 neighbor discovery messages, similar to DHCP snooping for IPv4.

Answer

Dynamic ARP Inspection (DAI)

Answer

DHCP Snooping

Answer

Port Security

Question 8

A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?

Accepted Answer

Bus Pirate. A Bus Pirate or similar hardware interface tool (like a Shikra or Total Phase Beagle) is used to interact with hardware communication protocols such as SPI, I2C, and UART to dump firmware. Wireshark is a network protocol analyzer, HackRF One is a software-defined radio for wireless analysis, and a Logic Analyzer captures signals but does not actively interface for reading/writing flash memory in this context.

Answer

Wireshark

Answer

Logic Analyzer

Answer

HackRF One

Question 9

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

Accepted Answer

post/multi/manage/autoroute. The autoroute module creates a SOCKS routing table entry inside the Metasploit framework, allowing auxiliary and exploit modules to communicate through the established Meterpreter session into the target subnet.

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/windows/local/payload_inject

Answer

auxiliary/server/socks_proxy

Question 10

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

Accepted Answer

Create a malicious script named after the command and prepend its directory to the PATH.. If a SUID binary calls a command without an absolute path, you can modify the PATH environment variable to point to a malicious version of that command.

Answer

Modify /etc/ld.so.preload to inject a malicious library.

Answer

Exploit a buffer overflow in the binary using a NOP sled.

Answer

Use the --inject flag on the binary to force command execution.

Answer

null

Question 11

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

Accepted Answer

The port is closed.. An ICMP Port Unreachable message (Type 3, Code 3) indicates that the target UDP port is closed.

Answer

The host is offline.

Answer

The port is filtered by a firewall.

Answer

The port is open and active.

Question 12

A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)

Accepted Answer

Deploying industrial Intrusion Detection Systems (IDS) capable of parsing proprietary OT protocols (e.g., Modbus, DNP3, S7). Securing OT networks involves strict Purdue model network segmentation, deploying unidirectional security gateways (data diodes), and implementing industrial IDS solutions.

Answer

Allowing unrestricted direct Internet access from all PLC controllers for automated driver updates

Answer

Disabling all encryption across SCADA servers to improve packet inspection speeds on firewalls

Question 13

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Accepted Answer

smbclient -L //target-ip. Smbclient and enum4linux are standard tools for enumerating SMB shares on Windows and Samba servers.

Answer

sqlmap -u target-url

Answer

nmap --script http-enum

Answer

aircrack-ng target.cap

Question 14

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Accepted Answer

It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.. While ping traditionally required SUID root to open raw sockets, modern Linux kernels support CAP_NET_RAW capability. If a misconfigured SUID binary allows arbitrary command execution, it leads to privilege escalation, but standard SUID ping is typically safe unless a vulnerability exists in that specific version. Let's frame it around exploiting a known SUID binary vulnerability or misconfigured SUID finder.

Answer

It allows remote attackers to execute system calls over ICMP tunneling.

Answer

Any local user can execute commands as root by passing malicious arguments to the SUID binary.

Answer

The system is immune to local privilege escalation because SUID is disabled by SELinux.

Question 15

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Accepted Answer

Write to coils and holding registers to manipulate actuator states and setpoints. Modbus/TCP lacks built-in security, meaning any host with network access can read registers, write/alter register values, and send stop/start commands to PLCs.

Answer

Automatically decrypt Active Directory Kerberos ticket-granting tickets stored on the PLC

Answer

Execute cross-site scripting (XSS) attacks against the PLC's internal browser rendering engine