Courseiva

CPENT · topic practice

Privilege Escalation Lateral Movement And Post Exploitation practice questions

This domain covers post-exploitation on compromised Linux and Windows hosts: enumerating sudo misconfigurations, abusing SUID/GUID and scheduled tasks, extracting credentials, and pivoting with Pass-the-Hash or DNS tunneling. CPENT tests these as hands-on objectives where you must identify the exact privilege escalation vector or lateral movement path and execute it under time pressure.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Privilege Escalation Lateral Movement And Post Exploitation
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Privilege Escalation Lateral Movement And Post Exploitation

You must be able to enumerate and exploit local privilege escalation on Linux and Windows, then pivot laterally using credential reuse or tunneling. The single most important thing is to verify the exact misconfiguration or credential validity before attempting the exploit, because blind attempts waste time and trigger alerts.

Enumerating sudo rights with sudo -l, checking /etc/sudoers, and identifying NOPASSWD entries or binaries that call system().

Finding SUID/SGID binaries, writable cron jobs, and weak service permissions on Linux for local privilege escalation.

Using Pass-the-Hash with tools like Mimikatz or Impacket to authenticate to remote Windows systems without plaintext passwords.

Exfiltrating data through DNS tunneling or ICMP when TCP/UDP egress is restricted to port 53.

Watch out for

Common Privilege Escalation Lateral Movement And Post Exploitation exam traps

  • ▸Assuming sudo -l alone reveals all vectors; missing sudoers entries that require a password or are hidden in included files.
  • ▸Trying Pass-the-Hash without local admin rights or NTLM enabled on the target, causing authentication to fail silently.
  • ▸Forgetting that DNS exfiltration requires a controlled authoritative DNS server and that monitoring may still detect anomalous query patterns.

Practice set

Privilege Escalation Lateral Movement And Post Exploitation questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During an internal engagement, a penetration tester attempts to perform pass-the-hash using Mimikatz, but receives an error indicating that Credential Guard is enabled. Which exploitation technique bypasses this limitation by forcing LSASS to interact with a compromised RPC endpoint?

Question 2mediummultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has compromised a Linux server and wants to establish persistence via a Cron job that runs every 5 minutes as the root user. Where should the persistence mechanism be placed to ensure execution without modifying /etc/crontab directly?

Question 3hardmultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

Question 4easymultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

Question 5hardmultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An operator has successfully established a Meterpreter session on a Windows Server 2019 domain member. To maintain access across system reboots without creating a new local user account, the operator decides to implement a WMI persistence mechanism. Which command sequence correctly establishes a WMI event subscription that executes a payload whenever the system boots?

Question 6easymultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

An attacker has gained access to a Linux machine and wants to enumerate all SUID binaries to find potential privilege escalation vectors. Which find command should the tester execute to locate all files with the SUID permission set while suppressing permission denied error messages?

Question 7mediummulti select
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

Question 8mediummultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have successfully compromised a Linux server and need to exfiltrate data. The network perimeter firewall blocks all outbound traffic except over port 443. Which tool would you use to create an encrypted tunnel for data exfiltration?

Question 9mediummultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have identified an unquoted service path vulnerability on a Windows server. What is the correct remediation path to escalate privileges?

Question 10hardmulti select
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You are assessing a Linux privilege escalation path. Which THREE techniques would allow you to escalate to root if you have write access to the /etc/passwd or /etc/shadow file?

Question 11easymulti select
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

Which TWO methods are commonly used for data exfiltration during a penetration test to bypass basic network monitoring?

Question 12mediummultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A tester has compromised a Linux host and wants to escalate privileges by exploiting a misconfigured cron job. The tester notices that a script in /etc/cron.d/backup.sh is writable by the current user. What is the most direct way to escalate privileges using this misconfiguration?

Question 13mediummultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has obtained a Meterpreter session on a Windows 10 workstation that is a member of an Active Directory domain. The tester runs `getsystem` and receives the error "[-] priv_elevate_getsystem: Operation failed: Access is denied." The session is running as a standard domain user, and UAC is enabled with the default setting. Which technique should the tester use to escalate privileges on this host?

