CPENT Iot And OT Exploitation — 15 Questions

Question 1

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Publishing retained messages with empty payloads to critical command topics. MQTT retained messages are stored by the broker and delivered to any future subscriber of that topic. Publishing a retained message with an empty payload to a critical command topic causes the broker to delete the retained message and, more importantly, can overwrite or clear the last known good command state. If the actuator subscribes and receives an empty payload, it may interpret this as a command to stop, reset, or enter an undefined state — a denial-of-service against the control channel.

Answer

Executing an MQTT-specific TCP SYN flood against port 1883

Answer

Subscribing to the '$SYS/#' system topic hierarchy using wildcard expansion

Answer

Sending a CONNECT packet with an invalid keep-alive timer value of zero

Question 2

A penetration tester is analyzing an IoT mobile companion app that communicates with a smart thermostat via BLE (Bluetooth Low Energy). Which tool can the tester use on a rooted Android device to intercept and inspect BLE GATT characteristics and descriptors?

Accepted Answer

nRF Connect for Mobile. GATT Explorer or specialized dynamic instrumentation frameworks like Frida or BLE sniffing tools on Android are used, but specifically for intercepting and manipulating BLE traffic locally on the device, 'GATTacker' or apps like 'nRF Connect' / 'Frida scripts' are deployed. Among standard choices, nRF Connect is the industry-standard diagnostic and testing tool for BLE.

Answer

Hydra

Answer

Sqlmap

Answer

Aircrack-ng

Question 3

A penetration tester is evaluating a Zigbee-based smart home lighting network. Using a Texas Instruments CC2531 USB dongle flashed with Sniffer firmware, the tester captures over-the-air packets. To decrypt the Zigbee application layer payload in Wireshark, what critical piece of cryptographic material must the tester input into Wireshark's Zigbee decryption settings?

Accepted Answer

The 128-bit Zigbee Network Key (NWK key). Zigbee networks encrypt application data using a Network Key. To inspect encrypted application payloads in Wireshark, the Network Key must be provided in the Zigbee protocol preferences.

Answer

The device's physical serial number printed on the casing

Answer

The manufacturer's IEEE 802.15.4 MAC address

Answer

The Wi-Fi WPA2 pre-shared key of the local router

Question 4

An auditor is reviewing an ICS network architecture and notes that a Supervisory Control and Data Acquisition (SCADA) server communicates with remote terminal units (RTUs) via DNP3 over serial-to-ethernet terminal servers. The auditor wants to test if unauthenticated DNP3 control commands can be accepted. Which default port should the auditor probe for DNP3 traffic?

Accepted Answer

TCP/UDP 20000. DNP3 (Distributed Network Protocol) is heavily used in electric and water utilities and operates by default on TCP/UDP port 20000.

Answer

TCP 443

Answer

TCP 2404

Answer

TCP 44818

Question 5

An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?

Accepted Answer

KillerBee. KillerBee is a popular Python framework and toolset for security auditing and exploiting Zigbee and IEEE 802.15.4 networks.

Answer

Impacket

Answer

Airgeddon

Answer

Bettercap

Question 6

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 7

An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)

Accepted Answer

Using 'grep' or 'strings' combined with regular expressions to search for API keys, passwords, and private certificates. Static analysis of firmware involves searching for hardcoded keys using pattern matching tools like 'grep' or 'Strings' and checking binary hardening properties using tools like 'checksec'.

Answer

Flashing a modified bootloader directly onto the physical SPI flash chip using a desoldered programmer

Answer

Capturing over-the-air 802.11 management frames using Wireshark

Question 8

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

Accepted Answer

Utilizing the Security 2 (S2) framework featuring Elliptic Curve Diffie-Hellman (ECDH) key exchange. Option B is correct because Z-Wave's Security 2 (S2) framework uses Elliptic Curve Diffie-Hellman (ECDH) key exchange to establish a temporary shared secret between the controller and joining node, then derives the network keys via a key derivation function, which is a Z-Wave-specific security mechanism not used by standard Wi-Fi or Zigbee. Option C is correct because Z-Wave operates in the sub-GHz ISM bands, typically around 868.42 MHz in Europe and 908.42 MHz in the US (the question's '9084 MHz' is a typo for 908.42 MHz), which distinguishes it from Wi-Fi's 2.4/5 GHz bands and Zigbee's 2.4 GHz (and some sub-GHz) operation. Option A is incorrect because IEEE 802.11 framing and MAC headers belong to Wi-Fi, not Z-Wave, which uses its own ITU-T G.9959 PHY/MAC. Option D is incorrect because BGP is an Internet inter-domain routing protocol and has nothing to do with smart home hub mesh networking. Option E is incorrect because Z-Wave does not operate on 5 GHz Wi-Fi bands and does not use WPA3-Enterprise authentication.

Answer

Relying on standard IEEE 802.11 physical layer framing and MAC headers

Answer

Requiring all participating nodes to maintain an active BGP routing table with upstream Internet routers

Answer

Operating natively on the 5 GHz Wi-Fi frequency band with WPA3-Enterprise authentication

Question 9

A penetration tester is assessing an MQTT-based industrial monitoring system where brokers communicate over unencrypted TCP ports. The tester wants to discover hidden topics that are not actively publishing data by brute-forcing topic names. Which tool natively supports MQTT fuzzing and topic discovery through automated subscription testing?

Accepted Answer

MQTT-Miner. MQTT-Miner is a specialized tool designed specifically for MQTT protocol security testing. It natively supports brute-forcing topic names by automating subscription attempts to discover hidden topics that are not actively publishing data. Unlike general-purpose scanners, it understands MQTT's publish/subscribe model and can efficiently test large topic wordlists against a broker.

