CPENT Multiple Select — 40 Questions

Question 1

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Option B is correct because hardcoding cloud provider API access keys into public source code repositories exposes long-lived credentials to anyone who can view the repo, enabling unauthorized API calls, resource creation, and data exfiltration; secrets should instead be stored in a secrets manager or KMS-backed vault and injected at runtime. Option D is correct because disabling centralized audit logging such as AWS CloudTrail or Azure Activity Logs destroys the tamper-evident record of control-plane and data-plane activity, eliminating detection, forensic investigation, and compliance evidence, which is a critical monitoring deficiency regardless of storage cost savings. The unmarked options do not belong: A is a sound detection practice that surfaces anomalous resource creation, C is a recommended key-management practice using cloud-native KMS with automatic rotation, and E is a foundational IAM control that reduces blast radius by enforcing least privilege.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 2

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect. Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Answer

arp -a

Answer

uname -r

Question 3

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. Option B is correct because MQTT brokers rely on ACLs to authorize which clients may publish or subscribe to specific topics, and a tester should verify that these restrictions are actually enforced to prevent unauthorized topic access. Option D is correct because many brokers ship with anonymous access enabled by default, so confirming whether unauthenticated clients can connect is a fundamental MQTT hardening check. Option E is correct because MQTT traffic is frequently deployed in cleartext on TCP port 1883, and verifying that TLS is used (typically on port 8883) ensures confidentiality and integrity of the smart home communications. Option A does not belong because Modbus/TCP function code 0x10 (Write Multiple Registers) is an industrial control protocol unrelated to MQTT broker configuration. Option C does not belong because an 802.11 deauthentication flood is a wireless-layer denial-of-service attack against Wi-Fi clients, not a broker security configuration check.

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 4

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). Option C is correct because Rubeus is a dedicated Kerberos attack toolkit, and its `asreproast` command specifically enumerates and extracts AS-REP hashes from accounts whose UserAccountControl flag does not have Kerberos preauthentication required (UF_DONT_REQUIRE_PREAUTH, 0x400000), which an unprivileged domain user can perform. Option E is correct because PowerView's `Get-DomainUser -PreauthNotRequired` queries Active Directory via LDAP for user objects with the DONT_REQUIRE_PREAUTH flag set, directly identifying AS-REP roasting candidates without elevated privileges. Option A is wrong because cleanmgr.exe is a disk cleanup utility with no AD enumeration capability. Option B is wrong because Mimikatz's `lsadump::dcsync` requires DCSync rights (typically Domain Admin or Replicating Directory Changes permissions), so it is not usable by an unprivileged domain user. Option D is wrong because secpol.msc edits local security policy on a single host and does not enumerate domain accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 5

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Option B is correct because mounting sensitive host directories such as '/' or '/proc' through a hostPath volume gives the container direct read/write access to host files, kernel interfaces, and process information, which an attacker can abuse to modify host binaries, read secrets, or escape the container boundary. Option C is correct because setting privileged: true disables most container isolation, grants all Linux capabilities, and removes seccomp/AppArmor restrictions, effectively giving the container root-level control over the host devices and kernel. Option D is correct because mounting /var/run/docker.sock exposes the Docker daemon API to the container, allowing an attacker to create a new privileged container that mounts the host filesystem and thereby compromise the node. Option A is not a risk but a hardening practice, since running as a non-root UID (USER 1000) reduces the impact of a compromise. Option E is also a security best practice, as RBAC with least-privilege bindings limits what identities can do in the cluster rather than enabling escapes.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 6

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Option A is correct because ESC8 abuses the HTTP-based web enrollment endpoints (certsrv) via NTLM relay, so disabling HTTP enrollment or enforcing HTTPS with Extended Protection for Authentication (EPA) and disabling NTLM on those endpoints blocks that relay vector. Option B is correct because continuous auditing of AD CS templates, CAs, and ACLs with tools like Certipy or BloodHound (e.g., Certipy's 'find' and 'template' checks) surfaces misconfigurations such as ESC1-ESC8 before attackers exploit them. Option E is correct because removing the ENROLLEE_SUPPLIES_SUBJECT flag prevents low-privileged enrollees from specifying an arbitrary subject/SAN (e.g., a domain admin UPN), which is the core of ESC1 template abuse. Option C is wrong because disabling Kerberos pre-authentication on domain controller computer accounts would weaken authentication and enable AS-REP roasting, not secure AD CS. Option D is wrong because enforcing unconstrained delegation on CA servers increases exposure to credential theft and relay/impersonation attacks rather than mitigating certificate abuse.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 7

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.

