Knowledge + Practice

CCNA Iot And OT Exploitation Questions

60 questions · Iot And OT Exploitation · All types, answers revealed

Practice these questions Domain overview All questions

1

Multi-Selectmedium

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

Select 3 answers

A.HDMI display output pins used for high-speed video graphics rendering

B.RJ-45 Ethernet port pin 8 carrying PoE (Power over Ethernet) voltage directly to the CPU core

C.SPI (Serial Peripheral Interface) flash memory pins

D.UART (Universal Asynchronous Receiver-Transmitter)

E.JTAG (Joint Test Action Group)

AnswersC, D, E

SPI flash pins expose the raw firmware chip directly; attaching a programmer or logic analyser to the CLK, MOSI, MISO and CS lines allows testers to read or dump memory contents without booting the device, satisfying the scenario's requirement for extracting firmware or debug data from the PCB.

Why this answer

Physical hardware hacking heavily relies on serial debug interfaces like UART, JTAG for boundary-scan debugging, and SPI/I2C for flash memory extraction.

Practice this question →

2

MCQmedium

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

A./etc/mosquitto/mosquitto.conf

B./var/lib/mqtt/config.ini

C./opt/broker/settings.xml

D./etc/init.d/mosquitto.cfg

AnswerA

Mosquitto's Debian package installs its main configuration at /etc/mosquitto/mosquitto.conf, so inspecting that file reveals whether `allow_anonymous true` is set. This satisfies the analyst's need to verify anonymous access on the broker, since the daemon reads this path by default unless overridden with the -c flag.

Why this answer

Eclipse Mosquitto stores its primary configuration settings in '/etc/mosquitto/mosquitto.conf' on standard Linux installations.

Practice this question →

3

MCQmedium

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

A.s7comm

B.mms

C.iec104

D.bacnet

AnswerC

The `iec104` display filter isolates IEC 60870-5-104 application-layer frames, matching the telecontrol traffic the hacker needs to inspect for unauthenticated control commands. Unlike generic TCP port filters, it decodes the APCI/ASDU structure, exposing command type identifiers and cause-of-transmission fields directly, so injected control commands can be identified without manual payload parsing.

Why this answer

IEC 60870-5-104 operates over TCP port 2404. Wireshark decodes this under the 'iec104' protocol filter.

Practice this question →

4

MCQhard

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

A.0x0800

B.0x86DD

C.0x88B8

D.0x88E5

AnswerC

IEC 61850 GOOSE frames are encapsulated directly in Ethernet with EtherType 0x88B8, distinguishing them from MMS (0x88BA) and SV (0x88BA/0x88B9 variants). This Layer 2 value lets the tester filter and identify GOOSE traffic on the substation network.

Why this answer

GOOSE messages in IEC 61850 bypass the IP/TCP stack for speed and operate directly at Layer 2 using EtherType 0x88B8.

Practice this question →

5

MCQeasy

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

A.-sT

B.-sP

C.-sS

D.-sU

AnswerC

The -sS flag performs a TCP SYN scan, sending SYN packets and never completing the handshake, so no full connection is logged. It satisfies the stealth requirement by omitting service version detection, which -sV would add and thereby generate noisy, easily detected probes.

Why this answer

The -sS flag tells Nmap to perform a TCP SYN (half-open) scan: it sends a SYN, waits for SYN/ACK (open) or RST (closed), then sends RST instead of completing the three-way handshake. This is faster and stealthier than a full connect scan because no session is ever established, so application-layer logs on the target typically never record the probe. It requires raw-socket privileges (root/SYSTEM or CAP_NET_RAW).

Exam trap

CPENT often tests the difference between -sS (SYN stealth) and -sT (full connect) — candidates who forget that -sT completes the handshake and is logged will pick the wrong flag.

How to eliminate wrong answers

Option A (-sT) is wrong because it performs a full TCP connect() scan that completes the three-way handshake, which is logged by the target application and is noisier — the opposite of what the question asks. Option B (-sP) is wrong because it is the deprecated ping-scan flag (now -sn) used for host discovery, not port scanning. Option D (-sU) is wrong because it initiates a UDP scan, which is a different protocol entirely and irrelevant to a TCP SYN scan.

Practice this question →

6

Multi-Selecthard

An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)

Select 2 answers

A.Brute-forcing SSH passwords using Hydra against the host machine

B.Populating a PostgreSQL database with image metadata and utilizing Firmadyne helper scripts to extract the file system

C.Executing an SQL injection payload against the web server running on port 80

D.Sniffing 802.11 wireless beacons with an external USB Wi-Fi adapter in monitor mode

E.Running the emulated kernel image within QEMU system mode (e.g., qemu-system-mips) using a patched initrd

AnswersB, E

Firmadyne relies on a PostgreSQL database storing image metadata plus helper scripts that extract the firmware file system, providing the artefacts needed before emulation. This satisfies the stem's requirement for critical emulation and analysis steps.

Why this answer

Option B is correct because Firmadyne relies on a PostgreSQL database (typically the 'firmadyne' database) to store image metadata such as the image ID, hash, and architecture, and its helper scripts like extractor.py and getArch.py depend on this data to extract the firmware filesystem and determine the correct architecture. Option E is correct because Firmadyne emulates the firmware's kernel and filesystem using QEMU in system mode (e.g., qemu-system-mips, qemu-system-arm) with a custom patched initrd (often built via the console/inferKernel scripts) that boots the extracted filesystem and sets up networking for analysis. Option A is not relevant because Hydra SSH brute-forcing is a credential attack, not a step in emulating firmware.

Option C is not relevant because SQL injection against a web server is an exploitation technique, not part of the emulation setup. Option D is not relevant because sniffing 802.11 beacons requires monitor-mode Wi-Fi hardware and pertains to wireless traffic capture, not Firmadyne's QEMU-based emulation workflow.

Practice this question →

7

MCQmedium

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

A.modbus-discover

B.enip-info

C.bacnet-discover

D.dnp3-info

AnswerB

The enip-info Nmap script queries EtherNet/IP devices over TCP/44818, retrieving device identity and explicit messaging object data via CIP. That directly satisfies the requirement to enumerate explicit messaging objects and identity information on the industrial control network.

Why this answer

Nmap includes the 'enip-info' NSE script specifically designed to query EtherNet/IP devices for identification and vendor details.

Practice this question →

8

MCQmedium

An assessment team is analyzing an embedded Linux firmware image for an industrial IoT gateway. They have successfully extracted the filesystem using Binwalk, but they need to statically analyze the compiled binaries for potential buffer overflows and insecure function calls. Which tool is specifically designed to perform static binary analysis and identify vulnerable functions likestrcpy within the extracted filesystem?

A.Aircrack-ng

B.Binwalk

C.Ghidra

D.John the Ripper

AnswerC

Ghidra's decompiler and static analysis engine disassembles extracted binaries and flags insecure calls such as strcpy, letting analysts trace buffer overflow paths without executing the firmware. It handles multiple architectures, matching the embedded Linux gateway binaries recovered by Binwalk.

Why this answer

Ghidra is a reverse-engineering framework developed by the NSA that performs static binary analysis, disassembly, and decompilation. It can load extracted ELF binaries from a firmware filesystem and identify insecure function calls like strcpy, gets, and sprintf by examining the symbol table, imports, and decompiled code, making it ideal for finding buffer overflow candidates.

Exam trap

The trap is confusing firmware extraction tools (Binwalk) with binary analysis tools (Ghidra); candidates must recognize that static analysis of compiled code for insecure functions requires a disassembler/decompiler, not an extractor or password cracker.

How to eliminate wrong answers

Option A is wrong because Aircrack-ng is a Wi-Fi security auditing tool for cracking WEP/WPA/WPA2 keys, not a binary analysis tool. Option B is wrong because Binwalk is a firmware extraction and signature-scanning tool; it identifies and extracts filesystems but does not perform static binary analysis or decompilation. Option D is wrong because John the Ripper is a password cracker that tests hashes against wordlists, not a static binary analyzer.

Practice this question →

9

MCQhard

During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?

A.mitmproxy

B.Airodump-ng

C.Ncat

D.Hping3

AnswerA

mitmproxy terminates TLS using a custom CA certificate installed on the client, then re-encrypts traffic to the backend, letting the analyst read MQTT payloads. Disabled certificate validation means the client accepts the forged certificate without complaint.

Why this answer

mitmproxy is an interactive HTTPS/TLS interception proxy that can be configured with a custom CA certificate; because the IoT client has certificate validation disabled, it will accept mitmproxy's forged certificate and the analyst can decrypt and inspect the MQTT-over-TLS traffic. This makes it the right tool for transparently proxying TLS-wrapped MQTT.

