CPENT Iot And OT Exploitation Practice Test 4 — 15 Questions

Question 1

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Airodump-ng. Airodump-ng is the premier tool included in the Aircrack-ng suite for capturing 802.11 wireless frames in monitor mode.

Answer

Hydra

Answer

Sqlmap

Answer

Nbtscan

Question 2

A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)

Accepted Answer

Lack of cryptographic authentication on control commands (allowing spoofing). Option A is correct because legacy OT protocols such as Modbus/TCP, DNP3, and IEC 60870-5-104 typically lack cryptographic authentication, so an attacker on the network can forge or replay control commands to spoof a master station or HMI. Option C is correct because these same industrial protocols (Modbus, DNP3, Profinet, and Telnet for device management) usually transmit data in cleartext, allowing credential capture and command manipulation via simple sniffing. Option E is correct because engineering workstations, PLCs, and RTUs frequently ship with default, shared, or hardcoded service credentials that are rarely changed in legacy deployments, giving testers easy authenticated access. Option B does not belong because mandatory end-to-end TLS 1.3 on internal PLC racks is not a common finding in legacy SCADA environments—most legacy PLCs cannot even negotiate TLS, so this describes a hardened state rather than a vulnerability. Option D does not belong because automatic hardware-level isolation from the corporate IT network is not a typical OT characteristic; flat or poorly segmented networks enabling IT-to-OT lateral movement are the common finding, not enforced isolation.

Answer

Strict implementation of mandatory end-to-end TLS 1.3 encryption on all internal PLC racks

Answer

Automatic hardware-level isolation preventing any lateral movement from the corporate IT network

Question 3

An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?

Accepted Answer

jeffs2dump / mtd-utils. The 'mtd-utils' package includes tools like 'jeffs2dump' and 'nanddump', while 'jeffs2dump' or 'jeffs2extract' utilities unpack JFFS2 file systems.

Answer

dpkg-deb

Answer

rpmbuild

Answer

apt-get extract

Question 4

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. Option B is correct because MQTT brokers rely on ACLs to authorize which clients may publish or subscribe to specific topics, and a tester should verify that these restrictions are actually enforced to prevent unauthorized topic access. Option D is correct because many brokers ship with anonymous access enabled by default, so confirming whether unauthenticated clients can connect is a fundamental MQTT hardening check. Option E is correct because MQTT traffic is frequently deployed in cleartext on TCP port 1883, and verifying that TLS is used (typically on port 8883) ensures confidentiality and integrity of the smart home communications. Option A does not belong because Modbus/TCP function code 0x10 (Write Multiple Registers) is an industrial control protocol unrelated to MQTT broker configuration. Option C does not belong because an 802.11 deauthentication flood is a wireless-layer denial-of-service attack against Wi-Fi clients, not a broker security configuration check.

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 5

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

Accepted Answer

Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'. Option D is correct because Nmap's NSE script engine includes ICS-specific scripts like modbus-discover, s7-info, and enip-info that actively probe Modbus/TCP (port 502), Siemens S7comm (port 102), and EtherNet/IP (port 44818) to identify and fingerprint PLCs, RTUs, and other industrial devices. Option E is correct because dedicated OT asset-discovery platforms such as Nozomi Guardian, Claroty, and Dragos Platform passively and/or actively inventory ICS/SCADA assets, extracting vendor, model, firmware, and protocol details across industrial networks. Option A is wrong because Aircrack-ng is a Wi-Fi auditing suite and does not inject BLE advertisements into smart meters. Option B is wrong because sqlmap targets SQL injection in web applications and has nothing to do with ICS device fingerprinting. Option C is wrong because Hashcat cracking WPA2-Enterprise handshakes is a wireless credential attack, not OT asset discovery.

Answer

Using 'Aircrack-ng' to inject Bluetooth Low Energy advertisements into nearby smart meters

Answer

Running 'sqlmap' against TCP port 80 to extract database schemas from the corporate ERP

Answer

Cracking WPA2 enterprise handshakes using Hashcat and a dictionary list

Question 6

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Accepted Answer

SPI (Serial Peripheral Interface) flash memory pins. Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Answer