Question 8

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

Accepted Answer

Use CrackMapExec or NetExec with the smb-signing module to enumerate signing configuration across the subnet in a single sweep.. SMB signing enforcement is advertised in the SMB2 negotiate response, so hosts that report signing enabled but not required are relay candidates. Nmap's smb2-security-mode script and CrackMapExec/NetExec's smb-signing module both retrieve this data across a subnet and let you build a precise target list. Machine account quota and NetBIOS name queries expose unrelated information, and modifying the target is out of scope.

Answer

Query Active Directory for the ms-DS-MachineAccountQuota attribute on the domain object to determine which machines allow unsigned SMB.

Answer

Enable the LanmanServer service on each target and set the RequireSecuritySignature registry value to 0 before testing.

Answer

Perform a broadcast NetBIOS name query for each host to read the SMB signing flag from the node status response.

Question 9

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Accepted Answer

Running the wafw00f enumeration tool. Option B is correct because wafw00f is a purpose-built fingerprinting tool that sends a series of benign and malicious HTTP requests and analyzes response headers, cookies, and status codes to identify the specific WAF product (e.g., Cloudflare, ModSecurity, AWS WAF) protecting a web server. Option E is correct because sending known malicious payloads such as SQL injection strings or XSS vectors and observing characteristic block responses (e.g., HTTP 403, 406, or 999, or vendor-specific error pages) is a reliable behavioral technique to confirm a WAF is inspecting and filtering traffic. Option A is not relevant because ARP cache tables only reveal layer-2 MAC-to-IP mappings on the local segment and cannot indicate the presence of a WAF, which operates at the application layer. Option C is incorrect because an ICMP ping sweep only tests host reachability and is typically blocked or answered by the origin server regardless of any WAF. Option D is incorrect because a DNS AXFR zone transfer enumerates DNS records and, even if permitted, reveals nothing about whether an application-layer firewall sits in front of the web server.

Answer

Reviewing local ARP cache tables

Answer

Performing a standard ICMP ping sweep

Answer

Running a DNS zone transfer (AXFR) query

Question 10

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Accepted Answer

tasklist /svc. Option A (tasklist /svc) is correct because it enumerates running processes along with the services hosted in each process, revealing service accounts, potentially privileged processes, and unquoted service paths or vulnerable services that can be leveraged for escalation. Option C (whoami /priv) is correct because it lists the privileges assigned to the current token, such as SeImpersonatePrivilege, SeDebugPrivilege, or SeBackupPrivilege, which directly indicate escalation vectors like token impersonation or Potato-style attacks. Option D (systeminfo) is correct because it returns OS version, build number, hotfix level, and patch information, allowing an attacker to identify missing patches and known kernel or local privilege escalation exploits. Option B (dir /s /b config.php) is not a Windows local enumeration technique for privilege escalation—it targets a PHP configuration file and is more relevant to web application reconnaissance. Option E (netsh wlan show profiles) only reveals saved wireless network profiles and their SSIDs, which is useful for credential or network discovery but not for local privilege escalation.

Answer

dir /s /b config.php

Answer

netsh wlan show profiles

Question 11

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee (A) is correct because it is a Python-based framework specifically designed for sniffing, injecting, and exploiting Zigbee and IEEE 802.15.4 networks, making it a core tool for assessing smart lighting installations that use these protocols. Wireshark (C) is correct because, when supplied with the captured Zigbee network key, it can decrypt and dissect 802.15.4 application-layer traffic (e.g., Zigbee APS/ZCL payloads), which is essential for analyzing the security of the lighting network. Aircrack-ng (B) targets Wi-Fi WPA-PSK handshakes and is irrelevant to 802.15.4/Zigbee, Metasploit's msfvenom (D) generates Windows Meterpreter payloads for host/AD attacks rather than RF-layer Zigbee assessment, and Burp Suite (E) intercepts HTTP(S) web traffic, none of which apply to Zigbee wireless security testing.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 12

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Accepted Answer

smbclient -L //target-ip. Option A (smbclient -L //target-ip) is correct because smbclient is an SMB/CIFS client that, with the -L flag, lists the shares and their comments/type on a remote Windows host over TCP 445/139, directly satisfying the share-enumeration requirement. Option C (enum4linux -a target-ip) is correct because enum4linux is a wrapper around Samba tools (smbclient, rpcclient, net) that with -a performs all simple enumeration, including share listing and permission/ACL information via SMB and RPC. Option B (sqlmap -u target-url) is wrong because sqlmap automates SQL-injection testing against web applications, not SMB share enumeration. Option D (nmap --script http-enum) is wrong because http-enum enumerates web server directories and files over HTTP, not SMB shares. Option E (aircrack-ng target.cap) is wrong because aircrack-ng cracks Wi-Fi (WEP/WPA) keys from captured 802.11 frames, which is unrelated to SMB share querying.

