CPENT Practice Test 3 — 25 Questions

Question 1

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lua. Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Answer

Bash

Answer

PowerShell

Answer

Ruby

Question 2

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

Accepted Answer

QEMU_LD_PREFIX. When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Answer

QEMU_ROOTFS

Answer

LD_LIBRARY_PATH

Answer

PATH

Question 3

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Option B is correct because assigning the Owner role to external guest users at the root management group level grants them full control over every subscription and resource in the tenant, violating least-privilege and creating a severe privilege-escalation and data-exfiltration risk. Option E is correct because long-lived, unchanged storage account access keys with broad data access effectively act as permanent shared secrets; if leaked, they allow full access to the storage account's data, and key rotation is a core configuration best practice. Option A is not a risk but a recommended defense, since Azure Defender for SQL provides threat detection and vulnerability assessment for Azure SQL databases. Option C is not a risk because Azure Monitor alerts on failed sign-in attempts improve detection of brute-force or credential-stuffing activity. Option D is not a risk because soft-delete and purge protection on Azure Key Vaults are recommended safeguards that prevent accidental or malicious permanent deletion of secrets, keys, and certificates.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 4

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Accepted Answer

ARP ping discovery (-PR). Option D, ARP ping discovery (-PR), is correct because Nmap's ARP scan operates at the data link/network layer by broadcasting ARP requests ("who has this IP?") and identifying live hosts from ARP replies, without generating any TCP or UDP port traffic, making it fast and quiet on a local subnet. Option E, ICMP Echo request ping (-PE), is correct because it uses the network-layer ICMP protocol (type 8 Echo Request, expecting type 0 Echo Reply) to determine host liveness, again without sending TCP or UDP port probes. Option A, TCP Connect scan (-sT), is wrong because it completes full TCP three-way handshakes to target ports, which is exactly the TCP port traffic the tester must avoid. Option B, TCP SYN port scan (-sS), is wrong because it sends TCP SYN packets to ports (half-open scanning), still TCP port traffic. Option C, UDP port scan (-sU), is wrong because it sends UDP datagrams to target ports, which is UDP port traffic and also slow and noisy.

Answer

TCP Connect scan (-sT)

Answer

TCP SYN port scan (-sS)

Answer

UDP port scan (-sU)

Question 5

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

Accepted Answer

DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. DCSync abuses the Directory Replication Service (DRS) Remote Protocol by impersonating a domain controller and requesting replication of directory changes. The specific rights required are the extended rights DS-Replication-Get-Changes and DS-Replication-Get-Changes-All (GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), typically granted to Domain Admins, Enterprise Admins, and the DC computer accounts themselves.

Answer

GenericAll over thekrbtgt account

Answer

FullControl over the Domain Controllers OU

Answer

WriteDACL on the builtin Administrators group

Question 6

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN scan, which sends a SYN packet and waits for a SYN-ACK response, never completing the full 3-way handshake, thus remaining stealthier.

Answer

-sA

Answer

-sU

Answer

-sT

Question 7

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Accepted Answer

-f. The -f option causes Nmap to split the IP packets into tiny fragments. Specifying it twice (-ff) sends 16-byte fragments instead of 8-byte fragments.

Answer

--mtu

Answer

--data-length

Answer

-D

Question 8

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

Accepted Answer

Using the -D option to launch a decoy scan with multiple fake source IP addresses. Option B is correct because Nmap's -D (decoy) option injects multiple spoofed source IP addresses into the scan, so packet inspection filters and IDS/IPS sensors see traffic from many apparent senders and cannot easily attribute or block the real scanning host. Option E is correct because --source-port (or -g) sets the TCP/UDP source port to a chosen value such as 53 (DNS) or 20 (FTP-data), which can slip past poorly written firewall or ACL rules that trust traffic originating from those well-known ports. Option A is not an evasion technique; -p- simply expands the port range to all 65,535 TCP ports and affects coverage, not header or timing manipulation. Option C is not an evasion feature; --script runs NSE scripts for discovery or vulnerability detection against open ports. Option D is not an evasion feature; -oA only writes scan output in normal, XML, and Grepable formats for reporting.

Answer

Using the -p- option to scan all 65,535 TCP ports on the target host

Answer

Using the --script option to execute NSE vulnerability scripts against open ports

Answer

Using the -oA option to output scan results simultaneously in normal, XML, and Grepable formats

Question 9

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

Accepted Answer

Snap7 library scripts. Snap7 is an open-source Siemens S7 communication library that allows developers and testers to interact with Siemens PLCs. Wireshark is passive, Metasploit has limited industrial modules, and Scapy can craft raw packets but Snap7 is the standard library for S7comm manipulation.

