CPENT Full-Length Exam Simulation

Question 1

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/. The grep command with the -r (recursive) and -n (line number) flags searches through all files in the squashfs-root directory for the string 'BEGIN RSA PRIVATE KEY'. This pattern is the standard header for PEM-encoded RSA private keys, making it an effective way to locate hardcoded keys in extracted firmware. The command is simple, fast, and does not require additional tools.

Answer

strings -k squashfs-root/

Answer

firmadyne -s squashfs-root/

Answer

binwalk -A squashfs-root/

Question 2

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Option B is correct because hardcoding cloud provider API access keys into public source code repositories exposes long-lived credentials to anyone who can view the repo, enabling unauthorized API calls, resource creation, and data exfiltration; secrets should instead be stored in a secrets manager or KMS-backed vault and injected at runtime. Option D is correct because disabling centralized audit logging such as AWS CloudTrail or Azure Activity Logs destroys the tamper-evident record of control-plane and data-plane activity, eliminating detection, forensic investigation, and compliance evidence, which is a critical monitoring deficiency regardless of storage cost savings. The unmarked options do not belong: A is a sound detection practice that surfaces anomalous resource creation, C is a recommended key-management practice using cloud-native KMS with automatic rotation, and E is a foundational IAM control that reduces blast radius by enforcing least privilege.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 3

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. With CAP_SYS_ADMIN and a read-write cgroup v1 mount, the attacker can write a path to the release_agent file and then trigger a cgroup release, causing the kernel to execute that path as root in the host's initial namespace. This is the canonical cgroup v1 container escape (CVE-2022-0492 is a related kernel-side variant). No other listed vector is available from inside a standard container without additional host misconfigurations.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 4

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder

Question 5

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect. Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Answer

arp -a

Answer

uname -r

Question 6

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.

Question 7

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Accepted Answer

AddMember. In BloodHound, the 'AddMember' edge indicates that a user or group has the ability to add members to a group. This is a direct privilege escalation path because adding a user to a high-privileged group (e.g., Domain Admins) grants that user the group's privileges. Therefore, the visual edge that indicates user 'A' can modify the membership of group 'B' is 'AddMember'.

Answer

AllowedToDelegate

Answer

ReadLAPSPassword

Answer

CoerceTo

Question 8

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command. By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Answer

Append a new user account to the /etc/passwd file by leveraging a kernel exploit

Answer

Modify the /etc/sudoers file directly using a buffer overflow vulnerability

Answer

Inject shellcode into the target binary's memory space using GDB while running under sudo

Question 9

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. Option B is correct because MQTT brokers rely on ACLs to authorize which clients may publish or subscribe to specific topics, and a tester should verify that these restrictions are actually enforced to prevent unauthorized topic access. Option D is correct because many brokers ship with anonymous access enabled by default, so confirming whether unauthenticated clients can connect is a fundamental MQTT hardening check. Option E is correct because MQTT traffic is frequently deployed in cleartext on TCP port 1883, and verifying that TLS is used (typically on port 8883) ensures confidentiality and integrity of the smart home communications. Option A does not belong because Modbus/TCP function code 0x10 (Write Multiple Registers) is an industrial control protocol unrelated to MQTT broker configuration. Option C does not belong because an 802.11 deauthentication flood is a wireless-layer denial-of-service attack against Wi-Fi clients, not a broker security configuration check.

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 10

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 11

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). Option C is correct because Rubeus is a dedicated Kerberos attack toolkit, and its `asreproast` command specifically enumerates and extracts AS-REP hashes from accounts whose UserAccountControl flag does not have Kerberos preauthentication required (UF_DONT_REQUIRE_PREAUTH, 0x400000), which an unprivileged domain user can perform. Option E is correct because PowerView's `Get-DomainUser -PreauthNotRequired` queries Active Directory via LDAP for user objects with the DONT_REQUIRE_PREAUTH flag set, directly identifying AS-REP roasting candidates without elevated privileges. Option A is wrong because cleanmgr.exe is a disk cleanup utility with no AD enumeration capability. Option B is wrong because Mimikatz's `lsadump::dcsync` requires DCSync rights (typically Domain Admin or Replicating Directory Changes permissions), so it is not usable by an unprivileged domain user. Option D is wrong because secpol.msc edits local security policy on a single host and does not enumerate domain accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 12

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Accepted Answer

The target must have NTLM authentication enabled in the local security policy.. Pass-the-Hash (PtH) works by using the NTLM hash of a user's password to authenticate via NTLM, bypassing the need for the plaintext password. For this to succeed, the target system must accept NTLM authentication. If NTLM is disabled in the local security policy (e.g., via 'Network security: Restrict NTLM' settings), the attack fails because the hash cannot be used. Thus, the mandatory prerequisite is that NTLM authentication is enabled on the target.

