CPENT Iot And OT Exploitation — Timed 30 Questions

Question 1

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

30 minute time limit — choose an answer to begin.

Accepted Answer

Publishing retained messages with empty payloads to critical command topics. MQTT retained messages are stored by the broker and delivered to any future subscriber of that topic. Publishing a retained message with an empty payload to a critical command topic causes the broker to delete the retained message and, more importantly, can overwrite or clear the last known good command state. If the actuator subscribes and receives an empty payload, it may interpret this as a command to stop, reset, or enter an undefined state — a denial-of-service against the control channel.

Answer

Executing an MQTT-specific TCP SYN flood against port 1883

Answer

Subscribing to the '$SYS/#' system topic hierarchy using wildcard expansion

Answer

Sending a CONNECT packet with an invalid keep-alive timer value of zero

Question 2

A penetration tester is analyzing an IoT mobile companion app that communicates with a smart thermostat via BLE (Bluetooth Low Energy). Which tool can the tester use on a rooted Android device to intercept and inspect BLE GATT characteristics and descriptors?

Accepted Answer

nRF Connect for Mobile. GATT Explorer or specialized dynamic instrumentation frameworks like Frida or BLE sniffing tools on Android are used, but specifically for intercepting and manipulating BLE traffic locally on the device, 'GATTacker' or apps like 'nRF Connect' / 'Frida scripts' are deployed. Among standard choices, nRF Connect is the industry-standard diagnostic and testing tool for BLE.

Answer

Hydra

Answer

Sqlmap

Answer

Aircrack-ng

Question 3

A penetration tester is evaluating a Zigbee-based smart home lighting network. Using a Texas Instruments CC2531 USB dongle flashed with Sniffer firmware, the tester captures over-the-air packets. To decrypt the Zigbee application layer payload in Wireshark, what critical piece of cryptographic material must the tester input into Wireshark's Zigbee decryption settings?

Accepted Answer

The 128-bit Zigbee Network Key (NWK key). Zigbee networks encrypt application data using a Network Key. To inspect encrypted application payloads in Wireshark, the Network Key must be provided in the Zigbee protocol preferences.

Answer

The device's physical serial number printed on the casing

Answer

The manufacturer's IEEE 802.15.4 MAC address

Answer

The Wi-Fi WPA2 pre-shared key of the local router

Question 4

An auditor is reviewing an ICS network architecture and notes that a Supervisory Control and Data Acquisition (SCADA) server communicates with remote terminal units (RTUs) via DNP3 over serial-to-ethernet terminal servers. The auditor wants to test if unauthenticated DNP3 control commands can be accepted. Which default port should the auditor probe for DNP3 traffic?

Accepted Answer

TCP/UDP 20000. DNP3 (Distributed Network Protocol) is heavily used in electric and water utilities and operates by default on TCP/UDP port 20000.

Answer

TCP 443

Answer

TCP 2404

Answer

TCP 44818

Question 5

An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?

Accepted Answer

KillerBee. KillerBee is a popular Python framework and toolset for security auditing and exploiting Zigbee and IEEE 802.15.4 networks.

Answer

Impacket

Answer

Airgeddon

Answer

Bettercap

Question 6

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

Accepted Answer

openssl s_client -dtls1 -psk 01020304 -psk_identity test_id -connect 192.168.1.50:5684. OpenSSL supports DTLS testing and allows specifying PSK identity and keys using parameters like '-psk' and '-psk_identity'.

Answer

ssh -p 5684 -o KexAlgorithms=psk 192.168.1.50

Answer

nc -u 192.168.1.50 5684

Answer

telnet 192.168.1.50 5684

Question 7

An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)

Accepted Answer

Using 'grep' or 'strings' combined with regular expressions to search for API keys, passwords, and private certificates. Static analysis of firmware involves searching for hardcoded keys using pattern matching tools like 'grep' or 'Strings' and checking binary hardening properties using tools like 'checksec'.

