CPENT Network And Perimeter Exploitation — All Questions With Answers

Read the full Network And Perimeter Exploitation explanation →

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Question 3easymultiple choice

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Question 4mediummultiple choice

Study the full Python automation breakdown →

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Question 5hardmultiple choice

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Question 6mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Question 7easymulti select

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Question 8mediummulti select

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

Question 9hardmulti select

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?

Question 10hardmultiple choice

A penetration tester has compromised a Windows host inside a segmented network. The tester wants to reach a server on a different VLAN that is not directly routable from the compromised host but is accessible from a domain controller that the host can communicate with. Which technique best allows the tester to access the target server's SMB service through the domain controller?

Question 11mediummultiple choice

During an internal penetration test, you gain access to a Windows Server 2019 host that has SMB signing disabled. You want to capture NetNTLMv2 challenge-response hashes from other hosts on the same subnet without relying on a user opening a file. Which technique should you use?

Question 12mediummultiple choice

During a perimeter penetration test, you discover that the target organization's Cisco ASA firewall allows outbound DNS (UDP/53) to any external resolver. You want to establish a covert bidirectional command-and-control channel that survives NAT and is difficult for the firewall's application inspection to distinguish from legitimate traffic. Which technique best fits this requirement?

Question 13mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is performing an external network assessment and discovers a Cisco router with SNMP enabled. The tester wants to extract the running configuration to identify potential weaknesses. Which SNMP operation and community string combination is most likely to succeed if the device uses default settings?

Question 14easymultiple choice

You are performing a penetration test against a network that uses 802.1X authentication for wired ports. You have physical access to an unoccupied office and want to bypass port-based authentication to gain network access. Which technique should you use?

Question 15mediummulti select

Read the full Network And Perimeter Exploitation explanation →

You are performing a penetration test against a network protected by a stateful firewall that only allows outbound TCP port 443. You have compromised an internal Windows host and need to establish a covert channel to exfiltrate data to your external server. Which TWO methods would allow you to tunnel data out through the firewall? (Choose two.)

Question 16hardmulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is attempting to bypass a network intrusion prevention system (IPS) that inspects traffic for known attack signatures. The tester wants to deliver a malicious payload to a target web server without triggering the IPS. Which two techniques are most effective for evading signature-based IPS detection? (Choose two.)

Question 17mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are conducting a penetration test against a network with a Cisco router that has SNMP enabled with the default read-only community string 'public'. You want to extract the router's running configuration. Which tool or technique should you use?

Question 18mediummulti select

A penetration tester is assessing a perimeter firewall and wants to identify open ports and services without triggering alerts. The tester decides to use Nmap with various scan techniques. Which two Nmap scan types are most likely to bypass simple packet-filtering devices that only block SYN packets? (Choose two.)

Question 19mediummultiple choice

During an external perimeter assessment, you identify a Cisco IOS router with SNMP enabled. You want to enumerate its routing table and interface details without triggering an alert. Which SNMP operation and community string should you use to efficiently extract this information?

Question 20hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

You have compromised a Linux host in a DMZ and need to pivot into the internal network. The host has two network interfaces: eth0 (public) and eth1 (internal). You want to use the compromised host as a router to forward traffic from your attack machine to internal targets. Which command should you run on the compromised host to enable IP forwarding?

Question 21mediummulti select

During a penetration test against a perimeter network, you identify a Cisco ASA firewall. You want to enumerate its configuration and potentially find vulnerabilities. Which two actions are most effective for gathering information about the firewall? (Choose two.)

Question 22easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Question 23mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Question 24hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Question 25easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Question 26mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Question 27hardmultiple choice

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

Question 28easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Question 29mediummultiple choice

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

Question 30easymultiple choice

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

Question 31hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

Question 32hardmultiple choice

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

Question 33easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

Question 34hardmultiple choice

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

Question 35mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Question 36easymultiple choice

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

Question 37mediummultiple choice

Study the full IPv6 explanation →

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

Question 38easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

Question 39mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Question 40hardmultiple choice

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Question 41easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

Question 42easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

Question 43mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

Question 44hardmultiple choice

Read the full wireless explanation →

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Question 45hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Question 46easymultiple choice

Read the full VRF explanation →

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

Question 47mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Question 48easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

Question 49mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

Question 50hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Question 51easymulti select

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

Question 52mediummulti select

Read the full Network And Perimeter Exploitation explanation →

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

Question 53mediummulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

Question 54hardmulti select

Read the full Network And Perimeter Exploitation explanation →

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

Question 55hardmulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

Question 56mediummulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Question 57easymulti select

Read the full Network And Perimeter Exploitation explanation →

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Question 58hardmulti select

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

Question 59easymulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Question 60hardmulti select

Read the full Network And Perimeter Exploitation explanation →

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

Question 61mediummulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is evaluating network security controls and wants to check for insecure or plaintext authentication protocols in use across the network. Which TWO protocols transmit credentials or session tokens in cleartext and can be easily sniffed? (Choose TWO)

