CPENT Practice Test 5 — 25 Questions

Question 1

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

uname -r. The command uname -r displays the specific kernel release version, which is critical for identifying applicable kernel-level vulnerabilities.

Answer

whoami

Answer

env

Answer

cat /etc/issue

Question 2

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?

Accepted Answer

auxiliary/scanner/snmp/snmp_login. SNMP enumeration can be performed using dedicated command-line utilities like snmpwalk, as well as Metasploit auxiliary modules such as auxiliary/scanner/snmp/snmp_enum and auxiliary/scanner/snmp/snmp_login.

Answer

exploit/windows/smb/ms17_010_eternalblue

Answer

auxiliary/scanner/http/dir_scanner

Question 3

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Accepted Answer

wmic useraccount get name. net user and wmic useraccount (or Get-LocalUser in PowerShell) are standard built-in mechanisms to list local users on Windows.

Answer

ipconfig /all

Answer

tasklist /v

Answer

systeminfo

Question 4

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Accepted Answer

WinRM (Windows Remote Management). WinRM, SMB (via PsExec/Services), and RDP are native Windows protocols commonly used for lateral movement.

Answer

FTP (File Transfer Protocol)

Answer

SNMP (Simple Network Management Protocol)

Question 5

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

Accepted Answer

HTTPS (Port 443). DNS, HTTPS (port 443), and ICMP are frequently allowed outbound through corporate firewalls and are heavily used for tunneling.

Answer

SMB (Port 445)

Answer

BGP (Port 179)

Question 6

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

Accepted Answer

Iodine. Iodine is a specialized tunneling tool designed specifically to tunnel IPv4 traffic through a DNS server, making it ideal for bypassing networks that only allow outgoing DNS traffic.

Answer

Socat

Answer

Chisel

Answer

Netcat

Question 7

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Accepted Answer

wevtutil cl <LogName>. wevtutil and PowerShell's Remove-EventLog or Clear-EventLog are standard utilities for managing Windows event logs.

Answer

netsh advfirewall reset

Answer

taskkill /f /im lsass.exe

Answer

ipconfig /flushdns

Question 8

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

Accepted Answer

Run 'docker run -v /:/hostfs --rm -it alpine chroot /hostfs' to mount the host root directory inside a new container.. Access to /var/run/docker.sock allows the container to interact with the host's Docker daemon. The tester can spin up a new container that mounts the host's root filesystem (/) and provides a chroot or direct execution shell on the host.

Answer

Modify /etc/passwd inside the container to add a root user.

Answer

Send a SIGKILL signal to the docker daemon process via kill -9 1.

Answer

Execute 'sudo su' inside the container environment.

Question 9

Which TWO methods are commonly used for data exfiltration during a penetration test to bypass basic network monitoring?

Accepted Answer

Using HTTPS to tunnel the data. Encoding data and using encrypted channels like HTTPS are standard ways to evade detection.

Answer

Storing data in the system event logs

Answer

Sending data via plaintext telnet

Answer

Using a standard FTP connection

Question 10

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

Accepted Answer

Null scan (-sN). Xmas scan (-sX), FIN scan (-sF), and Null scan (-sN) rely on non-standard or empty TCP flag combinations that modern stateful firewalls drop automatically.

Answer

TCP SYN scan (-sS)

Answer

TCP Connect scan (-sT)

Question 11

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Accepted Answer

Copying an executable to the ADMIN$ share and creating a remote Windows service via the Service Control Manager (SCM).. PsExec connects to the remote ADMIN$ share, uploads a service executable (such as Psexecsvc.exe), and then creates and starts a Windows service using the Service Control Manager (SCM) via RPC.

Answer

Initiating an RDP cliprdr channel file transfer.

Answer

Writing a payload to the target's startup folder via FTP.

Answer

Injecting shellcode into the lsass.exe process over WinRM.

Question 12

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

Accepted Answer

ssh -L 8080:10.0.0.5:80 user@jumpbox. The -L flag specifies local port forwarding. The syntax is -L [bind_address:]port:remote_host:remote_port, along with -N to prevent executing a remote command and -f to run in the background.

Answer

ssh -D 8080 user@jumpbox

Answer

ssh -R 8080:10.0.0.5:80 user@jumpbox

Answer

ssh -w 8080:80 user@jumpbox

Question 13

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

Accepted Answer

Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.. AlwaysInstallElevated allows MSI packages to be installed with elevated (NT AUTHORITY\SYSTEM) privileges. The tester can generate a malicious MSI file using msfvenom and install it silently.

Answer

Run a batch script that directly modifies the SAM database registry hive.

Answer

Execute a local exploit targeting the Print Spooler service via named pipes.

Answer

Extract plaintext credentials from the lsass.exe process memory.

Question 14

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

Accepted Answer

Create a malicious executable matching a component of the unquoted path.. By placing a malicious executable in the folder corresponding to the unquoted path (e.g., C:\Program.exe), the service manager will execute it instead of the intended binary.

Answer

Replace the existing service binary.

Answer

Restart the service with elevated arguments.

Answer

Modify the service registry key to add quotes.

Question 15

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

Accepted Answer

The NTLM hash (or AES keys) of the krbtgt service account.. A Golden Ticket is forged using the KRBTGT account's NTLM hash (or AES keys), which allows the attacker to generate valid Kerberos Ticket Granting Tickets (TGTs) for any user.

Answer

The krbtgt account's public SSH key stored in Active Directory.

Answer

The global catalog server IP address and LDAP bind credentials.

Answer

The Domain Administrator's plaintext password.

Question 16

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Accepted Answer

Using PowerShell to download and execute a script in memory.. LotL involves using pre-installed system tools (like PowerShell or WMI) to conduct malicious activities, minimizing the need for custom malware.

Answer

Installing a rootkit driver.

Answer

Deploying a custom C++ backdoor.

Answer

Using a known Metasploit payload.

Question 17

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. CrackMapExec (or NetExec) and nmap with the smb2-security-mode script are standard tools used to check SMB signing status across targets.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 18

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Accepted Answer

find / -type f -perm -4000 2>/dev/null. The command find / -perm -4000 2>/dev/null searches the entire filesystem for files with the SUID bit set (-4000) and redirects standard error to /dev/null to keep the output clean.

Answer

grep -r 'SUID' /etc/permissions.conf

Answer

getcap -r / 2>/dev/null

Answer

find / -name suid -exec ls -la {} \;

Question 19

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Accepted Answer

Chisel to establish a tunnel over HTTP.. Chisel is a fast TCP/UDP tunnel over HTTP that is ideal for bypassing firewalls by masquerading traffic as web requests.

Answer

ftp to a remote server.

Answer

scp using a custom port.

Answer

netcat with a simple pipe.

Question 20

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Accepted Answer

Compiling and loading a malicious Loadable Kernel Module (LKM) rootkit.. Loadable Kernel Modules (LKMs) allow attackers to run code in kernel space, hide processes, files, and network connections, and persist across reboots if loaded at boot time.

Answer

Modifying the SSH authorized_keys file for the root user.

Answer

Creating a systemd service unit file that executes a reverse shell.

Answer

Placing a persistent cron job in /etc/cron.d/