CPENT Timed Practice Test 2 — 10 Questions

Question 1

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

10 minute time limit — choose an answer to begin.

Accepted Answer

Rubeus (rubeus.exe asreproast). Option C is correct because Rubeus is a dedicated Kerberos attack toolkit, and its `asreproast` command specifically enumerates and extracts AS-REP hashes from accounts whose UserAccountControl flag does not have Kerberos preauthentication required (UF_DONT_REQUIRE_PREAUTH, 0x400000), which an unprivileged domain user can perform. Option E is correct because PowerView's `Get-DomainUser -PreauthNotRequired` queries Active Directory via LDAP for user objects with the DONT_REQUIRE_PREAUTH flag set, directly identifying AS-REP roasting candidates without elevated privileges. Option A is wrong because cleanmgr.exe is a disk cleanup utility with no AD enumeration capability. Option B is wrong because Mimikatz's `lsadump::dcsync` requires DCSync rights (typically Domain Admin or Replicating Directory Changes permissions), so it is not usable by an unprivileged domain user. Option D is wrong because secpol.msc edits local security policy on a single host and does not enumerate domain accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 2

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Accepted Answer

The target must have NTLM authentication enabled in the local security policy.. Pass-the-Hash (PtH) works by using the NTLM hash of a user's password to authenticate via NTLM, bypassing the need for the plaintext password. For this to succeed, the target system must accept NTLM authentication. If NTLM is disabled in the local security policy (e.g., via 'Network security: Restrict NTLM' settings), the attack fails because the hash cannot be used. Thus, the mandatory prerequisite is that NTLM authentication is enabled on the target.

Answer

The target must have the Remote Registry service disabled.

Answer

The target must be running Windows 10 or higher.

Answer

You must have the plaintext password of the target account.

Question 3

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Option B is correct because mounting sensitive host directories such as '/' or '/proc' through a hostPath volume gives the container direct read/write access to host files, kernel interfaces, and process information, which an attacker can abuse to modify host binaries, read secrets, or escape the container boundary. Option C is correct because setting privileged: true disables most container isolation, grants all Linux capabilities, and removes seccomp/AppArmor restrictions, effectively giving the container root-level control over the host devices and kernel. Option D is correct because mounting /var/run/docker.sock exposes the Docker daemon API to the container, allowing an attacker to create a new privileged container that mounts the host filesystem and thereby compromise the node. Option A is not a risk but a hardening practice, since running as a non-root UID (USER 1000) reduces the impact of a compromise. Option E is also a security best practice, as RBAC with least-privilege bindings limits what identities can do in the cluster rather than enabling escapes.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 4

An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?

Accepted Answer

The MQTT connection is not using TLS encryption.. MQTT does not encrypt traffic by default. Without TLS, the CONNECT packet, which contains username and password, is transmitted in cleartext. The observation of cleartext credentials directly points to the absence of TLS encryption on the MQTT connection. Other options describe scenarios that would either prevent connection or are specific subsets of the same root cause.

Answer

The MQTT broker is configured to use TLS, but the client is not.

Answer

The MQTT client is configured to use MQTT over WebSocket without TLS.

Answer

The MQTT broker is using a self-signed certificate that the client rejects.

Question 5

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

Accepted Answer

curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api. cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Answer

ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

Answer

netstat -an | grep 80

Answer

traceroute -p 80 192.168.1.100

Question 6

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

Accepted Answer

-sn. The -sn parameter tells Nmap to perform host discovery only (formerly known as a ping scan using -sP) and disables port scanning entirely.

Answer

-sS

Answer

-Pn

Answer

-sO

Question 7

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

Accepted Answer

Disable HTTP-based web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA) enabled.. Option A is correct because ESC8 abuses the HTTP-based web enrollment endpoints (certsrv) via NTLM relay, so disabling HTTP enrollment or enforcing HTTPS with Extended Protection for Authentication (EPA) and disabling NTLM on those endpoints blocks that relay vector. Option B is correct because continuous auditing of AD CS templates, CAs, and ACLs with tools like Certipy or BloodHound (e.g., Certipy's 'find' and 'template' checks) surfaces misconfigurations such as ESC1-ESC8 before attackers exploit them. Option E is correct because removing the ENROLLEE_SUPPLIES_SUBJECT flag prevents low-privileged enrollees from specifying an arbitrary subject/SAN (e.g., a domain admin UPN), which is the core of ESC1 template abuse. Option C is wrong because disabling Kerberos pre-authentication on domain controller computer accounts would weaken authentication and enable AS-REP roasting, not secure AD CS. Option D is wrong because enforcing unconstrained delegation on CA servers increases exposure to credential theft and relay/impersonation attacks rather than mitigating certificate abuse.

Answer

Disable Kerberos pre-authentication across all domain controller computer accounts.

Answer

Enforce unconstrained delegation on all certificate authority servers.

Question 8

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

Accepted Answer

Tunnel data through DNS queries using TXT records sent to a domain controlled by the attacker. DNS tunneling encapsulates arbitrary data within DNS query and response types (such as TXT, NULL, or CNAME records) sent to an authoritative nameserver controlled by the attacker, effectively bypassing egress filtering on port 53.

Answer

Use standard FTP data channels over ephemeral ports to push archives to an external staging server

Answer

Establish an ICMP reverse shell by embedding data inside the payload of ICMP echo request packets

Answer

Establish an HTTPS connection to an external IP address using port 443

Question 9

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

Accepted Answer

A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.. The create verb on pods/exec in Kubernetes RBAC allows a user to invoke the exec subresource, which runs arbitrary commands inside a running container. This is effectively remote code execution within the pod's namespace, and if the pod has a mounted service account token or hostPath volume, the attacker can pivot to the node or cluster.

Answer

The user can extract the master node's etcd database encryption keys.

Answer

The user can modify the cluster's underlying cloud provider IAM policies.

Answer

The user can bypass network policies by altering iptables rules on the host node.

Question 10

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

Accepted Answer

Using the AWS account root user credentials for day-to-day operational tasks.. Using root credentials for daily tasks and creating active access keys for root users violate foundational AWS security best practices.

Answer

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Answer

Enabling AWS CloudTrail logging across all regions in the account.

Answer

Attaching AWS managed policies for read-only access to auditing roles.