scenario questions

A hardware penetration tester is investigating an IoT device printed circuit board (PCB) to extract sensitive firmware or debug data. Which THREE of the following physical hardware interfaces are commonly targeted by testers to gain console access or read memory? (Choose THREE)

When executing BloodHound to map Active Directory attack paths, which collector option should be specified via SharpHound to gather computer local admin rights without requiring Domain Admin privileges?

A security analyst is investigating an IoT incident where an attacker gained unauthorized access to an MQTT broker. The analyst wants to inspect the broker configuration file on a Debian-based Linux system running Eclipse Mosquitto to check if anonymous access was enabled. What is the default file path for the Mosquitto configuration file?

A penetration tester is analyzing a compromised Windows system and wants to check for stored credentials in the Windows Credential Manager. Which command-line utility can be used to list saved credentials?

Which native Windows command-line tool can be used by a penetration tester to view cached Kerberos tickets currently loaded in the user session?

An ethical hacker is testing an ICS network that utilizes the IEC 60870-5-104 protocol for telecontrol equipment. The hacker wants to test whether control commands can be sent without proper authentication. Which Wireshark filter syntax should the hacker apply to isolate IEC 104 application layer frames in a capture file?

During an assessment, a penetration tester captures an LLMNR/NBT-NS broadcast request on the local network segment. Which tool can the tester use to spoof the response and capture the resulting NTLMv2 password hash when the victim machine attempts authentication?

An operator has gained administrative access to a Linux machine and wants to ensure persistent access that survives reboots while minimizing the chance of detection by standard security audits. Which THREE persistence methods are commonly implemented on Linux systems?

An attacker has gained access to an internal machine and wants to determine whether network traffic can be redirected using source routing options in IPv4 packets. Which tool allows crafting custom IPv4 packets with source routing options enabled?

When conducting lateral movement in an Active Directory environment, which TWO of the following techniques are commonly used to move from a compromised workstation to a server?

You have gained access to a Linux jump box and need to set up a local port forward using SSH to access an internal web application running on port 80 of a restricted server (10.0.0.5) that is only accessible from the jump box. Which SSH client flag combination establishes a local port forwarding tunnel listening on port 8080 of your attacking machine?

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

During an internal engagement, a penetration tester gains access to a Linux host that has multiple network interfaces. The tester needs to determine which interface can route to the 10.10.10.0/24 subnet and what the next-hop gateway is. Which command provides this information most directly?

A penetration tester is analyzing a smart medical pump and needs to check for open ports and running services on the embedded operating system. Using Nmap, the tester wants to perform a TCP SYN scan against the device while avoiding noisy service version detection to remain stealthy. Which Nmap flag specifies a SYN stealth scan?

An advanced adversary has gained Domain Administrator privileges and wants to establish stealthy, long-term persistence in Active Directory without relying solely on traditional user accounts or standard scheduled tasks. Which THREE advanced persistence mechanisms can be deployed in an Active Directory environment? (Choose THREE)

You have compromised a Windows workstation and want to maintain persistence by ensuring your malicious executable runs every time a user logs on. You have local administrator rights. Which registry key should you modify?

An attacker has successfully established a man-in-the-middle position on a local network segment using ARP spoofing. To ensure they capture sensitive authentication traffic, which THREE tools or utilities can capture and parse credentials passing across the wire? (Choose THREE)

An attacker has gained command execution on an internal machine and wants to bypass egress filtering that blocks all outbound TCP and UDP ports except port 53. Which tool can be used to tunnel arbitrary TCP traffic encapsulated inside DNS queries out of the network?

You are conducting an external penetration test against a company's web server. You discover that the server is vulnerable to a buffer overflow in a custom CGI script. You want to exploit it to gain a reverse shell. Which Metasploit payload should you use to establish a Meterpreter session?

An IoT firmware analyst is performing emulation of a MIPS-based router firmware binary using Firmadyne. Which TWO of the following steps or components are critical to successfully emulate and analyze the firmware image? (Choose TWO)

During an Azure penetration test, an attacker identifies an Azure Function with an HTTP trigger that uses function-level keys. However, the function key was leaked in a public GitHub repository. What level of access does this key provide?

An auditor is reviewing an Azure Kubernetes Service (AKS) cluster and discovers that Role-Based Access Control (RBAC) was disabled during cluster creation, and Azure Active Directory integration is not enabled. What is the primary security consequence?

You have gained access to a Linux host and escalated to root. You want to maintain persistence by creating a backdoor that will execute a reverse shell each time the system reboots. Which method would best achieve this while evading common detection mechanisms?

A pentester is analyzing an industrial control network and identifies devices communicating via EtherNet/IP (CIP). The pentester wants to enumerate explicit messaging objects and device identity data. Which Nmap script should the tester invoke?

An assessment team is analyzing an embedded Linux firmware image for an industrial IoT gateway. They have successfully extracted the filesystem using Binwalk, but they need to statically analyze the compiled binaries for potential buffer overflows and insecure function calls. Which tool is specifically designed to perform static binary analysis and identify vulnerable functions likestrcpy within the extracted filesystem?

