CPENT Network And Perimeter Exploitation Practice Test 4 — 15 Questions

Question 1

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

smtp-user-enum. SMTP-User-Enum is a classic tool used for enumerating OS user accounts via the SMTP service (VRFY, EXPN, RCPT TO commands).

Answer

Enum4linux

Answer

Wpscan

Answer

Nikto

Question 2

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

Accepted Answer

-Pn. The -Pn option disables host discovery, forcing Nmap to proceed with port scanning every specified IP address as if it were online.

Answer

-R

Answer

-p-

Answer

-n

Question 3

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

Accepted Answer

The port is closed.. An ICMP Port Unreachable message (Type 3, Code 3) is returned by the target host when a UDP packet is sent to a port with no listening service. This indicates the port is closed — the host is reachable and actively responding, but no application is bound to that UDP port. It is a definitive sign that the port is not open.

Answer

The host is offline.

Answer

The port is filtered by a firewall.

Answer

The port is open and active.

Question 4

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

Accepted Answer

SPAN (Switched Port Analyzer) / Port Mirroring. SPAN (Switched Port Analyzer), also called port mirroring, copies traffic from one or more switch ports to a designated monitoring port where a capture device or IDS can analyze it. It is passive — it does not alter or interrupt the monitored traffic — making it the correct technique for capturing the legacy application's unencrypted TCP stream on a managed switch.

Answer

802.1X Authentication

Answer

VLAN Trunking Protocol

Answer

Port Security

Question 5

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

Accepted Answer

Hping3. Hping3 is a command-line packet crafter that allows fine-grained control over TCP/IP header fields, including the IPv4 LSRR (Loose Source and Record Route) and SSRR (Strict Source and Record Route) options. It can send custom packets with source routing enabled to test whether routers honor or drop these options, making it the correct tool for this assessment.

Answer

Wget

Answer

Netcat

Answer

Nmap

Question 6

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

Accepted Answer

smb-os-discovery. Option D, smb-os-discovery, is correct because it safely queries SMB to extract the remote host's OS, computer name, domain, and SMB version information without performing intrusive actions. Option E, smb-protocols, is correct because it enumerates which SMB dialects (e.g., NT LM 0.12, SMB 2.02, SMB 3.0) the server supports, directly revealing SMB version details in a non-destructive manner. Option A, smb-brute, is incorrect because it performs credential brute-forcing, which is intrusive and can lock accounts, not a safe version/OS discovery method. Option B, smb-vuln-ms08-067, is incorrect because it actively checks for a specific vulnerability and may crash or disrupt the target, so it is not a safe discovery script. Option C, smb-enum-users, is incorrect because it enumerates user accounts, which is information gathering beyond SMB version/OS details and can be noisy or trigger alerts.

Answer

smb-brute

Answer

smb-vuln-ms08-067

Answer

smb-enum-users

Question 7

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

Accepted Answer

SMB / NetBIOS service enumeration. Option A (SMB / NetBIOS service enumeration) is correct because legacy SMB/NetBIOS services allow unauthenticated enumeration of shares, users, groups, domain membership, and OS details via null sessions (e.g., net view /domain, rpcclient, or enum4linux), frequently exposing sensitive domain information. Option E (SNMP with default community strings) is correct because SNMPv1/v2c uses cleartext community strings such as 'public' or 'private' for authentication, and if defaults are unchanged, an attacker can query MIB objects (e.g., snmpwalk -v2c -c public) to extract system, interface, and sometimes user/process information without real authentication. Option B (HTTPS with modern TLS 1.3) does not belong because it provides encrypted, authenticated transport and does not expose domain or system information unauthenticated. Option C (IPsec VPN tunnels) does not belong because IPsec is an encrypted, authenticated tunnel mechanism, not an information-disclosure enumeration service. Option D (SSH v2 with public key authentication) does not belong because SSHv2 with key-based auth is a secure, authenticated remote-access protocol that does not leak domain or system information without credentials.

Answer

HTTPS with modern TLS 1.3

Answer

IPsec VPN tunnels

Answer

SSH v2 with public key authentication

Question 8

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

Accepted Answer

Metasploit auxiliary/server/socks_proxy. Option C, Metasploit's auxiliary/server/socks_proxy module, is correct because it starts a SOCKS4a/SOCKS5 proxy server inside Metasploit that can route arbitrary TCP traffic through an existing Meterpreter or shell session, enabling pivoting into deeper network segments. Option E, SSH dynamic port forwarding with the -D flag, is correct because it creates a local SOCKS4/SOCKS5 proxy that tunnels arbitrary TCP connections through the SSH server (the compromised host if SSH access is available), which is a classic pivoting technique. Option A, Netcat's -e flag, is wrong because it binds a shell to a port rather than providing a SOCKS proxy for arbitrary TCP traffic. Option B, a Wireshark display filter, is wrong because it only filters captured packets for analysis and provides no tunneling capability. Option D, Nmap's -sS flag, is wrong because it performs a TCP SYN stealth scan and does not establish any proxy or tunnel.

Answer

Netcat -e flag

Answer

Wireshark display filter

Answer

Nmap -sS scan flag

Question 9

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

Accepted Answer

Packet fragmentation (-f flag). Packet fragmentation (-f flag) is correct because it splits probe packets into smaller IP fragments, making it harder for IDS signature engines to reassemble and match the scan payload. Source IP spoofing (-S flag) is correct because it lets Nmap forge the source address of scan packets, hiding the true origin of the scan from the target and its IDS. Decoy scanning (-D flag) is correct because it injects spoofed decoy source addresses alongside the real scan, obscuring which packets originate from the actual tester. The aggressive timing template (-T5) only speeds up scanning and actually increases detectability, while OS fingerprinting (-O flag) is a detection/identification feature that does not obscure origin or payload.

