CPENT Iot And OT Exploitation Practice Test 3 — 15 Questions

Question 1

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 2

During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?

Accepted Answer

Nikto. Nikto is a comprehensive web server scanner that checks for dangerous files, outdated software, and CGI scripts, while Metasploit contains specific modules for exploitation.

Answer

Reaver

Answer

Masscan

Answer

Aircrack-ng

Question 3

An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?

Accepted Answer

Scapy. Scapy is a powerful Python-based packet manipulation library that allows building custom packets for industrial protocols like Modbus, DNP3, and IEC 104.

Answer

BeautifulSoup

Answer

Pandas

Answer

Pygame

Question 4

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

Accepted Answer

Airodump-ng. Airodump-ng is the premier tool included in the Aircrack-ng suite for capturing 802.11 wireless frames in monitor mode.

Answer

Hydra

Answer

Sqlmap

Answer

Nbtscan

Question 5

A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)

Accepted Answer

Lack of cryptographic authentication on control commands (allowing spoofing). Legacy OT systems often lack encryption, authentication, and secure update mechanisms, exposing them to cleartext sniffing, command spoofing, and unauthenticated firmware updates.

Answer

Strict implementation of mandatory end-to-end TLS 1.3 encryption on all internal PLC racks

Answer

Automatic hardware-level isolation preventing any lateral movement from the corporate IT network

Question 6

An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?

Accepted Answer

jeffs2dump / mtd-utils. The 'mtd-utils' package includes tools like 'jeffs2dump' and 'nanddump', while 'jeffs2dump' or 'jeffs2extract' utilities unpack JFFS2 file systems.

Answer

dpkg-deb

Answer

rpmbuild

Answer

apt-get extract

Question 7

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. MQTT security assessments focus heavily on authentication, authorization (ACLs), and transport encryption (TLS).

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 8

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

Accepted Answer

Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'. Fingerprinting ICS equipment involves using Nmap NSE scripts tailored for industrial protocols or specialized asset discovery tools like Shodan/Industrial Defender tools.

Answer

Using 'Aircrack-ng' to inject Bluetooth Low Energy advertisements into nearby smart meters

Answer

Running 'sqlmap' against TCP port 80 to extract database schemas from the corporate ERP

Answer

Cracking WPA2 enterprise handshakes using Hashcat and a dictionary list

Question 9

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Accepted Answer

SPI (Serial Peripheral Interface) flash memory pins. Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Answer

HDMI display output pins used for high-speed video graphics rendering

Answer

RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

Question 10

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee and Universal Radio Hacker (URH) or Wireshark with appropriate hardware dongles (like CC2531) are standard toolsets for Zigbee and 802.15.4 assessments.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 11

An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)

Accepted Answer

Populating a PostgreSQL database with image metadata and utilizing Firmadyne helper scripts to extract the file system. Firmadyne emulation requires extracting the file system, initializing a PostgreSQL database to store image metadata, and running specialized QEMU system emulators with a modified kernel.

Answer

Brute-forcing SSH passwords using Hydra against the host machine

Answer

Executing an SQL injection payload against the web server running on port 80

Answer

Sniffing 802.11 wireless beacons with an external USB Wi-Fi adapter in monitor mode

Question 12

A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)

Accepted Answer

Deploying industrial Intrusion Detection Systems (IDS) capable of parsing proprietary OT protocols (e.g., Modbus, DNP3, S7). Securing OT networks involves strict Purdue model network segmentation, deploying unidirectional security gateways (data diodes), and implementing industrial IDS solutions.

Answer

Allowing unrestricted direct Internet access from all PLC controllers for automated driver updates

Answer

Disabling all encryption across SCADA servers to improve packet inspection speeds on firewalls

Question 13

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Accepted Answer

Write to coils and holding registers to manipulate actuator states and setpoints. Modbus/TCP lacks built-in security, meaning any host with network access can read registers, write/alter register values, and send stop/start commands to PLCs.

Answer

Automatically decrypt Active Directory Kerberos ticket-granting tickets stored on the PLC

Answer

Execute cross-site scripting (XSS) attacks against the PLC's internal browser rendering engine

Question 14

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Accepted Answer

Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing. BLE implementations frequently suffer from lack of encryption/pairing authentication, insecure GATT characteristic permissions allowing arbitrary reads/writes, and predictable static pairing PINs.

Answer

Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

Answer

Injecting malicious SQL statements into the BLE radio frequency advertising packets

Answer

Performing an ARP cache poisoning attack against the target device's switch port

Question 15

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

Accepted Answer

Utilizing the Security 2 (S2) framework featuring Elliptic Curve Diffie-Hellman (ECDH) key exchange. Z-Wave operates on sub-GHz frequencies (avoiding 2.4 GHz congestion) and incorporates S2 (Security 2) framework using ECDH for secure key exchange.

Answer

Relying on standard IEEE 802.11 physical layer framing and MAC headers

Answer

Requiring all participating nodes to maintain an active BGP routing table with upstream Internet routers

Answer

Operating natively on the 5 GHz Wi-Fi frequency band with WPA3-Enterprise authentication