CPENT Practice Test 4 — 25 Questions

Question 1

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Get-WmiObject win32_service | select Name, PathName | where { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }. Unquoted service paths can be queried via WMI or PowerShell without admin rights. The Get-WmiObject command querying Win32_Service can filter for paths containing spaces and not enclosed in quotes.

Answer

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command

Answer

sc query state= all | findstr /i "binpath"

Answer

Get-Service | Where-Object { $_.Status -eq 'Running' -and $_.Path -notmatch '"' }

Question 2

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Accepted Answer

Adding a scheduled task or cron job in /etc/crontab or user crontabs to periodically execute a reverse shell. Linux persistence can be achieved via Cron jobs (scheduled tasks), modifying initialization scripts like /etc/rc.local or systemd service units, and adding SSH authorized keys to user profiles.

Answer

Modifying the Windows Registry Run key using winereg

Answer

Injecting shellcode into the BIOS/UEFI firmware via flashrom without user interaction

Question 3

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Accepted Answer

WMI (Windows Management Instrumentation). PsExec and WMI are standard tools for executing remote commands across an AD domain.

Answer

DHCP spoofing

Answer

DNS poisoning

Answer

ARP cache poisoning

Question 4

When conducting a firmware security review of an embedded IoT device, a tester extracts the root filesystem and wants to identify potential memory corruption vulnerabilities introduced by compiler hardening settings. Which THREE security hardening flags or mechanisms should the tester verify are missing from the compiled binaries using tools like checksec? (Choose THREE)

Accepted Answer

Stack Canaries (Canary / GS). Checksec identifies binary protections such as RELRO, Stack Canaries, NX (No-Execute / DEP), and PIE (Position Independent Executable). ASLR is an OS-level feature, not a binary compilation flag. Therefore, Stack Canaries, NX, and RELRO are the correct binary compilation mitigations.

Answer

Address Space Layout Randomization (ASLR)

Answer

Bandwidth Throttling

Question 5

A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)

Accepted Answer

Using TFTP to load and execute an unauthorized custom kernel image into device RAM. Via the U-Boot serial prompt, an attacker can interrupt the boot sequence, override kernel command line arguments (e.g., init=/bin/sh), or boot a custom kernel image via TFTP.

Answer

Cracking WPA2 Pre-Shared Keys using a dictionary attack and Aircrack-ng

Answer

Executing an ARP spoofing attack to intercept printer traffic on the corporate IT network

Answer

Injecting an SQL injection payload into the device's Bluetooth GATT profile characteristic

Question 6

During an assessment of an Operational Technology (OT) network, a tester discovers a Programmable Logic Controller (PLC) using the Modbus TCP protocol. The tester needs to query holding registers to understand the operational state of the industrial process. Which default TCP port should the tester target for Modbus communications?

Accepted Answer

Port 502. Modbus TCP uses port 502 by default. Port 80 is HTTP, port 443 is HTTPS, and port 1883 is MQTT.

Answer

Port 80

Answer

Port 443

Answer

Port 1883

Question 7

An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)

Accepted Answer

Reviewing sudo privileges using 'sudo -l'. Finding privilege escalation vectors involves searching for SUID/SGID binaries, inspecting sudo permissions, and checking cron jobs.

Answer

Analyzing Modbus holding registers for unauthorized register modifications

Answer

Checking Bluetooth GATT profile characteristics using nRF Connect

Question 8

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

Accepted Answer

-sI. The -sI flag instructs Nmap to perform an idle scan using a specified zombie host, allowing completely blind port scanning where packets appear to originate from the zombie.

Answer

-sZ

Answer

-sO

Answer

-sM

Question 9

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Accepted Answer

Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.. SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow an attacker to impersonate tokens. Tools like Rotten Potato, RoguePotato, or PrintSpoofer leverage this to escalate to NT AUTHORITY\SYSTEM.

Answer

Mimikatz credential dumper via direct LSASS memory injection.

Answer

PowerView domain enumeration modules.

Answer

Windows Subsystem for Linux (WSL) container breakouts.

Question 10

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Accepted Answer

/etc/passwd. /etc/passwd, /etc/crontab, and ~/.ssh/ are key locations for user accounts, scheduled tasks, and SSH keys respectively.

Answer

/proc/version

Answer

/var/log/syslog

Question 11

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Accepted Answer

Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker. DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.

Answer

Use standard FTP data channels over ephemeral ports to push archives to an external staging server

Answer

Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets

Answer

Establish an HTTPS connection to an external IP address using port 443

Question 12

A penetration tester is reviewing the firmware of a smart electricity meter and discovers that the bootloader is unlocked. The tester connects a USB-to-UART serial adapter to the board's exposed pins and interrupts the boot sequence to gain a root shell. Which environment variable or kernel boot parameter must the tester modify to bypass the root password authentication prompt entirely?

Accepted Answer

init=/bin/sh. Appending 'init=/bin/sh' or 'init=/bin/bash' to the kernel boot arguments (bootargs) forces the Linux kernel to spawn a shell directly upon booting, bypassing init scripts and authentication prompts. 'rootfstype' defines the filesystem type, 'ip=' configures networking, and 'mem=' limits RAM.

Answer

rootfstype=squashfs

Answer

ip=DHCP

Answer

mem=256M

Question 13

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

Accepted Answer

--data-length. The --data-length option tells Nmap to append a random number of bytes to the sent packets, altering their length signature and evading simple signature-based Nmap detection rules.

Answer

--mtu

Answer

--badsum

Answer

-f

Question 14

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

Accepted Answer

Targeting user accounts that have associated Service Principal Names (SPNs). Kerberoasting involves requesting TGS service tickets for user accounts with Service Principal Names (SPNs), high volume of TGS-REQ requests, and RC4 encryption (encryption type 23).

Answer

Massive outbound DNS zone transfers (AXFR)

Answer

Frequent LLMNR poisoning broadcasts

Question 15

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

Accepted Answer

-sn. The -sn parameter tells Nmap to perform host discovery only (formerly known as a ping scan using -sP) and disables port scanning entirely.

Answer

-sS

Answer

-Pn

Answer

-sO

Question 16

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Accepted Answer

Insecure Scheduled Task Permissions / Writable Task Executable. If a scheduled task runs as SYSTEM or an admin, and the underlying script or binary is writable by low-privileged users, it represents an insecure file permissions vulnerability leading to privilege escalation when the task triggers.

Answer

Unquoted service path exploitation involving spaces in service binary names.

Answer

DLL Hijacking via PATH environment variable manipulation.

Answer

Kerberoasting against domain service principal names.

Question 17

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Accepted Answer

scp. scp, sftp, and curl (using HTTPS) or rsync over ssh provide encrypted file transfers. Standard nc and ftp are unencrypted.

Answer

nc (Netcat)

Answer

ftp

Question 18

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Accepted Answer

-Pn. The -Pn option disables host discovery, forcing Nmap to proceed with port scanning every specified IP address as if it were online.

Answer

-R

Answer

-p-

Answer

-n

Question 19

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Accepted Answer

Ptunnel. Ptunnel (Ping Tunnel) is a specialized application that allows tunneling TCP connections reliably through ICMP echo request and reply packets.

Answer

Socat

Answer

Netcat

Answer

Iodine

Question 20

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Accepted Answer

-f. The -f option causes Nmap to split the IP packets into tiny fragments. Specifying it twice (-ff) sends 16-byte fragments instead of 8-byte fragments.

Answer

--mtu

Answer

--data-length

Answer

-D