CPENT Practice Test 5 — 25 Questions

Question 1

A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploying industrial Intrusion Detection Systems (IDS) capable of parsing proprietary OT protocols (e.g., Modbus, DNP3, S7). Option A is correct because industrial IDS solutions that understand proprietary OT protocols such as Modbus, DNP3, and S7 can detect malicious or anomalous control-plane traffic that generic IT IDS would miss, providing deep visibility into SCADA-specific attacks. Option B is correct because unidirectional security gateways (data diodes) enforce one-way data flow from OT to IT, physically preventing any inbound return path that an attacker could use to pivot into the plant floor. Option E is correct because strict segmentation between IT corporate networks and OT plant floors using firewalls (often via a DMZ or Purdue-model layering) limits lateral movement and blocks remote attacks originating from business or Internet-facing networks. Option C is not recommended because giving PLC controllers unrestricted direct Internet access exposes them to remote exploitation and violates OT isolation principles; updates should be staged through controlled, mediated paths. Option D is not recommended because disabling encryption on SCADA servers weakens confidentiality and integrity and does not meaningfully improve firewall inspection, since firewalls generally do not decrypt traffic anyway.

Answer

Allowing unrestricted direct Internet access from all PLC controllers for automated driver updates

Answer

Disabling all encryption across SCADA servers to improve packet inspection speeds on firewalls

Question 2

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Accepted Answer

WinRM (Windows Remote Management). WinRM (B) is correct because it is a native Windows remote management service built on WS-Management and SOAP over HTTP/HTTPS (ports 5985/5986), allowing an operator to execute commands remotely via tools like winrs or PowerShell remoting without installing any agent. RDP (D) is correct because it is a built-in Windows remote desktop protocol (TCP 3389) that provides interactive graphical access to a remote host, enabling lateral movement using only native OS functionality. SMB/RPC via the Service Control Manager and ADMIN$ share (E) is correct because native Windows administrative tooling such as PsExec-style techniques use SMB (TCP 445) to copy a service binary to ADMIN$ and RPC to the Service Control Manager to start it remotely, requiring no third-party agent. FTP (A) is not correct because it is a file-transfer protocol, not a remote execution or administrative control mechanism, and SNMP (C) is not correct because it is a monitoring/management protocol for querying device state, not a native Windows remote command-execution channel.

Answer

FTP (File Transfer Protocol)

Answer

SNMP (Simple Network Management Protocol)

Question 3

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

Accepted Answer

Targeting user accounts that have associated Service Principal Names (SPNs). Kerberoasting begins by enumerating Active Directory accounts that have Service Principal Names (SPNs) registered, because any authenticated domain user can request a service ticket for those accounts, so option A correctly describes the target selection step. The attack then generates a high volume of TGS-REQ messages (Kerberos service ticket requests) to obtain those service tickets for offline cracking, making option B a valid network indicator. Attackers also favor requesting service tickets with weaker encryption such as RC4-HMAC (etype 23) because RC4 ticket hashes crack faster than AES, so option E is a legitimate artifact of Kerberoasting. Option C is wrong because AXFR zone transfers are a DNS reconnaissance technique, not part of Kerberos service ticket abuse. Option D is wrong because LLMNR poisoning is a name-resolution credential-capture attack (e.g., Responder), unrelated to Kerberoasting's TGS ticket requests.

Answer

Massive outbound DNS zone transfers (AXFR)

Answer

Frequent LLMNR poisoning broadcasts

Question 4

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Accepted Answer

Responder. Responder is a tool specifically designed to poison LLMNR, NBT-NS, and mDNS queries, spoofing responses to capture NTLMv1/v2 hashes when victims attempt authentication. It listens for broadcast name resolution requests and responds as the requested host, tricking the victim into sending credentials. This makes it the correct tool for this scenario.

