Network And Perimeter Exploitation →hardMultiple ChoiceObjective-mapped

CPENT Network And Perimeter Exploitation Practice Question

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

smb || smb2

SMB traffic relies heavily on SMB and SMB2 protocols. The display filter 'smb || smb2' isolates SMB protocol transactions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
kerberos
Why it's wrong here
This isolates Kerberos protocol traffic, which is encrypted and uses tickets rather than cleartext passwords.
✗
ldap
Why it's wrong here
This isolates LDAP traffic, which may contain simple bind credentials if unencrypted.
✓
smb || smb2
Why this is correct
This filter isolates both version 1 and version 2 Server Message Block traffic.
✗
http.request or ftp.request
Why it's wrong here
These filters isolate HTTP and FTP traffic, not SMB.

Visual reference

About these practice questions

This CPENT question is part of Courseiva's 274-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Practice tests

Scored 10-question sessions with instant feedback and explanations.

CPENT Practice Test 1 — 25 Questions→CPENT Exam Simulation 1 — 100 Questions→CPENT Practice Questions 1 — 50 Questions→

Practice by domain

Domains are weighted differently on the real exam — spend your time where you score lowest.

Network And Perimeter Exploitation Cloud And Hybrid Infrastructure Security Iot And OT Exploitation Active Directory Attacks

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Go deeper on a topic

Narrow in on a single topic rather than practising the whole bank at once.

Network And Perimeter Exploitation practice questions Privilege Escalation Lateral Movement And Post Exploitation practice questions CPENT fundamentals practice questions

Keep going

CPENT practice test Study guide All CPENT questions

This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.