Answer

Flashing a modified bootloader directly onto the physical SPI flash chip using a desoldered programmer

Answer

Capturing over-the-air 802.11 management frames using Wireshark

Question 8

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

Accepted Answer

Utilizing the Security 2 (S2) framework featuring Elliptic Curve Diffie-Hellman (ECDH) key exchange. Option B is correct because Z-Wave's Security 2 (S2) framework uses Elliptic Curve Diffie-Hellman (ECDH) key exchange to establish a temporary shared secret between the controller and joining node, then derives the network keys via a key derivation function, which is a Z-Wave-specific security mechanism not used by standard Wi-Fi or Zigbee. Option C is correct because Z-Wave operates in the sub-GHz ISM bands, typically around 868.42 MHz in Europe and 908.42 MHz in the US (the question's '9084 MHz' is a typo for 908.42 MHz), which distinguishes it from Wi-Fi's 2.4/5 GHz bands and Zigbee's 2.4 GHz (and some sub-GHz) operation. Option A is incorrect because IEEE 802.11 framing and MAC headers belong to Wi-Fi, not Z-Wave, which uses its own ITU-T G.9959 PHY/MAC. Option D is incorrect because BGP is an Internet inter-domain routing protocol and has nothing to do with smart home hub mesh networking. Option E is incorrect because Z-Wave does not operate on 5 GHz Wi-Fi bands and does not use WPA3-Enterprise authentication.

Answer

Relying on standard IEEE 802.11 physical layer framing and MAC headers

Answer

Requiring all participating nodes to maintain an active BGP routing table with upstream Internet routers

Answer

Operating natively on the 5 GHz Wi-Fi frequency band with WPA3-Enterprise authentication

Question 9

A penetration tester is assessing an MQTT-based industrial monitoring system where brokers communicate over unencrypted TCP ports. The tester wants to discover hidden topics that are not actively publishing data by brute-forcing topic names. Which tool natively supports MQTT fuzzing and topic discovery through automated subscription testing?

Accepted Answer

MQTT-Miner. MQTT-Miner is a specialized tool designed specifically for MQTT protocol security testing. It natively supports brute-forcing topic names by automating subscription attempts to discover hidden topics that are not actively publishing data. Unlike general-purpose scanners, it understands MQTT's publish/subscribe model and can efficiently test large topic wordlists against a broker.

Answer

DirBuster

Answer

Nmap

Answer

Nikto

Question 10

When conducting a firmware security review of an embedded IoT device, a tester extracts the root filesystem and wants to identify potential memory corruption vulnerabilities introduced by compiler hardening settings. Which THREE security hardening flags or mechanisms should the tester verify are missing from the compiled binaries using tools like checksec? (Choose THREE)

Accepted Answer

Stack Canaries (Canary / GS). The question asks which compiler/linker hardening mechanisms a tester should verify with checksec on extracted firmware binaries, and options A, D, and E are exactly the categories checksec reports. Stack Canaries (A) are stack-smashing protections inserted by the compiler (e.g., -fstack-protector) that detect overwrites of the return address, so their absence directly indicates potential memory corruption exploitability. Read-Only Relocations (D) harden the GOT/PLT against overwrite-based control-flow hijacking, with Full RELRO making the relocation table read-only after dynamic linking, so missing RELRO is a relevant memory-corruption weakness. Non-Executable Bit (E), also called NX/DEP, marks writable memory regions such as the stack and heap non-executable, preventing injected shellcode from running, so its absence is a key hardening gap. Option B (ASLR) is a kernel/OS-level randomization feature, not a per-binary compiler hardening flag that checksec reports as missing from compiled binaries, and option C (Bandwidth Throttling) is a network traffic control mechanism unrelated to memory corruption or binary hardening.

Answer

Address Space Layout Randomization (ASLR)

Answer

Bandwidth Throttling

Question 11

A penetration tester is evaluating the security of a Zigbee-based smart lock system used in a hotel. The tester wants to capture and analyze the Zigbee network traffic to identify potential weaknesses. Which hardware tool is specifically designed for capturing and interacting with Zigbee networks?

