A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?
A penetration tester is analyzing an IoT mobile companion app that communicates with a smart thermostat via BLE (Bluetooth Low Energy). Which tool can the tester use on a rooted Android device to intercept and inspect BLE GATT characteristics and descriptors?
A penetration tester is evaluating a Zigbee-based smart home lighting network. Using a Texas Instruments CC2531 USB dongle flashed with Sniffer firmware, the tester captures over-the-air packets. To decrypt the Zigbee application layer payload in Wireshark, what critical piece of cryptographic material must the tester input into Wireshark's Zigbee decryption settings?
An auditor is reviewing an ICS network architecture and notes that a Supervisory Control and Data Acquisition (SCADA) server communicates with remote terminal units (RTUs) via DNP3 over serial-to-ethernet terminal servers. The auditor wants to test if unauthenticated DNP3 control commands can be accepted. Which default port should the auditor probe for DNP3 traffic?
An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?
An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?
An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)
A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)
A penetration tester is assessing an MQTT-based industrial monitoring system where brokers communicate over unencrypted TCP ports. The tester wants to discover hidden topics that are not actively publishing data by brute-forcing topic names. Which tool natively supports MQTT fuzzing and topic discovery through automated subscription testing?
When conducting a firmware security review of an embedded IoT device, a tester extracts the root filesystem and wants to identify potential memory corruption vulnerabilities introduced by compiler hardening settings. Which THREE security hardening flags or mechanisms should the tester verify are missing from the compiled binaries using tools like checksec? (Choose THREE)
A penetration tester is evaluating the security of a Zigbee-based smart lock system used in a hotel. The tester wants to capture and analyze the Zigbee network traffic to identify potential weaknesses. Which hardware tool is specifically designed for capturing and interacting with Zigbee networks?
An IoT penetration tester is assessing a Zigbee-based smart home deployment. The tester wants to capture and analyze Zigbee network traffic to identify potential weaknesses such as default link keys or replay attacks. Which TWO of the following hardware tools are specifically designed for capturing and interacting with Zigbee networks? (Choose two.)
A penetration tester is assessing an industrial control system that uses the DNP3 protocol for communication between a master station and remote terminal units (RTUs). The tester has captured DNP3 traffic and notices that the master station does not authenticate responses from RTUs. The tester wants to demonstrate the impact of this weakness by injecting spoofed DNP3 responses to the master. Which DNP3 feature, when improperly configured, allows an attacker to spoof responses without authentication?
A penetration tester is assessing an industrial control system that uses PROFINET for communication between a Siemens PLC and remote I/O devices. The tester wants to perform a man-in-the-middle attack to alter process data between the PLC and an I/O module. Which of the following techniques would BEST allow the tester to manipulate PROFINET real-time (RT) frames without being detected by the PLC?
A penetration tester is analyzing the firmware of an IoT device that uses a lightweight publish-subscribe protocol for communication. The tester extracts the firmware and finds a configuration file containing a hardcoded username and password for the MQTT broker. The broker is configured to allow anonymous access. Which of the following is the most direct way for the tester to leverage this finding to intercept and manipulate MQTT messages?
A penetration tester is evaluating the security of a building automation system that uses BACnet for communication. The tester wants to enumerate BACnet devices and objects on the network to identify potential points of manipulation. Which of the following tools is specifically designed for BACnet discovery and interaction?
A CPENT tester is assessing an industrial control system that uses PROFINET for communication between a Siemens S7-1200 PLC and remote I/O devices. The tester has network access to the control VLAN and wants to capture and analyze PROFINET RT (Real-Time) frames to understand the process data exchanged. Which Wireshark display filter will correctly isolate PROFINET RT frames?
During a penetration test of a Modbus/TCP-based OT network, a CPENT tester wants to demonstrate the impact of unauthorized coil manipulation. The tester has identified a Modbus server at 192.168.1.10 and needs to write to coils to simulate opening a valve. Which TWO of the following actions are required to successfully write to a Modbus coil using the Metasploit Framework? (Choose two.)
A CPENT tester is assessing an IoT deployment of IP cameras and smart sensors on a corporate network. The tester wants to identify weaknesses in how the devices are discovered and managed. Which TWO of the following techniques are MOST relevant for enumerating these IoT devices and their services? (Choose two.)
An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?
A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?
An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?
During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?
A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?
A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?
