CPENT Iot And OT Exploitation Practice Test 5 — 15 Questions

Question 1

An assessment team is analyzing an embedded Linux firmware image for an industrial IoT gateway. They have successfully extracted the filesystem using Binwalk, but they need to statically analyze the compiled binaries for potential buffer overflows and insecure function calls. Which tool is specifically designed to perform static binary analysis and identify vulnerable functions likestrcpy within the extracted filesystem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ghidra. Ghidra is a reverse-engineering framework developed by the NSA that performs static binary analysis, disassembly, and decompilation. It can load extracted ELF binaries from a firmware filesystem and identify insecure function calls like strcpy, gets, and sprintf by examining the symbol table, imports, and decompiled code, making it ideal for finding buffer overflow candidates.

Answer

Aircrack-ng

Answer

Binwalk

Answer

John the Ripper

Question 2

During an assessment of an Operational Technology (OT) network, a tester discovers a Programmable Logic Controller (PLC) using the Modbus TCP protocol. The tester needs to query holding registers to understand the operational state of the industrial process. Which default TCP port should the tester target for Modbus communications?

Accepted Answer

Port 502. Modbus TCP uses port 502 by default. Port 80 is HTTP, port 443 is HTTPS, and port 1883 is MQTT.

Answer

Port 80

Answer

Port 443

Answer

Port 1883

Question 3

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

Accepted Answer

Snap7 library scripts. Snap7 is an open-source Siemens S7 communication library that allows developers and testers to interact with Siemens PLCs. Wireshark is passive, Metasploit has limited industrial modules, and Scapy can craft raw packets but Snap7 is the standard library for S7comm manipulation.

Answer

Aircrack-ng

Answer

Hydra

Answer

Wireshark

Question 4

A penetration tester is reviewing the firmware of a smart electricity meter and discovers that the bootloader is unlocked. The tester connects a USB-to-UART serial adapter to the board's exposed pins and interrupts the boot sequence to gain a root shell. Which environment variable or kernel boot parameter must the tester modify to bypass the root password authentication prompt entirely?

Accepted Answer

init=/bin/sh. Appending 'init=/bin/sh' or 'init=/bin/bash' to the kernel boot arguments (bootargs) forces the Linux kernel to spawn a shell directly upon booting, bypassing init scripts and authentication prompts. 'rootfstype' defines the filesystem type, 'ip=' configures networking, and 'mem=' limits RAM.

Answer

rootfstype=squashfs

Answer

ip=DHCP

Answer

mem=256M

Question 5

A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?

Accepted Answer

A UDP broadcast packet containing a BACnet Who-Is request sent to port 47808. BACnet's Who-Is service is a broadcast request used for device discovery; it is sent as a UDP datagram to the BACnet/IP broadcast address on port 47808 (0xBAC0). Any BACnet device on the subnet responds with an I-Am message containing its device instance and address, allowing discovery without prior IP knowledge.

Answer

An ICMP ping sweep to identify all live IP addresses on the local network segment

Answer

An SNMP GETBULK request using the default private community string

Answer

A TCP SYN scan directed at port 47808 across the entire subnet

Question 6

During an assessment of a smart manufacturing facility, a penetration tester discovers an unauthenticated MQTT broker allowing anonymous publishing and subscription. Which TWO actions should the tester perform to validate the security risks associated with this misconfiguration? (Choose TWO)

Accepted Answer

Publish arbitrary control messages to actuator topics to test if physical machinery responds to unauthorized commands. Option B is correct because an unauthenticated MQTT broker that permits anonymous publishing lets the tester send crafted payloads to actuator/control topics (e.g., factory/line1/actuator/cmd) and observe whether the physical machinery or PLC responds, directly validating the integrity and safety impact of the misconfiguration. Option E is correct because subscribing to the root wildcard '#' on an anonymous broker captures every published topic, including telemetry, sensor readings, and potentially sensitive operational data, validating the confidentiality impact of the exposure. Option A is not appropriate because an aggressive Nmap TCP scan only enumerates open ports and does not validate the anonymous MQTT publish/subscribe risk. Option C is unrelated because capturing WPA2 four-way handshakes targets Wi-Fi link-layer confidentiality, not the MQTT application-layer misconfiguration. Option D is also not applicable because the broker allows anonymous access, so brute-forcing a management interface with Hydra does not validate the anonymous publish/subscribe exposure.

