CPENT Practice Test 4 — 25 Questions

Question 1

When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?

Accepted Answer

It connects via RPC and invokes the DRSUAPI protocol (DsGetNCChanges) to request replication data.. Impacket's secretsdump.py performs DCSync by authenticating to a domain controller and invoking the DRSUAPI (Directory Replication Service Remote Protocol) interface, specifically the DsGetNCChanges method. This RPC call is the same mechanism legitimate DCs use to replicate directory data, so the DC treats the request as a normal replication pull and returns password hashes (NTLM, Kerberos keys) without the attacker ever executing code on the DC.

Answer

It executes an LDAP search request asking for the plaintext password attribute.

Answer

It queries the Active Directory Web Services (ADWS) REST API on port 9389.

Answer

It reads the NTDS.dit file directly over standard SMB file shares using administrator credentials.

Question 2

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Accepted Answer

Restrict the NSG rule source IP to trusted administrative networks or implement Azure Bastion for secure management.. The NSG rule exposes RDP (TCP 3389) to the entire internet, which is the primary attack surface for brute-force, BlueKeep-style exploits, and ransomware initial access. The correct remediation is to narrow the source to trusted administrative IP ranges or, better, remove the public RDP exposure entirely and use Azure Bastion, which provides browser-based RDP/SSH over TLS through the Azure portal without a public IP on the VM. This directly addresses the misconfiguration while preserving administrative access.

Answer

Disable the Azure Key Vault service across the subscription.

Answer

Enable Azure Active Directory Pass-Through Authentication on the VM guest OS.

Answer

Attach an AWS IAM instance profile to the Azure Virtual Machine.

Question 3

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Accepted Answer

Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.. With no_root_squash enabled, the NFS server maps the root user on the client to root on the server, so a client that mounts the share as root can create files owned by root with the SUID bit set. Copying /bin/bash to the share and running chmod +s on it produces a root-owned SUID shell that, when executed on the target, grants root privileges. This is the classic no_root_squash privilege escalation.

Answer

Modify the /etc/exports file on the remote target directly via standard FTP.

Answer

Mount the NFS share using standard user privileges and create a standard user shell script.

Answer

Log into the NFS server directly via SSH using the exported share credentials.

Question 4

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Accepted Answer

Mimikatz: kerberos::ptt ticket.kirbi. Pass-the-Ticket involves injecting exported ticket files (such as .kirbi or .ccache format) into memory. Mimikatz uses the 'kerberos::ptt' command to inject a ticket into the current Windows logon session.

Answer

Rubeus: golden /ticket:ticket.kirbi

Answer

PowerView: Invoke-TicketInjection -Path ticket.kirbi

Answer

Impacket: ticketer.py -nthash ...

Question 5

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

Accepted Answer

post/multi/manage/autoroute. The post/multi/manage/autoroute module in Metasploit adds routes to the Meterpreter session's routing table, enabling the framework to pivot through the compromised host into the 192.168.100.0/24 subnet. Once autoroute is configured with the target subnet, subsequent Metasploit modules (including scanners) automatically route traffic through the session. This is the prerequisite step before running any scan against the isolated network.

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/windows/local/payload_inject

Answer

auxiliary/server/socks_proxy

Question 6

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)

Accepted Answer

Query the Azure Instance Metadata Service (IMDS) endpoint at http://169.254.169.254/metadata/identity/oauth2/token to obtain an access token for the managed identity.. The two correct actions are querying the IMDS endpoint to obtain an access token and using that token to call Azure Resource Manager if the managed identity has Reader permissions. These steps allow an attacker to leverage SSRF to steal the managed identity's token and then access Azure resources. The other options are incorrect because they assume capabilities that IMDS does not provide, such as retrieving certificates or modifying role assignments, or they require permissions not typically granted to managed identities.

Answer

Modify the managed identity's role assignments by sending a PATCH request to the IMDS endpoint to add the Contributor role.

Answer

Retrieve the managed identity's certificate from the IMDS endpoint and use it to authenticate as the managed identity to any Azure service.

Answer

Use the managed identity's credentials to authenticate to Azure Active Directory (Azure AD) and enumerate all users and groups in the tenant.

Question 7

An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?

Accepted Answer

The Enterprise Admins group in the forest root domain. The Enterprise Admins group resides in the forest root domain and grants full administrative control over all domains in the forest. Compromising this group (or adding an account to it) is the definitive way to achieve forest-wide privilege escalation. In a multi-domain forest, even Domain Admin in a child domain does not automatically confer Enterprise Admin rights, so the attacker must target the forest root's Enterprise Admins group.