Which TWO configuration checks should a penetration tester perform when auditing an Active Directory domain for potential NTLM Relay vulnerabilities?

A penetration tester is evaluating a Google Cloud Platform (GCP) environment and discovers a service account key file stored in a public Cloud Storage bucket. The service account has the roles/editor role on the project. What is the most direct way for the tester to leverage this key to gain unauthorized access to the project's resources?

During network enumeration of a Windows domain, a penetration tester discovers multiple legacy services running. Which TWO protocols or services, if enabled, frequently expose sensitive domain or system information without requiring authentication? (Choose TWO)

When generating a Silver Ticket using Impacket's ticketer.py, what specific piece of cryptographic material is required instead of the KRBTGT hash?

During a post-exploitation phase on a Windows workstation, a tester dumps LSASS memory and extracts an NTLM password hash. The tester then uses the CrackMapExec tool to authenticate to other workstations using this hash without cracking it first. What attack technique is being executed?

During an IoT penetration test, an analyst discovers that a connected medical device communicates with its cloud backend using MQTT over TLS, but certificate validation is disabled in the client code. The analyst wants to perform a man-in-the-middle (MitM) attack to inspect the MQTT traffic. Which tool configured with a custom Certificate Authority (CA) is best suited to intercept this TLS-wrapped MQTT traffic?

You are performing a penetration test against a network segment where direct outbound TCP connections are blocked by a strict firewall, but outbound DNS queries over UDP port 53 to an external DNS server are permitted. To tunnel traffic out of this restricted environment, which tool allows you to encapsulate arbitrary TCP traffic within DNS queries?

A penetration tester is performing post-exploitation reconnaissance on a Linux machine. Which THREE files or directories should the tester examine to identify potential sensitive configuration data, credentials, or cron jobs? Choose three.

During an IoT assessment, a tester discovers that a connected security camera runs an embedded web server with a CGI script vulnerable to OS command injection via a GET parameter. Which automated vulnerability scanner includes specific modules for detecting web-based CGI vulnerabilities and command injection?

During a penetration test of an Azure Active Directory tenant, an attacker identifies multiple security misconfigurations. Which TWO of the following techniques represent common Azure AD attack vectors or misconfigurations? (Choose TWO)

A penetration tester is evaluating an Active Directory environment and discovers that LDAP signing is not enforced. Which attack technique does this misconfiguration directly facilitate?

An OT security analyst is reviewing network traffic on an industrial control system network and identifies DNP3 protocol packets. Which THREE of the following fields or functions are associated with the DNP3 protocol structure and security? (Choose THREE)

An external penetration tester wants to test if a target organization's mail server is susceptible to email harvesting by issuing standard SMTP VRFY and EXPN commands. Which tool performs this type of mail server enumeration?

A security researcher is evaluating an industrial IoT gateway running Linux. During a filesystem audit of the extracted rootfs, the researcher finds that the '/etc/shadow' file contains weak password hashes for the root user. Which utility can the researcher use offline on their host machine to attempt password cracking via dictionary attack against the extracted hash?

During an assessment of a smart manufacturing facility, a penetration tester discovers an unauthenticated MQTT broker allowing anonymous publishing and subscription. Which TWO actions should the tester perform to validate the security risks associated with this misconfiguration? (Choose TWO)

A penetration tester is analyzing a Kubernetes cluster where pods utilize service accounts with automountServiceAccountToken set to true globally or on sensitive pods. The tester gains remote code execution inside a pod running with a high-privilege service account token. How can they use this token against the Kubernetes API?

A tester has located a domain user account configured with Constrained Delegation (S4U2Self / S4U2Proxy) pointing to a target service. What tool and module in Impacket can be used to leverage this delegation to obtain a TGS for a privileged user (e.g., Administrator)?

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

When conducting post-exploitation, what is the primary risk of using 'Mimikatz' on a modern Windows system with Windows Defender enabled?

An attacker has intercepted ARP traffic on a switched local network and wants to maintain a man-in-the-middle position without causing high volumes of repetitive ARP reply frames that might trigger security alerts. Which tool allows selective, low-frequency ARP poisoning?

When executing a DCSync attack programmatically via Impacket's secretsdump.py, how does the tool interact with Active Directory to request password data without running code on the domain controller?

During a Windows privilege escalation assessment, a tester discovers that the local 'SeImpersonatePrivilege' is enabled on the current service account token. Which exploitation tool class is best suited for abusing this privilege?

A security consultant is performing a penetration test against an embedded IoT device that exposes an insecure bootloader and serial console. Which TWO of the following procedures can the consultant execute via the U-Boot serial prompt to compromise device security? (Choose TWO)

A penetration tester is performing an attack utilizing the PetitPotam (MS-EFSR) vulnerability against a domain controller. What is the primary objective of forcing the domain controller to authenticate via PetitPotam?

An elite penetration tester needs to pivot through a compromised Linux host using SSH local port forwarding (-L) to access a database server running on an internal port behind a firewall. Which correct syntax establishes a local port forward routing port 3306 on the attacker's machine to the internal database server IP 10.0.0.50 on port 3306 via the pivot host?

