CPENT Network And Perimeter Exploitation Practice Test 2 — 15 Questions

Question 1

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--data-length. The --data-length option tells Nmap to append a random number of bytes to the sent packets, altering their length signature and evading simple signature-based Nmap detection rules.

Answer

--mtu

Answer

--badsum

Answer

-f

Question 2

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

Accepted Answer

Netcat. Netcat or Nmap service version detection can grab banners. Netcat allows manual connection to port 21 to view the greeting banner.

Answer

Wpscan

Answer

Hashcat

Answer

Airbase-ng

Question 3

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

Accepted Answer

ssh -L 3306:10.0.0.50:3306 user@pivot_ip. ssh -L local_port:target_ip:target_port user@pivot_host establishes local port forwarding. Thus, ssh -L 3306:10.0.0.50:3306 user@pivot_ip is correct.

Answer

ssh -D 3306 user@pivot_ip

Answer

ssh -C -N user@pivot_ip

Answer

ssh -R 3306:10.0.0.50:3306 user@pivot_ip

Question 4

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Accepted Answer

Snmpwalk. Snmpwalk is a standard command-line utility used to query SNMP agents and walk the MIB tree to extract system information.

Answer

Rpcinfo

Answer

Smbclient

Answer

NFSstat

Question 5

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

Accepted Answer

TheHarvester. TheHarvester is a popular tool designed to gather emails, subdomains, and names from public sources like search engines and PGP key servers.

Answer

Metasploit

Answer

Wireshark

Answer

Burp Suite

Question 6

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

Accepted Answer

IPv6 RA Guard. IPv6 Neighbor Discovery Inspection (ND Inspection) or RA Guard is a layer 2 security feature on switches that validates IPv6 neighbor discovery messages, similar to DHCP snooping for IPv4.

Answer

Dynamic ARP Inspection (DAI)

Answer

DHCP Snooping

Answer

Port Security

Question 7

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

Accepted Answer

smb-vuln-ms17-010. smb-vuln-ms17-010 is the specific NSE script designed to safely check for the EternalBlue vulnerability.

Answer

smb-brute

Answer

smb-enum-shares

Answer

smb-os-discovery

Question 8

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Accepted Answer

--unprivileged. The --unprivileged flag tells Nmap to assume the user lacks raw socket privileges, forcing Nmap to use connect() system calls instead of raw packet generation.

Answer

-sP

Answer

--privileged

Answer

-Pn

Question 9

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Accepted Answer

RIP. Routing Information Protocol (RIP) uses hop counts up to 15 (16 being infinity) and traditionally lacks authentication, making it susceptible to injection attacks.

Answer

BGP

Answer

EIGRP

Answer

OSPF

Question 10

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Accepted Answer

Ptunnel. Ptunnel (Ping Tunnel) is a specialized application that allows tunneling TCP connections reliably through ICMP echo request and reply packets.

Answer

Socat

Answer

Netcat

Answer

Iodine

Question 11

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Accepted Answer

--randomize-hosts. The --randomize-hosts option tells Nmap to randomize the order in which it scans hosts, helping to evade threshold-based IDS/IPS alerts.

Answer

-T0

Answer

--spoof-mac

Answer

-D

Question 12

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

Accepted Answer

Nbtscan. Nbtscan is a program that scans IP networks for NetBIOS name information.

Answer

Tcpdump

Answer

Hydra

Answer

Sqlmap

Question 13

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster or Dirb are standard tools for brute-forcing directories and files on web servers. Gobuster is written in Go and is very fast.

Answer

Nmap

Answer

Netcat

Answer

Hping3

Question 14

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

Accepted Answer

Neo-reGeorg. Neo-reGeorg or HTTPTunnel are tunneling tools, but reGeorg / Neo-reGeorg tunnels TCP traffic through a web server script (PHP/ASPX) inside HTTP/HTTPS requests. Alternatively, CNTLM or Proxifier manage proxy authentication. For raw TCP tunneling over HTTP, HTTPTunnel or Neo-reGeorg are standard.

Answer

Netcat

Answer

Traceroute

Answer

DNS2TCP

Question 15

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Accepted Answer

Hostapd-mana. EAPHammer or Hostapd-mana are specialized tools used to execute rogue access point attacks and evil twin attacks against WPA2/WPA3 Enterprise networks to capture credentials.

Answer

Aircrack-ng

Answer

Reaver

Answer

Kismet