CPENT Network And Perimeter Exploitation Practice Test 3 — 15 Questions

Question 1

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

-sI. The -sI flag instructs Nmap to perform an idle scan using a specified zombie host, allowing completely blind port scanning where packets appear to originate from the zombie.

Answer

-sZ

Answer

-sO

Answer

-sM

Question 2

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

Accepted Answer

--data-length. The --data-length option tells Nmap to append a random number of bytes to the sent packets, altering their length signature and evading simple signature-based Nmap detection rules.

Answer

--mtu

Answer

--badsum

Answer

-f

Question 3

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

Accepted Answer

Netcat. Netcat can open a raw TCP connection to the FTP port and display the server's banner immediately upon connection, revealing the FTP software and version without performing a login. A simple nc target 21 returns the 220 service-ready banner, which is exactly the lightweight banner grab the question asks for.

Answer

Wpscan

Answer

Hashcat

Answer

Airbase-ng

Question 4

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

Accepted Answer

ssh -L 3306:10.0.0.50:3306 user@pivot_ip. The -L flag in OpenSSH establishes local port forwarding, and its argument syntax is [bind_address:]port:host:hostport. Here, '3306:10.0.0.50:3306' tells SSH to listen on local port 3306 and forward any connection through the pivot host to 10.0.0.50:3306, which is exactly the requirement for reaching an internal database behind a firewall.

Answer

ssh -D 3306 user@pivot_ip

Answer

ssh -C -N user@pivot_ip

Answer

ssh -R 3306:10.0.0.50:3306 user@pivot_ip

Question 5

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

Accepted Answer

Snmpwalk. Snmpwalk is a command-line tool from the Net-SNMP suite that queries SNMP-enabled devices using GETNEXT requests to retrieve a subtree of management information. It can walk the MIB tree to extract data such as user accounts (via OIDs like 1.3.6.1.4.1.77.1.2.25 for Windows), routing tables (1.3.6.1.2.1.4.21), and running processes (1.3.6.1.2.1.25.4.2.1.2). With a default community string like 'public', an attacker can enumerate this information without authentication.

Answer

Rpcinfo

Answer

Smbclient

Answer

NFSstat

Question 6

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

Accepted Answer

TheHarvester. TheHarvester is an OSINT reconnaissance tool that queries search engines (Google, Bing, Baidu), certificate transparency logs, PGP key servers, and public databases like Shodan and Hunter to enumerate emails, subdomains, hostnames, and employee names tied to a target domain. It is purpose-built for the passive reconnaissance phase of a penetration test.

Answer

Metasploit

Answer

Wireshark

Answer

Burp Suite

Question 7

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

Accepted Answer

IPv6 RA Guard. IPv6 RA Guard (Router Advertisement Guard) is a switch feature defined in RFC 6105 that inspects and blocks rogue ICMPv6 Router Advertisement and Redirect messages on access ports. It prevents an attacker from spoofing as an IPv6 router to redirect or intercept local traffic via NDP spoofing. RA Guard classifies ports as trusted (uplink to legitimate router) or untrusted (host-facing), dropping RAs received on untrusted ports.

Answer

Dynamic ARP Inspection (DAI)

Answer

DHCP Snooping

Answer

Port Security

Question 8

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

Accepted Answer

smb-vuln-ms17-010. The NSE script smb-vuln-ms17-010 is specifically designed to detect whether a Windows host is vulnerable to the MS17-010 (EternalBlue) SMBv1 vulnerability. It sends a crafted SMB packet to check for the presence of the vulnerability without exploiting it, thus avoiding service crashes. This script is part of the standard Nmap Scripting Engine and is the correct tool for non-intrusive vulnerability verification.

Answer

smb-brute

Answer

smb-enum-shares

Answer

smb-os-discovery

Question 9

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

Accepted Answer

RIP. RIP (Routing Information Protocol) uses cleartext, unauthenticated updates by default and a hop-count metric with a maximum of 15 hops (16 = unreachable), making it trivially vulnerable to route injection and poisoning attacks. This matches the description exactly.

Answer

BGP

Answer

EIGRP

Answer

OSPF

Question 10

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

Accepted Answer

Ptunnel. Ptunnel (Ping Tunnel) is a specialized application that allows tunneling TCP connections reliably through ICMP echo request and reply packets.

Answer

Socat

Answer

Netcat

Answer

Iodine

Question 11

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

Accepted Answer

Nbtscan. Nbtscan sends NetBIOS Name Service (NBNS) status queries (UDP port 137) to a range of IP addresses and parses the responses to reveal registered NetBIOS names, workgroup/domain names, and often the logged-in username via the Messenger service. It is purpose-built for exactly this enumeration task on legacy Windows hosts. Running 'nbtscan 192.168.1.0/24' produces a table of IP, NetBIOS name, server, user, and MAC address.

Answer

Tcpdump

Answer

Hydra

Answer

Sqlmap

Question 12

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster is a Go-based brute-forcing tool purpose-built for directory and file discovery on web servers, using wordlists to enumerate hidden paths, backup files, and administrative directories via HTTP requests. Its speed and multi-threaded design make it the standard choice for this task.

Answer

Nmap

Answer

Netcat

Answer

Hping3

Question 13

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

Accepted Answer

Neo-reGeorg. Neo-reGeorg is a tunneling tool that encapsulates TCP traffic within HTTP/HTTPS requests, allowing a compromised host to relay traffic through web servers even when only port 443 egress is permitted. It is designed specifically for egress bypass in restricted environments.

Answer

Netcat

Answer

Traceroute

Answer

DNS2TCP

Question 14

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Accepted Answer

Hostapd-mana. EAPHammer or Hostapd-mana are specialized tools used to execute rogue access point attacks and evil twin attacks against WPA2/WPA3 Enterprise networks to capture credentials.

Answer

Aircrack-ng

Answer

Reaver

Answer

Kismet

Question 15

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Accepted Answer

Bettercap. Bettercap is a modular network attack framework that includes an ARP spoofing module capable of selective, low-frequency poisoning. Unlike tools that flood the network with ARP replies, Bettercap allows the attacker to target specific hosts and control the rate of spoofed frames, maintaining a stealthy man-in-the-middle position. This makes it ideal for environments where repetitive ARP traffic would trigger IDS/IPS alerts.

Answer

FTP

Answer

Ping

Answer

Telnet