Answer

The Cert Publishers group on any workstation

Answer

The Domain Admins group of the subordinate domain

Answer

The Account Operators group in the builtin container

Question 8

A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?

Accepted Answer

bacpypes (using scripts like whois.py / iam.py). bacpypes is a Python library that implements the BACnet protocol stack, and its bundled scripts such as whois.py (Who-Is/I-Am discovery) and iam.py (I-Am response) are designed specifically for BACnet device discovery and property enumeration. This makes it the correct tool for assessing BACnet/IP devices on a smart building network.

Answer

ettercap

Answer

sqlmap

Answer

msfvenom

Question 9

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Accepted Answer

An Amazon S3 bucket configured with ACLs allowing public read and write access.. Option A is correct because an S3 bucket ACL granting public read and write access (e.g., AllUsers with WRITE or WRITE_ACP permissions) allows anyone on the internet to upload, overwrite, or delete objects, which is a serious misconfiguration and a common cause of data breaches. Option C is correct because binding storage.objectViewer to allUsers in Google Cloud Storage makes every object in the bucket readable by anyone on the internet, exposing data without authentication. Option B is not improper: setting 'Secure transfer required' to Enabled on an Azure Storage Account enforces HTTPS/TLS for all requests, which is a security best practice. Option D is not improper: versioning plus object lock (e.g., S3 Object Lock in compliance mode) protects financial data against deletion or tampering and supports retention requirements. Option E is not improper: enabling S3 Block Public Access at the account level is a recommended guardrail that overrides bucket policies and ACLs to prevent public exposure.

Answer

An Azure Storage Account with 'Secure transfer required' set to Enabled.

Answer

Enabling versioning and object lock on financial data storage buckets.

Answer

Enabling AWS S3 Block Public Access at the account level.

Question 10

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 11

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

Accepted Answer

s7-info. Nmap includes specific industrial control scripts in the 'scripts/' directory. The 's7-info' script specifically queries Siemens S7 devices to extract operational data.

Answer

modbus-discover

Answer

bacnet-info

Answer

enip-info

Question 12

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Accepted Answer

Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host. Option B is correct because Unconstrained Delegation (TrustedForDelegation) causes the host to cache the TGT of every authenticating user in LSASS memory; an attacker who compromises that host can extract those TGTs (e.g., via Mimikatz) and impersonate privileged users across the domain. Option C is correct because RBCD abuse occurs when an attacker controls a principal with write access to a target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, letting them configure the target to trust their controlled account and then obtain service tickets via S4U2Self/S4U2Proxy to impersonate any user to that target. Option D is correct because Constrained Delegation with Protocol Transition allows a service to obtain a forwardable ticket for a user without that user's credentials (S4U2Self) and then use S4U2Proxy to access downstream services, so a compromised service account can pivot to any resource listed in msDS-AllowedToDelegateTo. Option A is not a vulnerability—Kerberos pre-authentication with strong passwords is a hardening best practice that resists AS-REP roasting. Option E is unrelated to delegation; it concerns machine account quota (ms-DS-MachineAccountQuota) and does not by itself constitute a Kerberos delegation attack vector.

Answer

Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords

Answer

Automatic workstation registration limits set to allow zero new domain-joined machines

Question 13

During an external engagement, you find that the target's edge device responds to IKE on UDP/500 and appears to accept aggressive-mode Phase 1 proposals. You want to determine whether a pre-shared key can be recovered offline so you can impersonate a peer. Which approach is most appropriate?

Accepted Answer

Capture the aggressive-mode exchange with tcpdump and run ike-scan with the --pskcrack option to produce a hash file for offline cracking.. Aggressive-mode IKE exchanges include a hash derived from the pre-shared key, which can be captured and attacked offline. Ike-scan with --pskcrack extracts this material into a file that psk-crack or hashcat can process, enabling dictionary or brute-force recovery of the PSK. Replay, main-mode downgrade, and transform enumeration do not disclose the key, so they cannot achieve the stated objective.

Answer

Downgrade the tunnel by sending a main-mode proposal with weaker encryption to force the device to disclose its PSK.

Answer

Use ike-scan with the -M flag to enumerate transforms, then authenticate to the device using the default vendor PSK to confirm access.

Answer

Replay the captured IKE Phase 1 packets to the device to force it to reveal the pre-shared key in a notify payload.

