CPENT Timed Hard Questions — 25 Difficult Questions

Question 1

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Accepted Answer

The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).. ESC3 involves a certificate template configured as an Enrollment Agent (containing the Certificate Request Agent EKU), allowing enrollment by low-privileged users, and permitting issuance of certificates on behalf of other users.

Answer

The CA requires Manager Approval for all issued certificates.

Answer

The domain functional level is set to Windows Server 2003.

Question 2

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 3

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Accepted Answer

The Active Directory domain functional level must be Windows Server 2012 or higher.. RBCD requires permission to modify msDS-AllowedToActOnBehalfOfOtherIdentity on the target object, control over a computer or user object to act as the delegating entity, and Active Directory running at Windows Server 2012 or higher functional level.

Answer

Domain controllers must have SMB signing disabled globally.

Answer

The KRBTGT account password must be reset twice to invalidate existing tickets.

Question 4

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service

Question 5

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

Accepted Answer

0x88B8. GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Answer

0x0800

Answer

0x86DD

Answer

0x88E5

Question 6

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Accepted Answer

Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host. Kerberos delegation vulnerabilities include Unconstrained Delegation (allowing arbitrary service requests), Constrained Delegation with Protocol Transition (S4U2Self/S4U2Proxy abuse), and Resource-Based Constrained Delegation (RBCD).

Answer

Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords

Answer

Automatic workstation registration limits set to allow zero new domain-joined machines

Question 7

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Accepted Answer

Abusing misconfigured OpenID Connect (OIDC) federation trust settings between GitHub Actions and AWS IAM roles to assume roles without proper repository conditions.. SSRF targeting IMDS, unauthenticated API gateway endpoints, and misconfigured OIDC/service principal trust paths are core hybrid/cloud attack vectors.

Answer

Enabling AWS CloudTrail and guarding log files with immutable S3 Object Lock policies.

Answer

Configuring VPC peering with bi-directional network ACL restrictions.

Answer

Enforcing strict Azure AD Conditional Access policies based on device compliance and location.

Question 8

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Accepted Answer

Use 'nsenter --target 1 --mount --uts --ipc --net --pid' to enter the host's namespaces and spawn a root shell on the host node.. With CAP_SYS_ADMIN and hostPID enabled, the tester can inspect processes running on the host, locate processes like systemd or docker daemon, and use tools like nsenter or inject payloads into host namespaces.

Answer

Mount the Docker socket inside the container using the mount syscall enabled by CAP_SYS_ADMIN.

Answer

Execute the 'docker run' command inside the container to spin up a sibling container.

Answer

Write directly to the host's /proc/sysrq-trigger file without any additional mounts.

Question 9

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 10

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Accepted Answer

Exposing the Kubernetes etcd database port (2379) directly to the public internet without mutual TLS authentication.. Shared secrets in configmaps, unauthenticated etcd, and weak webhook configurations are critical flaws.

Answer

Enabling TLS encryption for all intra-pod and kubelet communications.

Answer

Enabling Kubernetes audit logs and exporting them to a secure SIEM platform.

Answer

Using RBAC authorization mode with narrowly scoped roles for all cluster service accounts.

Question 11

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 12

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

Accepted Answer

John the Ripper. John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Answer

Binwalk

Answer

Nmap

Answer

Tcpdump

Question 13

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 14

An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)

Accepted Answer

Using 'grep' or 'strings' combined with regular expressions to search for API keys, passwords, and private certificates. Static analysis of firmware involves searching for hardcoded keys using pattern matching tools like 'grep' or 'Strings' and checking binary hardening properties using tools like 'checksec'.

Answer

Flashing a modified bootloader directly onto the physical SPI flash chip using a desoldered programmer

Answer

Capturing over-the-air 802.11 management frames using Wireshark

Question 15

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee and Universal Radio Hacker (URH) or Wireshark with appropriate hardware dongles (like CC2531) are standard toolsets for Zigbee and 802.15.4 assessments.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 16

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

Accepted Answer

s7-info. Nmap includes specific industrial control scripts in the 'scripts/' directory. The 's7-info' script specifically queries Siemens S7 devices to extract operational data.

Answer

modbus-discover

Answer

bacnet-info

Answer

enip-info

Question 17

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Accepted Answer

Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing. BLE implementations frequently suffer from lack of encryption/pairing authentication, insecure GATT characteristic permissions allowing arbitrary reads/writes, and predictable static pairing PINs.

Answer

Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

Answer

Injecting malicious SQL statements into the BLE radio frequency advertising packets

Answer

Performing an ARP cache poisoning attack against the target device's switch port

Question 18

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

Accepted Answer

Utilizing the Security 2 (S2) framework featuring Elliptic Curve Diffie-Hellman (ECDH) key exchange. Z-Wave operates on sub-GHz frequencies (avoiding 2.4 GHz congestion) and incorporates S2 (Security 2) framework using ECDH for secure key exchange.

Answer

Relying on standard IEEE 802.11 physical layer framing and MAC headers

Answer

Requiring all participating nodes to maintain an active BGP routing table with upstream Internet routers

Answer

Operating natively on the 5 GHz Wi-Fi frequency band with WPA3-Enterprise authentication

Question 19

A penetration tester is evaluating a Zigbee-based smart home lighting network. Using a Texas Instruments CC2531 USB dongle flashed with Sniffer firmware, the tester captures over-the-air packets. To decrypt the Zigbee application layer payload in Wireshark, what critical piece of cryptographic material must the tester input into Wireshark's Zigbee decryption settings?

Accepted Answer

The 128-bit Zigbee Network Key (NWK key). Zigbee networks encrypt application data using a Network Key. To inspect encrypted application payloads in Wireshark, the Network Key must be provided in the Zigbee protocol preferences.

Answer

The device's physical serial number printed on the casing

Answer

The manufacturer's IEEE 802.15.4 MAC address

Answer

The Wi-Fi WPA2 pre-shared key of the local router

Question 20

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark