CPENT Iot And OT Exploitation Practice Test 3 — 15 Questions

Question 1

An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Wireshark. Wireshark natively dissects Modbus/TCP (port 502) and can display coil, register, and function-code fields; using its filter and IO Graph or Statistics features, the analyst can extract register values and visualize state changes over time from the PCAP. This makes it the correct tool for the described task.

Answer

John the Ripper

Answer

Hashcat

Answer

Dirb

Question 2

During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?

Accepted Answer

mitmproxy. mitmproxy is an interactive HTTPS/TLS interception proxy that can be configured with a custom CA certificate; because the IoT client has certificate validation disabled, it will accept mitmproxy's forged certificate and the analyst can decrypt and inspect the MQTT-over-TLS traffic. This makes it the right tool for transparently proxying TLS-wrapped MQTT.

Answer

Airodump-ng

Answer

Ncat

Answer

Hping3

Question 3

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

Accepted Answer

Lua. Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Answer

Bash

Answer

PowerShell

Answer

Ruby

Question 4

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

Accepted Answer

HackRF One / RTL-SDR. HackRF One, RTL-SDR, and similar software-defined radios are used for capturing RF signals. Specifically, devices like RTL-SDR or HackRF paired with GNU Radio or Universal Radio Hacker (URH) cover the 433 MHz band.

Answer

JTAGulator

Answer

Bus Pirate

Answer

Rubber Ducky

Question 5

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

Accepted Answer

John the Ripper. John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Answer

Binwalk

Answer

Nmap

Answer

Tcpdump

Question 6

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

Accepted Answer

Gobuster. Gobuster is a Go-based command-line tool purpose-built for brute-forcing URIs (directories and files), DNS subdomains, and virtual hosts on web servers. It uses wordlists to enumerate hidden paths such as /admin, /backup, and configuration files, making it the correct choice for discovering hidden administrative directories on the PLC's web interface.

Answer

Wifite

Answer

Nbtscan

Answer

Hping3

Question 7

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

Accepted Answer

QEMU_LD_PREFIX. When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Answer

QEMU_ROOTFS

Answer

LD_LIBRARY_PATH

Answer

PATH

Question 8

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

Accepted Answer

iec104. IEC 60870-5-104 operates over TCP port 2404. Wireshark decodes this under the 'iec104' protocol filter.

Answer

s7comm

Answer

mms

Answer

bacnet

Question 9

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

Accepted Answer

Hydra. Hydra is a fast, parallelized online password-cracking tool that supports dozens of protocols including Telnet, FTP, SSH, SMB, and HTTP. It accepts -L/-P username and password wordlists and performs a dictionary attack against a live service, making it the correct tool for brute-forcing Telnet on port 23. Its -t flag controls parallel tasks per target, and -f stops on the first valid credential found.

Answer

Sqlmap

Answer

Nikto

Answer

Wpscan

Question 10

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

Accepted Answer

0x88B8. GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Answer

0x0800

Answer

0x86DD

Answer

0x88E5

Question 11

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN (half-open) scan: it sends a SYN, waits for SYN/ACK (open) or RST (closed), then sends RST instead of completing the three-way handshake. This is faster and stealthier than a full connect scan because no session is ever established, so application-layer logs on the target typically never record the probe. It requires raw-socket privileges (root/SYSTEM or CAP_NET_RAW).

Answer

-sT

Answer

-sP

Answer

-sU

Question 12

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

Accepted Answer

/etc/mosquitto/mosquitto.conf. Eclipse Mosquitto stores its primary configuration settings in '/etc/mosquitto/mosquitto.conf' on standard Linux installations.

Answer

/var/lib/mqtt/config.ini

Answer

/opt/broker/settings.xml

Answer

/etc/init.d/mosquitto.cfg

Question 13

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

Accepted Answer

enip-info. Nmap includes the 'enip-info' NSE script specifically designed to query EtherNet/IP devices for identification and vendor details.

Answer

modbus-discover

Answer

bacnet-discover

Answer

dnp3-info

Question 14

During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?

Accepted Answer

Nikto. Nikto is a web server scanner that includes a comprehensive database of checks for CGI vulnerabilities, including OS command injection flaws in CGI scripts. It specifically tests for known CGI issues like Shellshock, default CGI scripts, and parameter injection points. The tool sends crafted HTTP requests to CGI endpoints and analyzes responses for signs of command execution, making it the correct choice for detecting web-based CGI vulnerabilities and command injection.

Answer

Reaver

Answer

Masscan

Answer

Aircrack-ng

Question 15

An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?

Accepted Answer

Scapy. Scapy is a Python library for crafting, sending, sniffing, and dissecting network packets at arbitrary protocol layers, including raw application-layer payloads. It can construct custom IEC 60870-5-104 APDU/ASDU frames and transmit them over TCP, making it the correct tool for injecting forged ASDU commands to a smart grid device.

Answer

BeautifulSoup

Answer

Pandas

Answer

Pygame