CPENT Practice Questions 2 — 50 Questions

Question 1

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing. BLE implementations frequently suffer from lack of encryption/pairing authentication, insecure GATT characteristic permissions allowing arbitrary reads/writes, and predictable static pairing PINs.

Answer

Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

Answer

Injecting malicious SQL statements into the BLE radio frequency advertising packets

Answer

Performing an ARP cache poisoning attack against the target device's switch port

Question 2

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Accepted Answer

Running the wafw00f enumeration tool. Sending anomalous HTTP requests or triggering typical attack signatures (like WAF-testing tools such as wafw00f) and observing unique block pages or headers are standard WAF detection techniques.

Answer

Reviewing local ARP cache tables

Answer

Performing a standard ICMP ping sweep

Answer

Running a DNS zone transfer (AXFR) query

Question 3

A penetration tester is analyzing an IoT mobile companion app that communicates with a smart thermostat via BLE (Bluetooth Low Energy). Which tool can the tester use on a rooted Android device to intercept and inspect BLE GATT characteristics and descriptors?

Accepted Answer

nRF Connect for Mobile. GATT Explorer or specialized dynamic instrumentation frameworks like Frida or BLE sniffing tools on Android are used, but specifically for intercepting and manipulating BLE traffic locally on the device, 'GATTacker' or apps like 'nRF Connect' / 'Frida scripts' are deployed. Among standard choices, nRF Connect is the industry-standard diagnostic and testing tool for BLE.

Answer

Hydra

Answer

Sqlmap

Answer

Aircrack-ng

Question 4

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

Accepted Answer

Airodump-ng. Airodump-ng is the premier tool included in the Aircrack-ng suite for capturing 802.11 wireless frames in monitor mode.

Answer

Hydra

Answer

Sqlmap

Answer

Nbtscan

Question 5

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

Accepted Answer

Utilizing the Security 2 (S2) framework featuring Elliptic Curve Diffie-Hellman (ECDH) key exchange. Z-Wave operates on sub-GHz frequencies (avoiding 2.4 GHz congestion) and incorporates S2 (Security 2) framework using ECDH for secure key exchange.

Answer

Relying on standard IEEE 802.11 physical layer framing and MAC headers

Answer

Requiring all participating nodes to maintain an active BGP routing table with upstream Internet routers

Answer

Operating natively on the 5 GHz Wi-Fi frequency band with WPA3-Enterprise authentication

Question 6

During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?

Accepted Answer

UART (Universal Asynchronous Receiver-Transmitter). UART (Universal Asynchronous Receiver-Transmitter) interfaces typically consist of 4 pins: VCC, GND, TX, and RX, where TX and RX show fluctuating voltage activity during transmission upon boot.

Answer

JTAG (Joint Test Action Group)

Answer

I2C (Inter-Integrated Circuit)

Answer

SPI (Serial Peripheral Interface)

Question 7

A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)

Accepted Answer

Lack of cryptographic authentication on control commands (allowing spoofing). Legacy OT systems often lack encryption, authentication, and secure update mechanisms, exposing them to cleartext sniffing, command spoofing, and unauthenticated firmware updates.

Answer

Strict implementation of mandatory end-to-end TLS 1.3 encryption on all internal PLC racks

Answer

Automatic hardware-level isolation preventing any lateral movement from the corporate IT network

Question 8

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Accepted Answer

Enum4linux. enum4linux or rpcclient can enumerate users. From an Nmap perspective, script-based enumeration using smb-enum-users is common, but specialized tools like enum4linux query RID cycling.

Answer

Aircrack-ng

Answer

John the Ripper

Answer

Hydra

Question 9

A penetration tester is evaluating a Zigbee-based smart home lighting network. Using a Texas Instruments CC2531 USB dongle flashed with Sniffer firmware, the tester captures over-the-air packets. To decrypt the Zigbee application layer payload in Wireshark, what critical piece of cryptographic material must the tester input into Wireshark's Zigbee decryption settings?

Accepted Answer

The 128-bit Zigbee Network Key (NWK key). Zigbee networks encrypt application data using a Network Key. To inspect encrypted application payloads in Wireshark, the Network Key must be provided in the Zigbee protocol preferences.

Answer

The device's physical serial number printed on the casing

Answer

The manufacturer's IEEE 802.15.4 MAC address

Answer

The Wi-Fi WPA2 pre-shared key of the local router

Question 10

An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?

Accepted Answer

jeffs2dump / mtd-utils. The 'mtd-utils' package includes tools like 'jeffs2dump' and 'nanddump', while 'jeffs2dump' or 'jeffs2extract' utilities unpack JFFS2 file systems.

Answer

dpkg-deb

Answer

rpmbuild

Answer

apt-get extract

Question 11

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Accepted Answer

Application layer function codes specifying operations like Read, Write, Select, and Operate. DNP3 features application layer functions, object headers, and Secure Authentication extensions (IEC 62351-5) to prevent spoofing of control commands.

Answer

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Answer

HTTP Authorization Bearer tokens used for REST API authentication

Question 12

An auditor is reviewing an ICS network architecture and notes that a Supervisory Control and Data Acquisition (SCADA) server communicates with remote terminal units (RTUs) via DNP3 over serial-to-ethernet terminal servers. The auditor wants to test if unauthenticated DNP3 control commands can be accepted. Which default port should the auditor probe for DNP3 traffic?

Accepted Answer

TCP/UDP 20000. DNP3 (Distributed Network Protocol) is heavily used in electric and water utilities and operates by default on TCP/UDP port 20000.

Answer

TCP 443

Answer

TCP 2404

Answer

TCP 44818

Question 13

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

Accepted Answer

Lua. Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Answer

Bash

Answer

PowerShell

Answer

Ruby

Question 14

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Common container security issues include mounting the Docker socket, running containers in privileged mode, and exposing sensitive host paths.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 15

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

Accepted Answer

enip-info. Nmap includes the 'enip-info' NSE script specifically designed to query EtherNet/IP devices for identification and vendor details.

Answer

modbus-discover

Answer

bacnet-discover

Answer

dnp3-info

Question 16

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark

Question 17

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

Accepted Answer

Snap7 library scripts. Snap7 is an open-source Siemens S7 communication library that allows developers and testers to interact with Siemens PLCs. Wireshark is passive, Metasploit has limited industrial modules, and Scapy can craft raw packets but Snap7 is the standard library for S7comm manipulation.

Answer

Aircrack-ng

Answer

Hydra

Answer

Wireshark

Question 18

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Accepted Answer

Hostapd-mana. EAPHammer or Hostapd-mana are specialized tools used to execute rogue access point attacks and evil twin attacks against WPA2/WPA3 Enterprise networks to capture credentials.

Answer

Aircrack-ng

Answer

Reaver

Answer

Kismet

Question 19

An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?

Accepted Answer

KillerBee. KillerBee is a popular Python framework and toolset for security auditing and exploiting Zigbee and IEEE 802.15.4 networks.

Answer

Impacket

Answer

Airgeddon

Answer

Bettercap

Question 20

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

Accepted Answer

QEMU_LD_PREFIX. When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Answer

QEMU_ROOTFS

Answer

LD_LIBRARY_PATH

Answer

PATH