Question 14

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

Accepted Answer

ssh -L 8080:10.0.0.5:80 user@jumpbox. The -L flag specifies local port forwarding. The syntax is -L [bind_address:]port:remote_host:remote_port, along with -N to prevent executing a remote command and -f to run in the background.

Answer

ssh -D 8080 user@jumpbox

Answer

ssh -R 8080:10.0.0.5:80 user@jumpbox

Answer

ssh -w 8080:80 user@jumpbox

Question 15

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

Accepted Answer

Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication. ESC1 is the AD CS misconfiguration where a template allows the enrollee to supply the subject (including SAN) and permits client authentication, while low-privileged users can enroll. An attacker requests a certificate with an arbitrary SAN such as the Domain Admin's UPN, then uses it for PKINIT (Kerberos certificate logon) to obtain a TGT as that user — effectively impersonating Domain Admin without knowing their password.

Answer

Execute a DCSync attack directly against the Certification Authority web enrollment endpoint

Answer

Force the CA machine account to authenticate to an attacker-controlled SMB share using PetitPotam

Answer

Perform a Silver Ticket attack by decrypting the CA database with a captured machine hash

Question 16

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Accepted Answer

Hostapd-mana. EAPHammer or Hostapd-mana are specialized tools used to execute rogue access point attacks and evil twin attacks against WPA2/WPA3 Enterprise networks to capture credentials.

Answer

Aircrack-ng

Answer

Reaver

Answer

Kismet

Question 17

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Accepted Answer

Snmpwalk. Snmpwalk is a command-line tool from the Net-SNMP suite that queries SNMP-enabled devices using GETNEXT requests to retrieve a subtree of management information. It can walk the MIB tree to extract data such as user accounts (via OIDs like 1.3.6.1.4.1.77.1.2.25 for Windows), routing tables (1.3.6.1.2.1.4.21), and running processes (1.3.6.1.2.1.25.4.2.1.2). With a default community string like 'public', an attacker can enumerate this information without authentication.

Answer

Rpcinfo

Answer

Smbclient

Answer

NFSstat

Question 18

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

Accepted Answer

Use the token in HTTP Authorization Bearer headers to query the Kubernetes API server and inspect or manipulate cluster resources based on the service account's RBAC privileges.. A Kubernetes service account token is a JWT that authenticates to the Kubernetes API server when presented as a Bearer token in the HTTP Authorization header. The API server validates the token's signature and expiry, then maps it to the service account's identity and enforces RBAC policies. With a high-privilege service account, the tester can list, create, or delete resources (e.g., secrets, pods) permitted by that account's RoleBindings or ClusterRoleBindings. This is the standard method for exploiting a compromised service account token in a cluster.

Answer

Convert the token into an Azure AD refresh token using Microsoft Graph API.

Answer

Submit the token to the AWS IAM STS assume-role API to gain root access to the underlying AWS cloud account.

Answer

Inject the token into the Linux kernel keyring to escalate the container to host root privileges.

Question 19

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

Accepted Answer

SharpHound.exe -CollectionMethod LocalAdmin. SharpHound's LocalAdmin collection method enumerates local administrator rights on computers by querying each machine (via SAM-R, remote registry, or NetSessionEnum depending on privileges) and records which principals have admin access. This data feeds BloodHound's 'AdminTo' edges, which are essential for finding privilege-escalation paths from a low-privileged user to Domain Admin — and it can be collected with only the rights of the invoking user, not Domain Admin.

Answer

SharpHound.exe -CollectionMethod GPOChanges

Answer

SharpHound.exe -CollectionMethod TrustList

Answer

SharpHound.exe -CollectionMethod DCOptions

Question 20

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

Accepted Answer

certipy req -u user@corp.local -p password -target ca.corp.local -template VulnerableTemplate -upn administrator@corp.local. The Certipy tool's 'req' command is used to request a certificate from a Certificate Authority (CA). By specifying the vulnerable template and the '-upn' flag with a high-privileged user's UPN (e.g., administrator@corp.local), the pentester can request a certificate that allows authentication as that privileged user. This exploits the ESC1 misconfiguration where the template allows the enrollee to supply the subject and permits client authentication. The other options do not perform this specific action.

Answer

certipy shadow -username user -target dc01

Answer

certipy ca -backup -ca "corp-CA-1"

Answer

certipy template -update VulnerableTemplate -enrollee-supplies-subject True