Accepted Answer

Atmel RZUSBSTICK (or similar 802.15.4 sniffer). The Atmel RZUSBSTICK is an 802.15.4 sniffer that, combined with software like Wireshark or KillerBee, can capture and decode Zigbee traffic. It is specifically designed for this purpose, unlike general-purpose SDRs or Bluetooth-specific tools. This makes it the correct choice for analyzing a Zigbee-based smart lock system.

Answer

APIMOTE

Answer

Ubertooth One

Answer

HackRF One

Question 12

An IoT penetration tester is assessing a Zigbee-based smart home deployment. The tester wants to capture and analyze Zigbee network traffic to identify potential weaknesses such as default link keys or replay attacks. Which TWO of the following hardware tools are specifically designed for capturing and interacting with Zigbee networks? (Choose two.)

Accepted Answer

ubertooth-one. ApiMote and Ubertooth One are both hardware platforms specifically designed for Zigbee and IEEE 802.15.4 security research. ApiMote is purpose-built for Zigbee sniffing and injection with KillerBee, while Ubertooth One supports Zigbee capture and injection via open-source firmware. HackRF One and RTL-SDR are general-purpose SDRs that require extra processing and may not support injection, and Proxmark3 targets RFID/NFC, not Zigbee.

Answer

RTL-SDR

Answer

Proxmark3

Answer

HackRF One

Question 13

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

30 minute time limit — choose an answer to begin.

Accepted Answer

DNP3 Secure Authentication is not enabled. DNP3 Secure Authentication, when enabled and properly configured, uses cryptographic challenges to authenticate critical messages such as responses. Without it, an attacker can spoof responses to the master station. The scenario indicates that the master does not authenticate responses, which directly points to Secure Authentication being disabled or misconfigured. Thus, the lack of this feature is the weakness being exploited.

Answer

DNP3 Secure Authentication

Answer

DNP3 Link Layer Confirmation

Answer

DNP3 Unsolicited Responses

Question 14

A penetration tester is assessing an industrial MQTT broker that requires client authentication but lacks Access Control Lists (ACLs). The tester successfully connects using valid credentials. Which attack technique can the tester leverage to perform denial-of-service against sensitive actuator topics?

30 minute time limit — choose an answer to begin.

Accepted Answer

ARP spoofing to redirect traffic through the tester's laptop, then modify the PROFINET RT frames in transit.. PROFINET RT communication is unencrypted and lacks authentication, making it susceptible to man-in-the-middle attacks. ARP spoofing can position the tester between the PLC and I/O device, allowing interception and modification of frames. While PROFINET RT is Layer 2, ARP spoofing can still disrupt and redirect traffic in many flat networks. Other options either cause network-wide disruption, require specific vulnerabilities, or are not designed for stealthy manipulation.

Answer

Exploiting a vulnerability in the PROFINET stack to inject crafted RT frames directly into the network.

Answer

Using a PROFINET engineering tool to change the I/O module's configuration and redirect its output to a malicious device.

Answer

MAC flooding the switch to force it into fail-open mode, then capture and modify PROFINET RT frames.

Question 15

A penetration tester is analyzing the firmware of an IoT device that uses a lightweight publish-subscribe protocol for communication. The tester extracts the firmware and finds a configuration file containing a hardcoded username and password for the MQTT broker. The broker is configured to allow anonymous access. Which of the following is the most direct way for the tester to leverage this finding to intercept and manipulate MQTT messages?

Accepted Answer

Use the hardcoded credentials to log into the MQTT broker and subscribe to all topics using a wildcard, then publish malicious messages.. With hardcoded MQTT broker credentials and anonymous access enabled, the tester can directly authenticate to the broker, subscribe to all topics using a wildcard to intercept messages, and publish malicious messages to manipulate the system. This leverages the discovered credentials in the most direct manner. Other methods like MITM or exploiting vulnerabilities are less direct and not necessary given the accessible broker.

Answer

Perform a man-in-the-middle attack between the device and the broker by ARP spoofing, then modify MQTT packets in transit.

Answer

Exploit a known vulnerability in the MQTT broker software to gain remote code execution, then use that to read all messages.