Exam trap

CPENT often tests whether candidates can distinguish a TLS-terminating proxy (mitmproxy, sslsplit) from a raw packet relay (Ncat) or a wireless capture tool (Airodump-ng) — the trap is picking a tool that can 'see traffic' but cannot decrypt TLS.

How to eliminate wrong answers

Option B is wrong because Airodump-ng is a wireless 802.11 packet capture tool for WEP/WPA cracking and AP discovery, not a TLS interception proxy. Option C is wrong because Ncat is a general-purpose TCP/UDP relay and listener (netcat variant) — it can forward raw bytes but cannot terminate and re-sign TLS with a custom CA. Option D is wrong because Hping3 is a packet crafting and network scanning tool for TCP/IP testing, not a TLS man-in-the-middle proxy.

Practice this question →

10

MCQeasy

During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?

A.Reaver

B.Masscan

C.Nikto

D.Aircrack-ng

AnswerC

Nikto's database includes targeted checks for CGI scripts and OS command injection through GET parameters, directly matching the camera's embedded web server weakness. Unlike general-purpose scanners, its signature set focuses on web server misconfigurations and legacy CGI abuse, satisfying the stem's requirement for specific CGI and command-injection detection modules.

Why this answer

Nikto is a web server scanner that includes a comprehensive database of checks for CGI vulnerabilities, including OS command injection flaws in CGI scripts. It specifically tests for known CGI issues like Shellshock, default CGI scripts, and parameter injection points. The tool sends crafted HTTP requests to CGI endpoints and analyzes responses for signs of command execution, making it the correct choice for detecting web-based CGI vulnerabilities and command injection.

Exam trap

CPENT often tests the confusion between network scanning tools (Masscan, Nmap) and web vulnerability scanners (Nikto), or between wireless tools (Reaver, Aircrack-ng) and web tools, causing candidates to pick a tool based on general 'security' association rather than specific functionality.

How to eliminate wrong answers

Option A is wrong because Reaver is a WPS brute-force tool for cracking Wi-Fi Protected Setup PINs, not a web vulnerability scanner. Option B is wrong because Masscan is a high-speed port scanner, not a web application scanner; it does not detect CGI or command injection vulnerabilities. Option D is wrong because Aircrack-ng is a suite for auditing wireless networks (WEP/WPA cracking, packet capture), not for scanning web servers or CGI scripts.

Practice this question →

11

Multi-Selectmedium

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

Select 3 answers

A.Application layer function codes specifying operations like Read, Write, Select, and Operate

B.IEEE 802.11 WPA2 four-way handshake cryptographic parameters

C.Data link layer CRC error detection checksums embedded in data blocks

D.HTTP Authorization Bearer tokens used for REST API authentication

E.DNP3 Secure Authentication (SA) extensions designed to prevent unauthorized command injection and spoofing

AnswersA, C, E

DNP3's application layer carries function codes such as Read, Write, Select and Operate, which drive master-to-outstation control operations. These codes define the request semantics an analyst inspects when reviewing DNP3 traffic for unauthorised control commands.

Why this answer

Option A is correct because DNP3's application layer defines function codes such as Read (1), Write (2), Select (3), Operate (4), and Direct Operate (5), which are used to request data and control outstations in SCADA/ICS environments. Option C is correct because DNP3's data link layer frames include a CRC checksum in each data block (and header) to detect transmission errors, providing integrity at the link layer. Option E is correct because DNP3 Secure Authentication (SAv2/v5, defined in IEEE 1815) adds challenge-response authentication using HMAC to prevent unauthorized command injection, spoofing, and replay attacks.

Option B is incorrect because the WPA2 four-way handshake belongs to IEEE 802.11 wireless LAN security, not DNP3, which is a serial/TCP-IP SCADA protocol. Option D is incorrect because HTTP Bearer tokens are used for REST API authentication over HTTP, which is unrelated to the DNP3 protocol structure.

Practice this question →

12

MCQhard

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

A.Binwalk

B.John the Ripper

C.Nmap

D.Tcpdump

AnswerB

John the Ripper parses the extracted '/etc/shadow' hash offline and runs dictionary attacks against the root entry, directly addressing the stem's requirement to crack weak hashes from a mounted rootfs without touching the live gateway.

Why this answer

John the Ripper and Hashcat are industry-standard password cracking tools that accept shadow file formats for offline dictionary and brute-force attacks.

Practice this question →

13

Multi-Selecthard

During an assessment of a smart manufacturing facility, a penetration tester discovers an unauthenticated MQTT broker allowing anonymous publishing and subscription. Which TWO actions should the tester perform to validate the security risks associated with this misconfiguration? (Choose TWO)

Select 2 answers

A.Perform an aggressive TCP port scan using Nmap to identify non-standard service ports

B.Publish arbitrary control messages to actuator topics to test if physical machinery responds to unauthorized commands

C.Capture WPA2 four-way handshakes to crack the underlying Wi-Fi pre-shared key

D.Execute a brute-force dictionary attack against the MQTT broker management interface using Hydra

E.Subscribe to the root topic using the wildcard character '#' to capture all telemetry and potentially sensitive messages

AnswersB, E

Publishing to actuator topics directly validates the unauthenticated broker's real-world impact: because MQTT lacks per-topic authorisation, anonymous clients can inject commands into control channels. This confirms the stem's constraint — anonymous publishing — by demonstrating whether physical machinery actually executes unauthorised instructions, proving genuine operational risk rather than theoretical exposure.

Why this answer

Option B is correct because an unauthenticated MQTT broker that permits anonymous publishing lets the tester send crafted payloads to actuator/control topics (e.g., factory/line1/actuator/cmd) and observe whether the physical machinery or PLC responds, directly validating the integrity and safety impact of the misconfiguration. Option E is correct because subscribing to the root wildcard '#' on an anonymous broker captures every published topic, including telemetry, sensor readings, and potentially sensitive operational data, validating the confidentiality impact of the exposure. Option A is not appropriate because an aggressive Nmap TCP scan only enumerates open ports and does not validate the anonymous MQTT publish/subscribe risk.

Option C is unrelated because capturing WPA2 four-way handshakes targets Wi-Fi link-layer confidentiality, not the MQTT application-layer misconfiguration. Option D is also not applicable because the broker allows anonymous access, so brute-forcing a management interface with Hydra does not validate the anonymous publish/subscribe exposure.

Exam trap

CPENT often tests the tendency to pick generic scanning or brute-forcing actions instead of the specific publish/subscribe actions that actually demonstrate MQTT misconfiguration impact.

Practice this question →

14

Multi-Selecthard

A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)

Select 2 answers

A.Cracking WPA2 Pre-Shared Keys using a dictionary attack and Aircrack-ng

B.Executing an ARP spoofing attack to intercept printer traffic on the corporate IT network

C.Injecting an SQL injection payload into the device's Bluetooth GATT profile characteristic

D.Using TFTP to load and execute an unauthorized custom kernel image into device RAM

E.Interrupting the boot countdown and modifying 'bootargs' to append 'init=/bin/sh' to spawn a root shell

AnswersD, E

U-Boot's tftp and bootm commands fetch an attacker-supplied kernel over the network and execute it from RAM, bypassing any signed firmware in flash. This directly exploits the insecure bootloader and serial console access described, granting arbitrary code execution at the highest privilege level before the OS loads.

Why this answer

Option D is correct because U-Boot provides built-in tftp and bootm commands, so an attacker at the serial prompt can pull a malicious kernel image from a TFTP server into RAM and boot it, bypassing secure boot and any signed firmware enforcement. Option E is correct because interrupting the U-Boot countdown and editing the bootargs environment variable to append init=/bin/sh causes the Linux kernel to launch a root shell instead of the normal init process, granting immediate privileged access. Option A is wrong because cracking WPA2 PSKs with Aircrack-ng is a wireless-layer attack performed from a NIC in monitor mode, not from a U-Boot serial console.

Option B is wrong because ARP spoofing is a layer-2 network attack executed from a running OS with tools like arpspoof, which U-Boot does not provide. Option C is wrong because SQL injection into a Bluetooth GATT characteristic is an application-layer attack against a running Bluetooth stack, not something achievable from the U-Boot bootloader prompt.

Practice this question →

15

MCQeasy

An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?

A.TCP 102

B.TCP 20000

C.TCP 502

D.UDP 44818

AnswerC

Modbus/TCP reserves TCP 502 as its registered port, and PLCs answer function-code requests there by default. Scanning 502 with tools such as Nmap's modbus-display script enumerates slave IDs and device identity, satisfying the native-protocol discovery requirement.

Why this answer

Modbus/TCP is an open protocol widely used in SCADA environments and operates natively over TCP port 502.