Answer

sqlmap -u target-url

Answer

nmap --script http-enum

Answer

aircrack-ng target.cap

Question 13

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Accepted Answer

Wireshark. Wireshark (B) is correct because it is a protocol analyzer that captures live packets on an interface and includes dissectors that can parse authentication protocols such as HTTP Basic, FTP, Telnet, and Kerberos pre-authentication data, exposing credentials in cleartext or crackable form. Bettercap (D) is correct because it is a MITM framework with built-in ARP spoofing, sniffing, and credential-sniffing modules (e.g., net.sniff) that actively capture and parse credentials such as HTTP POST logins, FTP, and NTLM hashes from the wire. Tcpdump (E) is correct because it captures raw packets on the segment and, with the -A or -X flags, prints payload contents in ASCII/hex so cleartext credentials in protocols like FTP, Telnet, or HTTP can be read directly. John the Ripper (A) is a password-cracking tool that operates on captured hash files offline and does not capture or parse live network traffic, and Sqlmap (C) is a SQL injection exploitation tool that targets web application databases rather than sniffing credentials off a network segment.

Answer

John the Ripper

Answer

Sqlmap

Question 14

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

Accepted Answer

Deploy industrial Intrusion Detection Systems (IDS) tuned for OT protocol anomalies. Option B is correct because an industrial IDS tuned for OT protocol anomalies (e.g., Modbus, DNP3, IEC 61850) provides passive monitoring and detection of malicious or abnormal commands without requiring the legacy protocols to support encryption or authentication. Option C is correct because ISA/IEC 62443 zones and conduits segmentation limits lateral movement and restricts access to SCADA devices, effectively compensating for the lack of native security in the protocols. Option D is correct because industrial firewalls with SCADA-aware Deep Packet Inspection can enforce protocol-level allowlisting and filter malformed or unauthorized function codes (e.g., Modbus write commands) that legacy protocols cannot authenticate. Option A is incorrect because disabling all TCP/UDP ports would break the SCADA network's required communications and is not a viable compensating control. Option E is incorrect because PLCs typically run real-time operating systems that cannot host traditional endpoint antivirus, and such software is not designed for OT environments.

Answer

Disable all TCP and UDP ports on the SCADA network switches

Answer

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Question 15

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Accepted Answer

Application layer function codes specifying operations like Read, Write, Select, and Operate. Option A is correct because DNP3's application layer defines function codes such as Read (1), Write (2), Select (3), Operate (4), and Direct Operate (5), which are used to request data and control outstations in SCADA/ICS environments. Option C is correct because DNP3's data link layer frames include a CRC checksum in each data block (and header) to detect transmission errors, providing integrity at the link layer. Option E is correct because DNP3 Secure Authentication (SAv2/v5, defined in IEEE 1815) adds challenge-response authentication using HMAC to prevent unauthorized command injection, spoofing, and replay attacks. Option B is incorrect because the WPA2 four-way handshake belongs to IEEE 802.11 wireless LAN security, not DNP3, which is a serial/TCP-IP SCADA protocol. Option D is incorrect because HTTP Bearer tokens are used for REST API authentication over HTTP, which is unrelated to the DNP3 protocol structure.

Answer

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Answer

HTTP Authorization Bearer tokens used for REST API authentication

Question 16

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Option B is correct because assigning the Owner role to external guest users at the root management group level grants them full control over every subscription and resource in the tenant, violating least-privilege and creating a severe privilege-escalation and data-exfiltration risk. Option E is correct because long-lived, unchanged storage account access keys with broad data access effectively act as permanent shared secrets; if leaked, they allow full access to the storage account's data, and key rotation is a core configuration best practice. Option A is not a risk but a recommended defense, since Azure Defender for SQL provides threat detection and vulnerability assessment for Azure SQL databases. Option C is not a risk because Azure Monitor alerts on failed sign-in attempts improve detection of brute-force or credential-stuffing activity. Option D is not a risk because soft-delete and purge protection on Azure Key Vaults are recommended safeguards that prevent accidental or malicious permanent deletion of secrets, keys, and certificates.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 17

