CPENT Practice Test 9 — 10 Questions

Question 1

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query the Azure Instance Metadata Service (IMDS) endpoint at http://169.254.169.254/metadata/identity/oauth2/token to obtain an access token for the managed identity.. The two correct actions are querying the IMDS endpoint to obtain an access token and using that token to call Azure Resource Manager if the managed identity has Reader permissions. These steps allow an attacker to leverage SSRF to steal the managed identity's token and then access Azure resources. The other options are incorrect because they assume capabilities that IMDS does not provide, such as retrieving certificates or modifying role assignments, or they require permissions not typically granted to managed identities.

Answer

Modify the managed identity's role assignments by sending a PATCH request to the IMDS endpoint to add the Contributor role.

Answer

Retrieve the managed identity's certificate from the IMDS endpoint and use it to authenticate as the managed identity to any Azure service.

Answer

Use the managed identity's credentials to authenticate to Azure Active Directory (Azure AD) and enumerate all users and groups in the tenant.

Question 2

An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?

Accepted Answer

The Enterprise Admins group in the forest root domain. The Enterprise Admins group resides in the forest root domain and grants full administrative control over all domains in the forest. Compromising this group (or adding an account to it) is the definitive way to achieve forest-wide privilege escalation. In a multi-domain forest, even Domain Admin in a child domain does not automatically confer Enterprise Admin rights, so the attacker must target the forest root's Enterprise Admins group.

Answer

The Cert Publishers group on any workstation

Answer

The Domain Admins group of the subordinate domain

Answer

The Account Operators group in the builtin container

Question 3

A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?

Accepted Answer

bacpypes (using scripts like whois.py / iam.py). bacpypes is a Python library that implements the BACnet protocol stack, and its bundled scripts such as whois.py (Who-Is/I-Am discovery) and iam.py (I-Am response) are designed specifically for BACnet device discovery and property enumeration. This makes it the correct tool for assessing BACnet/IP devices on a smart building network.

Answer

ettercap

Answer

sqlmap

Answer

msfvenom

Question 4

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Accepted Answer

An Amazon S3 bucket configured with ACLs allowing public read and write access.. Option A is correct because an S3 bucket ACL granting public read and write access (e.g., AllUsers with WRITE or WRITE_ACP permissions) allows anyone on the internet to upload, overwrite, or delete objects, which is a serious misconfiguration and a common cause of data breaches. Option C is correct because binding storage.objectViewer to allUsers in Google Cloud Storage makes every object in the bucket readable by anyone on the internet, exposing data without authentication. Option B is not improper: setting 'Secure transfer required' to Enabled on an Azure Storage Account enforces HTTPS/TLS for all requests, which is a security best practice. Option D is not improper: versioning plus object lock (e.g., S3 Object Lock in compliance mode) protects financial data against deletion or tampering and supports retention requirements. Option E is not improper: enabling S3 Block Public Access at the account level is a recommended guardrail that overrides bucket policies and ACLs to prevent public exposure.

Answer

An Azure Storage Account with 'Secure transfer required' set to Enabled.

Answer

Enabling versioning and object lock on financial data storage buckets.

Answer

Enabling AWS S3 Block Public Access at the account level.

Question 5

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 6

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

Accepted Answer

s7-info. Nmap includes specific industrial control scripts in the 'scripts/' directory. The 's7-info' script specifically queries Siemens S7 devices to extract operational data.

Answer

modbus-discover

Answer

bacnet-info

Answer

enip-info

Question 7

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Accepted Answer

Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host. Option B is correct because Unconstrained Delegation (TrustedForDelegation) causes the host to cache the TGT of every authenticating user in LSASS memory; an attacker who compromises that host can extract those TGTs (e.g., via Mimikatz) and impersonate privileged users across the domain. Option C is correct because RBCD abuse occurs when an attacker controls a principal with write access to a target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, letting them configure the target to trust their controlled account and then obtain service tickets via S4U2Self/S4U2Proxy to impersonate any user to that target. Option D is correct because Constrained Delegation with Protocol Transition allows a service to obtain a forwardable ticket for a user without that user's credentials (S4U2Self) and then use S4U2Proxy to access downstream services, so a compromised service account can pivot to any resource listed in msDS-AllowedToDelegateTo. Option A is not a vulnerability—Kerberos pre-authentication with strong passwords is a hardening best practice that resists AS-REP roasting. Option E is unrelated to delegation; it concerns machine account quota (ms-DS-MachineAccountQuota) and does not by itself constitute a Kerberos delegation attack vector.

Answer

Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords

Answer

Automatic workstation registration limits set to allow zero new domain-joined machines

Question 8

During an external engagement, you find that the target's edge device responds to IKE on UDP/500 and appears to accept aggressive-mode Phase 1 proposals. You want to determine whether a pre-shared key can be recovered offline so you can impersonate a peer. Which approach is most appropriate?

Accepted Answer

Capture the aggressive-mode exchange with tcpdump and run ike-scan with the --pskcrack option to produce a hash file for offline cracking.. Aggressive-mode IKE exchanges include a hash derived from the pre-shared key, which can be captured and attacked offline. Ike-scan with --pskcrack extracts this material into a file that psk-crack or hashcat can process, enabling dictionary or brute-force recovery of the PSK. Replay, main-mode downgrade, and transform enumeration do not disclose the key, so they cannot achieve the stated objective.

Answer

Downgrade the tunnel by sending a main-mode proposal with weaker encryption to force the device to disclose its PSK.

Answer

Use ike-scan with the -M flag to enumerate transforms, then authenticate to the device using the default vendor PSK to confirm access.

Answer

Replay the captured IKE Phase 1 packets to the device to force it to reveal the pre-shared key in a notify payload.

Question 9

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

Accepted Answer

ssh -L 8080:10.0.0.5:80 user@jumpbox. The -L flag specifies local port forwarding. The syntax is -L [bind_address:]port:remote_host:remote_port, along with -N to prevent executing a remote command and -f to run in the background.

Answer

ssh -D 8080 user@jumpbox

Answer

ssh -R 8080:10.0.0.5:80 user@jumpbox

Answer

ssh -w 8080:80 user@jumpbox

Question 10

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

Accepted Answer

Request a certificate specifying an arbitrary SAN (e.g., Domain Admin) and use it for PKINIT authentication. ESC1 is the AD CS misconfiguration where a template allows the enrollee to supply the subject (including SAN) and permits client authentication, while low-privileged users can enroll. An attacker requests a certificate with an arbitrary SAN such as the Domain Admin's UPN, then uses it for PKINIT (Kerberos certificate logon) to obtain a TGT as that user — effectively impersonating Domain Admin without knowing their password.

Answer

Execute a DCSync attack directly against the Certification Authority web enrollment endpoint

Answer

Force the CA machine account to authenticate to an attacker-controlled SMB share using PetitPotam

Answer

Perform a Silver Ticket attack by decrypting the CA database with a captured machine hash