CPENT Network And Perimeter Exploitation Practice Test 2 — 15 Questions

Question 1

A penetration tester is attempting to bypass a network intrusion prevention system (IPS) that inspects traffic for known attack signatures. The tester wants to deliver a malicious payload to a target web server without triggering the IPS. Which two techniques are most effective for evading signature-based IPS detection? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fragment the payload across multiple TCP segments with overlapping fragments.. Overlapping TCP fragments exploit reassembly ambiguities, causing the IPS and target to interpret the stream differently, which can hide the malicious payload. TLS encryption prevents the IPS from inspecting the payload content altogether, assuming no SSL interception. Both techniques directly target the limitations of signature-based detection, making them effective for evasion.

Answer

Send the payload in a single large packet to avoid fragmentation.

Answer

Use a slow scan to spread the attack over several hours.

Answer

Encode the payload using Base64 and include it in an HTTP header.

Question 2

You are conducting a penetration test against a network with a Cisco router that has SNMP enabled with the default read-only community string 'public'. You want to extract the router's running configuration. Which tool or technique should you use?

Accepted Answer

Use SNMP to retrieve the configuration via TFTP by setting OIDs. Extracting a Cisco router's running configuration via SNMP typically requires a read-write community string to set OIDs that initiate a TFTP copy. While the scenario mentions the read-only 'public' string, it is common for default read-write strings like 'private' to also be present. Using SNMP to trigger a TFTP transfer is a known technique to retrieve the configuration. Other methods like SNMP walk or brute-forcing without a target are less effective.

Answer

SNMP walk using snmpwalk with the 'public' community

Answer

Brute-force SNMP community strings to find a read-write string

Answer

Exploit a known SNMP vulnerability to read arbitrary files

Question 3

A penetration tester is assessing a perimeter firewall and wants to identify open ports and services without triggering alerts. The tester decides to use Nmap with various scan techniques. Which two Nmap scan types are most likely to bypass simple packet-filtering devices that only block SYN packets? (Choose two.)

Accepted Answer

TCP FIN scan (-sF). TCP FIN and Xmas scans are stealthy techniques that do not use the SYN flag, so they can bypass simple packet filters that only block SYN packets. They rely on the target's response (RST for closed ports, no response for open ports) to determine port state. These scans are useful when assessing perimeter devices that employ basic filtering.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

TCP ACK scan (-sA)

Question 4

During an external perimeter assessment, you identify a Cisco IOS router with SNMP enabled. You want to enumerate its routing table and interface details without triggering an alert. Which SNMP operation and community string should you use to efficiently extract this information?

Accepted Answer

SNMP BULKWALK with the community string 'public' to retrieve large tables efficiently.. SNMP BULKWALK leverages GETBULK requests to efficiently retrieve large MIB tables such as routing and interface information, making it the preferred method for enumeration. The 'public' community string is often left at default for read-only access, so it is a common target during penetration tests. This combination allows the tester to gather data quickly and with minimal traffic.

Answer

SNMP SET with the community string 'public' to modify and then read back the routing table.

Answer

SNMP GET with the community string 'public' to retrieve individual OIDs.

Answer

SNMP WALK with the community string 'private' to traverse the MIB tree.

Question 5

You have compromised a Linux host in a DMZ and need to pivot into the internal network. The host has two network interfaces: eth0 (public) and eth1 (internal). You want to use the compromised host as a router to forward traffic from your attack machine to internal targets. Which command should you run on the compromised host to enable IP forwarding?

Accepted Answer

echo 1 > /proc/sys/net/ipv4/ip_forward. Enabling IP forwarding on a compromised Linux host is essential for pivoting, as it allows the host to route packets between its network interfaces. The echo command writes directly to the sysctl parameter, immediately activating forwarding without requiring a reboot or additional tools. This is a standard technique in penetration testing to reach segmented networks.

Answer

iptables -A FORWARD -j ACCEPT

Answer

sysctl -w net.ipv4.ip_forward=1

Answer

route add -net 0.0.0.0/0 gw 192.168.1.1

Question 6

During a penetration test against a perimeter network, you identify a Cisco ASA firewall. You want to enumerate its configuration and potentially find vulnerabilities. Which two actions are most effective for gathering information about the firewall? (Choose two.)

Accepted Answer

Run a vulnerability scan using Nmap NSE scripts for Cisco ASA.. SNMP walk with default community strings and Nmap NSE scripts are both effective, low-risk enumeration techniques for Cisco ASA firewalls. They can reveal version information, configuration details, and potential vulnerabilities without disrupting services. These methods are preferred during the information-gathering phase.