Answer

Cain & Abel

Answer

Ettercap

Answer

Wireshark

Question 5

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

Accepted Answer

0x88B8. GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Answer

0x0800

Answer

0x86DD

Answer

0x88E5

Question 6

When analyzing a compromised Active Directory environment using BloodHound, which THREE common node properties or paths typically signify a high-value target or an immediate path to Domain Admin?

Accepted Answer

Principals with GenericAll or WriteDACL over the Domain object. Option A is correct because GenericAll or WriteDACL rights over the Domain object allow an attacker to modify the domain's ACLs or grant themselves DCSync rights, effectively leading to full domain compromise. Option D is correct because members of Domain Admins inherently possess the highest privileges in the domain, making them direct high-value targets and a clear path to Domain Admin. Option E is correct because computers configured with Unconstrained Delegation cache TGTs of any user who authenticates to them, so compromising such a host can yield Domain Admin credentials when a privileged account connects. Option B is not correct because membership in a departmental security group typically grants only limited, scoped access and does not by itself indicate a high-value target or Domain Admin path. Option C is not correct because default password policies on standard user accounts are a general hygiene weakness, not a specific BloodHound node property or path that directly signifies Domain Admin escalation.

Answer

Standard users with 'MemberOf' a departmental security group

Answer

Standard domain user accounts with default password policies

Question 7

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

Accepted Answer

ssh -L 3306:10.0.0.50:3306 user@pivot_ip. The -L flag in OpenSSH establishes local port forwarding, and its argument syntax is [bind_address:]port:host:hostport. Here, '3306:10.0.0.50:3306' tells SSH to listen on local port 3306 and forward any connection through the pivot host to 10.0.0.50:3306, which is exactly the requirement for reaching an internal database behind a firewall.

Answer

ssh -D 3306 user@pivot_ip

Answer

ssh -C -N user@pivot_ip

Answer

ssh -R 3306:10.0.0.50:3306 user@pivot_ip

Question 8

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Accepted Answer

SPI (Serial Peripheral Interface) flash memory pins. Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Answer

HDMI display output pins used for high-speed video graphics rendering

Answer

RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

Question 9

A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)

Accepted Answer

Lack of cryptographic authentication on control commands (allowing spoofing). Option A is correct because legacy OT protocols such as Modbus/TCP, DNP3, and IEC 60870-5-104 typically lack cryptographic authentication, so an attacker on the network can forge or replay control commands to spoof a master station or HMI. Option C is correct because these same industrial protocols (Modbus, DNP3, Profinet, and Telnet for device management) usually transmit data in cleartext, allowing credential capture and command manipulation via simple sniffing. Option E is correct because engineering workstations, PLCs, and RTUs frequently ship with default, shared, or hardcoded service credentials that are rarely changed in legacy deployments, giving testers easy authenticated access. Option B does not belong because mandatory end-to-end TLS 1.3 on internal PLC racks is not a common finding in legacy SCADA environments—most legacy PLCs cannot even negotiate TLS, so this describes a hardened state rather than a vulnerability. Option D does not belong because automatic hardware-level isolation from the corporate IT network is not a typical OT characteristic; flat or poorly segmented networks enabling IT-to-OT lateral movement are the common finding, not enforced isolation.

Answer

Strict implementation of mandatory end-to-end TLS 1.3 encryption on all internal PLC racks

Answer

Automatic hardware-level isolation preventing any lateral movement from the corporate IT network

Question 10

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

Accepted Answer

Hydra. Hydra is a fast, parallelized online password-cracking tool that supports dozens of protocols including Telnet, FTP, SSH, SMB, and HTTP. It accepts -L/-P username and password wordlists and performs a dictionary attack against a live service, making it the correct tool for brute-forcing Telnet on port 23. Its -t flag controls parallel tasks per target, and -f stops on the first valid credential found.

Answer

Sqlmap

Answer

Nikto

Answer

Wpscan

Question 11

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

Accepted Answer

It will alert the Security Operations Center (SOC) due to signature-based detection.. Windows Defender (and other EDRs) have specific signatures for Mimikatz and will trigger an alert or quarantine the file immediately upon execution.

Answer

It will cause the system to BSOD.