An ethical hacker is examining an operational technology (OT) network and needs to identify programmable logic controllers (PLCs) using their native industrial protocols. Which default TCP port should the hacker scan to discover Modbus/TCP devices?

During an AWS penetration test, the tester finds an Amazon API Gateway REST API configured with an AWS_IAM authorizer, but one specific method is mistakenly set to 'Authorization: None' (Open API method). What security risk does this introduce?

A penetration tester is reviewing the firmware of a smart electricity meter and discovers that the bootloader is unlocked. The tester connects a USB-to-UART serial adapter to the board's exposed pins and interrupts the boot sequence to gain a root shell. Which environment variable or kernel boot parameter must the tester modify to bypass the root password authentication prompt entirely?

A security engineer is hardening an industrial SCADA environment against remote attacks. Which THREE of the following mitigation strategies are recommended best practices for securing OT networks? (Choose THREE)

An OT security engineer is conducting a vulnerability assessment on a Distributed Control System (DCS). The engineer needs to test for unauthorized firmware write capabilities on a legacy controller using the Modbus protocol. Which Modbus function code is typically associated with writing multiple holding registers, which could be abused to modify configuration parameters?

During an internal penetration test, you need to identify active Windows hosts on a local subnet without generating noisy TCP or UDP port scan traffic. Which tool and command natively uses ARP requests to quickly map live systems on the local Ethernet segment?

During a penetration test on a Windows domain, a tester has compromised a workstation and obtained the NTLM hash of a domain user. The tester wants to authenticate to a remote server using this hash without cracking it. Which tool and command should the tester use to perform a pass-the-hash attack?

An analyst is examining the firmware of an IoT gateway and discovers a JFFS2 file system image. The analyst wants to extract the file system contents. Which tool, specifically designed for JFFS2 extraction and analysis, should the analyst run on a Linux workstation?

An operator is conducting an Active Directory penetration test and has obtained domain admin credentials. To maintain persistence, they want to create a backdoor that allows them to authenticate as any user without knowing their password, even if the domain admin password is changed. Which of the following techniques would BEST achieve this?

You have obtained a memory dump from a Windows machine. Which tool allows you to extract hashes, including NTLM and Kerberos tickets, from this dump?

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

A penetration tester is assessing a building automation system that uses BACnet for communication between controllers and a central workstation. The tester wants to enumerate all BACnet devices on the network and identify their object types and properties. Which tool should the tester use to perform this enumeration?

During a post-exploitation phase, you have obtained domain administrator credentials. You want to extract all password hashes from the domain controller's Active Directory database without installing additional software. Which built-in Windows utility should you use?

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

A penetration tester has obtained domain user credentials and wants to perform lateral movement to a Windows Server 2016 host using WinRM. The tester has network access to the target on port 5985. Which TWO methods can be used to execute commands remotely via WinRM? (Choose two.)

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?

A CPENT tester is evaluating an IoT device that exposes a serial console header on its PCB. After connecting a UART adapter, the tester sees garbled characters in the terminal. Which action should the tester take to obtain a readable console output?

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

During an Active Directory penetration test, an operator has compromised a user account and discovered that the account has GenericAll permissions on a computer object. The operator wants to abuse this permission to gain administrative access to the computer. Which technique should the operator use?

An operator has compromised a domain user account and wants to perform a Kerberoasting attack to extract service account hashes. The operator uses Rubeus with the kerberoast command. Which encryption type should the operator request to maximize the chance of cracking the extracted tickets?

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

You are conducting an external penetration test against a company that uses a Cisco ASA firewall. You have identified that the firewall is running an older firmware version. Which technique would best allow you to bypass the firewall's access control lists to reach an internal web server on port 80?

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

During an internal penetration test, an operator gains access to a domain-joined Windows workstation and discovers that the current user has local administrator rights on that machine. The operator wants to extract the NTLM hash of the domain administrator who previously logged into this workstation. Which of the following locations is MOST likely to contain this credential material?

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

During a penetration test of a Microsoft Azure environment, a tester obtains a managed identity token for a virtual machine. The token has permissions to read secrets from an Azure Key Vault. Which technique can the tester use to escalate privileges by leveraging the Key Vault access?

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

During a CPENT engagement against a pharmaceutical manufacturer's OT environment, the tester captures Modbus/TCP traffic between a human-machine interface (HMI) and several PLCs. The tester wants to demonstrate that an attacker on the IT network could manipulate coil states on a specific PLC without authentication. Which action BEST demonstrates this risk while minimizing impact on the production line?

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

An operator has obtained a valid Kerberos Ticket Granting Ticket (TGT) in the form of a .kirbi file from a compromised domain-joined Linux host. They want to convert this .kirbi file into a .ccache file so that it can be used with Impacket tools on their attack VM. Which of the following tools is specifically designed for this conversion?