HDMI display output pins used for high-speed video graphics rendering

Answer

RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

Question 7

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee (A) is correct because it is a Python-based framework specifically designed for sniffing, injecting, and exploiting Zigbee and IEEE 802.15.4 networks, making it a core tool for assessing smart lighting installations that use these protocols. Wireshark (C) is correct because, when supplied with the captured Zigbee network key, it can decrypt and dissect 802.15.4 application-layer traffic (e.g., Zigbee APS/ZCL payloads), which is essential for analyzing the security of the lighting network. Aircrack-ng (B) targets Wi-Fi WPA-PSK handshakes and is irrelevant to 802.15.4/Zigbee, Metasploit's msfvenom (D) generates Windows Meterpreter payloads for host/AD attacks rather than RF-layer Zigbee assessment, and Burp Suite (E) intercepts HTTP(S) web traffic, none of which apply to Zigbee wireless security testing.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 8

An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)

Accepted Answer

Populating a PostgreSQL database with image metadata and utilizing Firmadyne helper scripts to extract the file system. Option B is correct because Firmadyne relies on a PostgreSQL database (typically the 'firmadyne' database) to store image metadata such as the image ID, hash, and architecture, and its helper scripts like extractor.py and getArch.py depend on this data to extract the firmware filesystem and determine the correct architecture. Option E is correct because Firmadyne emulates the firmware's kernel and filesystem using QEMU in system mode (e.g., qemu-system-mips, qemu-system-arm) with a custom patched initrd (often built via the console/inferKernel scripts) that boots the extracted filesystem and sets up networking for analysis. Option A is not relevant because Hydra SSH brute-forcing is a credential attack, not a step in emulating firmware. Option C is not relevant because SQL injection against a web server is an exploitation technique, not part of the emulation setup. Option D is not relevant because sniffing 802.11 beacons requires monitor-mode Wi-Fi hardware and pertains to wireless traffic capture, not Firmadyne's QEMU-based emulation workflow.

Answer

Brute-forcing SSH passwords using Hydra against the host machine

Answer

Executing an SQL injection payload against the web server running on port 80

Answer

Sniffing 802.11 wireless beacons with an external USB Wi-Fi adapter in monitor mode

Question 9

A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)

Accepted Answer

Deploying industrial Intrusion Detection Systems (IDS) capable of parsing proprietary OT protocols (e.g., Modbus, DNP3, S7). Option A is correct because industrial IDS solutions that understand proprietary OT protocols such as Modbus, DNP3, and S7 can detect malicious or anomalous control-plane traffic that generic IT IDS would miss, providing deep visibility into SCADA-specific attacks. Option B is correct because unidirectional security gateways (data diodes) enforce one-way data flow from OT to IT, physically preventing any inbound return path that an attacker could use to pivot into the plant floor. Option E is correct because strict segmentation between IT corporate networks and OT plant floors using firewalls (often via a DMZ or Purdue-model layering) limits lateral movement and blocks remote attacks originating from business or Internet-facing networks. Option C is not recommended because giving PLC controllers unrestricted direct Internet access exposes them to remote exploitation and violates OT isolation principles; updates should be staged through controlled, mediated paths. Option D is not recommended because disabling encryption on SCADA servers weakens confidentiality and integrity and does not meaningfully improve firewall inspection, since firewalls generally do not decrypt traffic anyway.

Answer

Allowing unrestricted direct Internet access from all PLC controllers for automated driver updates

Answer

Disabling all encryption across SCADA servers to improve packet inspection speeds on firewalls

Question 10

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Accepted Answer

Write to coils and holding registers to manipulate actuator states and setpoints. Options A, B, and D are correct because Modbus/TCP is an unauthenticated industrial protocol whose function codes allow these operations once an attacker reaches the PLC. A: Function codes such as 0x05 (Write Single Coil), 0x06 (Write Single Register), 0x0F (Write Multiple Coils), and 0x10 (Write Multiple Registers) let an attacker change actuator states and setpoints, directly manipulating physical processes. B: Diagnostic function code 0x08 (Diagnostics) includes sub-functions like 0x01 (Restart Communications Option) and 0x04 (Force Listen Only Mode), and vendor-specific reset commands can force controller reboots or halt communications. D: Function codes 0x03 (Read Holding Registers) and 0x04 (Read Input Registers) allow unauthenticated reading of process variables and sensor data, enabling reconnaissance and process-value harvesting. Option C is wrong because Modbus/TCP PLCs do not store or process Active Directory Kerberos ticket-granting tickets, and Kerberos TGTs are encrypted with the KDC's secret key, not something an OT attacker decrypts via Modbus. Option E is wrong because Modbus/TCP PLCs do not run a browser rendering engine, so cross-site scripting is not applicable to them.

