How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the CPENT exam, each with detailed explanations and wrong-answer analysis.

How should I approach CPENT scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) questions

Scenario-based practice

Hard Difficulty Questions

Practise EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CPENT

exam code

EC-Council

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

A
The template includes the Certificate Request Agent EKU (Enrollment Agent functionality).
Enrollment agent EKUs allow requesting certificates on behalf of other principals.
B
Low-privileged users have enrollment rights over the template.
Attackers must be able to enroll in the enrollment agent template to initiate the attack.
C
The CA requires Manager Approval for all issued certificates.
Why wrong: Manager approval blocks automated ESC3 exploitation unless bypassed.
D
The application policy constraints or authorized signatures are missing or overly permissive.
Permissive template settings allow the agent to request arbitrary target certificates without restriction.
E
The domain functional level is set to Windows Server 2003.
Why wrong: AD CS vulnerabilities exist independently of old functional levels.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related CPENT topic practice pages

Cloud And Hybrid Infrastructure Security practice questions

Privilege Escalation Lateral Movement And Post Exploitation practice questions

Iot And OT Exploitation practice questions

Network And Perimeter Exploitation practice questions

Active Directory Attacks practice questions

CPENT fundamentals practice questions

CPENT scenario practice questions

CPENT troubleshooting practice questions

Practice scenarios

Which THREE conditions or configurations make an Active Directory certificate template vulnerable to ESC3 (Enrollment Agent abuse)?

An operator has identified an Active Directory domain trust relationship where a trusted forest has 'SID History' filtering disabled (Quarantined Domain Trust set to disabled/unfiltered). What attack does this enable?

Which THREE conditions must be met for a successful Resource-Based Constrained Delegation (RBCD) attack against a target computer object?

When conducting an advanced Active Directory penetration test, which THREE techniques can be used to extract or abuse credentials without interacting with LSASS directly on a domain controller?

An ICS penetration tester is auditing a substation utilizing the IEC 61850 standard for electrical substation automation. The tester captures Generic Object Oriented Substation Events (GOOSE) messages on the network. Which Layer 2 Ethernet type hex value identifies GOOSE multicast frames?

During an Active Directory security review, an assessor examines Kerberos delegation configurations. Which THREE delegation misconfigurations or vulnerabilities represent high-risk attack vectors if exploited? (Choose THREE)

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

During a container security assessment, a penetration tester identifies a Kubernetes pod running with 'CAP_SYS_ADMIN' capabilities and the host's PID namespace shared ('hostPID: true'). Which technique allows the tester to escape the container and execute code on the host?

A penetration tester is evaluating a Kubernetes environment and discovers that the Kubernetes dashboard is deployed with cluster-admin privileges and is exposed to the internet via a NodePort service without authentication. How can this be exploited?

A penetration tester is assessing an advanced hybrid cloud and Kubernetes infrastructure. Which THREE of the following scenarios represent critical architecture or configuration flaws? (Choose THREE)

An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

A security analyst is performing a security assessment on a Siemens S7-1200 PLC. Using Nmap, which NSE script should the analyst run to gather detailed device information, including rack, slot, and firmware version via the S7 communication protocol?

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)