Answer

Perform an aggressive TCP port scan using Nmap to identify non-standard service ports

Answer

Capture WPA2 four-way handshakes to crack the underlying Wi-Fi pre-shared key

Answer

Execute a brute-force dictionary attack against the MQTT broker management interface using Hydra

Question 7

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

Accepted Answer

Deploy industrial Intrusion Detection Systems (IDS) tuned for OT protocol anomalies. Option B is correct because an industrial IDS tuned for OT protocol anomalies (e.g., Modbus, DNP3, IEC 61850) provides passive monitoring and detection of malicious or abnormal commands without requiring the legacy protocols to support encryption or authentication. Option C is correct because ISA/IEC 62443 zones and conduits segmentation limits lateral movement and restricts access to SCADA devices, effectively compensating for the lack of native security in the protocols. Option D is correct because industrial firewalls with SCADA-aware Deep Packet Inspection can enforce protocol-level allowlisting and filter malformed or unauthorized function codes (e.g., Modbus write commands) that legacy protocols cannot authenticate. Option A is incorrect because disabling all TCP/UDP ports would break the SCADA network's required communications and is not a viable compensating control. Option E is incorrect because PLCs typically run real-time operating systems that cannot host traditional endpoint antivirus, and such software is not designed for OT environments.

Answer

Disable all TCP and UDP ports on the SCADA network switches

Answer

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Question 8

A CPENT tester is assessing a water treatment plant's OT network. The tester has captured traffic on the plant's control VLAN and wants to enumerate all Modbus/TCP devices and their supported function codes without disrupting operations. Which Nmap NSE script should the tester run against the subnet to perform this discovery safely?

Accepted Answer

nmap -p 502 --script modbus-discover <subnet>. Modbus/TCP devices listen on TCP port 502, and the modbus-discover NSE script performs read-only device identification and function-code enumeration by sending safe Read Device Identification requests. Running a standard TCP scan against port 502 with this script enumerates PLCs without issuing writes, which meets the requirement to discover devices without disrupting plant operations.

Answer

nmap -sU -p 502 --script modbus-discover <subnet>

Answer

nmap -p 502 --script modbus-write <subnet>

Answer

nmap -p 502 --script modbus-discover --script-args modbus-discover.force=true <subnet>

Question 9

A CPENT tester gains access to an engineering workstation on an OT network and finds a project file for a Siemens SIMATIC S7-1200 PLC. The tester wants to extract the PLC's configuration, including any stored password hashes, from the engineering workstation's project data to demonstrate credential exposure. Which artifact should the tester examine?

Accepted Answer

The .ap17 project archive's SystemBlock and hardware configuration XML files, which contain PLC protection level settings and hashed password material. TIA Portal project archives (.ap17) bundle the hardware configuration and SystemBlock data as XML and binary files. These contain the PLC protection level and the hashed password used for access control. Extracting and cracking that hash from the engineering workstation demonstrates credential exposure without interacting with the live PLC, which is the goal of this assessment.

Answer

The S7-1200's web server index page, which serves the PLC password in cleartext over HTTP for diagnostic purposes

Answer

The STEP 7 project's GlobalLabels CSV export, which stores the PLC password in a readable column

Answer

The S7-1200's SD card root directory file named PASSWD.TXT, which TIA Portal writes during commissioning

Question 10

A CPENT tester is assessing a building automation system that uses BACnet over IP. The tester needs to perform active discovery to enumerate BACnet devices and their objects on the network. Which TWO of the following approaches are valid for active BACnet/IP device enumeration? (Choose two.)

Accepted Answer

Use the BACnet ReadProperty service to query the object-list property of each discovered device to enumerate its objects. Active BACnet/IP enumeration starts with a Who-Is broadcast to collect I-Am responses, yielding device instance numbers and addresses. From there, ReadProperty against each device's object-list reveals all exposed objects. Together these read-only services provide a complete device and object inventory without writing to the system, which is essential for safe OT assessment.

