CPENT Practice Test 2 — 30 Questions

Question 1

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Accepted Answer

tasklist /svc. Option A (tasklist /svc) is correct because it enumerates running processes along with the services hosted in each process, revealing service accounts, potentially privileged processes, and unquoted service paths or vulnerable services that can be leveraged for escalation. Option C (whoami /priv) is correct because it lists the privileges assigned to the current token, such as SeImpersonatePrivilege, SeDebugPrivilege, or SeBackupPrivilege, which directly indicate escalation vectors like token impersonation or Potato-style attacks. Option D (systeminfo) is correct because it returns OS version, build number, hotfix level, and patch information, allowing an attacker to identify missing patches and known kernel or local privilege escalation exploits. Option B (dir /s /b config.php) is not a Windows local enumeration technique for privilege escalation—it targets a PHP configuration file and is more relevant to web application reconnaissance. Option E (netsh wlan show profiles) only reveals saved wireless network profiles and their SSIDs, which is useful for credential or network discovery but not for local privilege escalation.

Answer

dir /s /b config.php

Answer

netsh wlan show profiles

Question 2

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark

Question 3

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Accepted Answer

Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.. Disabling secure transfer allows unencrypted HTTP connections to the storage account, enabling potential Man-in-the-Middle (MitM) attacks to intercept data in transit.

Answer

Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.

Answer

Shared Access Signatures (SAS) tokens expire immediately upon generation.

Answer

Blob storage data at rest is stored without AES-256 encryption.

Question 4

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Accepted Answer

RIP. RIP (Routing Information Protocol) uses cleartext, unauthenticated updates by default and a hop-count metric with a maximum of 15 hops (16 = unreachable), making it trivially vulnerable to route injection and poisoning attacks. This matches the description exactly.

Answer

BGP

Answer

EIGRP

Answer

OSPF

Question 5

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee (A) is correct because it is a Python-based framework specifically designed for sniffing, injecting, and exploiting Zigbee and IEEE 802.15.4 networks, making it a core tool for assessing smart lighting installations that use these protocols. Wireshark (C) is correct because, when supplied with the captured Zigbee network key, it can decrypt and dissect 802.15.4 application-layer traffic (e.g., Zigbee APS/ZCL payloads), which is essential for analyzing the security of the lighting network. Aircrack-ng (B) targets Wi-Fi WPA-PSK handshakes and is irrelevant to 802.15.4/Zigbee, Metasploit's msfvenom (D) generates Windows Meterpreter payloads for host/AD attacks rather than RF-layer Zigbee assessment, and Burp Suite (E) intercepts HTTP(S) web traffic, none of which apply to Zigbee wireless security testing.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 6

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Accepted Answer

smbclient -L //target-ip. Option A (smbclient -L //target-ip) is correct because smbclient is an SMB/CIFS client that, with the -L flag, lists the shares and their comments/type on a remote Windows host over TCP 445/139, directly satisfying the share-enumeration requirement. Option C (enum4linux -a target-ip) is correct because enum4linux is a wrapper around Samba tools (smbclient, rpcclient, net) that with -a performs all simple enumeration, including share listing and permission/ACL information via SMB and RPC. Option B (sqlmap -u target-url) is wrong because sqlmap automates SQL-injection testing against web applications, not SMB share enumeration. Option D (nmap --script http-enum) is wrong because http-enum enumerates web server directories and files over HTTP, not SMB shares. Option E (aircrack-ng target.cap) is wrong because aircrack-ng cracks Wi-Fi (WEP/WPA) keys from captured 802.11 frames, which is unrelated to SMB share querying.

Answer

sqlmap -u target-url

Answer

nmap --script http-enum

Answer

aircrack-ng target.cap

Question 7

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Accepted Answer

Dig. Dig is the standard DNS query utility, and issuing a query of type AXFR against a name server (dig AXFR @ns target.com) directly tests whether that server permits an unauthorized zone transfer. If the server responds with the full zone contents, the AXFR vulnerability is confirmed. This makes dig the purpose-built tool for the task.

Answer

Nbtscan

Answer

DirBuster

Answer

Snort

Question 8

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Accepted Answer

-PA80. Nmap's -PA option performs a TCP ACK ping, sending an empty TCP packet with the ACK flag set to the specified port (default 80). Because a TCP ACK packet to a closed port elicits an RST from a live host and nothing from a filtered/blocked host, it can discover live hosts even when ICMP echo is blocked. Using -PA80 sends the ACK probe to port 80, which is the option the question requires.