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Accepted Answer

ARP ping discovery (-PR). Option D, ARP ping discovery (-PR), is correct because Nmap's ARP scan operates at the data link/network layer by broadcasting ARP requests ("who has this IP?") and identifying live hosts from ARP replies, without generating any TCP or UDP port traffic, making it fast and quiet on a local subnet. Option E, ICMP Echo request ping (-PE), is correct because it uses the network-layer ICMP protocol (type 8 Echo Request, expecting type 0 Echo Reply) to determine host liveness, again without sending TCP or UDP port probes. Option A, TCP Connect scan (-sT), is wrong because it completes full TCP three-way handshakes to target ports, which is exactly the TCP port traffic the tester must avoid. Option B, TCP SYN port scan (-sS), is wrong because it sends TCP SYN packets to ports (half-open scanning), still TCP port traffic. Option C, UDP port scan (-sU), is wrong because it sends UDP datagrams to target ports, which is UDP port traffic and also slow and noisy.

Answer

TCP Connect scan (-sT)

Answer

TCP SYN port scan (-sS)

Answer

UDP port scan (-sU)

Question 18

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

Accepted Answer

Using the -D option to launch a decoy scan with multiple fake source IP addresses. Option B is correct because Nmap's -D (decoy) option injects multiple spoofed source IP addresses into the scan, so packet inspection filters and IDS/IPS sensors see traffic from many apparent senders and cannot easily attribute or block the real scanning host. Option E is correct because --source-port (or -g) sets the TCP/UDP source port to a chosen value such as 53 (DNS) or 20 (FTP-data), which can slip past poorly written firewall or ACL rules that trust traffic originating from those well-known ports. Option A is not an evasion technique; -p- simply expands the port range to all 65,535 TCP ports and affects coverage, not header or timing manipulation. Option C is not an evasion feature; --script runs NSE scripts for discovery or vulnerability detection against open ports. Option D is not an evasion feature; -oA only writes scan output in normal, XML, and Grepable formats for reporting.

Answer

Using the -p- option to scan all 65,535 TCP ports on the target host

Answer

Using the --script option to execute NSE vulnerability scripts against open ports

Answer

Using the -oA option to output scan results simultaneously in normal, XML, and Grepable formats

Question 19

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Accepted Answer

nmap --script smb2-security-mode -p 445 <target_ip>. Option C is correct because the Nmap NSE script smb2-security-mode queries SMB2 on port 445 and reports the message signing configuration, explicitly showing whether signing is required or not, which directly identifies hosts vulnerable to NTLM relay. Option E is correct because CrackMapExec/NetExec's smb module enumerates SMB hosts across a subnet and reports signing status (e.g., 'signing:False') in its output, making it ideal for quickly sweeping an internal range. Option A (tracert) only maps the network path to a target via ICMP TTL expiry and reveals nothing about SMB configuration. Option B (ping -t) merely sends continuous ICMP echo requests to test reachability and cannot detect SMB signing. Option D (nslookup -type=mx) queries DNS mail exchanger records and is unrelated to SMB security settings.

Answer

tracert <target_ip>

Answer

ping -t <target_ip>

Answer

nslookup -type=mx <domain>

Question 20

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

Accepted Answer

Disabling multi-factor authentication requirements for global administrator accounts during emergency maintenance windows.. Option A is correct because disabling multi-factor authentication for global administrator accounts—even temporarily during emergency maintenance—removes the strongest protection on the most privileged identities, exposing the tenant to credential-stuffing, phishing, and token-replay attacks that MFA would otherwise block. Option D is correct because non-expiring service account passwords combined with interactive logon rights create long-lived, human-usable credentials that violate least privilege and the separation of service and interactive accounts, making lateral movement and credential theft far easier. Option B is not an insecure practice: strong password complexity and expiration policies are standard hardening controls for cloud user accounts. Option C is not insecure: Microsoft Entra ID Protection is a defensive tool that detects compromised credentials and risky sign-ins. Option E is not insecure: Azure managed identities eliminate hardcoded credentials by issuing tokens through the platform, which is a recommended secure practice.

Answer

Enforcing strong password complexity and expiration policies for all cloud user accounts.

Answer

Implementing Microsoft Entra ID Protection to detect compromised credentials and risky sign-ins.

Answer

Utilizing Azure AD managed identities for Azure resources instead of hardcoded credentials.