Answer

The target must have the Remote Registry service disabled.

Answer

The target must be running Windows 10 or higher.

Answer

You must have the plaintext password of the target account.

Question 13

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Option B is correct because mounting sensitive host directories such as '/' or '/proc' through a hostPath volume gives the container direct read/write access to host files, kernel interfaces, and process information, which an attacker can abuse to modify host binaries, read secrets, or escape the container boundary. Option C is correct because setting privileged: true disables most container isolation, grants all Linux capabilities, and removes seccomp/AppArmor restrictions, effectively giving the container root-level control over the host devices and kernel. Option D is correct because mounting /var/run/docker.sock exposes the Docker daemon API to the container, allowing an attacker to create a new privileged container that mounts the host filesystem and thereby compromise the node. Option A is not a risk but a hardening practice, since running as a non-root UID (USER 1000) reduces the impact of a compromise. Option E is also a security best practice, as RBAC with least-privilege bindings limits what identities can do in the cluster rather than enabling escapes.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 14

An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?

Accepted Answer

The MQTT connection is not using TLS encryption.. MQTT does not encrypt traffic by default. Without TLS, the CONNECT packet, which contains username and password, is transmitted in cleartext. The observation of cleartext credentials directly points to the absence of TLS encryption on the MQTT connection. Other options describe scenarios that would either prevent connection or are specific subsets of the same root cause.

Answer

The MQTT broker is configured to use TLS, but the client is not.

Answer

The MQTT client is configured to use MQTT over WebSocket without TLS.

Answer

The MQTT broker is using a self-signed certificate that the client rejects.

Question 15

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

Accepted Answer

curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api. cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Answer

ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

Answer

netstat -an | grep 80

Answer

traceroute -p 80 192.168.1.100

Question 16

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

Accepted Answer

-sn. The -sn parameter tells Nmap to perform host discovery only (formerly known as a ping scan using -sP) and disables port scanning entirely.

Answer

-sS

Answer

-Pn

Answer

-sO

Question 17

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Option A is correct because ESC8 abuses the HTTP-based web enrollment endpoints (certsrv) via NTLM relay, so disabling HTTP enrollment or enforcing HTTPS with Extended Protection for Authentication (EPA) and disabling NTLM on those endpoints blocks that relay vector. Option B is correct because continuous auditing of AD CS templates, CAs, and ACLs with tools like Certipy or BloodHound (e.g., Certipy's 'find' and 'template' checks) surfaces misconfigurations such as ESC1-ESC8 before attackers exploit them. Option E is correct because removing the ENROLLEE_SUPPLIES_SUBJECT flag prevents low-privileged enrollees from specifying an arbitrary subject/SAN (e.g., a domain admin UPN), which is the core of ESC1 template abuse. Option C is wrong because disabling Kerberos pre-authentication on domain controller computer accounts would weaken authentication and enable AS-REP roasting, not secure AD CS. Option D is wrong because enforcing unconstrained delegation on CA servers increases exposure to credential theft and relay/impersonation attacks rather than mitigating certificate abuse.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 18

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Accepted Answer

Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker. DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.

Answer

Use standard FTP data channels over ephemeral ports to push archives to an external staging server

Answer

Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets

Answer

Establish an HTTPS connection to an external IP address using port 443

Question 19

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The create verb on pods/exec in Kubernetes RBAC allows a user to invoke the exec subresource, which runs arbitrary commands inside a running container. This is effectively remote code execution within the pod's namespace, and if the pod has a mounted service account token or hostPath volume, the attacker can pivot to the node or cluster.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 20

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.