CPENT Practice Test 8 — 10 Questions

Question 1

During an Active Directory penetration test, an operator has compromised a user account and discovered that the account has GenericAll permissions on a computer object. The operator wants to abuse this permission to gain administrative access to the computer. Which technique should the operator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource-Based Constrained Delegation (RBCD). The correct answer is Resource-Based Constrained Delegation (RBCD) because GenericAll on a computer object allows the operator to modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. By setting this attribute to include a controlled account, the operator can impersonate any user to that computer, gaining administrative access. Other techniques like Kerberoasting or DCSync do not directly abuse this specific permission.

Answer

DCSync

Answer

AS-REP Roasting

Answer

Kerberoasting

Question 2

A CPENT tester is assessing a building automation system that uses BACnet over IP. The tester needs to perform active discovery to enumerate BACnet devices and their objects on the network. Which TWO of the following approaches are valid for active BACnet/IP device enumeration? (Choose two.)

Accepted Answer

Use the BACnet ReadProperty service to query the object-list property of each discovered device to enumerate its objects. Active BACnet/IP enumeration starts with a Who-Is broadcast to collect I-Am responses, yielding device instance numbers and addresses. From there, ReadProperty against each device's object-list reveals all exposed objects. Together these read-only services provide a complete device and object inventory without writing to the system, which is essential for safe OT assessment.

Answer

Perform a BACnet WriteProperty to set the device's object-list to a known value, then read it back to confirm enumeration

Answer

Send a BACnet Who-Has broadcast to retrieve the firmware version and vendor ID of every device

Answer

Use the BACnet SubscribeCOV service to force every device to continuously report all object values

Question 3

A penetration tester has gained access to a workstation and wants to move laterally to a server using a Golden Ticket. The tester has the KRBTGT hash and the domain SID. Which tool from the Impacket suite should be used to forge and inject the Golden Ticket?

Accepted Answer

ticketer.py. The correct answer is ticketer.py because it is the Impacket tool specifically designed to forge Golden and Silver tickets. It takes the KRBTGT hash and domain SID to create a TGT that can be used for authentication, enabling lateral movement. Other tools like getTGT.py only request legitimate tickets, while secretsdump.py extracts secrets but does not forge tickets.

Answer

psexec.py

Answer

getTGT.py

Answer

secretsdump.py

Question 4

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

Accepted Answer

Generate a malicious MSI file using msfvenom and execute it using msiexec /quiet /qn /i exploit.msi.. AlwaysInstallElevated allows MSI packages to be installed with elevated (NT AUTHORITY\SYSTEM) privileges. The tester can generate a malicious MSI file using msfvenom and install it silently.

Answer

Run a batch script that directly modifies the SAM database registry hive.

Answer

Execute a local exploit targeting the Print Spooler service via named pipes.

Answer

Extract plaintext credentials from the lsass.exe process memory.

Question 5

An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?

Accepted Answer

Scapy. Scapy is a Python library for crafting, sending, sniffing, and dissecting network packets at arbitrary protocol layers, including raw application-layer payloads. It can construct custom IEC 60870-5-104 APDU/ASDU frames and transmit them over TCP, making it the correct tool for injecting forged ASDU commands to a smart grid device.

Answer

BeautifulSoup

Answer

Pandas

Answer

Pygame

Question 6

When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?

Accepted Answer

It connects via RPC and invokes the DRSUAPI protocol (DsGetNCChanges) to request replication data.. Impacket's secretsdump.py performs DCSync by authenticating to a domain controller and invoking the DRSUAPI (Directory Replication Service Remote Protocol) interface, specifically the DsGetNCChanges method. This RPC call is the same mechanism legitimate DCs use to replicate directory data, so the DC treats the request as a normal replication pull and returns password hashes (NTLM, Kerberos keys) without the attacker ever executing code on the DC.

Answer

It executes an LDAP search request asking for the plaintext password attribute.

Answer

It queries the Active Directory Web Services (ADWS) REST API on port 9389.

Answer

It reads the NTDS.dit file directly over standard SMB file shares using administrator credentials.

Question 7

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

Accepted Answer

Restrict the NSG rule source IP to trusted administrative networks or implement Azure Bastion for secure management.. The NSG rule exposes RDP (TCP 3389) to the entire internet, which is the primary attack surface for brute-force, BlueKeep-style exploits, and ransomware initial access. The correct remediation is to narrow the source to trusted administrative IP ranges or, better, remove the public RDP exposure entirely and use Azure Bastion, which provides browser-based RDP/SSH over TLS through the Azure portal without a public IP on the VM. This directly addresses the misconfiguration while preserving administrative access.

Answer

Disable the Azure Key Vault service across the subscription.

Answer

Enable Azure Active Directory Pass-Through Authentication on the VM guest OS.

Answer

Attach an AWS IAM instance profile to the Azure Virtual Machine.

Question 8

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Accepted Answer

Mount the NFS share using sudo privileges, copy /bin/bash to the share, and set the SUID permission using chmod +s.. With no_root_squash enabled, the NFS server maps the root user on the client to root on the server, so a client that mounts the share as root can create files owned by root with the SUID bit set. Copying /bin/bash to the share and running chmod +s on it produces a root-owned SUID shell that, when executed on the target, grants root privileges. This is the classic no_root_squash privilege escalation.

Answer

Modify the /etc/exports file on the remote target directly via standard FTP.

Answer

Mount the NFS share using standard user privileges and create a standard user shell script.

Answer

Log into the NFS server directly via SSH using the exported share credentials.

Question 9

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Accepted Answer

Mimikatz: kerberos::ptt ticket.kirbi. Pass-the-Ticket involves injecting exported ticket files (such as .kirbi or .ccache format) into memory. Mimikatz uses the 'kerberos::ptt' command to inject a ticket into the current Windows logon session.

Answer

Rubeus: golden /ticket:ticket.kirbi

Answer

PowerView: Invoke-TicketInjection -Path ticket.kirbi

Answer

Impacket: ticketer.py -nthash ...

Question 10

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

Accepted Answer

post/multi/manage/autoroute. The post/multi/manage/autoroute module in Metasploit adds routes to the Meterpreter session's routing table, enabling the framework to pivot through the compromised host into the 192.168.100.0/24 subnet. Once autoroute is configured with the target subnet, subsequent Metasploit modules (including scanners) automatically route traffic through the session. This is the prerequisite step before running any scan against the isolated network.

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/windows/local/payload_inject

Answer

auxiliary/server/socks_proxy