Answer

DirBuster

Answer

Nmap

Answer

Nikto

Question 10

When conducting a firmware security review of an embedded IoT device, a tester extracts the root filesystem and wants to identify potential memory corruption vulnerabilities introduced by compiler hardening settings. Which THREE security hardening flags or mechanisms should the tester verify are missing from the compiled binaries using tools like checksec? (Choose THREE)

Accepted Answer

Stack Canaries (Canary / GS). The question asks which compiler/linker hardening mechanisms a tester should verify with checksec on extracted firmware binaries, and options A, D, and E are exactly the categories checksec reports. Stack Canaries (A) are stack-smashing protections inserted by the compiler (e.g., -fstack-protector) that detect overwrites of the return address, so their absence directly indicates potential memory corruption exploitability. Read-Only Relocations (D) harden the GOT/PLT against overwrite-based control-flow hijacking, with Full RELRO making the relocation table read-only after dynamic linking, so missing RELRO is a relevant memory-corruption weakness. Non-Executable Bit (E), also called NX/DEP, marks writable memory regions such as the stack and heap non-executable, preventing injected shellcode from running, so its absence is a key hardening gap. Option B (ASLR) is a kernel/OS-level randomization feature, not a per-binary compiler hardening flag that checksec reports as missing from compiled binaries, and option C (Bandwidth Throttling) is a network traffic control mechanism unrelated to memory corruption or binary hardening.

Answer

Address Space Layout Randomization (ASLR)

Answer

Bandwidth Throttling

Question 11

A penetration tester is evaluating the security of a Zigbee-based smart lock system used in a hotel. The tester wants to capture and analyze the Zigbee network traffic to identify potential weaknesses. Which hardware tool is specifically designed for capturing and interacting with Zigbee networks?

Accepted Answer

Atmel RZUSBSTICK (or similar 802.15.4 sniffer). The Atmel RZUSBSTICK is an 802.15.4 sniffer that, combined with software like Wireshark or KillerBee, can capture and decode Zigbee traffic. It is specifically designed for this purpose, unlike general-purpose SDRs or Bluetooth-specific tools. This makes it the correct choice for analyzing a Zigbee-based smart lock system.

Answer

APIMOTE

Answer

Ubertooth One

Answer

HackRF One

Question 12

An IoT penetration tester is assessing a Zigbee-based smart home deployment. The tester wants to capture and analyze Zigbee network traffic to identify potential weaknesses such as default link keys or replay attacks. Which TWO of the following hardware tools are specifically designed for capturing and interacting with Zigbee networks? (Choose two.)

Accepted Answer

ubertooth-one. ApiMote and Ubertooth One are both hardware platforms specifically designed for Zigbee and IEEE 802.15.4 security research. ApiMote is purpose-built for Zigbee sniffing and injection with KillerBee, while Ubertooth One supports Zigbee capture and injection via open-source firmware. HackRF One and RTL-SDR are general-purpose SDRs that require extra processing and may not support injection, and Proxmark3 targets RFID/NFC, not Zigbee.

Answer

RTL-SDR

Answer

Proxmark3

Answer

HackRF One

Question 13

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNP3 Secure Authentication is not enabled. DNP3 Secure Authentication, when enabled and properly configured, uses cryptographic challenges to authenticate critical messages such as responses. Without it, an attacker can spoof responses to the master station. The scenario indicates that the master does not authenticate responses, which directly points to Secure Authentication being disabled or misconfigured. Thus, the lack of this feature is the weakness being exploited.

Answer

DNP3 Secure Authentication

Answer

DNP3 Link Layer Confirmation

Answer

DNP3 Unsolicited Responses

Question 14

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ARP spoofing to redirect traffic through the tester's laptop, then modify the PROFINET RT frames in transit.. PROFINET RT communication is unencrypted and lacks authentication, making it susceptible to man-in-the-middle attacks. ARP spoofing can position the tester between the PLC and I/O device, allowing interception and modification of frames. While PROFINET RT is Layer 2, ARP spoofing can still disrupt and redirect traffic in many flat networks. Other options either cause network-wide disruption, require specific vulnerabilities, or are not designed for stealthy manipulation.

Answer

Exploiting a vulnerability in the PROFINET stack to inject crafted RT frames directly into the network.

Answer

Using a PROFINET engineering tool to change the I/O module's configuration and redirect its output to a malicious device.

Answer

MAC flooding the switch to force it into fail-open mode, then capture and modify PROFINET RT frames.

Question 15

A penetration tester is analyzing the firmware of an IoT device that uses a lightweight publish-subscribe protocol for communication. The tester extracts the firmware and finds a configuration file containing a hardcoded username and password for the MQTT broker. The broker is configured to allow anonymous access. Which of the following is the most direct way for the tester to leverage this finding to intercept and manipulate MQTT messages?

Accepted Answer

Use the hardcoded credentials to log into the MQTT broker and subscribe to all topics using a wildcard, then publish malicious messages.. With hardcoded MQTT broker credentials and anonymous access enabled, the tester can directly authenticate to the broker, subscribe to all topics using a wildcard to intercept messages, and publish malicious messages to manipulate the system. This leverages the discovered credentials in the most direct manner. Other methods like MITM or exploiting vulnerabilities are less direct and not necessary given the accessible broker.

Answer

Perform a man-in-the-middle attack between the device and the broker by ARP spoofing, then modify MQTT packets in transit.

Answer

Exploit a known vulnerability in the MQTT broker software to gain remote code execution, then use that to read all messages.

Answer

Use the hardcoded credentials to access the device's web interface and change the MQTT broker settings to redirect messages to a rogue broker.