CPENT Timed Hard Questions — 25 Difficult Questions

Question 1

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

15 minute time limit — choose an answer to begin.

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. With CAP_SYS_ADMIN and a read-write cgroup v1 mount, the attacker can write a path to the release_agent file and then trigger a cgroup release, causing the kernel to execute that path as root in the host's initial namespace. This is the canonical cgroup v1 container escape (CVE-2022-0492 is a related kernel-side variant). No other listed vector is available from inside a standard container without additional host misconfigurations.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 2

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect. Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Answer

arp -a

Answer

uname -r

Question 3

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 4

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Accepted Answer

The target must have NTLM authentication enabled in the local security policy.. Pass-the-Hash (PtH) works by using the NTLM hash of a user's password to authenticate via NTLM, bypassing the need for the plaintext password. For this to succeed, the target system must accept NTLM authentication. If NTLM is disabled in the local security policy (e.g., via 'Network security: Restrict NTLM' settings), the attack fails because the hash cannot be used. Thus, the mandatory prerequisite is that NTLM authentication is enabled on the target.

Answer

The target must have the Remote Registry service disabled.

Answer

The target must be running Windows 10 or higher.

Answer

You must have the plaintext password of the target account.

Question 5

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Option A is correct because ESC8 abuses the HTTP-based web enrollment endpoints (certsrv) via NTLM relay, so disabling HTTP enrollment or enforcing HTTPS with Extended Protection for Authentication (EPA) and disabling NTLM on those endpoints blocks that relay vector. Option B is correct because continuous auditing of AD CS templates, CAs, and ACLs with tools like Certipy or BloodHound (e.g., Certipy's 'find' and 'template' checks) surfaces misconfigurations such as ESC1-ESC8 before attackers exploit them. Option E is correct because removing the ENROLLEE_SUPPLIES_SUBJECT flag prevents low-privileged enrollees from specifying an arbitrary subject/SAN (e.g., a domain admin UPN), which is the core of ESC1 template abuse. Option C is wrong because disabling Kerberos pre-authentication on domain controller computer accounts would weaken authentication and enable AS-REP roasting, not secure AD CS. Option D is wrong because enforcing unconstrained delegation on CA servers increases exposure to credential theft and relay/impersonation attacks rather than mitigating certificate abuse.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 6

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Accepted Answer

Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker. DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.

Answer

Use standard FTP data channels over ephemeral ports to push archives to an external staging server

Answer

Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets

Answer

Establish an HTTPS connection to an external IP address using port 443

Question 7

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The create verb on pods/exec in Kubernetes RBAC allows a user to invoke the exec subresource, which runs arbitrary commands inside a running container. This is effectively remote code execution within the pod's namespace, and if the pod has a mounted service account token or hostPath volume, the attacker can pivot to the node or cluster.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 8

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Accepted Answer

-sX. Nmap's -sX flag performs the Xmas scan, which sets the FIN, PSH, and URG flags simultaneously in the TCP header. This unusual flag combination is designed to evade stateless firewalls and some IDS signatures that only look for SYN or common flag patterns. The name comes from the flags being 'lit up' like a Christmas tree in a packet analyzer.

Answer

-sN

Answer

-sF

Answer

-sW

Question 9

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

Accepted Answer

Use CrackMapExec or NetExec with the smb-signing module to enumerate signing configuration across the subnet in a single sweep.. SMB signing enforcement is advertised in the SMB2 negotiate response, so hosts that report signing enabled but not required are relay candidates. Nmap's smb2-security-mode script and CrackMapExec/NetExec's smb-signing module both retrieve this data across a subnet and let you build a precise target list. Machine account quota and NetBIOS name queries expose unrelated information, and modifying the target is out of scope.

Answer

Query Active Directory for the ms-DS-MachineAccountQuota attribute on the domain object to determine which machines allow unsigned SMB.

Answer

Enable the LanmanServer service on each target and set the RequireSecuritySignature registry value to 0 before testing.

Answer

Perform a broadcast NetBIOS name query for each host to read the SMB signing flag from the node status response.

Question 10

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

Accepted Answer

.kirbi. Mimikatz uses the .kirbi file extension to save exported Kerberos tickets.

Answer

.ntds

Answer

.sam

Answer

.pfx

Question 11

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

Accepted Answer

The template allows enrollees to supply alternate subject names (SAN) and authorizes low-privileged users to enroll with client authentication EKUs.. ESC1 is defined by a certificate template that permits the enrollee to specify a Subject Alternative Name (SAN) and is enrollable by low-privileged users, while also including a client authentication EKU (e.g., Client Authentication, Smart Card Logon). This lets an attacker request a certificate with an arbitrary SAN (e.g., a Domain Admin's UPN) and authenticate as that user via PKINIT.