Answer

Aggressive timing template (-T5)

Answer

OS fingerprinting (-O flag)

Question 10

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

Accepted Answer

Targeting user accounts that have associated Service Principal Names (SPNs). Kerberoasting begins by enumerating Active Directory accounts that have Service Principal Names (SPNs) registered, because any authenticated domain user can request a service ticket for those accounts, so option A correctly describes the target selection step. The attack then generates a high volume of TGS-REQ messages (Kerberos service ticket requests) to obtain those service tickets for offline cracking, making option B a valid network indicator. Attackers also favor requesting service tickets with weaker encryption such as RC4-HMAC (etype 23) because RC4 ticket hashes crack faster than AES, so option E is a legitimate artifact of Kerberoasting. Option C is wrong because AXFR zone transfers are a DNS reconnaissance technique, not part of Kerberos service ticket abuse. Option D is wrong because LLMNR poisoning is a name-resolution credential-capture attack (e.g., Responder), unrelated to Kerberoasting's TGS ticket requests.

Answer

Massive outbound DNS zone transfers (AXFR)

Answer

Frequent LLMNR poisoning broadcasts

Question 11

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

Accepted Answer

Running the wafw00f enumeration tool. Option B is correct because wafw00f is a purpose-built fingerprinting tool that sends a series of benign and malicious HTTP requests and analyzes response headers, cookies, and status codes to identify the specific WAF product (e.g., Cloudflare, ModSecurity, AWS WAF) protecting a web server. Option E is correct because sending known malicious payloads such as SQL injection strings or XSS vectors and observing characteristic block responses (e.g., HTTP 403, 406, or 999, or vendor-specific error pages) is a reliable behavioral technique to confirm a WAF is inspecting and filtering traffic. Option A is not relevant because ARP cache tables only reveal layer-2 MAC-to-IP mappings on the local segment and cannot indicate the presence of a WAF, which operates at the application layer. Option C is incorrect because an ICMP ping sweep only tests host reachability and is typically blocked or answered by the origin server regardless of any WAF. Option D is incorrect because a DNS AXFR zone transfer enumerates DNS records and, even if permitted, reveals nothing about whether an application-layer firewall sits in front of the web server.

Answer

Reviewing local ARP cache tables

Answer

Performing a standard ICMP ping sweep

Answer

Running a DNS zone transfer (AXFR) query

Question 12

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

Accepted Answer

ARP ping discovery (-PR). Option D, ARP ping discovery (-PR), is correct because Nmap's ARP scan operates at the data link/network layer by broadcasting ARP requests ("who has this IP?") and identifying live hosts from ARP replies, without generating any TCP or UDP port traffic, making it fast and quiet on a local subnet. Option E, ICMP Echo request ping (-PE), is correct because it uses the network-layer ICMP protocol (type 8 Echo Request, expecting type 0 Echo Reply) to determine host liveness, again without sending TCP or UDP port probes. Option A, TCP Connect scan (-sT), is wrong because it completes full TCP three-way handshakes to target ports, which is exactly the TCP port traffic the tester must avoid. Option B, TCP SYN port scan (-sS), is wrong because it sends TCP SYN packets to ports (half-open scanning), still TCP port traffic. Option C, UDP port scan (-sU), is wrong because it sends UDP datagrams to target ports, which is UDP port traffic and also slow and noisy.

Answer

TCP Connect scan (-sT)

Answer

TCP SYN port scan (-sS)

Answer

UDP port scan (-sU)

Question 13

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

Accepted Answer

HTTPS (Port 443). DNS, HTTPS (port 443), and ICMP are frequently allowed outbound through corporate firewalls and are heavily used for tunneling.

Answer

SMB (Port 445)

Answer

BGP (Port 179)

Question 14

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

Accepted Answer

smbclient -L //target-ip. Option A (smbclient -L //target-ip) is correct because smbclient is an SMB/CIFS client that, with the -L flag, lists the shares and their comments/type on a remote Windows host over TCP 445/139, directly satisfying the share-enumeration requirement. Option C (enum4linux -a target-ip) is correct because enum4linux is a wrapper around Samba tools (smbclient, rpcclient, net) that with -a performs all simple enumeration, including share listing and permission/ACL information via SMB and RPC. Option B (sqlmap -u target-url) is wrong because sqlmap automates SQL-injection testing against web applications, not SMB share enumeration. Option D (nmap --script http-enum) is wrong because http-enum enumerates web server directories and files over HTTP, not SMB shares. Option E (aircrack-ng target.cap) is wrong because aircrack-ng cracks Wi-Fi (WEP/WPA) keys from captured 802.11 frames, which is unrelated to SMB share querying.

Answer

sqlmap -u target-url

Answer

nmap --script http-enum

Answer

aircrack-ng target.cap

Question 15

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

Accepted Answer

Null scan (-sN). Xmas scan (-sX), FIN scan (-sF), and Null scan (-sN) rely on non-standard or empty TCP flag combinations that modern stateful firewalls drop automatically.

Answer

TCP SYN scan (-sS)

Answer

TCP Connect scan (-sT)