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

A penetration tester is assessing a Microsoft 365 tenant and discovers that a global administrator account has no multi-factor authentication (MFA) enforcement. The tester wants to exploit this to gain persistent access to the tenant's email and files. Which Azure AD feature, if misconfigured, would allow the attacker to maintain access even after the initial password is changed?

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

A penetration tester is assessing a Microsoft Azure environment and finds that a virtual machine has a system-assigned managed identity. The tester has obtained a shell on the VM and wants to use the managed identity to access an Azure Key Vault. Which endpoint should the tester query to obtain an access token for the Key Vault?

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?

A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

During a Red Team assessment against an enterprise network, an operator wants to execute a Silver Ticket attack against a specific service (e.g., CIFS) on a target server. What is a key operational advantage of a Silver Ticket compared to a Golden Ticket?

An operator has compromised an Active Directory domain and wants to extract domain user password hashes without directly dumping LSASS memory on the Domain Controller. Which technique allows this from a machine with Domain Admin privileges?

An administrator needs to secure communication between microservices running across different AWS Virtual Private Clouds (VPCs). Which native AWS networking feature provides private connectivity without exposing traffic to the public internet?

During an internal network scan, a pentester identifies an open port 445 on a Windows machine and wants to check if it is vulnerable to MS17-010 (EternalBlue) without crashing the service. Which Nmap Scripting Engine (NSE) script should be executed?

An attacker has retrieved the KRBTGT account hash and wants to forge a Golden Ticket. Which tool from the Impacket suite is specifically designed to perform this forgery offline and inject the ticket?

An external penetration tester is performing reconnaissance against a corporate network and needs to identify live hosts while minimizing direct connection alerts on traditional port scanners. Which Nmap command-line argument should be used to execute an ICMP Echo Request ping sweep without performing port scanning on the discovered live hosts?

During an internal network assessment, you need to identify NetBIOS information such as registered computer names and logged-in usernames on legacy Windows hosts. Which tool performs a NetBIOS name query scan across an IP range?

An attacker is scanning a network and needs to determine which operating system is running on a target host by analyzing its TCP/IP stack response behaviors. What feature does Nmap provide for this?

A penetration tester is evaluating an internal network and needs to identify live Windows hosts that have Server Message Block (SMB) services running. Which TWO Nmap Scripting Engine (NSE) scripts can be used to gather SMB version and OS details safely? (Choose TWO)

An operator is performing data exfiltration from a highly secure network environment where all outbound TCP and UDP ports except 53 are blocked by a strict egress firewall. Furthermore, DNS queries are monitored and restricted to the internal corporate DNS servers. Which advanced exfiltration technique can the operator use to bypass this restriction?

A pentester wants to execute a Shadow Credentials attack (Key Credential Link abuse) against a high-value user account in Active Directory. What permission on the target user object is required to successfully perform this attack?

An AWS penetration tester uncovers an IAM policy attached to a user that contains the action 'iam:PutUserPolicy' with a resource of '*'. What privilege escalation vector does this enable?

A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?

You have compromised a Linux server and want to exfiltrate sensitive data to an external server. The network egress filtering only allows DNS traffic (UDP port 53) to a specific internal DNS resolver. Which technique would best allow you to exfiltrate data over DNS while evading detection?

During an assessment of a Google Cloud Platform project, a penetration tester finds that a Cloud Storage bucket has the allUsers principal granted the Storage Object Viewer role. What security flaw does this represent, and how should it be fixed?

A client asks you to verify that their perimeter router does not leak internal topology information to the internet. You want to send crafted probe packets with varying TTL values and observe the ICMP responses to map the path and infer router interfaces. Which technique should you use?

You are performing a Linux privilege escalation assessment and identify a binary with the SUID bit set that executes system commands using relative paths. How do you exploit this?

An Azure penetration tester identifies a Virtual Machine with public IP access that has an incoming Network Security Group (NSG) rule allowing TCP port 3389 (RDP) from any source ('Any' or 'Internet'). What is the recommended remediation?

A penetration tester has compromised a Linux server and wants to verify if the kernel is vulnerable to a known local privilege escalation exploit (such as Dirty COW). Which command should the tester run to check the exact Linux kernel version?

An operator has compromised a Windows domain and wants to maintain persistence via Active Directory mechanisms. Which TWO techniques represent valid AD-based persistence methods? Choose two.

An auditor identifies that an organization's Azure storage account allows anonymous public read access to containers and blobs. What configuration change must be applied to remediate this finding?

During a lateral movement phase, a penetration tester needs to move from a compromised Windows workstation to a domain controller. Traditional SMB-based lateral movement using PsExec is blocked by host-based firewalls, but WinRM (Windows Remote Management) port 5985 is open. Which built-in command-line utility should the tester use to establish an interactive remote session?

Which TWO Active Directory mechanisms or configurations are commonly targeted during lateral movement to bypass traditional perimeter security and leverage built-in domain trust relationships?

You are auditing a perimeter network protected by an Intrusion Detection System (IDS). To bypass signature-based detection mechanisms that look for standard Nmap packet patterns, you decide to fragment outgoing TCP packets into tiny 8-byte blocks. Which Nmap argument accomplishes this packet fragmentation?