Practice this question →

16

MCQmedium

A penetration tester is reviewing the firmware of a smart electricity meter and discovers that the bootloader is unlocked. The tester connects a USB-to-UART serial adapter to the board's exposed pins and interrupts the boot sequence to gain a root shell. Which environment variable or kernel boot parameter must the tester modify to bypass the root password authentication prompt entirely?

A.rootfstype=squashfs

B.ip=DHCP

C.mem=256M

D.init=/bin/sh

AnswerD

Setting `init=/bin/sh` replaces the kernel's default init process with a shell, so the boot sequence drops straight into a root shell without starting the login daemon that prompts for a password. This directly satisfies the stem's requirement to bypass the root password authentication prompt on the unlocked meter.

Why this answer

Appending 'init=/bin/sh' or 'init=/bin/bash' to the kernel boot arguments (bootargs) forces the Linux kernel to spawn a shell directly upon booting, bypassing init scripts and authentication prompts. 'rootfstype' defines the filesystem type, 'ip=' configures networking, and 'mem=' limits RAM.

Practice this question →

17

Multi-Selectmedium

A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)

Select 3 answers

A.Deploying industrial Intrusion Detection Systems (IDS) capable of parsing proprietary OT protocols (e.g., Modbus, DNP3, S7)

B.Utilizing unidirectional security gateways (data diodes) where data must flow from OT to IT without permitting inbound return paths

C.Allowing unrestricted direct Internet access from all PLC controllers for automated driver updates

D.Disabling all encryption across SCADA servers to improve packet inspection speeds on firewalls

E.Implementing strict network segmentation between IT corporate networks and OT plant floors using firewalls

AnswersA, B, E

Industrial IDS parsing Modbus, DNP3 and S7 detects malicious commands at the process level, where IT signature tools fail on proprietary protocols. This satisfies the stem's constraint of hardening SCADA against remote attacks by providing passive, protocol-aware monitoring that flags reconnaissance and manipulation attempts without disrupting fragile OT devices.

Why this answer

Option A is correct because industrial IDS solutions that understand proprietary OT protocols such as Modbus, DNP3, and S7 can detect malicious or anomalous control-plane traffic that generic IT IDS would miss, providing deep visibility into SCADA-specific attacks. Option B is correct because unidirectional security gateways (data diodes) enforce one-way data flow from OT to IT, physically preventing any inbound return path that an attacker could use to pivot into the plant floor. Option E is correct because strict segmentation between IT corporate networks and OT plant floors using firewalls (often via a DMZ or Purdue-model layering) limits lateral movement and blocks remote attacks originating from business or Internet-facing networks.

Option C is not recommended because giving PLC controllers unrestricted direct Internet access exposes them to remote exploitation and violates OT isolation principles; updates should be staged through controlled, mediated paths. Option D is not recommended because disabling encryption on SCADA servers weakens confidentiality and integrity and does not meaningfully improve firewall inspection, since firewalls generally do not decrypt traffic anyway.

Exam trap

CPENT often tests the misconception that 'encryption everywhere' and 'Internet access for updates' are universal hardening rules, when in OT the correct priorities are segmentation, one-way flow, and protocol-aware monitoring.

Practice this question →

18

MCQmedium

An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?

A.Function Code 01 (0x01) - Read Coils

B.Function Code 04 (0x04) - Read Input Registers

C.Function Code 02 (0x02) - Read Discrete Inputs

D.Function Code 16 (0x10) - Write Multiple Registers

AnswerD

Function Code 16 writes multiple holding registers in a single Modbus transaction, allowing an attacker to alter controller configuration parameters. This directly satisfies the requirement to test unauthorised firmware or configuration write capability on the legacy DCS controller.

Why this answer

Modbus function codes define the action to be performed. Function Code 16 (0x10) is 'Write Multiple Registers', frequently used to change register blocks in industrial controllers.

Practice this question →

19

MCQmedium

An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?

A.dpkg-deb

B.jeffs2dump / mtd-utils

C.rpmbuild

D.apt-get extract

AnswerB

Utilities within mtd-utils such as jeffs2dump allow parsing and extracting JFFS2 compressed flash image formats.

Why this answer

The 'mtd-utils' package includes tools like 'jeffs2dump' and 'nanddump', while 'jeffs2dump' or 'jeffs2extract' utilities unpack JFFS2 file systems.

Practice this question →

20

MCQmedium

A penetration tester is assessing a building automation system that uses BACnet for communication between controllers and a central workstation. The tester wants to enumerate all BACnet devices on the network and identify their object types and properties. Which tool should the tester use to perform this enumeration?

A.BACnet discovery tool (e.g., BACnet Scan or VTS)

B.Wireshark with a BACnet display filter

C.Nmap with the bacnet-info NSE script

D.Metasploit with the bacnet_scanner module

AnswerA

This is correct because dedicated BACnet discovery tools like BACnet Scan or VTS (Visual Test Shell) actively send BACnet Who-Is and Read-Property requests to enumerate devices, their object types, and properties. They provide a comprehensive view of the BACnet network, which is exactly what the tester needs. These tools are designed for BACnet enumeration and can list objects such as Analog Input, Binary Output, and their present values.

Why this answer

A dedicated BACnet discovery tool such as BACnet Scan or VTS can actively query the network using BACnet services like Who-Is and Read-Property to enumerate all devices, object types, and properties. This provides the comprehensive inventory the tester needs. Other tools like Nmap or Wireshark may offer limited visibility but cannot perform the full active enumeration required.

Exam trap

The trap here is confusing passive protocol analyzers with active enumeration tools, leading to incomplete results.

Practice this question →

21

MCQeasy

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

A.Gobuster

B.Wifite

C.Nbtscan

D.Hping3

AnswerA

Gobuster performs brute-force enumeration of web directories and files using wordlists, directly satisfying the need to uncover hidden administrative backup directories and configuration files on the embedded PLC's HTTP interface. Its directory mode sends rapid requests and reports valid paths by response status.

Why this answer

Gobuster is a Go-based command-line tool purpose-built for brute-forcing URIs (directories and files), DNS subdomains, and virtual hosts on web servers. It uses wordlists to enumerate hidden paths such as /admin, /backup, and configuration files, making it the correct choice for discovering hidden administrative directories on the PLC's web interface.

Exam trap

CPENT often tests tool-to-purpose mapping — candidates may pick Hping3 or Nmap because they associate 'brute force' with network scanning, but directory brute-forcing is specifically a web content discovery task handled by Gobuster, Dirb, or Feroxbuster.

How to eliminate wrong answers

Option B is wrong because Wifite is a wireless attack automation tool for cracking WEP/WPA/WPS networks — it has nothing to do with web directory enumeration. Option C is wrong because Nbtscan enumerates NetBIOS name information on Windows networks, not HTTP paths. Option D is wrong because Hping3 is a packet crafting and TCP/IP testing tool used for port scanning and firewall testing, not web content discovery.

Practice this question →

22

Multi-Selecthard

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

Select 2 answers

A.KillerBee (Python framework for exploiting Zigbee/IEEE 802.15.4)

B.Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

C.Wireshark configured with a captured network key to decrypt 802.15.4 application layers

D.Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

E.Burp Suite Professional for intercepting HTTP requests from web applications

AnswersA, C

KillerBee is a Python framework providing 802.15.4 packet capture, injection and Zigbee exploitation primitives, directly satisfying the stem's requirement for a tool specifically targeting Zigbee wireless security assessment rather than generic Wi-Fi or Bluetooth testing.

Why this answer

KillerBee (A) is correct because it is a Python-based framework specifically designed for sniffing, injecting, and exploiting Zigbee and IEEE 802.15.4 networks, making it a core tool for assessing smart lighting installations that use these protocols. Wireshark (C) is correct because, when supplied with the captured Zigbee network key, it can decrypt and dissect 802.15.4 application-layer traffic (e.g., Zigbee APS/ZCL payloads), which is essential for analyzing the security of the lighting network. Aircrack-ng (B) targets Wi-Fi WPA-PSK handshakes and is irrelevant to 802.15.4/Zigbee, Metasploit's msfvenom (D) generates Windows Meterpreter payloads for host/AD attacks rather than RF-layer Zigbee assessment, and Burp Suite (E) intercepts HTTP(S) web traffic, none of which apply to Zigbee wireless security testing.

Practice this question →

23

Multi-Selectmedium

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Select 3 answers

A.Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

B.Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights

C.Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

D.Verifying whether anonymous client connections are permitted by the broker

E.Checking if communication traffic is encrypted using TLS (Transport Layer Security)

AnswersB, D, E

Without enforced ACLs, any authenticated client can publish or subscribe to arbitrary topics, including control channels for locks or medical commands. Verifying ACL enforcement confirms whether the broker restricts topic-level permissions, satisfying the check for unauthorised publish and subscribe access.