Answer

Aircrack-ng

Answer

Hydra

Answer

Wireshark

Question 10

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. Option C is correct because the Nmap NSE script smb2-security-mode queries SMB2 on port 445 and reports the message signing configuration, explicitly showing whether signing is required or not, which directly identifies hosts vulnerable to NTLM relay. Option E is correct because CrackMapExec/NetExec's smb module enumerates SMB hosts across a subnet and reports signing status (e.g., 'signing:False') in its output, making it ideal for quickly sweeping an internal range. Option A (tracert) only maps the network path to a target via ICMP TTL expiry and reveals nothing about SMB configuration. Option B (ping -t) merely sends continuous ICMP echo requests to test reachability and cannot detect SMB signing. Option D (nslookup -type=mx) queries DNS mail exchanger records and is unrelated to SMB security settings.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 11

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Accepted Answer

The explicit Deny in the bucket policy takes precedence, resulting in access being denied.. AWS evaluates all applicable policies (identity-based, resource-based, ACLs, SCPs, permission boundaries) together, and any explicit Deny anywhere in the evaluation chain overrides every Allow. Because the bucket policy contains an explicit Deny for public read, that Deny wins over the ACL's public-read grant, and the request is denied. This is the fundamental 'explicit deny always wins' rule in AWS IAM policy evaluation logic.

Answer

AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.

Answer

Access is granted because any Allow permission supersedes bucket restrictions.

Answer

The public ACL takes precedence because ACLs are evaluated before bucket policies.

Question 12

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

Accepted Answer

Disabling multi-factor authentication requirements for global administrator accounts during emergency maintenance windows.. Option A is correct because disabling multi-factor authentication for global administrator accounts—even temporarily during emergency maintenance—removes the strongest protection on the most privileged identities, exposing the tenant to credential-stuffing, phishing, and token-replay attacks that MFA would otherwise block. Option D is correct because non-expiring service account passwords combined with interactive logon rights create long-lived, human-usable credentials that violate least privilege and the separation of service and interactive accounts, making lateral movement and credential theft far easier. Option B is not an insecure practice: strong password complexity and expiration policies are standard hardening controls for cloud user accounts. Option C is not insecure: Microsoft Entra ID Protection is a defensive tool that detects compromised credentials and risky sign-ins. Option E is not insecure: Azure managed identities eliminate hardcoded credentials by issuing tokens through the platform, which is a recommended secure practice.

Answer

Enforcing strong password complexity and expiration policies for all cloud user accounts.

Answer

Implementing Microsoft Entra ID Protection to detect compromised credentials and risky sign-ins.

Answer

Utilizing Azure AD managed identities for Azure resources instead of hardcoded credentials.

Question 13

An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?

Accepted Answer

Function Code 16 (0x10) - Write Multiple Registers. Modbus function codes define the action to be performed. Function Code 16 (0x10) is 'Write Multiple Registers', frequently used to change register blocks in industrial controllers.

Answer

Function Code 01 (0x01) - Read Coils

Answer

Function Code 04 (0x04) - Read Input Registers

Answer

Function Code 02 (0x02) - Read Discrete Inputs

Question 14

A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?

Accepted Answer

Azure AD application with a client secret that has a long expiration. A global administrator can create or modify an Microsoft Entra ID application and add a client secret. This secret acts as a credential for the service principal and remains valid until it expires or is revoked, regardless of the user's password changes. Attackers often use this technique to maintain persistence in Microsoft 365 environments, as it allows continued access to mail, files, and other resources granted to the application.

Answer

Azure AD password protection with a custom banned password list

Answer

Azure AD Privileged Identity Management (PIM) with just-in-time access

Answer

Azure AD Conditional Access policy that blocks legacy authentication

Question 15

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Accepted Answer

-Pn. The -Pn option disables host discovery, forcing Nmap to proceed with port scanning every specified IP address as if it were online.

Answer

-R

Answer

-p-

Answer

-n

Question 16

A CPENT tester is assessing a water treatment plant's OT network. The tester has captured traffic on the plant's control VLAN and wants to enumerate all Modbus/TCP devices and their supported function codes without disrupting operations. Which Nmap NSE script should the tester run against the subnet to perform this discovery safely?