Answer

The template grants WriteDACL permissions to authenticated users over the Certificate Authority object.

Answer

The template publishes certificates to Active Directory user objects automatically.

Answer

The template has Manager Approval enabled and requires enterprise admin signatures.

Question 12

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark

Question 13

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee (A) is correct because it is a Python-based framework specifically designed for sniffing, injecting, and exploiting Zigbee and IEEE 802.15.4 networks, making it a core tool for assessing smart lighting installations that use these protocols. Wireshark (C) is correct because, when supplied with the captured Zigbee network key, it can decrypt and dissect 802.15.4 application-layer traffic (e.g., Zigbee APS/ZCL payloads), which is essential for analyzing the security of the lighting network. Aircrack-ng (B) targets Wi-Fi WPA-PSK handshakes and is irrelevant to 802.15.4/Zigbee, Metasploit's msfvenom (D) generates Windows Meterpreter payloads for host/AD attacks rather than RF-layer Zigbee assessment, and Burp Suite (E) intercepts HTTP(S) web traffic, none of which apply to Zigbee wireless security testing.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 14

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Accepted Answer

Wireshark. Wireshark (B) is correct because it is a protocol analyzer that captures live packets on an interface and includes dissectors that can parse authentication protocols such as HTTP Basic, FTP, Telnet, and Kerberos pre-authentication data, exposing credentials in cleartext or crackable form. Bettercap (D) is correct because it is a MITM framework with built-in ARP spoofing, sniffing, and credential-sniffing modules (e.g., net.sniff) that actively capture and parse credentials such as HTTP POST logins, FTP, and NTLM hashes from the wire. Tcpdump (E) is correct because it captures raw packets on the segment and, with the -A or -X flags, prints payload contents in ASCII/hex so cleartext credentials in protocols like FTP, Telnet, or HTTP can be read directly. John the Ripper (A) is a password-cracking tool that operates on captured hash files offline and does not capture or parse live network traffic, and Sqlmap (C) is a SQL injection exploitation tool that targets web application databases rather than sniffing credentials off a network segment.

Answer

John the Ripper

Answer

Sqlmap

Question 15

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Accepted Answer

Bettercap. Bettercap is a modular network attack framework that includes an ARP spoofing module capable of selective, low-frequency poisoning. Unlike tools that flood the network with ARP replies, Bettercap allows the attacker to target specific hosts and control the rate of spoofed frames, maintaining a stealthy man-in-the-middle position. This makes it ideal for environments where repetitive ARP traffic would trigger IDS/IPS alerts.

Answer

FTP

Answer

Ping

Answer

Telnet

Question 16

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 17

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Accepted Answer

Use 'nsenter --target 1 --mount --uts --ipc --net --pid' to enter the host's namespaces and spawn a root shell on the host node.. With CAP_SYS_ADMIN and hostPID enabled, the tester can inspect processes running on the host, locate processes like systemd or docker daemon, and use tools like nsenter or inject payloads into host namespaces.

Answer

Mount the Docker socket inside the container using the mount syscall enabled by CAP_SYS_ADMIN.

Answer

Execute the 'docker run' command inside the container to spin up a sibling container.

Answer

Write directly to the host's /proc/sysrq-trigger file without any additional mounts.

Question 18

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

Accepted Answer

Deploy industrial Intrusion Detection Systems (IDS) tuned for OT protocol anomalies. Option B is correct because an industrial IDS tuned for OT protocol anomalies (e.g., Modbus, DNP3, IEC 61850) provides passive monitoring and detection of malicious or abnormal commands without requiring the legacy protocols to support encryption or authentication. Option C is correct because ISA/IEC 62443 zones and conduits segmentation limits lateral movement and restricts access to SCADA devices, effectively compensating for the lack of native security in the protocols. Option D is correct because industrial firewalls with SCADA-aware Deep Packet Inspection can enforce protocol-level allowlisting and filter malformed or unauthorized function codes (e.g., Modbus write commands) that legacy protocols cannot authenticate. Option A is incorrect because disabling all TCP/UDP ports would break the SCADA network's required communications and is not a viable compensating control. Option E is incorrect because PLCs typically run real-time operating systems that cannot host traditional endpoint antivirus, and such software is not designed for OT environments.

Answer

Disable all TCP and UDP ports on the SCADA network switches

Answer

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Question 19

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 20

An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)

Accepted Answer

Using 'grep' or 'strings' combined with regular expressions to search for API keys, passwords, and private certificates. Static analysis of firmware involves searching for hardcoded keys using pattern matching tools like 'grep' or 'Strings' and checking binary hardening properties using tools like 'checksec'.

Answer

Flashing a modified bootloader directly onto the physical SPI flash chip using a desoldered programmer

Answer

Capturing over-the-air 802.11 management frames using Wireshark