CPENT Timed Practice Test 2 — 10 Questions

Question 1

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

Accepted Answer

Executing Kerberoasting against service principal names to crack hashes offline. Avoiding LSASS interaction can be achieved via DCSync (DRSUAPI replication), Kerberoasting (offline cracking of TGS), and NTDS.dit extraction using Volume Shadow Copies (VSS).

Answer

Running procdump.exe against the lsass.exe process on the domain controller

Answer

Injecting DLL payloads into the Local Security Authority Subsystem Service

Question 2

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

Accepted Answer

Data in transit between clients and the storage account can be intercepted over unencrypted HTTP connections.. Disabling secure transfer allows unencrypted HTTP connections to the storage account, enabling potential Man-in-the-Middle (MitM) attacks to intercept data in transit.

Answer

Storage account access keys are transmitted in plaintext during Azure Resource Manager API calls.

Answer

Shared Access Signatures (SAS) tokens expire immediately upon generation.

Answer

Blob storage data at rest is stored without AES-256 encryption.

Question 3

During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?

Accepted Answer

It does not require interaction with the Domain Controller to generate and does not alert the KDC for a TGT request. A Silver Ticket is forged for a specific service using the NTLM hash of that specific service account (or computer account), meaning it does not require interaction with the Domain Controller's KDC for creation, and it does not generate a TGT request that might alert domain-level monitoring.

Answer

It can only be detected by physically inspecting the NTDS.dit file on the Domain Controller

Answer

It grants full Domain Administrator privileges across all domain controllers

Answer

It automatically updates the KRBTGT password to maintain persistence

Question 4

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). AS-REP Roasting targets accounts where Kerberos pre-authentication is disabled. Unprivileged users can query LDAP directly or use automated tools like Rubeus or PowerView to find these accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 5

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

Accepted Answer

Add a compromised or attacker-controlled user account to the privileged group using PowerView or net group. Having write access or GenericAll over a group allows an attacker to add a controlled user to that privileged group (e.g., via Add-DomainGroupMember) or modify the ACLs to grant themselves full control over the group object.

Answer

Execute a Kerberoasting attack against the Active Directory Web Services endpoint

Answer

Extract plaintext passwords from the Windows Registry SAM hive remotely using ping.exe

Answer

Force an immediate password reset of the krbtgt account via Group Policy Preferences

Question 6

A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?

Accepted Answer

Modify the GPO's SYSVOL folder contents to inject a malicious Immediate Task or startup script. Having GenericAll or WriteProperty rights over a GPO allows an attacker to modify the GPO settings, such as adding a Scheduled Task or an Immediate Task via 'Preferences -> Control Panel Settings -> Scheduled Tasks', which will execute commands on targets processing that GPO.

Answer

Extract domain administrator password hashes directly from the GPO ACL metadata

Answer

Request a TGT ticket with custom PAC extensions via Kerberos delegation

Question 7

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

Accepted Answer

Mimikatz: kerberos::ptt ticket.kirbi. Pass-the-Ticket involves injecting exported ticket files (such as .kirbi or .ccache format) into memory. Mimikatz uses the 'kerberos::ptt' command to inject a ticket into the current Windows logon session.

Answer

Rubeus: golden /ticket:ticket.kirbi

Answer

PowerView: Invoke-TicketInjection -Path ticket.kirbi

Answer

Impacket: ticketer.py -nthash ...

Question 8

An AWS administrator wants to prevent users from accidentally creating public Amazon S3 buckets across the entire AWS account. Which specific AWS feature should be enabled?

Accepted Answer

S3 Block Public Access at the AWS account level.. S3 Block Public Access at the account level blocks the creation of public buckets and modification of public policies organization-wide.

Answer

AWS Web Application Firewall rules attached to the S3 global endpoint.

Answer

AWS Organizations Service Control Policies blocking the s3:PutBucketAcl action.

Answer

Amazon Macie to automatically encrypt all public buckets.

Question 9

During a hybrid cloud assessment, a penetration tester examines the connection between an on-premises Active Directory and Azure AD. Which THREE of the following mechanisms or misconfigurations could lead to credential exposure or privilege escalation in the hybrid environment? (Choose THREE)

Accepted Answer

Storing application secrets and database connection strings in plaintext within Azure App Service configuration settings.. Over-privileged sync accounts, storing secrets in plaintext, and unmitigated PHS/PTA risks are major hybrid threats.

Answer

Enforcing Azure AD Conditional Access policies requiring compliant devices for access.

Answer

Using Azure Key Vault with managed hardware security modules (HSMs) for cryptographic keys.

Answer

Configuring Azure Bastion for secure administrative RDP and SSH connectivity.

Question 10

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

Accepted Answer

0x88B8. GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Answer

0x0800

Answer

0x86DD

Answer

0x88E5