CPENT Network And Perimeter Exploitation Practice Test 5 — 15 Questions

Question 1

A penetration tester is evaluating network security controls and wants to check for insecure or plaintext authentication protocols in use across the network. Which TWO protocols transmit credentials or session tokens in cleartext and can be easily sniffed? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Telnet. Telnet (D) is correct because it operates over TCP port 23 and transmits all data, including usernames and passwords, in cleartext with no encryption, making credentials trivially recoverable via packet sniffing. FTP (E) is correct because its control channel on TCP port 21 sends USER and PASS commands in plaintext, so authentication credentials can be captured by any sniffer on the path. SSH v2 (A) is not correct because it negotiates encrypted sessions using strong ciphers and key exchange, protecting credentials from sniffing. SFTP (B) is not correct because it runs over the SSH transport, inheriting its encryption and integrity protections. HTTPS (C) is not correct because it wraps HTTP inside TLS, encrypting credentials and session tokens in transit.

Answer

SSH v2

Answer

SFTP (SSH File Transfer Protocol)

Answer

HTTPS

Question 2

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

Accepted Answer

DHCP Spoofing / Rogue DHCP Server. DHCP Spoofing / Rogue DHCP Server (B) is correct because an attacker can stand up an unauthorized DHCP server that answers client DISCOVER/REQUEST messages with malicious OFFER/ACK leases, supplying a rogue default gateway and DNS server so the victim's traffic is redirected through the attacker for interception (a man-in-the-middle). DHCP Starvation / Exhaustion (C) is correct because the attacker floods the DHCP server with forged DHCP DISCOVER requests using spoofed/changing MAC addresses (e.g., via tools like Yersinia or dhcpstarv), consuming the entire DHCP address pool so legitimate clients cannot obtain a lease, causing a denial of service. DNS Zone Transfer (AXFR) (A) is a DNS misconfiguration attack that copies zone records and does not target DHCP. Kerberoasting (D) is an Active Directory attack that requests Kerberos service tickets (TGS) for accounts with SPNs to crack their passwords offline, unrelated to DHCP. ARP Cache Poisoning (E) manipulates ARP tables at Layer 2 to intercept traffic but does not attack the DHCP infrastructure itself.

Answer

DNS Zone Transfer (AXFR)

Answer

Kerberoasting

Answer

ARP Cache Poisoning

Question 3

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

Accepted Answer

post/multi/manage/autoroute. The post/multi/manage/autoroute module in Metasploit adds routes to the Meterpreter session's routing table, enabling the framework to pivot through the compromised host into the 192.168.100.0/24 subnet. Once autoroute is configured with the target subnet, subsequent Metasploit modules (including scanners) automatically route traffic through the session. This is the prerequisite step before running any scan against the isolated network.

Answer

auxiliary/scanner/portscan/tcp

Answer

exploit/windows/local/payload_inject

Answer

auxiliary/server/socks_proxy

Question 4

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

Accepted Answer

-f. The -f option causes Nmap to split the IP packets into tiny fragments. Specifying it twice (-ff) sends 16-byte fragments instead of 8-byte fragments.

Answer

--mtu

Answer

--data-length

Answer

-D

Question 5

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

Accepted Answer

-sn. The -sn parameter tells Nmap to perform host discovery only (formerly known as a ping scan using -sP) and disables port scanning entirely.

Answer

-sS

Answer

-Pn

Answer

-sO

Question 6

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

Accepted Answer

Nmap Xmas Tree Scan (-sX). The Xmas Tree scan (-sX) is named for the three flags it sets — FIN, PSH, and URG — which 'light up' the TCP header like a Christmas tree. Per RFC 793, a closed port must respond to a packet with no SYN/ACK/RST with an RST, while an open port silently discards it, so the scan infers port state from the presence or absence of an RST.

Answer

Nmap Null Scan (-sN)

Answer

Nmap Window Scan (-sW)

Answer

Nmap FIN Scan (-sF)

Question 7

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

Accepted Answer

Wireshark. Wireshark (B) is correct because it is a protocol analyzer that captures live packets on an interface and includes dissectors that can parse authentication protocols such as HTTP Basic, FTP, Telnet, and Kerberos pre-authentication data, exposing credentials in cleartext or crackable form. Bettercap (D) is correct because it is a MITM framework with built-in ARP spoofing, sniffing, and credential-sniffing modules (e.g., net.sniff) that actively capture and parse credentials such as HTTP POST logins, FTP, and NTLM hashes from the wire. Tcpdump (E) is correct because it captures raw packets on the segment and, with the -A or -X flags, prints payload contents in ASCII/hex so cleartext credentials in protocols like FTP, Telnet, or HTTP can be read directly. John the Ripper (A) is a password-cracking tool that operates on captured hash files offline and does not capture or parse live network traffic, and Sqlmap (C) is a SQL injection exploitation tool that targets web application databases rather than sniffing credentials off a network segment.

Answer

John the Ripper

Answer

Sqlmap

Question 8

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

Accepted Answer

Remote Procedure Calls (RPC) over SMB. enum4linux is a wrapper around tools like rpcclient, net, and nmblookup that primarily uses MS-RPC over SMB (typically via the IPC$ share and the SAMR/LSARPC interfaces) to enumerate users, groups, shares, and password policies. This RPC-over-SMB approach queries domain information without brute-forcing credentials, avoiding account lockouts. It targets ports 139/445 and leverages null or authenticated SMB sessions.