Why this answer

Option B is correct because MQTT brokers rely on ACLs to authorize which clients may publish or subscribe to specific topics, and a tester should verify that these restrictions are actually enforced to prevent unauthorized topic access. Option D is correct because many brokers ship with anonymous access enabled by default, so confirming whether unauthenticated clients can connect is a fundamental MQTT hardening check. Option E is correct because MQTT traffic is frequently deployed in cleartext on TCP port 1883, and verifying that TLS is used (typically on port 8883) ensures confidentiality and integrity of the smart home communications.

Option A does not belong because Modbus/TCP function code 0x10 (Write Multiple Registers) is an industrial control protocol unrelated to MQTT broker configuration. Option C does not belong because an 802.11 deauthentication flood is a wireless-layer denial-of-service attack against Wi-Fi clients, not a broker security configuration check.

Practice this question →

24

MCQeasy

A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?

A.Bus Pirate

B.Wireshark

C.Logic Analyzer

D.HackRF One

AnswerA

The exposed clock, data, ground and power pins form a serial debug bus such as SPI or I2C. Bus Pirate speaks those protocols directly, letting the tester read the internal flash chip and dump firmware for hardcoded key analysis, which the scenario requires.

Why this answer

The Bus Pirate is a universal open-source hardware hacking tool designed to interface with embedded chips via SPI, I2C, UART, JTAG, and other low-level protocols. The described pins (clock, data, ground, power) match an SPI or I2C flash chip interface, which the Bus Pirate can directly read to dump firmware. It is the standard tool for in-circuit flash extraction when a physical debugging header is exposed.

Exam trap

CPENT often tests tool-purpose confusion — candidates see 'debugging interface' and pick a logic analyzer because it sounds like a debugging tool, but a logic analyzer only observes signals passively and cannot actively read or dump flash memory like the Bus Pirate.

How to eliminate wrong answers

Option B is wrong because Wireshark is a software network protocol analyzer that captures and inspects network packets — it has no physical interface for connecting to hardware debug pins or reading flash memory. Option C is wrong because a logic analyzer passively observes and records digital signals for timing analysis; it does not actively drive a bus or read flash contents, so it cannot dump firmware. Option D is wrong because the HackRF One is a software-defined radio for transmitting and receiving RF signals (e.g., Bluetooth, GPS, GSM), not a tool for interfacing with SPI/I2C flash chips on a circuit board.

Practice this question →

25

MCQeasy

A CPENT tester is evaluating an IoT device that exposes a serial console header on its PCB. After connecting a UART adapter, the tester sees garbled characters in the terminal. Which action should the tester take to obtain a readable console output?

A.Enable hardware flow control (RTS/CTS) in the terminal to stabilize the serial connection

B.Increase the UART adapter's voltage from 3.3V to 5V to boost signal integrity

C.Adjust the terminal's baud rate to match the device's configured UART speed, trying common values such as 115200 or 9600

D.Swap the TX and RX lines on the UART adapter to correct the garbled output

AnswerC

Garbled UART output almost always indicates a baud rate mismatch between the terminal and the device. Trying standard speeds like 115200, 57600, 38400, or 9600 until readable text appears is the correct diagnostic step. This is non-destructive and quickly establishes a working console for further IoT firmware and bootloader analysis.

Why this answer

Garbled UART output indicates the terminal's baud rate does not match the device's configured speed. Systematically trying common baud rates such as 115200, 57600, 38400, and 9600 until readable text appears is the standard, non-destructive fix. This restores the serial console, enabling bootloader and firmware analysis on the IoT device.

Exam trap

The trap here is misdiagnosing garbled UART output as a wiring or voltage problem, when it is almost always a baud rate mismatch.

Practice this question →

26

MCQeasy

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

A.Sqlmap

B.Hydra

C.Nikto

D.Wpscan

AnswerB

Hydra performs parallelised online dictionary attacks against network login services, including Telnet on port 23, accepting separate username and password lists. Its speed and protocol modules satisfy the stem's requirement for a fast credential-guessing tool.

Why this answer

Hydra is a fast, parallelized online password-cracking tool that supports dozens of protocols including Telnet, FTP, SSH, SMB, and HTTP. It accepts -L/-P username and password wordlists and performs a dictionary attack against a live service, making it the correct tool for brute-forcing Telnet on port 23. Its -t flag controls parallel tasks per target, and -f stops on the first valid credential found.

Exam trap

The trap here is confusing general-purpose scanners (Nikto, Wpscan, sqlmap) with dedicated authentication brute-force tools; candidates often pick Nikto because it 'scans services,' but it does not perform credential attacks.

How to eliminate wrong answers

Option A is wrong because sqlmap is a SQL injection automation tool for web applications and has no Telnet authentication brute-force capability. Option C is wrong because Nikto is a web server vulnerability scanner that probes HTTP/HTTPS services for misconfigurations and known issues, not a credential brute-forcer. Option D is wrong because Wpscan is a WordPress-specific scanner that enumerates plugins, themes, and users, and cannot attack a raw Telnet service.

Practice this question →

27

Multi-Selecthard

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

Select 2 answers

A.Executing a remote buffer overflow against the Linux kernel via wireless 802.11 management frames

B.Static or hardcoded pairing PINs (e.g., '0000' or '1234') susceptible to sniffing and brute-forcing

C.Injecting malicious SQL statements into the BLE radio frequency advertising packets

D.Performing an ARP cache poisoning attack against the target device's switch port

E.Insecure GATT characteristics allowing unauthorized unauthenticated read and write operations

AnswersB, E

Hardcoded or static pairing PINs such as '0000' let an attacker capture the pairing exchange and brute-force the six-digit key offline, then impersonate the sensor or hub. This weak-credential flaw directly undermines BLE pairing confidentiality in IoT medical devices.

Why this answer

Option B is correct because many BLE IoT devices ship with fixed or hardcoded pairing PINs such as '0000' or '1234'; since these values are predictable and often transmitted or used during the pairing exchange, an attacker within radio range can brute-force them or capture them via sniffing to complete pairing and gain access. Option E is correct because the Generic Attribute Profile (GATT) defines how services and characteristics are exposed, and if the device permits read/write operations on characteristics without requiring authentication or encryption, an attacker can use tools like gatttool or nRF Connect to read sensitive medical data or write malicious values to the sensor. Option A is not correct because it describes an 802.11 Wi-Fi kernel buffer overflow, which is unrelated to the BLE radio and protocol stack.

Option C is not correct because BLE advertising packets carry structured data (flags, UUIDs, TX power, etc.) and are not interpreted as SQL by any backend, so SQL injection is not a BLE attack vector. Option D is not correct because ARP cache poisoning targets IP/Ethernet LAN switching, whereas BLE is a point-to-point wireless protocol with no ARP or switch port involvement.

Practice this question →

28

MCQhard

During a CPENT engagement against a pharmaceutical manufacturer's OT environment, the tester captures Modbus/TCP traffic between a human-machine interface (HMI) and several PLCs. The tester wants to demonstrate that an attacker on the IT network could manipulate coil states on a specific PLC without authentication. Which action BEST demonstrates this risk while minimizing impact on the production line?

A.Initiate a Modbus/TCP Diagnose (0x08) request to clear counters and diagnostic registers on the PLC.

B.Send a Modbus/TCP Read Coils (0x01) request to the PLC and capture the response to prove unauthenticated access.

C.Craft a Modbus/TCP Write Single Coil (function code 0x05) packet targeting an unused coil address on the PLC.

D.Broadcast a Modbus/TCP Write Multiple Coils (0x0F) packet to all PLCs on the subnet to change every coil.

AnswerC

Modbus/TCP has no built-in authentication, and Write Single Coil (0x05) lets an attacker change a coil state directly. Targeting an unused coil address demonstrates the lack of authentication and the write capability while avoiding disruption to the production line's active control logic. This is a controlled proof of concept appropriate for a CPENT engagement where operational safety must be preserved.

Why this answer

Modbus/TCP lacks authentication, so a Write Single Coil (0x05) to an unused coil proves an attacker can manipulate coil states without credentials while avoiding disruption to active production logic. Broadcasting writes, reading only, or clearing diagnostics either endanger the line or fail to demonstrate the write capability that the scenario requires.

Exam trap

The trap here is believing that reading coil data proves write access, when the scenario specifically requires demonstrating manipulation of coil states.