A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?
A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?
A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?
A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?
An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?
An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?
During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?
A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?
A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?
A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?
During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?
A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?
An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?
A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?
An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?
A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?
A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?
A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?
During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?
An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?
During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?
A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)
An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?
A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)
An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)
A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)
An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)
An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)
A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)
A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)
An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)
An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)
An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)
A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)
A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?
An assessment team is analyzing an embedded Linux firmware image for an industrial IoT gateway. They have successfully extracted the filesystem using Binwalk, but they need to statically analyze the compiled binaries for potential buffer overflows and insecure function calls. Which tool is specifically designed to perform static binary analysis and identify vulnerable functions likestrcpy within the extracted filesystem?
During an assessment of an Operational Technology (OT) network, a tester discovers a Programmable Logic Controller (PLC) using the Modbus TCP protocol. The tester needs to query holding registers to understand the operational state of the industrial process. Which default TCP port should the tester target for Modbus communications?
An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?
A penetration tester is reviewing the firmware of a smart electricity meter and discovers that the bootloader is unlocked. The tester connects a USB-to-UART serial adapter to the board's exposed pins and interrupts the boot sequence to gain a root shell. Which environment variable or kernel boot parameter must the tester modify to bypass the root password authentication prompt entirely?
A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?
During an assessment of a smart manufacturing facility, a penetration tester discovers an unauthenticated MQTT broker allowing anonymous publishing and subscription. Which TWO actions should the tester perform to validate the security risks associated with this misconfiguration? (Choose TWO)
An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)
A CPENT tester is assessing a water treatment plant's OT network. The tester has captured traffic on the plant's control VLAN and wants to enumerate all Modbus/TCP devices and their supported function codes without disrupting operations. Which Nmap NSE script should the tester run against the subnet to perform this discovery safely?
A CPENT tester gains access to an engineering workstation on an OT network and finds a project file for a Siemens SIMATIC S7-1200 PLC. The tester wants to extract the PLC's configuration, including any stored password hashes, from the engineering workstation's project data to demonstrate credential exposure. Which artifact should the tester examine?
A CPENT tester is assessing a building automation system that uses BACnet over IP. The tester needs to perform active discovery to enumerate BACnet devices and their objects on the network. Which TWO of the following approaches are valid for active BACnet/IP device enumeration? (Choose two.)
A penetration tester is assessing a building automation system that uses BACnet for communication between controllers and a central workstation. The tester wants to enumerate all BACnet devices on the network and identify their object types and properties. Which tool should the tester use to perform this enumeration?
During an OT assessment, you capture network traffic on the plant floor and notice that a Siemens S7-1200 PLC responds to read/write requests on TCP port 102 without requiring any authentication. You want to interact with the PLC to read its current process values and verify whether an attacker could manipulate the logic. Which tool is specifically designed to communicate with Siemens S7 PLCs over the S7comm protocol for this purpose?
An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?
A CPENT tester is evaluating an IoT device that exposes a serial console header on its PCB. After connecting a UART adapter, the tester sees garbled characters in the terminal. Which action should the tester take to obtain a readable console output?
A penetration tester is assessing an IoT device that uses MQTT for communication. The tester has captured MQTT traffic and notices that the CONNECT packets do not include a username or password. Which of the following best describes the security implication of this observation?
A CPENT tester is engaged to assess a municipal water utility's OT network. After passively mapping the environment, the tester identifies a Siemens SIMATIC S7-1200 PLC on VLAN 20 and wants to read the current state of its process image inputs and outputs without altering the running program. Which approach is MOST appropriate for this objective?
During a CPENT engagement against a pharmaceutical manufacturer's OT environment, the tester captures Modbus/TCP traffic between a human-machine interface (HMI) and several PLCs. The tester wants to demonstrate that an attacker on the IT network could manipulate coil states on a specific PLC without authentication. Which action BEST demonstrates this risk while minimizing impact on the production line?
A CPENT tester is evaluating an industrial control system that uses the DNP3 protocol for communication between a master station and remote terminal units (RTUs). The tester wants to determine whether the RTUs enforce any authentication on critical control functions. Which method is MOST appropriate to assess this without causing an outage?
A CPENT tester is assessing a building automation system that uses KNX for lighting and HVAC control. The tester wants to understand the group address structure to map which devices control which functions. Which action BEST accomplishes this?