Accepted Answer

nmap -p 502 --script modbus-discover <subnet>. Modbus/TCP devices listen on TCP port 502, and the modbus-discover NSE script performs read-only device identification and function-code enumeration by sending safe Read Device Identification requests. Running a standard TCP scan against port 502 with this script enumerates PLCs without issuing writes, which meets the requirement to discover devices without disrupting plant operations.

Answer

nmap -sU -p 502 --script modbus-discover <subnet>

Answer

nmap -p 502 --script modbus-write <subnet>

Answer

nmap -p 502 --script modbus-discover --script-args modbus-discover.force=true <subnet>

Question 17

A CPENT tester gains access to an engineering workstation on an OT network and finds a project file for a Siemens SIMATIC S7-1200 PLC. The tester wants to extract the PLC's configuration, including any stored password hashes, from the engineering workstation's project data to demonstrate credential exposure. Which artifact should the tester examine?

Accepted Answer

The .ap17 project archive's SystemBlock and hardware configuration XML files, which contain PLC protection level settings and hashed password material. TIA Portal project archives (.ap17) bundle the hardware configuration and SystemBlock data as XML and binary files. These contain the PLC protection level and the hashed password used for access control. Extracting and cracking that hash from the engineering workstation demonstrates credential exposure without interacting with the live PLC, which is the goal of this assessment.

Answer

The S7-1200's web server index page, which serves the PLC password in cleartext over HTTP for diagnostic purposes

Answer

The STEP 7 project's GlobalLabels CSV export, which stores the PLC password in a readable column

Answer

The S7-1200's SD card root directory file named PASSWD.TXT, which TIA Portal writes during commissioning

Question 18

During a CPENT engagement, you have obtained a low-privileged shell on a Windows Server 2019 host that is a member of an Active Directory domain. You notice the host has the SMB signing requirement disabled. You want to perform lateral movement to other hosts on the network by capturing and relaying authentication attempts. Which tool and technique would best allow you to relay NTLM authentication to a target host where SMB signing is not enforced?

Accepted Answer

Use ntlmrelayx.py from Impacket to relay captured NTLM authentication to the target host's SMB service.. Relaying NTLM authentication is a powerful lateral movement technique when SMB signing is not enforced. The tool ntlmrelayx.py from Impacket is specifically built to relay authentication to SMB and other protocols. With SMB signing disabled on the target, the relayed authentication is accepted, allowing the attacker to execute commands or dump SAM hashes. This avoids the need to crack captured hashes and directly leverages the authentication attempt.

Answer

Use Responder with the -w flag to capture NTLMv2 hashes and then crack them offline with Hashcat.

Answer

Use Metasploit's psexec module with the current user's credentials to move laterally.

Answer

Use Mimikatz to extract plaintext credentials from memory and then use them for lateral movement.

Question 19

During an OT assessment, you capture network traffic on the plant floor and notice that a Siemens S7-1200 PLC responds to read/write requests on TCP port 102 without requiring any authentication. You want to interact with the PLC to read its current process values and verify whether an attacker could manipulate the logic. Which tool is specifically designed to communicate with Siemens S7 PLCs over the S7comm protocol for this purpose?

Accepted Answer

Snap7. Siemens S7 PLCs use the proprietary S7comm protocol over TCP port 102. To actively read/write process values or modify logic, a tool that implements S7comm is required. Snap7 is an open-source library and set of tools that provides this capability, allowing direct interaction with S7-1200, S7-1500, S7-300, and S7-400 PLCs. Other options either target different protocols or are passive/information-gathering tools.

Answer

Wireshark with the s7comm dissector

Answer

Modbus Poll

Answer

Nmap with the s7-info script

Question 20

A penetration tester has obtained domain administrator credentials for a Windows Active Directory environment. The tester wants to extract the KRBTGT account password hash to create Golden Tickets. Which method is most direct for obtaining this hash?

Accepted Answer

Run Mimikatz with the lsadump::dcsync command targeting the krbtgt account.. DCSync is a technique that impersonates a domain controller to request replication of account data, including password hashes. With domain administrator rights, Mimikatz's lsadump::dcsync can retrieve the KRBTGT hash directly from a domain controller without needing to access the DC's file system. This is the most direct and stealthy method for obtaining the KRBTGT hash to forge Golden Tickets.

Answer

Perform a Kerberoasting attack against the KRBTGT service account.

Answer

Use Volume Shadow Copy to copy the NTDS.dit file and extract hashes offline.

Answer

Run Mimikatz with the sekurlsa::logonpasswords command on a domain-joined workstation.