Answer

It will corrupt the LSASS process.

Answer

It requires a reboot to function.

Question 12

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

Accepted Answer

SPAN (Switched Port Analyzer) / Port Mirroring. SPAN (Switched Port Analyzer), also called port mirroring, copies traffic from one or more switch ports to a designated monitoring port where a capture device or IDS can analyze it. It is passive — it does not alter or interrupt the monitored traffic — making it the correct technique for capturing the legacy application's unencrypted TCP stream on a managed switch.

Answer

802.1X Authentication

Answer

VLAN Trunking Protocol

Answer

Port Security

Question 13

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

Accepted Answer

/etc/mosquitto/mosquitto.conf. Eclipse Mosquitto stores its primary configuration settings in '/etc/mosquitto/mosquitto.conf' on standard Linux installations.

Answer

/var/lib/mqtt/config.ini

Answer

/opt/broker/settings.xml

Answer

/etc/init.d/mosquitto.cfg

Question 14

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

Accepted Answer

psexec.py from the Impacket toolkit. Pass-the-Hash relies on injecting or using the NTLM hash directly in place of the user's password during authentication. Impacket's psexec.py (or crackmapexec / netexec) natively supports NTLM hash authentication.

Answer

Windows Remote Desktop Connection (mstsc.exe)

Answer

Standard Windows net use command

Answer

WinRM standard client via browser

Question 15

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

Accepted Answer

Create a malicious script named after the command and prepend its directory to the PATH.. When a SUID binary executes system commands using relative paths (e.g., calling 'cat' or 'ls' without a full path), it inherits the caller's PATH environment variable. An attacker can create a malicious executable with the same name as the called command in a writable directory, prepend that directory to PATH, and the SUID binary will execute the malicious script with elevated (root) privileges. This is a classic PATH hijacking privilege escalation.

Answer

Modify /etc/ld.so.preload to inject a malicious library.

Answer

Exploit a buffer overflow in the binary using a NOP sled.

Answer

Use the --inject flag on the binary to force command execution.

Answer

null

Question 16

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

Accepted Answer

iec104. IEC 60870-5-104 operates over TCP port 2404. Wireshark decodes this under the 'iec104' protocol filter.

Answer

s7comm

Answer

mms

Answer

bacnet

Question 17

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

Accepted Answer

Gobuster. Gobuster is a Go-based command-line tool purpose-built for brute-forcing URIs (directories and files), DNS subdomains, and virtual hosts on web servers. It uses wordlists to enumerate hidden paths such as /admin, /backup, and configuration files, making it the correct choice for discovering hidden administrative directories on the PLC's web interface.

Answer

Wifite

Answer

Nbtscan

Answer

Hping3

Question 18

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN (half-open) scan: it sends a SYN, waits for SYN/ACK (open) or RST (closed), then sends RST instead of completing the three-way handshake. This is faster and stealthier than a full connect scan because no session is ever established, so application-layer logs on the target typically never record the probe. It requires raw-socket privileges (root/SYSTEM or CAP_NET_RAW).

Answer

-sT

Answer

-sP

Answer

-sU

Question 19

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Accepted Answer

A DNS tunneling tool such as dnscat2 or iodine to encode the archive into DNS query records.. DNS tunneling tools like dnscat2 or iodine encapsulate data inside DNS queries (such as TXT, A, or CNAME records) sent to a controlled nameserver.

Answer

Standard FTP client configured to use port 53 as the control channel.

Answer

Wget command pointing to an external HTTP server listening on port 53.

Answer

Netcat in listening mode on TCP port 53.

Question 20

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Accepted Answer

Hping3. Hping3 is a command-line packet crafter that allows fine-grained control over TCP/IP header fields, including the IPv4 LSRR (Loose Source and Record Route) and SSRR (Strict Source and Record Route) options. It can send custom packets with source routing enabled to test whether routers honor or drop these options, making it the correct tool for this assessment.

Answer

Wget

Answer

Netcat

Answer

Nmap