Practice this question →

29

Multi-Selectmedium

An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)

Select 3 answers

A.Analyzing Modbus holding registers for unauthorized register modifications

B.Checking Bluetooth GATT profile characteristics using nRF Connect

C.Reviewing sudo privileges using 'sudo -l'

D.Inspecting scheduled tasks and cron jobs in '/etc/crontab' and '/var/spool/cron/'

E.Finding files with SUID/SGID permissions using 'find / -perm -4000 2>/dev/null'

AnswersC, D, E

Running sudo -l lists the invoking user's permitted sudo commands and their restrictions. Any allowed command that can spawn a shell or edit privileged files becomes an escalation path, directly exposing misconfigured sudoers entries on the gateway.

Why this answer

Finding privilege escalation vectors involves searching for SUID/SGID binaries, inspecting sudo permissions, and checking cron jobs.

Practice this question →

30

Multi-Selecthard

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

Select 2 answers

A.Using 'Aircrack-ng' to inject Bluetooth Low Energy advertisements into nearby smart meters

B.Running 'sqlmap' against TCP port 80 to extract database schemas from the corporate ERP

C.Cracking WPA2 enterprise handshakes using Hashcat and a dictionary list

D.Using Nmap with industrial NSE scripts such as 'modbus-discover', 's7-info', and 'enip-info'

E.Employing active asset discovery tools designed for OT environments (e.g., Nozomi Guardian, Claroty, or Dragos Platform)

AnswersD, E

Nmap's industrial NSE scripts probe protocol-specific fields: modbus-discover enumerates Modbus devices, s7-info fingerprints Siemens S7 PLCs, and enip-info queries EtherNet/IP identity objects. These fingerprint ICS devices by parsing native protocol responses rather than generic TCP banners.

Why this answer

Option D is correct because Nmap's NSE script engine includes ICS-specific scripts like modbus-discover, s7-info, and enip-info that actively probe Modbus/TCP (port 502), Siemens S7comm (port 102), and EtherNet/IP (port 44818) to identify and fingerprint PLCs, RTUs, and other industrial devices. Option E is correct because dedicated OT asset-discovery platforms such as Nozomi Guardian, Claroty, and Dragos Platform passively and/or actively inventory ICS/SCADA assets, extracting vendor, model, firmware, and protocol details across industrial networks. Option A is wrong because Aircrack-ng is a Wi-Fi auditing suite and does not inject BLE advertisements into smart meters.

Option B is wrong because sqlmap targets SQL injection in web applications and has nothing to do with ICS device fingerprinting. Option C is wrong because Hashcat cracking WPA2-Enterprise handshakes is a wireless credential attack, not OT asset discovery.

Exam trap

The trap is that candidates see 'network discovery' and pick generic IT tools (Nmap without ICS scripts, sqlmap, Aircrack-ng) instead of recognizing that ICS fingerprinting requires protocol-aware scripts or dedicated OT platforms.

Practice this question →

31

MCQmedium

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

A.tftp 0x80000000 kernel.bin

B.printenv mtdparts

C.setenv bootargs ${bootargs} init=/bin/sh

D.run flash_os_image

AnswerC

U-Boot's `setenv bootargs` rewrites the kernel command line passed at boot, and appending `init=/bin/sh` replaces the default init process with a shell running as root. This directly satisfies the stem's requirement to override kernel boot arguments via the serial console and spawn a root shell.

Why this answer

U-Boot uses environment variables to define boot parameters. Appending 'init=/bin/sh' or 'init=/bin/bash' to the 'bootargs' variable forces the kernel to launch a shell instead of the standard init process.

Practice this question →

32

Multi-Selectmedium

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Select 3 answers

A.Write to coils and holding registers to manipulate actuator states and setpoints

B.Send diagnostic or reset commands (e.g., Function Code 0x08) to cause controller reboots

C.Automatically decrypt Active Directory Kerberos ticket-granting tickets stored on the PLC

D.Read holding registers and input registers to harvest process variables and sensor data

E.Execute cross-site scripting (XSS) attacks against the PLC's internal browser rendering engine

AnswersA, B, D

Modbus/TCP lacks authentication, so an attacker reaching the broker can issue write function codes to coils and holding registers, altering actuator states and setpoints directly. This satisfies the stem's condition of improper segmentation and firewall rules.

Why this answer

Options A, B, and D are correct because Modbus/TCP is an unauthenticated industrial protocol whose function codes allow these operations once an attacker reaches the PLC. A: Function codes such as 0x05 (Write Single Coil), 0x06 (Write Single Register), 0x0F (Write Multiple Coils), and 0x10 (Write Multiple Registers) let an attacker change actuator states and setpoints, directly manipulating physical processes. B: Diagnostic function code 0x08 (Diagnostics) includes sub-functions like 0x01 (Restart Communications Option) and 0x04 (Force Listen Only Mode), and vendor-specific reset commands can force controller reboots or halt communications.

D: Function codes 0x03 (Read Holding Registers) and 0x04 (Read Input Registers) allow unauthenticated reading of process variables and sensor data, enabling reconnaissance and process-value harvesting. Option C is wrong because Modbus/TCP PLCs do not store or process Active Directory Kerberos ticket-granting tickets, and Kerberos TGTs are encrypted with the KDC's secret key, not something an OT attacker decrypts via Modbus. Option E is wrong because Modbus/TCP PLCs do not run a browser rendering engine, so cross-site scripting is not applicable to them.

Exam trap

CPENT often tests the misconception that OT/SCADA protocols have built-in security controls like authentication or encryption — candidates who assume Modbus/TCP behaves like a modern IT protocol will miss that read/write/diagnostic abuse is trivially possible once network segmentation fails.

Practice this question →

33

MCQeasy

A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?

A.Wireshark

B.Binwalk

C.Metasploit Framework

D.Aircrack-ng

AnswerB

Binwalk signatures compressed file systems, bootloaders, kernels and other embedded structures directly within the raw firmware image, listing offsets without extraction. That satisfies the quick identification constraint, unlike hexdump or strings, which reveal no structured layout.

Why this answer

Binwalk is the industry-standard tool for searching binary images for embedded file systems and executable code signatures.

Practice this question →

34

MCQeasy

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

A.Hydra

B.Airodump-ng

C.Sqlmap

D.Nbtscan

AnswerB

Airodump-ng passively captures 802.11 management frames, including beacons and probe requests, revealing access points and associated clients across the 2.4 GHz band. This satisfies the auditor's need to monitor and dump management frames during the wireless survey.

Why this answer

Airodump-ng is the premier tool included in the Aircrack-ng suite for capturing 802.11 wireless frames in monitor mode.

Practice this question →

35

MCQhard

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

A.QEMU_ROOTFS

B.LD_LIBRARY_PATH

C.QEMU_LD_PREFIX

D.PATH

AnswerC

QEMU_LD_PREFIX points QEMU-user at the emulated root filesystem, so the dynamic linker resolves shared libraries from that directory tree instead of the host. Exporting it satisfies the constraint of supplying missing library dependencies, preventing the segmentation fault during MIPS binary execution.

Why this answer

When running binaries under QEMU user-mode emulation, the QEMU_LD_PREFIX environment variable specifies the path to the root directory containing the target architecture's libraries.

Practice this question →

36

MCQmedium

During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?

A.UART (Universal Asynchronous Receiver-Transmitter)

B.JTAG (Joint Test Action Group)

C.I2C (Inter-Integrated Circuit)

D.SPI (Serial Peripheral Interface)

AnswerA

UART transmits asynchronously over two data lines: one for transmit, one for receive, with no shared clock. Ground and 3.3V on the outer pins supply reference and power, while the fluctuating middle pins carry serial data during boot, matching UART's idle-high signalling.

Why this answer

UART (Universal Asynchronous Receiver-Transmitter) interfaces typically consist of 4 pins: VCC, GND, TX, and RX, where TX and RX show fluctuating voltage activity during transmission upon boot.

Practice this question →

37

MCQmedium

A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?

A.A UDP broadcast packet containing a BACnet Who-Is request sent to port 47808

B.An ICMP ping sweep to identify all live IP addresses on the local network segment

C.An SNMP GETBULK request using the default private community string

D.A TCP SYN scan directed at port 47808 across the entire subnet

AnswerA

BACnet Who-Is is a broadcast datagram sent to UDP port 47808; every device on the subnet replies with an I-Am containing its device instance and address. This discovers devices without prior IP knowledge, unlike unicast or directed queries.

Why this answer

BACnet's Who-Is service is a broadcast request used for device discovery; it is sent as a UDP datagram to the BACnet/IP broadcast address on port 47808 (0xBAC0). Any BACnet device on the subnet responds with an I-Am message containing its device instance and address, allowing discovery without prior IP knowledge.

Exam trap

The trap is assuming BACnet uses TCP or that a generic ICMP/SNMP sweep will find devices; candidates must remember BACnet/IP is UDP-based on port 47808 and uses the Who-Is/I-Am broadcast discovery mechanism.