Question 62mediummulti select

Read the full DHCP explanation →

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

Question 63mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

Question 64mediummultiple choice

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Question 65easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

Question 66hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

Question 67hardmulti select

Read the full Network And Perimeter Exploitation explanation →

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Question 68hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

Question 69mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

Question 70easymultiple choice

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

Question 71hardmulti select

Read the full Network And Perimeter Exploitation explanation →

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

Question 72mediummultiple choice

Study the full ACL explanation →

During an internal engagement, a penetration tester gains access to a Linux host that has multiple network interfaces. The tester needs to determine which interface can route to the 10.10.10.0/24 subnet and what the next-hop gateway is. Which command provides this information most directly?

Question 73hardmultiple choice

You are conducting an external penetration test against a company that uses a Cisco ASA firewall. You have identified that the firewall is running an older firmware version. Which technique would best allow you to bypass the firewall's access control lists to reach an internal web server on port 80?

Question 74hardmulti select

Read the full Network And Perimeter Exploitation explanation →

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

Question 75mediummultiple choice

You have compromised a dual-homed Linux host that sits between a DMZ and an internal network. From this host you need to reach internal web servers on TCP/8080 that are not routable from your attack machine, and you want to route all your tooling traffic through the pivot using SOCKS. Which approach correctly establishes the pivot?

Question 76easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A client asks you to verify that their perimeter router does not leak internal topology information to the internet. You want to send crafted probe packets with varying TTL values and observe the ICMP responses to map the path and infer router interfaces. Which technique should you use?

Question 77hardmultiple choice

During an external engagement, you find that the target's edge device responds to IKE on UDP/500 and appears to accept aggressive-mode Phase 1 proposals. You want to determine whether a pre-shared key can be recovered offline so you can impersonate a peer. Which approach is most appropriate?

Question 78hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal penetration test, you compromise a Windows host that sits on a management VLAN. The network is segmented, and the host has two interfaces: one on the management VLAN (10.10.10.0/24) and one on the corporate VLAN (192.168.1.0/24). You want to reach a database server at 172.16.5.20 on a third VLAN, but your compromised host has no route to that subnet. You have administrative privileges on the compromised host. Which of the following is the most reliable technique to pivot to the 172.16.5.0/24 network?

Question 79easymultiple choice

During a perimeter penetration test, you need to identify live hosts on a target network without performing a full port scan. You have no prior knowledge of the network and want to minimize the chance of triggering intrusion detection systems. Which Nmap command is best suited for this task?

Question 80hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are conducting an external penetration test against a company's web server. You discover that the server is vulnerable to a buffer overflow in a custom CGI script. You want to exploit it to gain a reverse shell. Which Metasploit payload should you use to establish a Meterpreter session?

Question 1hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Question 2mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Question 3easymultiple choice

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Question 4mediummultiple choice

Study the full Python automation breakdown →

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Question 5hardmultiple choice

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Question 6mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Question 7easymulti select

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Question 8mediummulti select

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

Question 9hardmulti select

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?

Question 10hardmultiple choice

A penetration tester has compromised a Windows host inside a segmented network. The tester wants to reach a server on a different VLAN that is not directly routable from the compromised host but is accessible from a domain controller that the host can communicate with. Which technique best allows the tester to access the target server's SMB service through the domain controller?

Question 11mediummultiple choice

During an internal penetration test, you gain access to a Windows Server 2019 host that has SMB signing disabled. You want to capture NetNTLMv2 challenge-response hashes from other hosts on the same subnet without relying on a user opening a file. Which technique should you use?

Question 12mediummultiple choice

During a perimeter penetration test, you discover that the target organization's Cisco ASA firewall allows outbound DNS (UDP/53) to any external resolver. You want to establish a covert bidirectional command-and-control channel that survives NAT and is difficult for the firewall's application inspection to distinguish from legitimate traffic. Which technique best fits this requirement?

Question 13mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is performing an external network assessment and discovers a Cisco router with SNMP enabled. The tester wants to extract the running configuration to identify potential weaknesses. Which SNMP operation and community string combination is most likely to succeed if the device uses default settings?

Question 14easymultiple choice

You are performing a penetration test against a network that uses 802.1X authentication for wired ports. You have physical access to an unoccupied office and want to bypass port-based authentication to gain network access. Which technique should you use?

Question 15mediummulti select

Read the full Network And Perimeter Exploitation explanation →

You are performing a penetration test against a network protected by a stateful firewall that only allows outbound TCP port 443. You have compromised an internal Windows host and need to establish a covert channel to exfiltrate data to your external server. Which TWO methods would allow you to tunnel data out through the firewall? (Choose two.)

Question 16hardmulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is attempting to bypass a network intrusion prevention system (IPS) that inspects traffic for known attack signatures. The tester wants to deliver a malicious payload to a target web server without triggering the IPS. Which two techniques are most effective for evading signature-based IPS detection? (Choose two.)

