CPENT Multiple Select — 50 Questions

Question 1

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Accepted Answer

The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).. ESC3 involves a certificate template configured as an Enrollment Agent (containing the Certificate Request Agent EKU), allowing enrollment by low-privileged users, and permitting issuance of certificates on behalf of other users.

Answer

The CA requires Manager Approval for all issued certificates.

Answer

The domain functional level is set to Windows Server 2003.

Question 2

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Accepted Answer

The Active Directory domain functional level must be Windows Server 2012 or higher.. RBCD requires permission to modify msDS-AllowedToActOnBehalfOfOtherIdentity on the target object, control over a computer or user object to act as the delegating entity, and Active Directory running at Windows Server 2012 or higher functional level.

Answer

Domain controllers must have SMB signing disabled globally.

Answer

The KRBTGT account password must be reset twice to invalidate existing tickets.

Question 3

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service

Question 4

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). AS-REP Roasting targets accounts where Kerberos pre-authentication is disabled. Unprivileged users can query LDAP directly or use automated tools like Rubeus or PowerView to find these accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 5

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

Accepted Answer

Add a compromised or attacker-controlled user account to the privileged group using PowerView or net group. Having write access or GenericAll over a group allows an attacker to add a controlled user to that privileged group (e.g., via Add-DomainGroupMember) or modify the ACLs to grant themselves full control over the group object.

Answer

Execute a Kerberoasting attack against the Active Directory Web Services endpoint

Answer

Extract plaintext passwords from the Windows Registry SAM hive remotely using ping.exe

Answer

Force an immediate password reset of the krbtgt account via Group Policy Preferences

Question 6

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

Accepted Answer

Storing application secrets and database connection strings in plaintext within Azure App Service configuration settings.. Over-privileged sync accounts, storing secrets in plaintext, and unmitigated PHS/PTA risks are major hybrid threats.

Answer

Enforcing Azure AD Conditional Access policies requiring compliant devices for access.

Answer

Using Azure Key Vault with managed hardware security modules (HSMs) for cryptographic keys.

Answer

Configuring Azure Bastion for secure administrative RDP and SSH connectivity.

Question 7

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Accepted Answer

An Amazon S3 bucket configured with ACLs allowing public read and write access.. Public read permissions and disabled encryption at rest are critical storage security findings.

Answer

An Azure Storage Account with 'Secure transfer required' set to Enabled.

Answer

Enabling versioning and object lock on financial data storage buckets.

Answer

Enabling AWS S3 Block Public Access at the account level.

Question 8

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Accepted Answer

Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host. Kerberos delegation vulnerabilities include Unconstrained Delegation (allowing arbitrary service requests), Constrained Delegation with Protocol Transition (S4U2Self/S4U2Proxy abuse), and Resource-Based Constrained Delegation (RBCD).

Answer

Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords

Answer

Automatic workstation registration limits set to allow zero new domain-joined machines

Question 9

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Accepted Answer

A security group allowing inbound TCP port 3389 (RDP) from 0.0.0.0/0.. Exposing management ports like SSH (22) and RDP (3389) to 0.0.0.0/0 is a critical security risk.

Answer

Enabling AWS Shield Advanced for DDoS protection on Application Load Balancers.

Answer

Using AWS PrivateLink to connect securely to VPC endpoint services.

Answer

A VPC Flow Log enabled and streaming traffic data to an encrypted S3 bucket.

Question 10

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Accepted Answer

Abusing misconfigured OpenID Connect (OIDC) federation trust settings between GitHub Actions and AWS IAM roles to assume roles without proper repository conditions.. SSRF targeting IMDS, unauthenticated API gateway endpoints, and misconfigured OIDC/service principal trust paths are core hybrid/cloud attack vectors.

Answer

Enabling AWS CloudTrail and guarding log files with immutable S3 Object Lock policies.

Answer

Configuring VPC peering with bi-directional network ACL restrictions.

Answer

Enforcing strict Azure AD Conditional Access policies based on device compliance and location.

Question 11

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Accepted Answer

Exposing the Kubernetes API server endpoint directly to the public internet (0.0.0.0/0) without IP whitelisting or robust authentication.. Granting cluster-admin via ClusterRoleBinding to default service accounts and exposing the API server publicly without auth are severe risks.

Answer

Enabling Pod Security Standards (e.g., Restricted profile) across all namespaces.

Answer

Using network policies to isolate sensitive database pods from frontend web pods.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) across all API groups.

Question 12

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.

Question 13

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

Accepted Answer

Exposing the Kubernetes etcd database port (2379) directly to the public internet without mutual TLS authentication.. Shared secrets in configmaps, unauthenticated etcd, and weak webhook configurations are critical flaws.

Answer

Enabling TLS encryption for all intra-pod and kubelet communications.

Answer

Enabling Kubernetes audit logs and exporting them to a secure SIEM platform.

Answer

Using RBAC authorization mode with narrowly scoped roles for all cluster service accounts.

Question 14

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Accepted Answer

SPI (Serial Peripheral Interface) flash memory pins. Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Answer

HDMI display output pins used for high-speed video graphics rendering

Answer

RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

Question 15

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Accepted Answer

KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4). KillerBee and Universal Radio Hacker (URH) or Wireshark with appropriate hardware dongles (like CC2531) are standard toolsets for Zigbee and 802.15.4 assessments.

Answer

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Answer

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Answer

Burp Suite Professional for intercepting HTTP requests from web applications

Question 16

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

Accepted Answer

Assigning the Owner role to external guest users at the root management group level without justification.. Assigning Owner/Contributor at the subscription root and leaving storage account access keys unrotated are major risks.

Answer

Enabling Azure Defender for SQL on all Azure SQL databases.

Answer

Configuring Azure Monitor alerts for failed sign-in attempts.

Answer

Enabling soft-delete and purge protection on Azure Key Vaults.

Question 17

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Disabling audit logging and storing static administrative keys in code repositories are critical security deficiencies.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 18

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Accepted Answer

Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing. BLE implementations frequently suffer from lack of encryption/pairing authentication, insecure GATT characteristic permissions allowing arbitrary reads/writes, and predictable static pairing PINs.

Answer

Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

Answer

Injecting malicious SQL statements into the BLE radio frequency advertising packets

Answer

Performing an ARP cache poisoning attack against the target device's switch port

Question 19

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Accepted Answer

Running the wafw00f enumeration tool. Sending anomalous HTTP requests or triggering typical attack signatures (like WAF-testing tools such as wafw00f) and observing unique block pages or headers are standard WAF detection techniques.

Answer

Reviewing local ARP cache tables

Answer

Performing a standard ICMP ping sweep

Answer

Running a DNS zone transfer (AXFR) query

Question 20

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

Accepted Answer

Utilizing the Security 2 (S2) framework featuring Elliptic Curve Diffie-Hellman (ECDH) key exchange. Z-Wave operates on sub-GHz frequencies (avoiding 2.4 GHz congestion) and incorporates S2 (Security 2) framework using ECDH for secure key exchange.

Answer

Relying on standard IEEE 802.11 physical layer framing and MAC headers

Answer

Requiring all participating nodes to maintain an active BGP routing table with upstream Internet routers

Answer

Operating natively on the 5 GHz Wi-Fi frequency band with WPA3-Enterprise authentication