Answer

Use the hardcoded credentials to access the device's web interface and change the MQTT broker settings to redirect messages to a rogue broker.

Question 16

A penetration tester is evaluating the security of a building automation system that uses BACnet for communication. The tester wants to enumerate BACnet devices and objects on the network to identify potential points of manipulation. Which of the following tools is specifically designed for BACnet discovery and interaction?

Accepted Answer

BACnet Protocol Test Tool (VTS). The BACnet Protocol Test Tool (VTS) is a specialized application for BACnet testing. It supports device discovery, object enumeration, and property read/write operations, which are essential for identifying manipulation points in a building automation system. Nmap and Wireshark are limited to information gathering or passive analysis, and Scapy requires manual packet crafting without dedicated BACnet features.

Answer

Nmap with the bacnet-info script

Answer

Scapy with BACnet layer

Answer

Wireshark with the BACnet dissector

Question 17

A CPENT tester is assessing an industrial control system that uses PROFINET for communication between a Siemens S7-1200 PLC and remote I/O devices. The tester has network access to the control VLAN and wants to capture and analyze PROFINET RT (Real-Time) frames to understand the process data exchanged. Which Wireshark display filter will correctly isolate PROFINET RT frames?

Accepted Answer

pn_rt. In PROFINET, real-time cyclic data is transported using the RT protocol, which Wireshark dissects as 'pn_rt'. This filter allows the tester to focus on the process data exchanged between the PLC and remote I/O, which is essential for understanding the control logic and potential attack vectors. Other PROFINET protocols like DCP or PTCP serve different purposes and would not provide the same insight.

Answer

profinet

Answer

pn_dcp

Answer

eth.type == 0x8892

Question 18

During a penetration test of a Modbus/TCP-based OT network, a CPENT tester wants to demonstrate the impact of unauthorized coil manipulation. The tester has identified a Modbus server at 192.168.1.10 and needs to write to coils to simulate opening a valve. Which TWO of the following actions are required to successfully write to a Modbus coil using the Metasploit Framework? (Choose two.)

Accepted Answer

Set the DATA_ADDRESS to the coil number and DATA to 1 to open the valve.. To write to a Modbus coil using Metasploit, the tester must use the auxiliary/scanner/scada/modbusclient module, set ACTION to WRITE_COIL, and specify the coil address and value via DATA_ADDRESS and DATA. These steps ensure the correct Modbus function code (5) is sent to the target. Other options either reference non-existent modules or incorrect options that are not part of the module's interface.

Answer

Use the exploit/windows/scada/modbus_write_coil module to send a crafted packet.

Answer

Set the RHOSTS to the Modbus server IP and RPORT to 502.

Answer

Set the MODBUS_FUNCTION_CODE to 5 for write single coil.

Question 19

A CPENT tester is assessing an IoT deployment of IP cameras and smart sensors on a corporate network. The tester wants to identify weaknesses in how the devices are discovered and managed. Which TWO of the following techniques are MOST relevant for enumerating these IoT devices and their services? (Choose two.)

Accepted Answer

Query mDNS for _services._dns-sd._udp.local to enumerate advertised services on the local segment.. SSDP M-SEARCH and mDNS service discovery are the two techniques that directly enumerate UPnP- and zero-configuration-advertised IoT devices and their services on a local network. SNMP walks target different device classes, while Kerberos and BGP attacks are unrelated protocols that do not enumerate IoT endpoints.

Answer

Execute a BGP route hijack to redirect IoT management traffic through the tester's workstation for inspection.

Answer

Run a Kerberos AS-REP roasting attack against the IoT devices to extract service account hashes.

Answer

Perform an SNMP walk using the public community string against each IoT device to dump its full management information base.

Question 20

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

Accepted Answer

setenv bootargs ${bootargs} init=/bin/sh. U-Boot uses environment variables to define boot parameters. Appending 'init=/bin/sh' or 'init=/bin/bash' to the 'bootargs' variable forces the kernel to launch a shell instead of the standard init process.

Answer

tftp 0x80000000 kernel.bin

Answer

printenv mtdparts

Answer

run flash_os_image