A CPENT tester gains access to an engineering workstation on an OT network and finds a project file for a Siemens SIMATIC S7-1200 PLC. The tester wants to extract the PLC's configuration, including any stored password hashes, from the engineering workstation's project data to demonstrate credential exposure. Which artifact should the tester examine?

An auditor reviews network security configurations in an AWS VPC. Which TWO of the following network configurations represent potential security risks? (Choose TWO)

An elite penetration tester is conducting network reconnaissance behind a restrictive stateful firewall that drops anomalous TCP flag combinations. Which THREE Nmap scan types are most likely to fail or receive unreliable results because they rely on non-standard TCP flag combinations? (Choose THREE)

A CPENT tester is assessing a building automation system that uses KNX for lighting and HVAC control. The tester wants to understand the group address structure to map which devices control which functions. Which action BEST accomplishes this?

Which THREE methods or attack primitives can be used to achieve domain escalation when an attacker has compromised an account with 'GenericAll' permissions over a Group Policy Object (GPO)?

A tester has achieved code execution on a Windows server and needs to clean up event logs or check log activity to evade detection during post-exploitation. Which TWO built-in tools or commands can be used to manage or clear Windows Event Logs? Choose two.

During a lateral movement assessment in an Active Directory environment, a penetration tester wants to verify if SMB signing is disabled on internal subnet hosts to assess vulnerability to NTLM relay attacks. Which TWO tools or methods can be used to identify systems with SMB signing disabled? Choose two.

During a Windows post-exploitation assessment, you have compromised a local service account with 'SeImpersonatePrivilege'. Which tool and technique should you utilize to escalate to NT AUTHORITY\SYSTEM?

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

Which THREE tactics or actions are effective in defending against or detecting Golden Ticket attacks in an enterprise Active Directory environment?

An auditor reviews an enterprise's hybrid cloud identity architecture. Which TWO of the following configurations represent insecure identity practices? (Choose TWO)

An operator has gained administrative access to a subordinate domain in a multi-domain Active Directory forest and wishes to escalate privileges to Enterprise Admin across the entire forest. What object or group must be compromised to achieve forest-wide control?

A security consultant is performing a penetration test against a smart building HVAC system controlled by BACnet/IP. The consultant wants to discover BACnet devices and their supported object properties on the local subnet. Which utility or Python tool specifically designed for BACnet protocol assessment should the consultant use?

A penetration tester is evaluating a hybrid Active Directory environment. They compromise an on-premises user account that has been synchronized to Azure AD. They discover that the on-premises account is a member of a high-privilege local group, but Azure AD Connect has filtered out this group synchronization. How can the tester leverage Azure AD Connect configuration weaknesses?

An attacker has gained access to a compromised host and wants to establish persistence and covert command-and-control (C2) communication through corporate firewalls. Which THREE protocols or channels are commonly leveraged for outbound covert tunneling because they are rarely blocked by egress filters? (Choose THREE)

A penetration tester is performing network reconnaissance against a hardened target and needs to discover live hosts while avoiding ping probes. Which Nmap option tells Nmap not to perform host discovery before scanning ports, ensuring every target IP is fully port-scanned?

An attacker wants to bypass egress filtering on a restricted network by encapsulating TCP packets inside ICMP echo request payloads. Which open-source tunneling utility is designed specifically for this purpose?

You are performing a privilege escalation on a Windows machine. Which THREE of the following are valid techniques to gather local information for further escalation?

An auditor is evaluating cloud storage security across multiple cloud providers. Which TWO of the following settings indicate improper security configurations for cloud storage buckets? (Choose TWO)

When analyzing a compromised Active Directory environment using BloodHound, which THREE common node properties or paths typically signify a high-value target or an immediate path to Domain Admin?

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

A penetration tester is auditing an AWS environment and discovers that an IAM role used by an EC2 instance has an overly permissive trust policy allowing any principal in an external AWS account to assume it without specifying an ExternalId. What is the standard security term and remediation for this vulnerability?

An auditor is reviewing Active Directory Certificate Services and identifies ESC8. What exact AD CS endpoint is exploited during an ESC8 attack vector?

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

A penetration tester has obtained a low-privileged shell on a Windows 10 workstation that is part of an Active Directory domain. The tester discovers that the workstation has Credential Guard enabled and that the current user has local admin rights on a different server. The tester wants to move laterally to the server using the current user's credentials without knowing the plaintext password. Which technique should the tester use to extract the user's Kerberos ticket from memory and reuse it on the target server?

During an external engagement, you find that the target's edge device responds to IKE on UDP/500 and appears to accept aggressive-mode Phase 1 proposals. You want to determine whether a pre-shared key can be recovered offline so you can impersonate a peer. Which approach is most appropriate?

A CPENT tester is evaluating an industrial control system that uses the DNP3 protocol for communication between a master station and remote terminal units (RTUs). The tester wants to determine whether the RTUs enforce any authentication on critical control functions. Which method is MOST appropriate to assess this without causing an outage?