How to eliminate wrong answers

Option B is wrong because an ICMP ping sweep only identifies live IPs and does not speak BACnet, so it cannot enumerate BACnet device instances or properties. Option C is wrong because SNMP GETBULK with a community string targets SNMP agents (UDP 161), not BACnet devices, and BACnet does not use SNMP MIBs. Option D is wrong because BACnet/IP uses UDP, not TCP; a TCP SYN scan to port 47808 will not elicit BACnet responses and will miss devices entirely.

Practice this question →

38

MCQhard

A CPENT tester gains access to an engineering workstation on an OT network and finds a project file for a Siemens SIMATIC S7-1200 PLC. The tester wants to extract the PLC's configuration, including any stored password hashes, from the engineering workstation's project data to demonstrate credential exposure. Which artifact should the tester examine?

A.The S7-1200's web server index page, which serves the PLC password in cleartext over HTTP for diagnostic purposes

B.The .ap17 project archive's SystemBlock and hardware configuration XML files, which contain PLC protection level settings and hashed password material

C.The STEP 7 project's GlobalLabels CSV export, which stores the PLC password in a readable column

D.The S7-1200's SD card root directory file named PASSWD.TXT, which TIA Portal writes during commissioning

AnswerB

TIA Portal stores project data in an .ap17 archive containing XML and binary files. The SystemBlock and hardware configuration XML files hold the PLC's protection level and the password hash used for access levels. Extracting and analyzing these files can reveal the hash for offline cracking, demonstrating credential exposure from the engineering workstation without touching the live PLC.

Why this answer

TIA Portal project archives (.ap17) bundle the hardware configuration and SystemBlock data as XML and binary files. These contain the PLC protection level and the hashed password used for access control. Extracting and cracking that hash from the engineering workstation demonstrates credential exposure without interacting with the live PLC, which is the goal of this assessment.

Exam trap

The trap here is assuming the PLC itself exposes cleartext credentials, when the realistic exposure path is hashed password material inside the engineering workstation's project archive.

Practice this question →

39

MCQeasy

A CPENT tester is assessing a building automation system that uses KNX for lighting and HVAC control. The tester wants to understand the group address structure to map which devices control which functions. Which action BEST accomplishes this?

A.Send KNXnet/IP Tunneling requests to read the device descriptor of every actuator on the bus.

B.Perform a KNXnet/IP device management scan that resets all devices to factory default addresses.

C.Broadcast KNXnet/IP routing indications with a forged source address to overwrite group address assignments.

D.Capture KNXnet/IP traffic and decode the group address fields in telegram frames to map device-to-function relationships.

AnswerD

KNXnet/IP carries KNX telegrams over IP, and each telegram includes source, destination group address, and payload. Capturing and decoding these fields reveals which devices write to which group addresses, effectively mapping control relationships for lighting and HVAC. This passive method is appropriate for understanding the system without disrupting building operations.

Why this answer

Decoding group address fields in captured KNXnet/IP telegrams maps which devices control which lighting and HVAC functions, because each telegram carries source, destination group address, and payload. Overwriting assignments, factory resets, and descriptor reads either disrupt the system or return inventory data rather than the control relationships needed.

Exam trap

The trap here is confusing device descriptor reads with group address mapping, when descriptors reveal hardware details rather than control relationships.

Practice this question →

40

MCQmedium

A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?

A.ettercap

B.bacpypes (using scripts like whois.py / iam.py)

C.sqlmap

D.msfvenom

AnswerB

bacpypes is a Python BACnet stack whose whois.py and iam.py scripts broadcast Who-Is and parse I-Am replies, enumerating devices and object properties on the subnet. This directly satisfies the requirement for a BACnet-specific discovery tool.

Why this answer

bacpypes is a Python library that implements the BACnet protocol stack, and its bundled scripts such as whois.py (Who-Is/I-Am discovery) and iam.py (I-Am response) are designed specifically for BACnet device discovery and property enumeration. This makes it the correct tool for assessing BACnet/IP devices on a smart building network.

Exam trap

CPENT often tests whether candidates can map a protocol to its dedicated assessment tool — the trap is picking a generic network tool like ettercap or a web tool like sqlmap when the question specifically requires BACnet object/property discovery, which only bacpypes (or BACnet-specific tools like BACnet-discover) provides.

How to eliminate wrong answers

Option A is wrong because ettercap is a general-purpose LAN man-in-the-middle and ARP spoofing tool — it does not understand BACnet object properties or device discovery. Option C is wrong because sqlmap is an automated SQL injection tool for web applications, unrelated to BACnet. Option D is wrong because msfvenom is a Metasploit payload generator for creating exploit binaries, not a BACnet protocol assessment tool.

Practice this question →

41

MCQhard

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

A.s7-info

B.modbus-discover

C.bacnet-info

D.enip-info

AnswerA

The `s7-info` NSE script queries Siemens S7 PLCs over the S7comm protocol on TCP port 102, extracting module identification, rack and slot configuration, firmware version, and hardware order numbers. This directly satisfies the stem's requirement for detailed device information via the S7 communication protocol against the S7-1200.

Why this answer

Nmap includes specific industrial control scripts in the 'scripts/' directory. The 's7-info' script specifically queries Siemens S7 devices to extract operational data.

Practice this question →

42

MCQhard

A CPENT tester is evaluating an industrial control system that uses the DNP3 protocol for communication between a master station and remote terminal units (RTUs). The tester wants to determine whether the RTUs enforce any authentication on critical control functions. Which method is MOST appropriate to assess this without causing an outage?

A.Send DNP3 Operate (function code 0x04) commands to the RTU's control points to see if they are rejected.

B.Issue DNP3 Cold Restart (function code 0x0D) to the RTU and observe whether the device reboots successfully.

C.Use DNP3 Disable Unsolicited Responses (function code 0x15) to suppress event reporting and check for errors.

D.Capture DNP3 traffic and analyze the application layer for Secure Authentication (IEEE 1815) challenge-response exchanges.

AnswerD

DNP3 Secure Authentication adds challenge-response exchanges for critical function codes, so inspecting captured traffic reveals whether the RTU and master negotiate authentication. This passive analysis determines whether authentication is enforced without sending any control commands. It is the safest way to assess authentication on a live ICS and directly answers the question about enforcement on critical functions.

Why this answer

Passively analyzing captured DNP3 traffic for Secure Authentication challenge-response exchanges reveals whether the RTU enforces authentication on critical functions without sending control commands. Active Operate, Cold Restart, and Disable Unsolicited Responses either risk an outage or fail to answer the authentication question, so passive inspection is the safest and most direct method.

Exam trap

The trap here is thinking that sending a control command is necessary to test authentication, when passive inspection of challenge-response exchanges already reveals whether it is enforced.

Practice this question →

43

MCQhard

An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?

A.BeautifulSoup

B.Pandas

C.Pygame

D.Scapy

AnswerD

Scapy provides an IEC 60870-5-104 contrib layer (scapy.contrib.iec104) with APCI/ASDU classes, letting you craft and send raw application-layer frames over TCP. This satisfies the requirement to forge a circuit-breaker command ASDU at the application layer.

Why this answer

Scapy is a Python library for crafting, sending, sniffing, and dissecting network packets at arbitrary protocol layers, including raw application-layer payloads. It can construct custom IEC 60870-5-104 APDU/ASDU frames and transmit them over TCP, making it the correct tool for injecting forged ASDU commands to a smart grid device.

Exam trap

CPENT often tests whether candidates can distinguish general-purpose Python libraries from packet-crafting libraries — the trap is picking a familiar name like Pandas or BeautifulSoup when the question specifically requires raw protocol frame construction, which only Scapy provides.

How to eliminate wrong answers

Option A is wrong because BeautifulSoup is an HTML/XML parsing library used for web scraping — it has no packet crafting or network transmission capability. Option B is wrong because Pandas is a data analysis library for tabular data manipulation, unrelated to network protocols. Option C is wrong because Pygame is a game development framework for graphics and input handling, with no networking or protocol construction features.

Practice this question →

44

MCQmedium

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

A.strings -k squashfs-root/

B.grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/

C.firmadyne -s squashfs-root/

D.binwalk -A squashfs-root/

AnswerB

Recursive grep scans every file under squashfs-root, matching the literal PEM header that precedes hardcoded private RSA keys in firmware. The -r flag satisfies the requirement to search the entire extracted directory tree, while -n reports line numbers for locating each key within its file.

Why this answer

The grep command with the -r (recursive) and -n (line number) flags searches through all files in the squashfs-root directory for the string 'BEGIN RSA PRIVATE KEY'. This pattern is the standard header for PEM-encoded RSA private keys, making it an effective way to locate hardcoded keys in extracted firmware. The command is simple, fast, and does not require additional tools.