Question 17mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are conducting a penetration test against a network with a Cisco router that has SNMP enabled with the default read-only community string 'public'. You want to extract the router's running configuration. Which tool or technique should you use?

Question 18mediummulti select

A penetration tester is assessing a perimeter firewall and wants to identify open ports and services without triggering alerts. The tester decides to use Nmap with various scan techniques. Which two Nmap scan types are most likely to bypass simple packet-filtering devices that only block SYN packets? (Choose two.)

Question 19mediummultiple choice

During an external perimeter assessment, you identify a Cisco IOS router with SNMP enabled. You want to enumerate its routing table and interface details without triggering an alert. Which SNMP operation and community string should you use to efficiently extract this information?

Question 20hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

You have compromised a Linux host in a DMZ and need to pivot into the internal network. The host has two network interfaces: eth0 (public) and eth1 (internal). You want to use the compromised host as a router to forward traffic from your attack machine to internal targets. Which command should you run on the compromised host to enable IP forwarding?

Question 21mediummulti select

During a penetration test against a perimeter network, you identify a Cisco ASA firewall. You want to enumerate its configuration and potentially find vulnerabilities. Which two actions are most effective for gathering information about the firewall? (Choose two.)

Question 22easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Question 23mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Question 24hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Question 25easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Question 26mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Question 27hardmultiple choice

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

Question 28easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Question 29mediummultiple choice

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

Question 30easymultiple choice

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

Question 31hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

Question 32hardmultiple choice

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

Question 33easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

Question 34hardmultiple choice

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

Question 35mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Question 36easymultiple choice

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

Question 37mediummultiple choice

Study the full IPv6 explanation →

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

Question 38easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

Question 39mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Question 40hardmultiple choice

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Question 41easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

Question 42easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

Question 43mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

Question 44hardmultiple choice

Read the full wireless explanation →

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Question 45hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Question 46easymultiple choice

Read the full VRF explanation →

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

Question 47mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Question 48easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

Question 49mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

Question 50hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Question 51easymulti select

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

Question 52mediummulti select

Read the full Network And Perimeter Exploitation explanation →

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

Question 53mediummulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

Question 54hardmulti select

Read the full Network And Perimeter Exploitation explanation →

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

Question 55hardmulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

Question 56mediummulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Question 57easymulti select

Read the full Network And Perimeter Exploitation explanation →

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Question 58hardmulti select

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

Question 59easymulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Question 60hardmulti select

Read the full Network And Perimeter Exploitation explanation →

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

Question 61mediummulti select

Read the full Network And Perimeter Exploitation explanation →

A penetration tester is evaluating network security controls and wants to check for insecure or plaintext authentication protocols in use across the network. Which TWO protocols transmit credentials or session tokens in cleartext and can be easily sniffed? (Choose TWO)

Question 62mediummulti select

Read the full DHCP explanation →

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

Question 63mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

Question 64mediummultiple choice

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Question 65easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

Question 66hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

Question 67hardmulti select

Read the full Network And Perimeter Exploitation explanation →

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Question 68hardmultiple choice

Read the full Network And Perimeter Exploitation explanation →

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

Question 69mediummultiple choice

Read the full Network And Perimeter Exploitation explanation →

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

Question 70easymultiple choice

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

Question 71hardmulti select

Read the full Network And Perimeter Exploitation explanation →

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

Question 72mediummultiple choice

Study the full ACL explanation →

During an internal engagement, a penetration tester gains access to a Linux host that has multiple network interfaces. The tester needs to determine which interface can route to the 10.10.10.0/24 subnet and what the next-hop gateway is. Which command provides this information most directly?

Question 73hardmultiple choice

You are conducting an external penetration test against a company that uses a Cisco ASA firewall. You have identified that the firewall is running an older firmware version. Which technique would best allow you to bypass the firewall's access control lists to reach an internal web server on port 80?

Question 74hardmulti select

Read the full Network And Perimeter Exploitation explanation →

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

Question 75mediummultiple choice

You have compromised a dual-homed Linux host that sits between a DMZ and an internal network. From this host you need to reach internal web servers on TCP/8080 that are not routable from your attack machine, and you want to route all your tooling traffic through the pivot using SOCKS. Which approach correctly establishes the pivot?

Question 76easymultiple choice

Read the full Network And Perimeter Exploitation explanation →

A client asks you to verify that their perimeter router does not leak internal topology information to the internet. You want to send crafted probe packets with varying TTL values and observe the ICMP responses to map the path and infer router interfaces. Which technique should you use?

Question 77hardmultiple choice

During an external engagement, you find that the target's edge device responds to IKE on UDP/500 and appears to accept aggressive-mode Phase 1 proposals. You want to determine whether a pre-shared key can be recovered offline so you can impersonate a peer. Which approach is most appropriate?

Question 78hardmultiple choice