CPENT Iot And OT Exploitation Practice Test 2 — 15 Questions

Question 1

An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Function Code 16 (0x10) - Write Multiple Registers. Modbus function codes define the action to be performed. Function Code 16 (0x10) is 'Write Multiple Registers', frequently used to change register blocks in industrial controllers.

Answer

Function Code 01 (0x01) - Read Coils

Answer

Function Code 04 (0x04) - Read Input Registers

Answer

Function Code 02 (0x02) - Read Discrete Inputs

Question 2

An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?

Accepted Answer

Wireshark. Wireshark includes built-in dissectors for Modbus/TCP and filters that allow inspecting every register read/write operation, making it the primary tool for packet-level ICS analysis.

Answer

John the Ripper

Answer

Hashcat

Answer

Dirb

Question 3

During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?

Accepted Answer

mitmproxy. Burp Suite or mitmproxy can act as transparent or explicit proxies, terminating the TLS connection using a rogue CA certificate, allowing inspection and modification of MQTT-over-TLS traffic.

Answer

Airodump-ng

Answer

Ncat

Answer

Hping3

Question 4

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

Accepted Answer

Lua. Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Answer

Bash

Answer

PowerShell

Answer

Ruby

Question 5

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

Accepted Answer

HackRF One / RTL-SDR. HackRF One, RTL-SDR, and similar software-defined radios are used for capturing RF signals. Specifically, devices like RTL-SDR or HackRF paired with GNU Radio or Universal Radio Hacker (URH) cover the 433 MHz band.

Answer

JTAGulator

Answer

Bus Pirate

Answer

Rubber Ducky

Question 6

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

Accepted Answer

John the Ripper. John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Answer

Binwalk

Answer

Nmap

Answer

Tcpdump

Question 7

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

Accepted Answer

Gobuster. Gobuster or Dirb/Dirbuster are standard directory brute-forcing tools used to find hidden web resources.

Answer

Wifite

Answer

Nbtscan

Answer

Hping3

Question 8

An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?

Accepted Answer

KillerBee. KillerBee is a popular Python framework and toolset for security auditing and exploiting Zigbee and IEEE 802.15.4 networks.

Answer

Impacket

Answer

Airgeddon

Answer

Bettercap

Question 9

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

Accepted Answer

QEMU_LD_PREFIX. When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Answer

QEMU_ROOTFS

Answer

LD_LIBRARY_PATH

Answer

PATH

Question 10

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

Accepted Answer

iec104. IEC 60870-5-104 operates over TCP port 2404. Wireshark decodes this under the 'iec104' protocol filter.

Answer

s7comm

Answer

mms

Answer

bacnet

Question 11

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

Accepted Answer

Hydra. Hydra is a versatile, parallelized login cracker supporting numerous network authentication protocols, including Telnet.

Answer

Sqlmap

Answer

Nikto

Answer

Wpscan

Question 12

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

Accepted Answer

0x88B8. GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Answer

0x0800

Answer

0x86DD

Answer

0x88E5

Question 13

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

Accepted Answer

-sS. The '-sS' flag instructs Nmap to perform a TCP SYN scan, which is the default and most popular stealth scan because it never completes the full 3-way handshake.

Answer

-sT

Answer

-sP

Answer

-sU

Question 14

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

Accepted Answer

/etc/mosquitto/mosquitto.conf. Eclipse Mosquitto stores its primary configuration settings in '/etc/mosquitto/mosquitto.conf' on standard Linux installations.

Answer

/var/lib/mqtt/config.ini

Answer

/opt/broker/settings.xml

Answer

/etc/init.d/mosquitto.cfg

Question 15

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

Accepted Answer

enip-info. Nmap includes the 'enip-info' NSE script specifically designed to query EtherNet/IP devices for identification and vendor details.

Answer

modbus-discover

Answer

bacnet-discover

Answer

dnp3-info