An AWS penetration tester discovers that an Amazon RDS database instance has the 'Publicly Accessible' flag set to true, and its security group allows inbound traffic from 0.0.0.0/0 on port 3306. What is the immediate risk, and what is the recommended control?

An attacker has identified an Active Directory Certificate Services (AD CS) template configured with the 'Enrollee Supplies Subject' flag enabled (EDITF_ATTRIBUTESUBJECTALTNAME2 is enabled on the CA), and the template permissions allow low-privileged domain users to enroll. Furthermore, the template allows client authentication. How can this misconfiguration (ESC1) be exploited?

A penetration tester has obtained domain administrator credentials for a Windows Active Directory environment. The tester wants to extract the KRBTGT account password hash to create Golden Tickets. Which method is most direct for obtaining this hash?

An ethical hacker is performing a security review of a smart energy grid employing IEC 60870-5-104. The hacker wishes to inject a forged ASDU (Application Service Data Unit) command to open a circuit breaker. Using Python, which library can the hacker use to construct and transmit raw IEC 104 application layer frames over TCP?

A penetration tester is conducting a network penetration test and discovers an open SNMP service (UDP port 161) using a default community string. Which tool can be used to enumerate user accounts, routing tables, and running processes via SNMP?

A penetration tester has compromised an internal machine and needs to pivot deeper into the network. Which TWO tools or features can be utilized to set up a SOCKS proxy for tunneling arbitrary TCP traffic through the compromised host? (Choose TWO)

A penetration tester is scanning a web server and wants to rapidly locate hidden administrative directories and backup files using a wordlist. Which command-line tool is designed specifically for directory brute-forcing?

During a CPENT engagement, you have obtained a low-privileged shell on a Windows Server 2019 host that is a member of an Active Directory domain. You notice the host has the SMB signing requirement disabled. You want to perform lateral movement to other hosts on the network by capturing and relaying authentication attempts. Which tool and technique would best allow you to relay NTLM authentication to a target host where SMB signing is not enforced?

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

A penetration tester is evaluating network security controls and wants to check for insecure or plaintext authentication protocols in use across the network. Which TWO protocols transmit credentials or session tokens in cleartext and can be easily sniffed? (Choose TWO)

Which THREE techniques or remediation steps are recommended to secure Active Directory Certificate Services (AD CS) against certificate-based abuse vectors like ESC1 through ESC8?

An engineering team is hardening an Operational Technology (OT) network segment that relies on legacy SCADA protocols lacking native encryption or authentication. Which THREE compensating controls should the penetration tester recommend to mitigate risks associated with these insecure protocols? (Choose THREE)

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

During a CPENT engagement against a Microsoft 365 tenant, you obtain a low-privileged user's credentials and successfully authenticate. You need to determine whether the tenant has enabled Security Defaults or configured custom Conditional Access policies, because this affects your ability to perform password spraying and legacy authentication attacks. Which Microsoft Graph endpoint should you query to retrieve the tenant's Conditional Access policy configuration?

A penetration tester is assessing an IoT device that uses MQTT for communication. The tester has captured MQTT traffic and notices that the CONNECT packets do not include a username or password. Which of the following best describes the security implication of this observation?

During a Kubernetes cluster security assessment, a penetration tester identifies multiple misconfigurations. Which TWO of the following findings represent high-risk security flaws in Kubernetes RBAC and cluster setup? (Choose TWO)

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

An auditor finds an Amazon S3 bucket configured with public read access enabled via an Access Control List (ACL), but the bucket policy explicitly denies public read access. How does AWS evaluate these conflicting permissions?

Which technique is most effective for achieving persistence on a Windows system by leveraging the automatic startup mechanism that executes during user login?

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

A tester gains code execution on a Linux host inside a Docker container and discovers they can access the Docker socket (/var/run/docker.sock) from within the container. How can the tester exploit this to escape the container and compromise the host?

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?

A penetration tester is evaluating the security posture of an industrial SCADA network. Which THREE of the following operational technology (OT) vulnerabilities are most commonly found during network penetration tests of legacy control systems? (Choose THREE)

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

An operator has compromised an Active Directory domain and wants to establish persistence using a Golden Ticket. What critical piece of information from the domain is required to forge this ticket?

A penetration tester has gained initial access to a Windows system and needs to enumerate local users and groups to identify high-privileged accounts for potential escalation. Which TWO built-in Windows command-line commands can be used to list local user accounts? Choose two.

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

A CPENT tester is engaged to assess a municipal water utility's OT network. After passively mapping the environment, the tester identifies a Siemens SIMATIC S7-1200 PLC on VLAN 20 and wants to read the current state of its process image inputs and outputs without altering the running program. Which approach is MOST appropriate for this objective?

An auditor is reviewing an AWS cloud environment and identifies several common misconfigurations related to identity and access management. Which TWO of the following practices represent significant security risks? (Choose TWO)

A penetration tester executing lateral movement in a Windows domain wants to hide their network activity and command execution by using WinRM (Windows Remote Management). Which PowerShell cmdlet is specifically designed to execute commands on a remote trusted host via WinRM?

