20+ practice questions focused on Privilege Escalation Lateral Movement And Post Exploitation — one of the most tested topics on the EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Privilege Escalation Lateral Movement And Post Exploitation PracticeDuring an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?
Explanation: When Credential Guard is enabled, direct reading of LSASS memory is blocked. However, techniques like throwing tokens or using restricted administrator access tokens, or abusing specific COM/RPC objects, are alternative vectors, though Pass-the-Ticket via Kerberos delegation or abusing DPAPI are standard workarounds. Specifically, forcing NTLM authentication or abusing constrained delegation are preferred. Wait, the question asks for bypassing Credential Guard or interacting with LSASS - actually, direct LSASS dumping fails, but token impersonation or abusing DCShadow/DCSync if domain admin is available works. For local Credential Guard bypass, Over-Pass-the-Hash (generating Kerberos tickets via AES keys) works if AES keys are extracted from NTDS.dit or kerberos traffic.
An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?
Explanation: The /etc/cron.d/ directory is specifically designed for system administrators and packages to drop in cron job files without editing the main /etc/crontab. Each file in /etc/cron.d/ follows the system crontab format, which includes an extra field for the user to run the job as (e.g., 'root'). This allows an attacker with write access to /etc/cron.d/ to create a file that schedules a command to run as root every 5 minutes, achieving persistence. The format '* * * * * root /bin/nc ...' is correct for a job that runs every minute, but the question specifies every 5 minutes; however, the option is still the correct location because it's the only one that supports root execution via cron without modifying /etc/crontab.
During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?
Explanation: WMI (Windows Management Instrumentation) relies on DCOM/RPC for remote communication. The initial connection is made to the RPC Endpoint Mapper on TCP port 135, which then directs the client to a dynamically allocated port for the actual WMI service. Therefore, TCP 135 must be accessible through firewalls to initiate a WMI connection.
A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?
Explanation: Unquoted service paths can be queried via WMI or PowerShell without admin rights. The Get-WmiObject command querying Win32_Service can filter for paths containing spaces and not enclosed in quotes.
An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?
Explanation: WMI persistence involves creating an __EventFilter to trigger on system startup, an __EventConsumer (specifically CommandLineEventConsumer) to execute the payload, and a __FilterToConsumerBinding to link the two objects together.
+15 more Privilege Escalation Lateral Movement And Post Exploitation questions available
Practice all Privilege Escalation Lateral Movement And Post Exploitation questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Privilege Escalation Lateral Movement And Post Exploitation. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Privilege Escalation Lateral Movement And Post Exploitation questions on the CPENT frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Privilege Escalation Lateral Movement And Post Exploitation is tested as part of the EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) blueprint. Practicing with targeted Privilege Escalation Lateral Movement And Post Exploitation questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CPENT practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Privilege Escalation Lateral Movement And Post Exploitation is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Privilege Escalation Lateral Movement And Post Exploitation practice session with instant scoring and detailed explanations.
Start Privilege Escalation Lateral Movement And Post Exploitation Practice →