Answer

Lightweight Directory Access Protocol (LDAP) over port 389

Answer

NetBIOS Name Service (NBNS) over UDP port 137

Answer

Simple Network Management Protocol (SNMP)

Question 9

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

Accepted Answer

Iodine. Iodine is a specialized tunneling tool designed specifically to tunnel IPv4 traffic through a DNS server, making it ideal for bypassing networks that only allow outgoing DNS traffic.

Answer

Socat

Answer

Chisel

Answer

Netcat

Question 10

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

Accepted Answer

ssh -L 8080:10.0.0.5:80 user@jumpbox. The -L flag specifies local port forwarding. The syntax is -L [bind_address:]port:remote_host:remote_port, along with -N to prevent executing a remote command and -f to run in the background.

Answer

ssh -D 8080 user@jumpbox

Answer

ssh -R 8080:10.0.0.5:80 user@jumpbox

Answer

ssh -w 8080:80 user@jumpbox

Question 11

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

Accepted Answer

Using the -D option to launch a decoy scan with multiple fake source IP addresses. Option B is correct because Nmap's -D (decoy) option injects multiple spoofed source IP addresses into the scan, so packet inspection filters and IDS/IPS sensors see traffic from many apparent senders and cannot easily attribute or block the real scanning host. Option E is correct because --source-port (or -g) sets the TCP/UDP source port to a chosen value such as 53 (DNS) or 20 (FTP-data), which can slip past poorly written firewall or ACL rules that trust traffic originating from those well-known ports. Option A is not an evasion technique; -p- simply expands the port range to all 65,535 TCP ports and affects coverage, not header or timing manipulation. Option C is not an evasion feature; --script runs NSE scripts for discovery or vulnerability detection against open ports. Option D is not an evasion feature; -oA only writes scan output in normal, XML, and Grepable formats for reporting.

Answer

Using the -p- option to scan all 65,535 TCP ports on the target host

Answer

Using the --script option to execute NSE vulnerability scripts against open ports

Answer

Using the -oA option to output scan results simultaneously in normal, XML, and Grepable formats

Question 12

During an internal engagement, a penetration tester gains access to a Linux host that has multiple network interfaces. The tester needs to determine which interface can route to the 10.10.10.0/24 subnet and what the next-hop gateway is. Which command provides this information most directly?

Accepted Answer

ip route get 10.10.10.1. The ip route get command performs a routing table lookup for a specific destination and reports the exact outgoing interface, source address, and gateway that the kernel would use. This directly answers both parts of the question: which interface can reach the subnet and what the next hop is. Other commands list interfaces or routes but do not resolve the path for a given target address.

Answer

ifconfig -a

Answer

arp -a

Answer

netstat -rn

Question 13

You are conducting an external penetration test against a company that uses a Cisco ASA firewall. You have identified that the firewall is running an older firmware version. Which technique would best allow you to bypass the firewall's access control lists to reach an internal web server on port 80?

Accepted Answer

Exploiting a known vulnerability in the ASA firmware to gain access. Exploiting a known vulnerability in outdated Cisco ASA firmware can yield direct access or the ability to bypass ACLs, enabling reach to internal resources. The scenario emphasizes older firmware, signaling that a vulnerability exploit is the most effective route. Other techniques like fragmentation or source routing are typically mitigated by modern firewalls and do not provide a reliable ACL bypass in this context.

Answer

Fragmented packet attack using overlapping IP fragments

Answer

TCP port redirection using a compromised external host

Answer

Source routing with the IP Record Route option

Question 14

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

Accepted Answer

Use CrackMapExec or NetExec with the smb-signing module to enumerate signing configuration across the subnet in a single sweep.. SMB signing enforcement is advertised in the SMB2 negotiate response, so hosts that report signing enabled but not required are relay candidates. Nmap's smb2-security-mode script and CrackMapExec/NetExec's smb-signing module both retrieve this data across a subnet and let you build a precise target list. Machine account quota and NetBIOS name queries expose unrelated information, and modifying the target is out of scope.

Answer

Query Active Directory for the ms-DS-MachineAccountQuota attribute on the domain object to determine which machines allow unsigned SMB.

Answer

Enable the LanmanServer service on each target and set the RequireSecuritySignature registry value to 0 before testing.

Answer

Perform a broadcast NetBIOS name query for each host to read the SMB signing flag from the node status response.

Question 15

You have compromised a dual-homed Linux host that sits between a DMZ and an internal network. From this host you need to reach internal web servers on TCP/8080 that are not routable from your attack machine, and you want to route all your tooling traffic through the pivot using SOCKS. Which approach correctly establishes the pivot?

Accepted Answer

Run ssh -D 1080 user@pivot and configure your tools to use the local SOCKS5 proxy on port 1080.. A dynamic SSH forward with -D creates a SOCKS proxy on the attack machine that tunnels arbitrary TCP connections through the dual-homed host. Because the pivot has an internal interface, those connections reach internal web servers that are otherwise unroutable. Static local forwards reach only one destination, reverse forwards run in the wrong direction, and a proxy option alone does not establish the tunnel.

Answer

Run ssh -L 8080:internal-web:8080 user@pivot and point your tools at localhost:8080.

Answer

Use nmap --proxies socks4://pivot:1080 to route scans through the pivot's SOCKS service.

Answer

Run ssh -R 1080:localhost:1080 user@pivot to create a reverse SOCKS proxy on the pivot host.