CPENT Timed Practice Test 1 — 10 Questions

Question 1

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

10 minute time limit — choose an answer to begin.

Accepted Answer

grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/. The grep command with the -r (recursive) and -n (line number) flags searches through all files in the squashfs-root directory for the string 'BEGIN RSA PRIVATE KEY'. This pattern is the standard header for PEM-encoded RSA private keys, making it an effective way to locate hardcoded keys in extracted firmware. The command is simple, fast, and does not require additional tools.

Answer

strings -k squashfs-root/

Answer

firmadyne -s squashfs-root/

Answer

binwalk -A squashfs-root/

Question 2

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Option B is correct because hardcoding cloud provider API access keys into public source code repositories exposes long-lived credentials to anyone who can view the repo, enabling unauthorized API calls, resource creation, and data exfiltration; secrets should instead be stored in a secrets manager or KMS-backed vault and injected at runtime. Option D is correct because disabling centralized audit logging such as AWS CloudTrail or Azure Activity Logs destroys the tamper-evident record of control-plane and data-plane activity, eliminating detection, forensic investigation, and compliance evidence, which is a critical monitoring deficiency regardless of storage cost savings. The unmarked options do not belong: A is a sound detection practice that surfaces anomalous resource creation, C is a recommended key-management practice using cloud-native KMS with automatic rotation, and E is a foundational IAM control that reduces blast radius by enforcing least privilege.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 3

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. With CAP_SYS_ADMIN and a read-write cgroup v1 mount, the attacker can write a path to the release_agent file and then trigger a cgroup release, causing the kernel to execute that path as root in the host's initial namespace. This is the canonical cgroup v1 container escape (CVE-2022-0492 is a related kernel-side variant). No other listed vector is available from inside a standard container without additional host misconfigurations.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 4

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder

Question 5

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect. Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Answer

arp -a

Answer

uname -r

Question 6

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Azure Active Directory synchronization pipe.

Question 7

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Accepted Answer

AddMember. In BloodHound, the 'AddMember' edge indicates that a user or group has the ability to add members to a group. This is a direct privilege escalation path because adding a user to a high-privileged group (e.g., Domain Admins) grants that user the group's privileges. Therefore, the visual edge that indicates user 'A' can modify the membership of group 'B' is 'AddMember'.

Answer

AllowedToDelegate

Answer

ReadLAPSPassword

Answer

CoerceTo

Question 8

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command. By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Answer

Append a new user account to the /etc/passwd file by leveraging a kernel exploit

Answer

Modify the /etc/sudoers file directly using a buffer overflow vulnerability

Answer

Inject shellcode into the target binary's memory space using GDB while running under sudo

Question 9

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. Option B is correct because MQTT brokers rely on ACLs to authorize which clients may publish or subscribe to specific topics, and a tester should verify that these restrictions are actually enforced to prevent unauthorized topic access. Option D is correct because many brokers ship with anonymous access enabled by default, so confirming whether unauthenticated clients can connect is a fundamental MQTT hardening check. Option E is correct because MQTT traffic is frequently deployed in cleartext on TCP port 1883, and verifying that TLS is used (typically on port 8883) ensures confidentiality and integrity of the smart home communications. Option A does not belong because Modbus/TCP function code 0x10 (Write Multiple Registers) is an industrial control protocol unrelated to MQTT broker configuration. Option C does not belong because an 802.11 deauthentication flood is a wireless-layer denial-of-service attack against Wi-Fi clients, not a broker security configuration check.

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 10

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060