CPENT Quick Quiz — 10 Questions

Question 1

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

Accepted Answer

The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).. ESC3 involves a certificate template configured as an Enrollment Agent (containing the Certificate Request Agent EKU), allowing enrollment by low-privileged users, and permitting issuance of certificates on behalf of other users.

Answer

The CA requires Manager Approval for all issued certificates.

Answer

The domain functional level is set to Windows Server 2003.

Question 2

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Accepted Answer

The explicit Deny in the bucket policy takes precedence, resulting in access being denied.. AWS evaluation logic states that an explicit Deny anywhere in the policy evaluation overrides all allows.

Answer

AWS generates a configuration error and blocks all traffic until the conflict is resolved manually.

Answer

Access is granted because any Allow permission supersedes bucket restrictions.

Answer

The public ACL takes precedence because ACLs are evaluated before bucket policies.

Question 3

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Accepted Answer

Forest-wide privilege escalation via SID History injection. When SID filtering is disabled on an external or forest trust, an attacker who compromises the trusting/trusted child domain can inject enterprise admin SIDs into the SID History attribute of a forged ticket, granting access across the trust boundary.

Answer

AD CS ESC8 NTLM relay attacks

Answer

Standard Kerberoasting against domain controllers

Answer

Unconstrained delegation exploitation via print spooler

Question 4

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.

Question 5

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

Accepted Answer

The bucket is public; the allUsers or allAuthenticatedUsers IAM binding must be removed to secure the data.. Granting allUsers IAM role bindings on a Cloud Storage bucket makes its objects publicly readable over the internet. Remediation requires removing the allUsers binding.

Answer

The bucket is vulnerable to GCP IAM privilege escalation via service account impersonation.

Answer

Google Cloud Armor automatically deletes the bucket objects.

Answer

Compute Engine instances can no longer mount the bucket as a persistent disk.

Question 6

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

Accepted Answer

AWS VPC Endpoints powered by AWS PrivateLink.. AWS VPC Endpoints (powered by AWS PrivateLink) allow private connections between VPCs and AWS services or other VPCs without internet gateways.

Answer

Amazon CloudFront origin access control (OAC).

Answer

AWS Web Application Firewall (WAF) rule groups.

Answer

AWS Identity and Access Management resource-based policies.

Question 7

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

Accepted Answer

The NTLM password hash of the specific service account. A Silver Ticket is forged for a specific service using the NTLM hash of the service account running that service (e.g., MSSQL or CIFS service account), rather than the KRBTGT hash.

Answer

The plaintext password of the Domain Administrator

Answer

The Domain Controller's computer account machine password

Answer

The domain root CA private key (.pfx)

Question 8

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

Accepted Answer

The Active Directory domain functional level must be Windows Server 2012 or higher.. RBCD requires permission to modify msDS-AllowedToActOnBehalfOfOtherIdentity on the target object, control over a computer or user object to act as the delegating entity, and Active Directory running at Windows Server 2012 or higher functional level.

Answer

Domain controllers must have SMB signing disabled globally.

Answer

The KRBTGT account password must be reset twice to invalidate existing tickets.

Question 9

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

Accepted Answer

psexec.py from the Impacket toolkit. Pass-the-Hash relies on injecting or using the NTLM hash directly in place of the user's password during authentication. Impacket's psexec.py (or crackmapexec / netexec) natively supports NTLM hash authentication.

Answer

Windows Remote Desktop Connection (mstsc.exe)

Answer

Standard Windows net use command

Answer

WinRM standard client via browser

Question 10

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder