Courseiva

CPENT · topic practice

Network And Perimeter Exploitation practice questions

This CPENT domain covers external and internal reconnaissance, host discovery, firewall and IDS evasion, and exploitation of network services and perimeter devices. Questions present realistic scenarios requiring you to select the correct Nmap flags, scanning techniques, enumeration tools, and relay or pivoting methods, then justify the choice based on stealth, protocol behavior, and the target environment.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Network And Perimeter Exploitation
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Network And Perimeter Exploitation

A candidate must choose and justify the right Nmap scan type, evasion flag, enumeration tool, or relay prerequisite for a given perimeter scenario. The single most important thing is matching the technique to the firewall, protocol, and privilege constraints described in the question.

Nmap host discovery and port scanning flags that minimize alerts and bypass filtering

Nmap FIN, PSH, URG, and fragmentation options for evading stateful inspection firewalls

Search-engine and public-source tools such as theHarvester for email and infrastructure enumeration

SMB signing enumeration to identify hosts vulnerable to NTLM relay attacks

Watch out for

Common Network And Perimeter Exploitation exam traps

  • ▸Assuming -sS stealth scans work without root privileges, when Nmap falls back to TCP connect and generates more logs
  • ▸Confusing NULL, FIN, and Xmas scans, or expecting them to work against Windows hosts that ignore such packets
  • ▸Treating SMB signing as always enabled, instead of checking each host before planning an NTLM relay attack

Practice set

Network And Perimeter Exploitation questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice
Read the full Network And Perimeter Exploitation explanation →

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

Question 2mediummultiple choice
Open the full VLAN trunking answer →

During an internal network assessment, a tester discovers that direct routing to a segmented VLAN is blocked, but an accessible host on that VLAN is running an SSH server. Which Metasploit auxiliary module can be used to set up a routing table so subsequent exploit modules can reach the isolated subnet through the compromised SSH host?

Question 3easymultiple choice
Read the full Network And Perimeter Exploitation explanation →

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?

Question 4mediummultiple choice
Study the full Python automation breakdown →

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

Question 5hardmultiple choice
Review the full subnetting walkthrough →

An attacker has gained access to a Linux machine and wants to scan the local subnet for live hosts using raw sockets via ping sweep, but does not have root privileges. Which Nmap flag allows unprivileged users to perform host discovery and port scanning without raw socket access?

Question 6mediummultiple choice
Review the full subnetting walkthrough →

A penetration tester is operating inside a segmented corporate network and needs to scan a target subnet using TCP SYN packets while randomizing the order of scanned hosts and ports to evade intrusion detection systems. Which Nmap option implements this randomization?

Question 7easymulti select
Read the full Network And Perimeter Exploitation explanation →

When performing a network penetration test against an organization with strict perimeter defenses, which TWO Nmap scanning techniques can be utilized to map out firewall rules and filter states? (Choose TWO)

Question 8mediummulti select
Review the full routing breakdown →

When pivoting through a compromised Windows system during an internal engagement, you need to enumerate active TCP and UDP network connections, listening ports, and associated routing tables using native operating system binaries. Which THREE of the following commands or tools native to Windows can be used to gather this network enumeration data?

Question 9hardmulti select
Read the full network assurance explanation →

During an assessment of network perimeter services, you discover a misconfigured Simple Network Management Protocol (SNMP) daemon running on a core router. Which THREE of the following tools or Metasploit auxiliary modules can be leveraged to enumerate sensitive information such as running processes, network interfaces, and routing tables via SNMP?

Question 10hardmultiple choice
Open the full VLAN trunking answer →

A penetration tester has compromised a Windows host inside a segmented network. The tester wants to reach a server on a different VLAN that is not directly routable from the compromised host but is accessible from a domain controller that the host can communicate with. Which technique best allows the tester to access the target server's SMB service through the domain controller?

Question 11mediummultiple choice
Review the full subnetting walkthrough →

During an internal penetration test, you gain access to a Windows Server 2019 host that has SMB signing disabled. You want to capture NetNTLMv2 challenge-response hashes from other hosts on the same subnet without relying on a user opening a file. Which technique should you use?

Question 12mediummultiple choice
Read the full DNS explanation →

During a perimeter penetration test, you discover that the target organization's Cisco ASA firewall allows outbound DNS (UDP/53) to any external resolver. You want to establish a covert bidirectional command-and-control channel that survives NAT and is difficult for the firewall's application inspection to distinguish from legitimate traffic. Which technique best fits this requirement?

Question 13mediummultiple choice
Read the full network assurance explanation →

A penetration tester is performing an external network assessment and discovers a Cisco router with SNMP enabled. The tester wants to extract the running configuration to identify potential weaknesses. Which SNMP operation and community string combination is most likely to succeed if the device uses default settings?

Question 14easymultiple choice
Read the full Network And Perimeter Exploitation explanation →

You are performing a penetration test against a network that uses 802.1X authentication for wired ports. You have physical access to an unoccupied office and want to bypass port-based authentication to gain network access. Which technique should you use?

Question 15mediummulti select
Read the full Network And Perimeter Exploitation explanation →

You are performing a penetration test against a network protected by a stateful firewall that only allows outbound TCP port 443. You have compromised an internal Windows host and need to establish a covert channel to exfiltrate data to your external server. Which TWO methods would allow you to tunnel data out through the firewall? (Choose two.)

Question 16hardmulti select
Read the full Network And Perimeter Exploitation explanation →

A penetration tester is attempting to bypass a network intrusion prevention system (IPS) that inspects traffic for known attack signatures. The tester wants to deliver a malicious payload to a target web server without triggering the IPS. Which two techniques are most effective for evading signature-based IPS detection? (Choose two.)

Question 17mediummultiple choice
Read the full network assurance explanation →

You are conducting a penetration test against a network with a Cisco router that has SNMP enabled with the default read-only community string 'public'. You want to extract the router's running configuration. Which tool or technique should you use?

Question 18mediummulti select
Read the full Network And Perimeter Exploitation explanation →

A penetration tester is assessing a perimeter firewall and wants to identify open ports and services without triggering alerts. The tester decides to use Nmap with various scan techniques. Which two Nmap scan types are most likely to bypass simple packet-filtering devices that only block SYN packets? (Choose two.)

Question 19mediummultiple choice
Read the full network assurance explanation →

During an external perimeter assessment, you identify a Cisco IOS router with SNMP enabled. You want to enumerate its routing table and interface details without triggering an alert. Which SNMP operation and community string should you use to efficiently extract this information?

Question 20hardmultiple choice
Review the full routing breakdown →

You have compromised a Linux host in a DMZ and need to pivot into the internal network. The host has two network interfaces: eth0 (public) and eth1 (internal). You want to use the compromised host as a router to forward traffic from your attack machine to internal targets. Which command should you run on the compromised host to enable IP forwarding?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Network And Perimeter Exploitation sessions

Start a Network And Perimeter Exploitation only practice session

Every question in these sessions is drawn from the Network And Perimeter Exploitation domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Network And Perimeter Exploitation questions →Mixed CPENT session

Related practice questions

Related CPENT topic practice pages

Move into related areas when this topic feels solid.

Network And Perimeter Exploitation practice questions

Practise CPENT questions linked to Network And Perimeter Exploitation.

Active Directory Attacks practice questions

Practise CPENT questions linked to Active Directory Attacks.

Iot And OT Exploitation practice questions

Targeted CPENT practice covering Iot And OT Exploitation.

Cloud And Hybrid Infrastructure Security practice questions

Targeted CPENT practice covering Cloud And Hybrid Infrastructure Security.

Privilege Escalation Lateral Movement And Post Exploitation practice questions

Privilege Escalation Lateral Movement And Post Exploitation practice questions for CPENT.

CPENT fundamentals practice questions

Work through CPENT questions on CPENT fundamentals.

CPENT scenario practice questions

Sharpen your CPENT knowledge of CPENT scenario.

CPENT troubleshooting practice questions

Sharpen your CPENT knowledge of CPENT troubleshooting.

Frequently asked questions

What does the CPENT exam test about Network And Perimeter Exploitation?
A candidate must choose and justify the right Nmap scan type, evasion flag, enumeration tool, or relay prerequisite for a given perimeter scenario. The single most important thing is matching the technique to the firewall, protocol, and privilege constraints described in the question.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Network And Perimeter Exploitation questions in a focused session?
Yes — the session launcher on this page draws every question from the Network And Perimeter Exploitation domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CPENT topics?
Use the topic links above to move to related areas, or go back to the CPENT question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the CPENT exam covers. They are not copied from any real exam or dump site.