CPENT Network And Perimeter Exploitation Practice Test 3 — 15 Questions

Question 1

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bettercap. Bettercap or Ettercap support ARP spoofing, but Bettercap is modern and allows fine-grained module control for network attacks. Alternatively, customized arpspoof can be tuned.

Answer

FTP

Answer

Ping

Answer

Telnet

Question 2

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

Accepted Answer

smtp-user-enum. SMTP-User-Enum is a classic tool used for enumerating OS user accounts via the SMTP service (VRFY, EXPN, RCPT TO commands).

Answer

Enum4linux

Answer

Wpscan

Answer

Nikto

Question 3

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Accepted Answer

-Pn. The -Pn option disables host discovery, forcing Nmap to proceed with port scanning every specified IP address as if it were online.

Answer

-R

Answer

-p-

Answer

-n

Question 4

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

Accepted Answer

The port is closed.. An ICMP Port Unreachable message (Type 3, Code 3) indicates that the target UDP port is closed.

Answer

The host is offline.

Answer

The port is filtered by a firewall.

Answer

The port is open and active.

Question 5

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

Accepted Answer

SPAN (Switched Port Analyzer) / Port Mirroring. Port Mirroring, also known as Switched Port Analyzer (SPAN), copies traffic from one or more switch ports to a destination monitoring port where a tool like Wireshark is connected.

Answer

802.1X Authentication

Answer

VLAN Trunking Protocol

Answer

Port Security

Question 6

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Accepted Answer

Hping3. Hping3 or Scapy can craft custom IP packets with IP options such as loose or strict source routing (LSR/SSR).

Answer

Wget

Answer

Netcat

Answer

Nmap

Question 7

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

Accepted Answer

smb-os-discovery. smb-os-discovery and smb-protocols (or smb-enum-shares) gather SMB and OS details. Specifically, smb-os-discovery and smb-security-mode or smb-protocols are standard discovery scripts.

Answer

smb-brute

Answer

smb-vuln-ms08-067

Answer

smb-enum-users

Question 8

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

Accepted Answer

SMB / NetBIOS service enumeration. LDAP (without signing/anonymous binds) and SNMP (with default community strings) or SMB/RPC often expose information. Specifically, SNMP and LDAP or SMB NetBIOS services. Let's choose SNMP and SMB.

Answer

HTTPS with modern TLS 1.3

Answer

IPsec VPN tunnels

Answer

SSH v2 with public key authentication

Question 9

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

Accepted Answer

Metasploit auxiliary/server/socks_proxy. Metasploit's auxiliary/server/socks_proxy and SSH dynamic port forwarding (-D) are primary methods for establishing SOCKS proxies during pivoting.

Answer

Netcat -e flag

Answer

Wireshark display filter

Answer

Nmap -sS scan flag

Question 10

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

Accepted Answer

Packet fragmentation (-f flag). Decoys (-D), source IP spoofing (-S), and packet fragmentation (-f) are classic Nmap evasion techniques.

Answer

Aggressive timing template (-T5)

Answer

OS fingerprinting (-O flag)

Question 11

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

Accepted Answer

Targeting user accounts that have associated Service Principal Names (SPNs). Kerberoasting involves requesting TGS service tickets for user accounts with Service Principal Names (SPNs), high volume of TGS-REQ requests, and RC4 encryption (encryption type 23).

Answer

Massive outbound DNS zone transfers (AXFR)

Answer

Frequent LLMNR poisoning broadcasts

Question 12

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Accepted Answer

Running the wafw00f enumeration tool. Sending anomalous HTTP requests or triggering typical attack signatures (like WAF-testing tools such as wafw00f) and observing unique block pages or headers are standard WAF detection techniques.

Answer

Reviewing local ARP cache tables

Answer

Performing a standard ICMP ping sweep

Answer

Running a DNS zone transfer (AXFR) query

Question 13

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Accepted Answer

ARP ping discovery (-PR). ICMP Echo requests (-PE) and ARP ping scans (-PR) use ICMP and ARP protocols respectively to find live hosts without touching TCP ports.

Answer

TCP Connect scan (-sT)

Answer

TCP SYN port scan (-sS)

Answer

UDP port scan (-sU)

Question 14

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

Accepted Answer

HTTPS (Port 443). DNS, HTTPS (port 443), and ICMP are frequently allowed outbound through corporate firewalls and are heavily used for tunneling.

Answer

SMB (Port 445)

Answer

BGP (Port 179)

Question 15

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Accepted Answer

smbclient -L //target-ip. Smbclient and enum4linux are standard tools for enumerating SMB shares on Windows and Samba servers.

Answer

sqlmap -u target-url

Answer

nmap --script http-enum

Answer

aircrack-ng target.cap