Answer

Automatically decrypt Active Directory Kerberos ticket-granting tickets stored on the PLC

Answer

Execute cross-site scripting (XSS) attacks against the PLC's internal browser rendering engine

Question 11

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Accepted Answer

Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing. Option B is correct because many BLE IoT devices ship with fixed or hardcoded pairing PINs such as '0000' or '1234'; since these values are predictable and often transmitted or used during the pairing exchange, an attacker within radio range can brute-force them or capture them via sniffing to complete pairing and gain access. Option E is correct because the Generic Attribute Profile (GATT) defines how services and characteristics are exposed, and if the device permits read/write operations on characteristics without requiring authentication or encryption, an attacker can use tools like gatttool or nRF Connect to read sensitive medical data or write malicious values to the sensor. Option A is not correct because it describes an 802.11 Wi-Fi kernel buffer overflow, which is unrelated to the BLE radio and protocol stack. Option C is not correct because BLE advertising packets carry structured data (flags, UUIDs, TX power, etc.) and are not interpreted as SQL by any backend, so SQL injection is not a BLE attack vector. Option D is not correct because ARP cache poisoning targets IP/Ethernet LAN switching, whereas BLE is a point-to-point wireless protocol with no ARP or switch port involvement.

Answer

Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

Answer

Injecting malicious SQL statements into the BLE radio frequency advertising packets

Answer

Performing an ARP cache poisoning attack against the target device's switch port

Question 12

An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)

Accepted Answer

Reviewing sudo privileges using 'sudo -l'. Finding privilege escalation vectors involves searching for SUID/SGID binaries, inspecting sudo permissions, and checking cron jobs.

Answer

Analyzing Modbus holding registers for unauthorized register modifications

Answer

Checking Bluetooth GATT profile characteristics using nRF Connect

Question 13

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Accepted Answer

Application layer function codes specifying operations like Read, Write, Select, and Operate. Option A is correct because DNP3's application layer defines function codes such as Read (1), Write (2), Select (3), Operate (4), and Direct Operate (5), which are used to request data and control outstations in SCADA/ICS environments. Option C is correct because DNP3's data link layer frames include a CRC checksum in each data block (and header) to detect transmission errors, providing integrity at the link layer. Option E is correct because DNP3 Secure Authentication (SAv2/v5, defined in IEEE 1815) adds challenge-response authentication using HMAC to prevent unauthorized command injection, spoofing, and replay attacks. Option B is incorrect because the WPA2 four-way handshake belongs to IEEE 802.11 wireless LAN security, not DNP3, which is a serial/TCP-IP SCADA protocol. Option D is incorrect because HTTP Bearer tokens are used for REST API authentication over HTTP, which is unrelated to the DNP3 protocol structure.

Answer

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Answer

HTTP Authorization Bearer tokens used for REST API authentication

Question 14

A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)

Accepted Answer

Using TFTP to load and execute an unauthorized custom kernel image into device RAM. Option D is correct because U-Boot provides built-in tftp and bootm commands, so an attacker at the serial prompt can pull a malicious kernel image from a TFTP server into RAM and boot it, bypassing secure boot and any signed firmware enforcement. Option E is correct because interrupting the U-Boot countdown and editing the bootargs environment variable to append init=/bin/sh causes the Linux kernel to launch a root shell instead of the normal init process, granting immediate privileged access. Option A is wrong because cracking WPA2 PSKs with Aircrack-ng is a wireless-layer attack performed from a NIC in monitor mode, not from a U-Boot serial console. Option B is wrong because ARP spoofing is a layer-2 network attack executed from a running OS with tools like arpspoof, which U-Boot does not provide. Option C is wrong because SQL injection into a Bluetooth GATT characteristic is an application-layer attack against a running Bluetooth stack, not something achievable from the U-Boot bootloader prompt.

Answer

Cracking WPA2 Pre-Shared Keys using a dictionary attack and Aircrack-ng

Answer

Executing an ARP spoofing attack to intercept printer traffic on the corporate IT network

Answer

Injecting an SQL injection payload into the device's Bluetooth GATT profile characteristic

Question 15

A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?

Accepted Answer

Bus Pirate. The Bus Pirate is a universal open-source hardware hacking tool designed to interface with embedded chips via SPI, I2C, UART, JTAG, and other low-level protocols. The described pins (clock, data, ground, power) match an SPI or I2C flash chip interface, which the Bus Pirate can directly read to dump firmware. It is the standard tool for in-circuit flash extraction when a physical debugging header is exposed.

Answer

Wireshark

Answer

Logic Analyzer

Answer

HackRF One