An attacker gains access to an Azure environment and enumerates App Service Configuration settings. They discover that connection strings and database passwords are stored in plaintext within the application settings rather than being referenced via Azure Key Vault references. What attack path does this enable?

An external penetration tester is conducting reconnaissance against a corporate network and needs to discover valid email addresses and associated infrastructure hosted publicly. Which tool uses search engines and public databases to gather open-source intelligence on target domains?

An elite penetration tester needs to bypass a strict perimeter stateful inspection firewall that drops fragmented packets and inspects TCP payload flags. They decide to use Nmap to send packets with the FIN, PSH, and URG flags set simultaneously (a Xmas scan). Which Nmap flag implements this?

You are conducting an internal network penetration test and have obtained credentials for a domain user. You want to identify which hosts on the internal network permit SMB signing to be disabled so that relay attacks become feasible. Which TWO actions should you take to build this target list? (Choose two.)

You have compromised a domain user account and discovered that the user has 'WriteDACL' permission on a sensitive Organizational Unit (OU). You want to escalate privileges by modifying the OU's ACL to grant yourself full control. Which built-in Windows command-line utility can you use to modify the ACL of the OU?

During an assessment of an Operational Technology (OT) network, a tester discovers a Programmable Logic Controller (PLC) using the Modbus TCP protocol. The tester needs to query holding registers to understand the operational state of the industrial process. Which default TCP port should the tester target for Modbus communications?

An auditor reviews an Azure storage account and notes that 'Secure transfer required' is set to Disabled. What security risk does this misconfiguration introduce?

A penetration tester is analyzing an ARM-based IoT router firmware. The tester wants to statically analyze a compiled ELF binary named 'auth_service' to identify potential buffer overflows. Which open-source reverse engineering framework, developed by NSA, should the tester utilize to perform disassembly and decompilation of this binary?

An analyst is reviewing PCAP files captured from an ICS environment where Modbus/TCP traffic is flowing. The analyst notices cleartext commands being sent to alter coil values. Which tool can the analyst use to automatically extract Modbus registers and visualize the register state changes over time from the PCAP file?

A tester is conducting a physical security and RF assessment against a wireless building automation system operating at 433 MHz. The tester wants to capture and replay the radio frequency signal emitted by a key fob to unlock a gate. Which hardware tool is specifically designed for software-defined radio (SDR) signal capture and analysis in this frequency range?

A penetration tester is analyzing network traffic and notices an attacker is leveraging IPv6 neighbor discovery protocol (NDP) spoofing to intercept local traffic. Which mitigation feature implemented on enterprise switches prevents malicious rogue advertisements on local networks?

During lateral movement, you decide to use 'Pass-the-Ticket' to access a target. Which file format does Mimikatz typically use to export Kerberos tickets?

During a perimeter penetration test, you need to identify live hosts on a target network without performing a full port scan. You have no prior knowledge of the network and want to minimize the chance of triggering intrusion detection systems. Which Nmap command is best suited for this task?

A penetration tester needs to enumerate available shares and permissions on a remote Windows file server during an internal audit. Which TWO tools or commands can be used to query SMB shares? (Choose TWO)

During an internal penetration test, you compromise a domain-joined Windows 10 workstation and obtain a SYSTEM-level shell. You extract the NTLM hash of a domain user from LSASS but cannot crack it. Which technique allows you to authenticate to a remote server as that domain user without knowing the plaintext password?

A penetration tester is analyzing a network where ICMP echo requests are blocked by perimeter firewalls, making traditional host discovery fail. Which Nmap host discovery option should be used to discover live hosts using TCP ACK packets sent to port 80?

In a hybrid enterprise environment, an organization uses Azure AD Seamless Single Sign-On (Seamless SSO). During a penetration test, an attacker compromises a domain-joined workstation and attempts to abuse Seamless SSO. What is the mechanism by which Seamless SSO authenticates users, and what is a known security consideration?

A CPENT tester is assessing a building automation system that uses BACnet over IP. The tester needs to perform active discovery to enumerate BACnet devices and their objects on the network. Which TWO of the following approaches are valid for active BACnet/IP device enumeration? (Choose two.)

A penetration tester is analyzing a Linux system and finds that the binary /bin/ping has the SUID bit set along with root ownership. What is the security implication of this finding?

A penetration tester is evaluating an AWS environment and discovers that an IAM role attached to an Amazon EC2 instance has an overly permissive trust policy allowing any user in the account to assume it via the sts:AssumeRole API without external conditions. Which specific remediation step should the cloud administrator apply to fix this risk?

You have compromised a dual-homed Linux host that sits between a DMZ and an internal network. From this host you need to reach internal web servers on TCP/8080 that are not routable from your attack machine, and you want to route all your tooling traffic through the pivot using SOCKS. Which approach correctly establishes the pivot?

A penetration tester is assessing an AWS environment where an EC2 instance is associated with an IAM role that trusts an external third-party AWS account in its trust policy, but the external account ID was mistyped or left overly broad (e.g., condition missing external ID or using an insecure principal). What vulnerability does this introduce?

