CPENT Iot And OT Exploitation Practice Test 2 — 15 Questions

Question 1

A penetration tester is evaluating the security of a building automation system that uses BACnet for communication. The tester wants to enumerate BACnet devices and objects on the network to identify potential points of manipulation. Which of the following tools is specifically designed for BACnet discovery and interaction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BACnet Protocol Test Tool (VTS). The BACnet Protocol Test Tool (VTS) is a specialized application for BACnet testing. It supports device discovery, object enumeration, and property read/write operations, which are essential for identifying manipulation points in a building automation system. Nmap and Wireshark are limited to information gathering or passive analysis, and Scapy requires manual packet crafting without dedicated BACnet features.

Answer

Nmap with the bacnet-info script

Answer

Scapy with BACnet layer

Answer

Wireshark with the BACnet dissector

Question 2

A CPENT tester is assessing an industrial control system that uses PROFINET for communication between a Siemens S7-1200 PLC and remote I/O devices. The tester has network access to the control VLAN and wants to capture and analyze PROFINET RT (Real-Time) frames to understand the process data exchanged. Which Wireshark display filter will correctly isolate PROFINET RT frames?

Accepted Answer

pn_rt. In PROFINET, real-time cyclic data is transported using the RT protocol, which Wireshark dissects as 'pn_rt'. This filter allows the tester to focus on the process data exchanged between the PLC and remote I/O, which is essential for understanding the control logic and potential attack vectors. Other PROFINET protocols like DCP or PTCP serve different purposes and would not provide the same insight.

Answer

profinet

Answer

pn_dcp

Answer

eth.type == 0x8892

Question 3

During a penetration test of a Modbus/TCP-based OT network, a CPENT tester wants to demonstrate the impact of unauthorized coil manipulation. The tester has identified a Modbus server at 192.168.1.10 and needs to write to coils to simulate opening a valve. Which TWO of the following actions are required to successfully write to a Modbus coil using the Metasploit Framework? (Choose two.)

Accepted Answer

Set the DATA_ADDRESS to the coil number and DATA to 1 to open the valve.. To write to a Modbus coil using Metasploit, the tester must use the auxiliary/scanner/scada/modbusclient module, set ACTION to WRITE_COIL, and specify the coil address and value via DATA_ADDRESS and DATA. These steps ensure the correct Modbus function code (5) is sent to the target. Other options either reference non-existent modules or incorrect options that are not part of the module's interface.

Answer

Use the exploit/windows/scada/modbus_write_coil module to send a crafted packet.

Answer

Set the RHOSTS to the Modbus server IP and RPORT to 502.

Answer

Set the MODBUS_FUNCTION_CODE to 5 for write single coil.

Question 4

A CPENT tester is assessing an IoT deployment of IP cameras and smart sensors on a corporate network. The tester wants to identify weaknesses in how the devices are discovered and managed. Which TWO of the following techniques are MOST relevant for enumerating these IoT devices and their services? (Choose two.)

Accepted Answer

Query mDNS for _services._dns-sd._udp.local to enumerate advertised services on the local segment.. SSDP M-SEARCH and mDNS service discovery are the two techniques that directly enumerate UPnP- and zero-configuration-advertised IoT devices and their services on a local network. SNMP walks target different device classes, while Kerberos and BGP attacks are unrelated protocols that do not enumerate IoT endpoints.

Answer

Execute a BGP route hijack to redirect IoT management traffic through the tester's workstation for inspection.

Answer

Run a Kerberos AS-REP roasting attack against the IoT devices to extract service account hashes.

Answer

Perform an SNMP walk using the public community string against each IoT device to dump its full management information base.

Question 5

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

Accepted Answer

setenv bootargs ${bootargs} init=/bin/sh. U-Boot uses environment variables to define boot parameters. Appending 'init=/bin/sh' or 'init=/bin/bash' to the 'bootargs' variable forces the kernel to launch a shell instead of the standard init process.

Answer

tftp 0x80000000 kernel.bin

Answer

printenv mtdparts

Answer

run flash_os_image

Question 6

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

Accepted Answer

s7-info. Nmap includes specific industrial control scripts in the 'scripts/' directory. The 's7-info' script specifically queries Siemens S7 devices to extract operational data.

Answer

modbus-discover

Answer

bacnet-info

Answer

enip-info

Question 7

An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?

Accepted Answer

TCP 502. Modbus/TCP is an open protocol widely used in SCADA environments and operates natively over TCP port 502.

Answer

TCP 102

Answer

TCP 20000

Answer

UDP 44818

Question 8

During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?

Accepted Answer

UART (Universal Asynchronous Receiver-Transmitter). UART (Universal Asynchronous Receiver-Transmitter) interfaces typically consist of 4 pins: VCC, GND, TX, and RX, where TX and RX show fluctuating voltage activity during transmission upon boot.

Answer

JTAG (Joint Test Action Group)

Answer

I2C (Inter-Integrated Circuit)

Answer

SPI (Serial Peripheral Interface)

Question 9

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

Accepted Answer

grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/. The grep command with the -r (recursive) and -n (line number) flags searches through all files in the squashfs-root directory for the string 'BEGIN RSA PRIVATE KEY'. This pattern is the standard header for PEM-encoded RSA private keys, making it an effective way to locate hardcoded keys in extracted firmware. The command is simple, fast, and does not require additional tools.

Answer

strings -k squashfs-root/

Answer

firmadyne -s squashfs-root/

Answer

binwalk -A squashfs-root/

Question 10

A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?

Accepted Answer

bacpypes (using scripts like whois.py / iam.py). bacpypes is a Python library that implements the BACnet protocol stack, and its bundled scripts such as whois.py (Who-Is/I-Am discovery) and iam.py (I-Am response) are designed specifically for BACnet device discovery and property enumeration. This makes it the correct tool for assessing BACnet/IP devices on a smart building network.

Answer

ettercap

Answer

sqlmap

Answer

msfvenom

Question 11

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 12

A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?

Accepted Answer

Binwalk. Binwalk is the industry-standard tool for searching binary images for embedded file systems and executable code signatures.

Answer

Wireshark

Answer

Metasploit Framework

Answer

Aircrack-ng

Question 13

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

Accepted Answer

curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api. cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Answer

ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

Answer

netstat -an | grep 80

Answer

traceroute -p 80 192.168.1.100

Question 14

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

Accepted Answer

Ghidra. Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Answer

Snort

Answer

Autopsy

Answer

Wireshark

Question 15

An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?

Accepted Answer

Function Code 16 (0x10) - Write Multiple Registers. Modbus function codes define the action to be performed. Function Code 16 (0x10) is 'Write Multiple Registers', frequently used to change register blocks in industrial controllers.

Answer

Function Code 01 (0x01) - Read Coils

Answer

Function Code 04 (0x04) - Read Input Registers

Answer

Function Code 02 (0x02) - Read Discrete Inputs