Answer

-PS80

Answer

-PE

Answer

-PU80

Question 9

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Accepted Answer

Wireshark. Wireshark (B) is correct because it is a protocol analyzer that captures live packets on an interface and includes dissectors that can parse authentication protocols such as HTTP Basic, FTP, Telnet, and Kerberos pre-authentication data, exposing credentials in cleartext or crackable form. Bettercap (D) is correct because it is a MITM framework with built-in ARP spoofing, sniffing, and credential-sniffing modules (e.g., net.sniff) that actively capture and parse credentials such as HTTP POST logins, FTP, and NTLM hashes from the wire. Tcpdump (E) is correct because it captures raw packets on the segment and, with the -A or -X flags, prints payload contents in ASCII/hex so cleartext credentials in protocols like FTP, Telnet, or HTTP can be read directly. John the Ripper (A) is a password-cracking tool that operates on captured hash files offline and does not capture or parse live network traffic, and Sqlmap (C) is a SQL injection exploitation tool that targets web application databases rather than sniffing credentials off a network segment.

Answer

John the Ripper

Answer

Sqlmap

Question 10

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

Accepted Answer

It uses a computer account (AZUREADSSOACC$) in on-premises AD to generate Kerberos tickets for users authenticating to cloud services via browser redirection.. Seamless SSO uses a computer account named AZUREADSSOACC$ in on-premises AD whose Kerberos decryption key is shared with Microsoft Entra ID. When a user on a domain-joined machine accesses a Microsoft 365 resource, the browser is redirected to Microsoft Entra ID, which returns a Kerberos challenge; the local machine requests a service ticket for AZUREADSSOACC$ from the on-prem DC, and the browser presents it to Microsoft Entra ID, which decrypts it with the shared key to authenticate the user without re-entering credentials.

Answer

It requires all users to store their plaintext Active Directory passwords in Azure Key Vault.

Answer

It bypasses all Conditional Access policies for users connecting from corporate networks.

Answer

It forces the domain controllers to export NTLMv1 hashes to the Azure cloud directory.

Question 11

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Accepted Answer

Bettercap. Bettercap is a modular network attack framework that includes an ARP spoofing module capable of selective, low-frequency poisoning. Unlike tools that flood the network with ARP replies, Bettercap allows the attacker to target specific hosts and control the rate of spoofed frames, maintaining a stealthy man-in-the-middle position. This makes it ideal for environments where repetitive ARP traffic would trigger IDS/IPS alerts.

Answer

FTP

Answer

Ping

Answer

Telnet

Question 12

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

Accepted Answer

Deploy industrial Intrusion Detection Systems (IDS) tuned for OT protocol anomalies. Option B is correct because an industrial IDS tuned for OT protocol anomalies (e.g., Modbus, DNP3, IEC 61850) provides passive monitoring and detection of malicious or abnormal commands without requiring the legacy protocols to support encryption or authentication. Option C is correct because ISA/IEC 62443 zones and conduits segmentation limits lateral movement and restricts access to SCADA devices, effectively compensating for the lack of native security in the protocols. Option D is correct because industrial firewalls with SCADA-aware Deep Packet Inspection can enforce protocol-level allowlisting and filter malformed or unauthorized function codes (e.g., Modbus write commands) that legacy protocols cannot authenticate. Option A is incorrect because disabling all TCP/UDP ports would break the SCADA network's required communications and is not a viable compensating control. Option E is incorrect because PLCs typically run real-time operating systems that cannot host traditional endpoint antivirus, and such software is not designed for OT environments.

Answer

Disable all TCP and UDP ports on the SCADA network switches

Answer

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Question 13

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

Accepted Answer

uname -r. The command uname -r displays the specific kernel release version, which is critical for identifying applicable kernel-level vulnerabilities.

Answer

whoami

Answer

env

Answer

cat /etc/issue

Question 14

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Accepted Answer

It allows the binary to execute with the privileges of the file owner (root), which can be exploited if the binary has flaws or drops to a shell.. The SUID bit causes /bin/ping to execute with the effective UID of its owner (root) rather than the invoking user, which is why unprivileged users can open raw ICMP sockets. If the binary contains a vulnerability — buffer overflow, command injection, or an unsafe system()/exec() call — or if it can be coerced into spawning a shell, the attacker inherits root privileges, making it a classic local privilege escalation vector.

Answer

It allows remote attackers to execute system calls over ICMP tunneling.

Answer

Any local user can execute commands as root by passing malicious arguments to the SUID binary.

Answer

The system is immune to local privilege escalation because SUID is disabled by SELinux.