Exam trap

The trap is overcomplicating the search with specialized tools when a basic grep command is the most direct method. Candidates might choose binwalk or firmadyne thinking they are required for firmware analysis, but the question asks for a search command.

How to eliminate wrong answers

Option A is wrong because 'strings -k' is not a valid option; strings extracts printable characters but does not search for specific patterns recursively. Option C is wrong because firmadyne is an emulation framework, not a search tool, and '-s' is not a valid flag for searching. Option D is wrong because binwalk -A performs architecture analysis, not string searching for private keys.

Practice this question →

45

Multi-Selecthard

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

Select 3 answers

A.Disable all TCP and UDP ports on the SCADA network switches

B.Deploy industrial Intrusion Detection Systems (IDS) tuned for OT protocol anomalies

C.Deploy network segmentation adhering to the ISA/IEC 62443 zones and conduits model

D.Implement industrial firewalls capable of Deep Packet Inspection (DPI) for SCADA protocols

E.Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

AnswersB, C, D

An OT-tuned IDS passively monitors SCADA traffic and alerts on protocol anomalies and malicious command sequences, compensating for the absent encryption and authentication in legacy protocols by detecting exploitation attempts that those protocols cannot themselves prevent or log.

Why this answer

Option B is correct because an industrial IDS tuned for OT protocol anomalies (e.g., Modbus, DNP3, IEC 61850) provides passive monitoring and detection of malicious or abnormal commands without requiring the legacy protocols to support encryption or authentication. Option C is correct because ISA/IEC 62443 zones and conduits segmentation limits lateral movement and restricts access to SCADA devices, effectively compensating for the lack of native security in the protocols. Option D is correct because industrial firewalls with SCADA-aware Deep Packet Inspection can enforce protocol-level allowlisting and filter malformed or unauthorized function codes (e.g., Modbus write commands) that legacy protocols cannot authenticate.

Option A is incorrect because disabling all TCP/UDP ports would break the SCADA network's required communications and is not a viable compensating control. Option E is incorrect because PLCs typically run real-time operating systems that cannot host traditional endpoint antivirus, and such software is not designed for OT environments.

Exam trap

CPENT often tests the misconception that IT security controls (antivirus, patching, standard firewalls) translate directly to OT — candidates who pick endpoint AV on PLCs or blanket port shutdowns reveal a lack of OT-specific knowledge.

Practice this question →

46

MCQeasy

A penetration tester is assessing an IoT device that uses MQTT for communication. The tester has captured MQTT traffic and notices that the CONNECT packets do not include a username or password. Which of the following best describes the security implication of this observation?

A.The MQTT protocol inherently does not support authentication, so this is expected behavior.

B.The MQTT traffic is encrypted with TLS, so the absence of credentials is not a concern.

C.The MQTT broker is using certificate-based authentication, which replaces username and password.

D.The MQTT broker allows anonymous connections, which may permit unauthorized clients to publish or subscribe to topics.

AnswerD

When MQTT CONNECT packets lack a username and password, the broker may be configured to allow anonymous access. This means any client can connect without credentials and potentially subscribe to sensitive topics or publish malicious data. In IoT environments, this is a common misconfiguration that can lead to data leakage or device manipulation. Therefore, this observation indicates a significant security risk.

Why this answer

MQTT CONNECT packets without a username and password often indicate that the broker permits anonymous connections. This misconfiguration allows any client to connect and potentially access or manipulate MQTT topics, leading to data breaches or unauthorized control of IoT devices. It is a critical finding in a penetration test, as it directly impacts the confidentiality and integrity of the system.

Exam trap

The trap here is assuming that TLS encryption automatically provides authentication, when in fact anonymous access can still be allowed even over TLS.

Practice this question →

47

MCQeasy

An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?

A.The MQTT connection is not using TLS encryption.

B.The MQTT broker is configured to use TLS, but the client is not.

C.The MQTT client is configured to use MQTT over WebSocket without TLS.

D.The MQTT broker is using a self-signed certificate that the client rejects.

AnswerA

MQTT, by default, does not encrypt traffic. If TLS is not configured, all data, including CONNECT packets with username and password, is sent in cleartext. This is the most likely reason for the exposure. The tester observed credentials in cleartext, which directly indicates the absence of TLS encryption on the MQTT connection.

Why this answer

MQTT does not encrypt traffic by default. Without TLS, the CONNECT packet, which contains username and password, is transmitted in cleartext. The observation of cleartext credentials directly points to the absence of TLS encryption on the MQTT connection.

Other options describe scenarios that would either prevent connection or are specific subsets of the same root cause.

Exam trap

The trap here is overcomplicating the reason for cleartext credentials when the simplest explanation is the lack of TLS encryption.

Practice this question →

48

Multi-Selectmedium

A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)

Select 3 answers

A.Lack of cryptographic authentication on control commands (allowing spoofing)

B.Strict implementation of mandatory end-to-end TLS 1.3 encryption on all internal PLC racks

C.Cleartext transmission of industrial control protocols (e.g., Modbus, Telnet)

D.Automatic hardware-level isolation preventing any lateral movement from the corporate IT network

E.Use of default or hardcoded service credentials on engineering workstations and PLCs

AnswersA, C, E

Legacy OT protocols such as Modbus and DNP3 were designed without authentication, so any host on the segment can forge control commands. This satisfies the spoofing vector, letting an attacker issue unauthorised setpoints or commands to PLCs.

Why this answer

Option A is correct because legacy OT protocols such as Modbus/TCP, DNP3, and IEC 60870-5-104 typically lack cryptographic authentication, so an attacker on the network can forge or replay control commands to spoof a master station or HMI. Option C is correct because these same industrial protocols (Modbus, DNP3, Profinet, and Telnet for device management) usually transmit data in cleartext, allowing credential capture and command manipulation via simple sniffing. Option E is correct because engineering workstations, PLCs, and RTUs frequently ship with default, shared, or hardcoded service credentials that are rarely changed in legacy deployments, giving testers easy authenticated access.

Option B does not belong because mandatory end-to-end TLS 1.3 on internal PLC racks is not a common finding in legacy SCADA environments—most legacy PLCs cannot even negotiate TLS, so this describes a hardened state rather than a vulnerability. Option D does not belong because automatic hardware-level isolation from the corporate IT network is not a typical OT characteristic; flat or poorly segmented networks enabling IT-to-OT lateral movement are the common finding, not enforced isolation.

Practice this question →

49

MCQeasy

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

A.ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

B.netstat -an | grep 80

C.traceroute -p 80 192.168.1.100

D.curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api

AnswerD

curl sends an arbitrary POST with a JSON body and explicit Content-Type header, letting the tester deliver the injection payload to the unauthenticated API endpoint. It satisfies the constraint of crafting a custom JSON request from the command line without needing a scripting language or interactive client.

Why this answer

cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Practice this question →

50

MCQmedium

A CPENT tester is engaged to assess a municipal water utility's OT network. After passively mapping the environment, the tester identifies a Siemens SIMATIC S7-1200 PLC on VLAN 20 and wants to read the current state of its process image inputs and outputs without altering the running program. Which approach is MOST appropriate for this objective?

A.Replay a captured S7comm Stop CPU request to place the PLC in STOP mode and inspect its diagnostic buffer.

B.Perform an S7comm Upload (0x1D) of the entire program block to the tester's workstation to infer I/O values.

C.Use an S7comm Read Variable (0x04) request against the process image input and output areas of the PLC.

D.Send S7comm Write Variable (0x05) requests to the PLC's memory areas to force input and output values.

AnswerC

S7comm Read Variable requests retrieve data from specified memory areas, including the process image inputs (PE) and outputs (PA), without writing to the PLC. This satisfies the requirement to observe current I/O state while leaving the running program and physical process untouched. It is a standard, low-impact method used during OT enumeration on Siemens S7-1200/1500 devices.

Why this answer

Reading the current process image inputs and outputs on a Siemens S7-1200 requires an S7comm Read Variable request, which queries the PLC's PE and PA areas without changing execution. Write Variable, Stop CPU, and full program Upload either alter state, halt the process, or return logic rather than live I/O, so they fail the read-only requirement on a live water utility.

Exam trap

The trap here is assuming that uploading the PLC program is equivalent to reading live I/O, when upload returns static logic rather than the current process image values.

Practice this question →

51

MCQeasy

During an assessment of an Operational Technology (OT) network, a tester discovers a Programmable Logic Controller (PLC) using the Modbus TCP protocol. The tester needs to query holding registers to understand the operational state of the industrial process. Which default TCP port should the tester target for Modbus communications?