Answer

Send a crafted packet to the IKE service to extract pre-shared keys.

Answer

Use default credentials 'admin/admin' to log into the ASDM interface.

Answer

Attempt to exploit CVE-2018-0101 for a remote code execution.

Question 7

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

Accepted Answer

-O. Nmap's -O option enables OS detection by analyzing TCP/IP stack fingerprinting, such as initial TTL values, TCP window sizes, and responses to specific probes. This allows Nmap to guess the operating system of the target host. The other options serve different purposes: -A enables aggressive scanning (including OS detection, version detection, script scanning, and traceroute), -sV performs service version detection, and --traceroute maps the network path.

Answer

-A

Answer

-sV

Answer

--traceroute

Question 8

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

Accepted Answer

-PA80. Nmap's -PA option performs a TCP ACK ping, sending an empty TCP packet with the ACK flag set to the specified port (default 80). Because a TCP ACK packet to a closed port elicits an RST from a live host and nothing from a filtered/blocked host, it can discover live hosts even when ICMP echo is blocked. Using -PA80 sends the ACK probe to port 80, which is the option the question requires.

Answer

-PS80

Answer

-PE

Answer

-PU80

Question 9

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

Accepted Answer

-sX. Nmap's -sX flag performs the Xmas scan, which sets the FIN, PSH, and URG flags simultaneously in the TCP header. This unusual flag combination is designed to evade stateless firewalls and some IDS signatures that only look for SYN or common flag patterns. The name comes from the flags being 'lit up' like a Christmas tree in a packet analyzer.

Answer

-sN

Answer

-sF

Answer

-sW

Question 10

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

Accepted Answer

-sS. The -sS flag tells Nmap to perform a TCP SYN scan, which sends a SYN packet and waits for a SYN-ACK response, never completing the full 3-way handshake, thus remaining stealthier.

Answer

-sA

Answer

-sU

Answer

-sT

Question 11

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

Accepted Answer

Responder. Responder is a tool specifically designed to poison LLMNR, NBT-NS, and mDNS queries, spoofing responses to capture NTLMv1/v2 hashes when victims attempt authentication. It listens for broadcast name resolution requests and responds as the requested host, tricking the victim into sending credentials. This makes it the correct tool for this scenario.

Answer

Cain & Abel

Answer

Ettercap

Answer

Wireshark

Question 12

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

Accepted Answer

Dnscat2. Dnscat2 is a purpose-built DNS tunneling tool that encapsulates arbitrary TCP traffic inside DNS queries and responses, allowing it to traverse egress filters that only permit port 53. It uses a client-server architecture where the server acts as an authoritative DNS server, and the client encodes data in DNS record types (TXT, CNAME, MX, etc.), effectively creating a covert command-and-control channel. Because the traffic appears as legitimate DNS queries, it bypasses firewalls that block all other outbound TCP/UDP ports.

Answer

Socat

Answer

Metasploit Meterpreter reverse_tcp

Answer

Netcat

Question 13

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

Accepted Answer

Dig. Dig is the standard DNS query utility, and issuing a query of type AXFR against a name server (dig AXFR @ns target.com) directly tests whether that server permits an unauthorized zone transfer. If the server responds with the full zone contents, the AXFR vulnerability is confirmed. This makes dig the purpose-built tool for the task.

Answer

Nbtscan

Answer

DirBuster

Answer

Snort

Question 14

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

Accepted Answer

ProcDump. ProcDump, part of the Sysinternals suite, can create a memory dump of a running process by name or PID, so running it against lsass.exe produces a dump file that can later be parsed offline with Mimikatz or similar tools to recover cached credentials and hashes. It is frequently abused by red teams because it is a legitimate, signed Microsoft utility that is less likely to trigger antivirus than custom dumpers.

Answer

Process Explorer

Answer

TCPView

Answer

Autoruns

Question 15

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

Accepted Answer

Netdiscover. Netdiscover is a reconnaissance tool built specifically to send ARP requests (and ARP replies in active mode) to enumerate live hosts on a local Layer 2 segment. Because ARP operates below IP and requires no TCP/UDP ports to be open, it maps hosts quickly without generating the noisy port-scan traffic that IDS/IPS signatures look for.

Answer

Wireshark

Answer

Nikto

Answer

Sqlmap