Question 15

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Accepted Answer

Potato family exploits (e.g., PrintSpoofer, RoguePotato) that abuse token impersonation via named pipes.. SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege allow an attacker to impersonate tokens. Tools like Rotten Potato, RoguePotato, or PrintSpoofer leverage this to escalate to NT AUTHORITY\SYSTEM.

Answer

Mimikatz credential dumper via direct LSASS memory injection.

Answer

PowerView domain enumeration modules.

Answer

Windows Subsystem for Linux (WSL) container breakouts.

Question 16

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

Accepted Answer

Modify the IAM role trust policy to include a Condition block restricting the principal or requiring multi-factor authentication.. The overly permissive trust policy allows any user in the account to assume the role, which is a significant risk. The remediation is to modify the trust policy to include a Condition block that restricts the principal (e.g., specific IAM users or roles) or requires multi-factor authentication. This ensures that only authorized entities can assume the role, following the principle of least privilege.

Answer

Rotate the AWS account root user access keys immediately.

Answer

Attach an explicit Deny policy to the EC2 instance metadata service version 2 configuration.

Answer

Disable the AWS Security Token Service endpoint globally across the AWS organization.

Question 17

You have compromised a dual-homed Linux host that sits between a DMZ and an internal network. From this host you need to reach internal web servers on TCP/8080 that are not routable from your attack machine, and you want to route all your tooling traffic through the pivot using SOCKS. Which approach correctly establishes the pivot?

Accepted Answer

Run ssh -D 1080 user@pivot and configure your tools to use the local SOCKS5 proxy on port 1080.. A dynamic SSH forward with -D creates a SOCKS proxy on the attack machine that tunnels arbitrary TCP connections through the dual-homed host. Because the pivot has an internal interface, those connections reach internal web servers that are otherwise unroutable. Static local forwards reach only one destination, reverse forwards run in the wrong direction, and a proxy option alone does not establish the tunnel.

Answer

Run ssh -L 8080:internal-web:8080 user@pivot and point your tools at localhost:8080.

Answer

Use nmap --proxies socks4://pivot:1080 to route scans through the pivot's SOCKS service.

Answer

Run ssh -R 1080:localhost:1080 user@pivot to create a reverse SOCKS proxy on the pivot host.

Question 18

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Accepted Answer

Application layer function codes specifying operations like Read, Write, Select, and Operate. Option A is correct because DNP3's application layer defines function codes such as Read (1), Write (2), Select (3), Operate (4), and Direct Operate (5), which are used to request data and control outstations in SCADA/ICS environments. Option C is correct because DNP3's data link layer frames include a CRC checksum in each data block (and header) to detect transmission errors, providing integrity at the link layer. Option E is correct because DNP3 Secure Authentication (SAv2/v5, defined in IEEE 1815) adds challenge-response authentication using HMAC to prevent unauthorized command injection, spoofing, and replay attacks. Option B is incorrect because the WPA2 four-way handshake belongs to IEEE 802.11 wireless LAN security, not DNP3, which is a serial/TCP-IP SCADA protocol. Option D is incorrect because HTTP Bearer tokens are used for REST API authentication over HTTP, which is unrelated to the DNP3 protocol structure.

Answer

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Answer

HTTP Authorization Bearer tokens used for REST API authentication

Question 19

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

Accepted Answer

WriteProperty, GenericAll, or GenericWrite over the msDS-KeyCredentialLink attribute / target object. Shadow Credentials abuse requires write access to the target object's msDS-KeyCredentialLink attribute. Permissions such as GenericAll, GenericWrite, or the specific WriteProperty right over that attribute allow an attacker to inject a Key Credential, which can then be used with PKINIT to obtain a TGT for the target account without knowing its password.

Answer

ReadLAPSPassword extended right

Answer

DS-Replication-Get-Changes-All domain right

Answer

SeEnableDelegationPrivilege on the domain controller

Question 20

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

Accepted Answer

The trusted external account can assume the role, and without an ExternalID condition, it is vulnerable to cross-account confusion or unauthorized assumption.. When an IAM role trust policy allows an external AWS account to assume the role without an ExternalID condition, any principal in that account with sts:AssumeRole permissions can assume the role. If the external account ID is mistyped or overly broad, it could allow unintended accounts to assume the role, leading to unauthorized access. The ExternalID is a best practice to prevent the confused deputy problem, especially when third-party vendors are involved.

Answer

The EC2 instance is vulnerable to local root privilege escalation via kernel module injection.

Answer

AWS CloudTrail logs for the instance are permanently deleted.

Answer

The third-party account gains direct SSH access to the EC2 instance filesystem.