A.Port 80

B.Port 502

C.Port 443

D.Port 1883

AnswerB

Modbus TCP encapsulates its protocol data unit directly in TCP segments, and the specification reserves port 502 as the registered default for this traffic. Targeting 502 lets the tester issue function code 3 read-holding-register requests to the PLC, satisfying the requirement to query holding registers and assess the process state.

Why this answer

Modbus TCP uses port 502 by default. Port 80 is HTTP, port 443 is HTTPS, and port 1883 is MQTT.

Practice this question →

52

MCQhard

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

A.Snort

B.Autopsy

C.Wireshark

D.Ghidra

AnswerD

Ghidra, released by NSA, disassembles and decompiles ELF binaries across architectures including ARM, so it handles the router's auth_service without executing it. Static analysis of compiled code for buffer overflows is exactly its supported workflow.

Why this answer

Ghidra is an open-source reverse engineering suite developed by the NSA that supports multiple processor architectures, including ARM, MIPS, and PowerPC, making it ideal for IoT firmware analysis.

Practice this question →

53

MCQeasy

An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?

A.John the Ripper

B.Wireshark

C.Hashcat

D.Dirb

AnswerB

Wireshark's Modbus/TCP dissector decodes function codes, register addresses and values, and its IO Graph and statistics features plot register state changes over capture time. This satisfies the stem's requirement to automatically extract registers and visualise changes from the PCAP.

Why this answer

Wireshark natively dissects Modbus/TCP (port 502) and can display coil, register, and function-code fields; using its filter and IO Graph or Statistics features, the analyst can extract register values and visualize state changes over time from the PCAP. This makes it the correct tool for the described task.

Exam trap

CPENT often tests whether candidates recognize that Wireshark is not just a 'packet viewer' but a full protocol dissector with export and graphing capabilities — the trap is assuming you need a specialized ICS tool when Wireshark already parses Modbus.

How to eliminate wrong answers

Option A is wrong because John the Ripper is an offline password cracker for hashes, not a protocol analyzer. Option C is wrong because Hashcat is a GPU-accelerated hash cracking tool, unrelated to Modbus traffic analysis. Option D is wrong because Dirb is a web content brute-forcer that enumerates directories and files on HTTP servers, not an ICS protocol dissector.

Practice this question →

54

MCQeasy

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

A.JTAGulator

B.Bus Pirate

C.Rubber Ducky

D.HackRF One / RTL-SDR

AnswerD

HackRF One is a half-duplex SDR transceiver covering 1 MHz to 6 GHz, spanning the 433 MHz band, with RTL-SDR as a receive-only alternative. It satisfies the stem's capture-and-replay requirement, unlike fixed-frequency hardware that cannot record arbitrary waveforms.

Why this answer

HackRF One, RTL-SDR, and similar software-defined radios are used for capturing RF signals. Specifically, devices like RTL-SDR or HackRF paired with GNU Radio or Universal Radio Hacker (URH) cover the 433 MHz band.

Practice this question →

55

Multi-Selectmedium

A CPENT tester is assessing a building automation system that uses BACnet over IP. The tester needs to perform active discovery to enumerate BACnet devices and their objects on the network. Which TWO of the following approaches are valid for active BACnet/IP device enumeration? (Choose two.)

Select 2 answers

A.Use the BACnet ReadProperty service to query the object-list property of each discovered device to enumerate its objects

B.Perform a BACnet WriteProperty to set the device's object-list to a known value, then read it back to confirm enumeration

C.Send a BACnet Who-Has broadcast to retrieve the firmware version and vendor ID of every device

D.Send a BACnet Who-Is broadcast and collect I-Am responses to identify device instance numbers and addresses

E.Use the BACnet SubscribeCOV service to force every device to continuously report all object values

AnswersA, D

Once devices are discovered, the ReadProperty service can retrieve the object-list property, which enumerates all BACnet objects (analog inputs, binary outputs, schedules, etc.) on the device. This is a read-only operation that maps the device's exposed points. It is a core active enumeration technique for understanding what is controllable or monitorable on the BACnet network.

Why this answer

Active BACnet/IP enumeration starts with a Who-Is broadcast to collect I-Am responses, yielding device instance numbers and addresses. From there, ReadProperty against each device's object-list reveals all exposed objects. Together these read-only services provide a complete device and object inventory without writing to the system, which is essential for safe OT assessment.

Exam trap

The trap here is confusing read-only BACnet services like Who-Is and ReadProperty with write or subscription services like WriteProperty and SubscribeCOV, which are not enumeration tools.

Practice this question →

56

MCQmedium

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

A.Bash

B.PowerShell

C.Lua

D.Ruby

AnswerC

Lua is embedded in Wireshark as its scripting engine for lightweight, user-written dissectors, letting the tester parse the proprietary UDP binary structure without recompiling C code. This satisfies the stem's requirement for a natively supported scripting language.

Why this answer

Wireshark supports Lua natively for writing post-dissection scripts, custom dissectors, and heuristic analyzers without needing to recompile the source code in C.

Practice this question →

57

MCQmedium

During an OT assessment, you capture network traffic on the plant floor and notice that a Siemens S7-1200 PLC responds to read/write requests on TCP port 102 without requiring any authentication. You want to interact with the PLC to read its current process values and verify whether an attacker could manipulate the logic. Which tool is specifically designed to communicate with Siemens S7 PLCs over the S7comm protocol for this purpose?

A.Wireshark with the s7comm dissector

B.Snap7

C.Modbus Poll

D.Nmap with the s7-info script

AnswerB

Snap7 is an open-source Ethernet communication suite specifically designed for Siemens S7 PLCs. It implements the S7comm protocol and allows a tester to connect to S7-1200/1500/300/400 PLCs over TCP port 102, read/write memory areas, and even manipulate the PLC program. It is the correct tool for actively interacting with the S7-1200 in this scenario.

Why this answer

Siemens S7 PLCs use the proprietary S7comm protocol over TCP port 102. To actively read/write process values or modify logic, a tool that implements S7comm is required. Snap7 is an open-source library and set of tools that provides this capability, allowing direct interaction with S7-1200, S7-1500, S7-300, and S7-400 PLCs.

Other options either target different protocols or are passive/information-gathering tools.

Exam trap

The trap here is confusing information-gathering tools like Nmap scripts with active exploitation tools that can read and write PLC memory.

Practice this question →

58

MCQmedium

A CPENT tester is assessing a water treatment plant's OT network. The tester has captured traffic on the plant's control VLAN and wants to enumerate all Modbus/TCP devices and their supported function codes without disrupting operations. Which Nmap NSE script should the tester run against the subnet to perform this discovery safely?

A.nmap -p 502 --script modbus-discover <subnet>

B.nmap -sU -p 502 --script modbus-discover <subnet>

C.nmap -p 502 --script modbus-write <subnet>

D.nmap -p 502 --script modbus-discover --script-args modbus-discover.force=true <subnet>

AnswerA

The modbus-discover NSE script sends a safe Modbus Read Device Identification request to TCP port 502 and parses the response to list slave IDs, vendor, and supported function codes. Running it with a normal TCP scan on port 502 is non-intrusive and ideal for enumerating PLCs on a live control VLAN without writing coils or registers.

Why this answer

Modbus/TCP devices listen on TCP port 502, and the modbus-discover NSE script performs read-only device identification and function-code enumeration by sending safe Read Device Identification requests. Running a standard TCP scan against port 502 with this script enumerates PLCs without issuing writes, which meets the requirement to discover devices without disrupting plant operations.

Exam trap

The trap here is assuming Modbus/TCP uses UDP or that a write-capable NSE script is needed to enumerate device details, when read-only discovery on TCP 502 is sufficient.

Practice this question →

59

MCQhard

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

A.Snap7 library scripts

B.Aircrack-ng

C.Hydra

D.Wireshark

AnswerA

Snap7 is an open-source library exposing S7comm client functions, letting an attacker craft packets that read and write PLC memory and change the operating mode. This satisfies the requirement to inject malicious logic into the S7-300.

Why this answer

Snap7 is an open-source Siemens S7 communication library that allows developers and testers to interact with Siemens PLCs. Wireshark is passive, Metasploit has limited industrial modules, and Scapy can craft raw packets but Snap7 is the standard library for S7comm manipulation.

Practice this question →

60

MCQhard

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

A.UDP 1900

B.UDP 5353

C.UDP 5060

D.UDP 5683

AnswerD

UDP 5683 is the IANA-assigned default port for unencrypted CoAP, matching the stem's plaintext constraint. CoAP's encrypted variant, CoAPs, uses UDP 5684 with DTLS instead. Targeting 5683 lets the Scapy packet reach the smart meter's standard CoAP endpoint without TLS interception.

Why this answer

CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Iot And OT Exploitation questions.

Start 20-question session