CPENT Privilege Escalation Lateral Movement And Post Exploitation — All Questions With Answers

Question 1easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Question 2hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?

Question 3mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Question 4mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?

Question 5easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

Question 6mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

Question 7hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

Question 8easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Question 9easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Question 10easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Question 11hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Question 12mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

Question 13mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

Question 14hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Question 15easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

Question 16hardmultiple choice

Read the full DNS explanation →

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Question 17easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Question 18hardmulti select

Review the full subnetting walkthrough →

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Question 19mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Question 20mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Question 21easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Question 22mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Question 23hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Question 24easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Question 25mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Question 26easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Question 27hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

Question 28mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

Question 29easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Question 30mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Question 31hardmultiple choice

Read the full DNS explanation →

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Question 32easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

Question 33mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

Question 34mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

Question 35hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Question 36mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

Question 37hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Question 38mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Question 39easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

Question 40mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Question 41hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

Question 42easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

Question 43mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

Question 44easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Question 45hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

Question 46mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Question 47mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Question 48hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

Question 49hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are assessing a Linux privilege escalation path. Which THREE techniques would allow you to escalate to root if you have write access to the /etc/passwd or /etc/shadow file?

Question 50easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which TWO methods are commonly used for data exfiltration during a penetration test to bypass basic network monitoring?

Question 1easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

Question 2hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?

Question 3mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

Question 4mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?

Question 5easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

Question 6mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

Question 7hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

Question 8easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Question 9easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

Question 10easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

Question 11hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

Question 12mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

Question 13mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

Question 14hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

Question 15easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

Question 16hardmultiple choice

Read the full DNS explanation →

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

Question 17easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

Question 18hardmulti select

Review the full subnetting walkthrough →

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

Question 19mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

Question 20mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

Question 21easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

Question 22mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

Question 23hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Question 24easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

Question 25mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

Question 26easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Question 27hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

Question 28mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

Question 29easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Question 30mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Question 31hardmultiple choice

Read the full DNS explanation →

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Question 32easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

Question 33mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

Question 34mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

Question 35hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

Question 36mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

Question 37hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Question 38mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Question 39easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

Question 40mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Question 41hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

Question 42easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

Question 43mediummultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

Question 44easymultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Question 45hardmultiple choice

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

Question 46mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

Question 47mediummulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

Question 48hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

Question 49hardmulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are assessing a Linux privilege escalation path. Which THREE techniques would allow you to escalate to root if you have write access to the /etc/passwd or /etc/shadow file?

Question 50easymulti select

Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →