CPENT Timed Practice Test 3 — 10 Questions

Question 1

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

Accepted Answer

An Amazon S3 bucket configured with ACLs allowing public read and write access.. Public read permissions and disabled encryption at rest are critical storage security findings.

Answer

An Azure Storage Account with 'Secure transfer required' set to Enabled.

Answer

Enabling versioning and object lock on financial data storage buckets.

Answer

Enabling AWS S3 Block Public Access at the account level.

Question 2

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Accepted Answer

Unconstrained Delegation on a computer account, allowing any user's TGT to be cached when they authenticate to the host. Kerberos delegation vulnerabilities include Unconstrained Delegation (allowing arbitrary service requests), Constrained Delegation with Protocol Transition (S4U2Self/S4U2Proxy abuse), and Resource-Based Constrained Delegation (RBCD).

Answer

Standard Kerberos pre-authentication enabled on all standard user accounts with strong passwords

Answer

Automatic workstation registration limits set to allow zero new domain-joined machines

Question 3

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

Accepted Answer

The database can be reached from the internet; the security group should be restricted to trusted CIDR blocks and public accessibility disabled.. The database is exposed to the public internet, requiring network ACLs, security group restriction, and disabling public accessibility.

Answer

S3 bucket policies will automatically override database access controls.

Answer

The database is vulnerable to container escape via Docker socket exposure.

Answer

IAM role trust policies are bypassed by external SQL injection attacks.

Question 4

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

Accepted Answer

A security group allowing inbound TCP port 3389 (RDP) from 0.0.0.0/0.. Exposing management ports like SSH (22) and RDP (3389) to 0.0.0.0/0 is a critical security risk.

Answer

Enabling AWS Shield Advanced for DDoS protection on Application Load Balancers.

Answer

Using AWS PrivateLink to connect securely to VPC endpoint services.

Answer

A VPC Flow Log enabled and streaming traffic data to an encrypted S3 bucket.

Question 5

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

Accepted Answer

setenv bootargs ${bootargs} init=/bin/sh. U-Boot uses environment variables to define boot parameters. Appending 'init=/bin/sh' or 'init=/bin/bash' to the 'bootargs' variable forces the kernel to launch a shell instead of the standard init process.

Answer

tftp 0x80000000 kernel.bin

Answer

printenv mtdparts

Answer

run flash_os_image

Question 6

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

Accepted Answer

curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api. cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Answer

ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

Answer

netstat -an | grep 80

Answer

traceroute -p 80 192.168.1.100

Question 7

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

Accepted Answer

Abusing misconfigured OpenID Connect (OIDC) federation trust settings between GitHub Actions and AWS IAM roles to assume roles without proper repository conditions.. SSRF targeting IMDS, unauthenticated API gateway endpoints, and misconfigured OIDC/service principal trust paths are core hybrid/cloud attack vectors.

Answer

Enabling AWS CloudTrail and guarding log files with immutable S3 Object Lock policies.

Answer

Configuring VPC peering with bi-directional network ACL restrictions.

Answer

Enforcing strict Azure AD Conditional Access policies based on device compliance and location.

Question 8

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

Accepted Answer

Use 'nsenter --target 1 --mount --uts --ipc --net --pid' to enter the host's namespaces and spawn a root shell on the host node.. With CAP_SYS_ADMIN and hostPID enabled, the tester can inspect processes running on the host, locate processes like systemd or docker daemon, and use tools like nsenter or inject payloads into host namespaces.

Answer

Mount the Docker socket inside the container using the mount syscall enabled by CAP_SYS_ADMIN.

Answer

Execute the 'docker run' command inside the container to spin up a sibling container.

Answer

Write directly to the host's /proc/sysrq-trigger file without any additional mounts.

Question 9

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

Accepted Answer

An external attacker can access the dashboard web interface without credentials and deploy malicious pods with host-level access, resulting in complete cluster compromise.. An unauthenticated Kubernetes dashboard exposed via NodePort allows an attacker to execute arbitrary commands, deploy malicious pods, and take over the entire cluster.

Answer

The dashboard exposes the cloud provider root account password in plain text logs.

Answer

The attacker can harvest Kerberos ticket-granting tickets from the dashboard cache.

Answer

The attacker can perform a buffer overflow against the etcd TLS listener via the dashboard port.

Question 10

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

Accepted Answer

Exposing the Kubernetes API server endpoint directly to the public internet (0.0.0.0/0) without IP whitelisting or robust authentication.. Granting cluster-admin via ClusterRoleBinding to default service accounts and exposing the API server publicly without auth are severe risks.

Answer

Enabling Pod Security Standards (e.g., Restricted profile) across all namespaces.

Answer

Using network policies to isolate sensitive database pods from frontend web pods.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) across all API groups.