Answer

Perform a BACnet WriteProperty to set the device's object-list to a known value, then read it back to confirm enumeration

Answer

Send a BACnet Who-Has broadcast to retrieve the firmware version and vendor ID of every device

Answer

Use the BACnet SubscribeCOV service to force every device to continuously report all object values

Question 11

A penetration tester is assessing a building automation system that uses BACnet for communication between controllers and a central workstation. The tester wants to enumerate all BACnet devices on the network and identify their object types and properties. Which tool should the tester use to perform this enumeration?

Accepted Answer

BACnet discovery tool (e.g., BACnet Scan or VTS). A dedicated BACnet discovery tool such as BACnet Scan or VTS can actively query the network using BACnet services like Who-Is and Read-Property to enumerate all devices, object types, and properties. This provides the comprehensive inventory the tester needs. Other tools like Nmap or Wireshark may offer limited visibility but cannot perform the full active enumeration required.

Answer

Wireshark with a BACnet display filter

Answer

Nmap with the bacnet-info NSE script

Answer

Metasploit with the bacnet_scanner module

Question 12

During an OT assessment, you capture network traffic on the plant floor and notice that a Siemens S7-1200 PLC responds to read/write requests on TCP port 102 without requiring any authentication. You want to interact with the PLC to read its current process values and verify whether an attacker could manipulate the logic. Which tool is specifically designed to communicate with Siemens S7 PLCs over the S7comm protocol for this purpose?

Accepted Answer

Snap7. Siemens S7 PLCs use the proprietary S7comm protocol over TCP port 102. To actively read/write process values or modify logic, a tool that implements S7comm is required. Snap7 is an open-source library and set of tools that provides this capability, allowing direct interaction with S7-1200, S7-1500, S7-300, and S7-400 PLCs. Other options either target different protocols or are passive/information-gathering tools.

Answer

Wireshark with the s7comm dissector

Answer

Modbus Poll

Answer

Nmap with the s7-info script

Question 13

An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?

Accepted Answer

The MQTT connection is not using TLS encryption.. MQTT does not encrypt traffic by default. Without TLS, the CONNECT packet, which contains username and password, is transmitted in cleartext. The observation of cleartext credentials directly points to the absence of TLS encryption on the MQTT connection. Other options describe scenarios that would either prevent connection or are specific subsets of the same root cause.

Answer

The MQTT broker is configured to use TLS, but the client is not.

Answer

The MQTT client is configured to use MQTT over WebSocket without TLS.

Answer

The MQTT broker is using a self-signed certificate that the client rejects.

Question 14

A CPENT tester is evaluating an IoT device that exposes a serial console header on its PCB. After connecting a UART adapter, the tester sees garbled characters in the terminal. Which action should the tester take to obtain a readable console output?

Accepted Answer

Adjust the terminal's baud rate to match the device's configured UART speed, trying common values such as 115200 or 9600. Garbled UART output indicates the terminal's baud rate does not match the device's configured speed. Systematically trying common baud rates such as 115200, 57600, 38400, and 9600 until readable text appears is the standard, non-destructive fix. This restores the serial console, enabling bootloader and firmware analysis on the IoT device.

Answer

Enable hardware flow control (RTS/CTS) in the terminal to stabilize the serial connection

Answer

Increase the UART adapter's voltage from 3.3V to 5V to boost signal integrity

Answer

Swap the TX and RX lines on the UART adapter to correct the garbled output

Question 15

A penetration tester is assessing an IoT device that uses MQTT for communication. The tester has captured MQTT traffic and notices that the CONNECT packets do not include a username or password. Which of the following best describes the security implication of this observation?

Accepted Answer

The MQTT broker allows anonymous connections, which may permit unauthorized clients to publish or subscribe to topics.. MQTT CONNECT packets without a username and password often indicate that the broker permits anonymous connections. This misconfiguration allows any client to connect and potentially access or manipulate MQTT topics, leading to data breaches or unauthorized control of IoT devices. It is a critical finding in a penetration test, as it directly impacts the confidentiality and integrity of the system.

Answer

The MQTT protocol inherently does not support authentication, so this is expected behavior.

Answer

The MQTT traffic is encrypted with TLS, so the absence of credentials is not a concern.

Answer

The MQTT broker is using certificate-based authentication, which replaces username and password.