A penetration tester is analyzing a proprietary IoT device protocol that operates over UDP. The tester has captured raw binary network traffic and wants to write a custom dissector script to parse the packet structure in Wireshark. What scripting language does Wireshark natively support for writing lightweight protocol dissectors?

During an Azure subscription review, a security assessor checks for role-based access control and resource configuration best practices. Which TWO of the following findings represent high-severity security risks? (Choose TWO)

During an OT assessment, you capture network traffic on the plant floor and notice that a Siemens S7-1200 PLC responds to read/write requests on TCP port 102 without requiring any authentication. You want to interact with the PLC to read its current process values and verify whether an attacker could manipulate the logic. Which tool is specifically designed to communicate with Siemens S7 PLCs over the S7comm protocol for this purpose?

During an AWS security review, a penetration tester identifies several identity and storage policies. Which TWO of the following configurations are considered insecure? (Choose TWO)

A CPENT tester is assessing a water treatment plant's OT network. The tester has captured traffic on the plant's control VLAN and wants to enumerate all Modbus/TCP devices and their supported function codes without disrupting operations. Which Nmap NSE script should the tester run against the subnet to perform this discovery safely?

Which Active Directory right or permission allows a security principal to perform a DCSync attack, thereby replicating domain secrets?

A penetration tester needs to perform a stealthy TCP SYN scan against a target network using Nmap to avoid triggering simple stateless packet filters. Which command-line flag should be used?

An attacker is performing a man-in-the-middle attack against an industrial control network utilizing the S7comm protocol between a Siemens S7-300 PLC and an engineering station. The attacker wants to inject malicious logic into the PLC memory. Which tool can be used to craft and send malicious S7comm packets to manipulate the PLC operating mode?

During a penetration test, you have compromised a workstation and obtained the NTLM hash of a domain user who is logged in. You want to move laterally to a server where this user has administrative rights. Which technique would allow you to authenticate to the server without knowing the plaintext password?

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

A penetration tester has gained access to a workstation and wants to move laterally to a server using a Golden Ticket. The tester has the KRBTGT hash and the domain SID. Which tool from the Impacket suite should be used to forge and inject the Golden Ticket?

A tester discovers that an internal Windows host has the AlwaysInstallElevated registry key set to 1 in both HKCU and HKLM. How can the tester leverage this misconfiguration to escalate privileges?

A penetration tester is performing post-exploitation on a Linux system and wants to exploit an NFS share with the 'no_root_squash' option enabled. Which of the following steps must the tester perform from their attacking machine to successfully write a SUID shell to the share?

A CPENT tester is targeting a hybrid cloud environment that uses AWS IAM Identity Center (successor to AWS Single Sign-On) to federate with an on-premises Active Directory. The tester has obtained read-only access to the AWS Organizations management account. Which TWO actions should the tester perform to enumerate potential privilege escalation paths into member accounts? (Choose two.)

An operator captures a valid Ticket Granting Ticket (TGT) for a domain user from memory and wants to inject it into their current session to access network resources without re-authenticating. Which tool and command syntax should be used to import this ticket into the local LSASS session on Windows?

During an internal penetration test, you successfully compromise a Linux host with two network interfaces: eth0 (10.10.10.50) connected to the initial segment, and eth1 (192.168.100.10) connected to an isolated internal subnet. To route subsequent Nmap TCP SYN scans through this compromised host into the 192.168.100.0/24 network using Metasploit, which post-exploitation module must you configure and run first?

A penetration tester is assessing a Microsoft Azure environment and discovers that a virtual machine (VM) has a system-assigned managed identity enabled. The VM is running a web application that is vulnerable to server-side request forgery (SSRF). The tester wants to exploit the SSRF to gain access to Azure resources. Which TWO of the following actions can the tester perform to leverage the managed identity? (Choose two.)

During an internal penetration test, you compromise a Windows host that sits on a management VLAN. The network is segmented, and the host has two interfaces: one on the management VLAN (10.10.10.0/24) and one on the corporate VLAN (192.168.1.0/24). You want to reach a database server at 172.16.5.20 on a third VLAN, but your compromised host has no route to that subnet. You have administrative privileges on the compromised host. Which of the following is the most reliable technique to pivot to the 172.16.5.0/24 network?

Which TWO native Windows tools or Sysinternals utilities can be used by an operator during post-exploitation to dump credentials from the LSASS process memory?

During a CPENT engagement, a tester gains a low-privileged shell on a Windows Server 2019 host. The tester runs 'whoami /priv' and sees SeImpersonatePrivilege enabled. The host is running IIS with a service account that has this privilege. Which tool is most appropriate to escalate privileges by leveraging this token privilege?

An operator has discovered a computer object with Unconstrained Delegation enabled in Active Directory. How can this configuration be abused if a Domain Administrator account can be coerced to authenticate to it?

During an internal penetration test, an operator wants to perform lateral movement using PsExec. Which underlying Windows mechanism does PsExec rely on to deploy and execute its service binary on the remote target?

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?