Question 14hardmulti select
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a foothold on a Windows Server 2016 host in a domain environment and now wants to perform lateral movement to other systems using only native Windows tools to avoid detection. The tester has valid domain user credentials but no administrative rights on the target hosts. Which two techniques can be used to move laterally while remaining stealthy? (Choose two.)

Question 15mediummulti select
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

During a penetration test on a Windows domain, you have compromised a workstation and obtained local administrator privileges. You want to escalate privileges to domain administrator by exploiting Active Directory Certificate Services (AD CS) misconfigurations. Which TWO certificate template settings, if misconfigured, can be exploited to request a certificate that allows domain administrator impersonation? (Choose two.)

Question 16easymultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has compromised a Linux web server and wants to establish persistence by creating a new user account with root privileges. The tester has root access and wants to ensure the account remains hidden from casual inspection by administrators. Which command should the tester use to create a backdoor user with UID 0 and no password prompt?

Question 17hardmultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has compromised a Windows Server 2019 domain controller and wants to extract credentials from memory to facilitate further lateral movement. The tester has administrative rights on the domain controller but wants to avoid running tools that are commonly flagged by antivirus. Which built-in Windows mechanism can be abused to dump LSASS memory without using third-party tools?

Question 18mediummulti select
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

A penetration tester has gained a foothold on a Linux server and wants to escalate privileges by exploiting misconfigured file permissions. The tester runs 'find / -perm -o+w -type f 2>/dev/null' and identifies several world-writable files. Which TWO of the following files, if world-writable, would most likely allow immediate privilege escalation to root? (Choose two.)

Question 19mediummultiple choice
Open the full VLAN trunking answer →

During an internal penetration test, you compromise a workstation in the Finance VLAN and want to move laterally to a server in the HR VLAN. The HR VLAN is protected by an internal firewall that blocks most inbound traffic from Finance. You have valid domain credentials for a user who is a member of the HR server's local Administrators group. Which technique is most appropriate to establish a connection to the HR server?

Question 20hardmultiple choice
Read the full Privilege Escalation Lateral Movement And Post Exploitation explanation →

You have obtained a low-privileged shell on a Windows Server 2016 host. You discover that the AppLocker policy is configured to allow only signed scripts from the IT department. You need to escalate privileges to SYSTEM. Which technique is most likely to succeed?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Privilege Escalation Lateral Movement And Post Exploitation sessions

Start a Privilege Escalation Lateral Movement And Post Exploitation only practice session

Every question in these sessions is drawn from the Privilege Escalation Lateral Movement And Post Exploitation domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Privilege Escalation Lateral Movement And Post Exploitation questions →Mixed CPENT session

Related practice questions

Related CPENT topic practice pages

Move into related areas when this topic feels solid.

Network And Perimeter Exploitation practice questions

Practise CPENT questions linked to Network And Perimeter Exploitation.

Active Directory Attacks practice questions

Practise CPENT questions linked to Active Directory Attacks.

Iot And OT Exploitation practice questions

Targeted CPENT practice covering Iot And OT Exploitation.

Cloud And Hybrid Infrastructure Security practice questions

Targeted CPENT practice covering Cloud And Hybrid Infrastructure Security.

Privilege Escalation Lateral Movement And Post Exploitation practice questions

Privilege Escalation Lateral Movement And Post Exploitation practice questions for CPENT.

CPENT fundamentals practice questions

Work through CPENT questions on CPENT fundamentals.

CPENT scenario practice questions

Sharpen your CPENT knowledge of CPENT scenario.

CPENT troubleshooting practice questions

Sharpen your CPENT knowledge of CPENT troubleshooting.

Frequently asked questions

What does the CPENT exam test about Privilege Escalation Lateral Movement And Post Exploitation?
You must be able to enumerate and exploit local privilege escalation on Linux and Windows, then pivot laterally using credential reuse or tunneling. The single most important thing is to verify the exact misconfiguration or credential validity before attempting the exploit, because blind attempts waste time and trigger alerts.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Privilege Escalation Lateral Movement And Post Exploitation questions in a focused session?
Yes — the session launcher on this page draws every question from the Privilege Escalation Lateral Movement And Post Exploitation domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CPENT topics?
Use the topic links above to move to related areas, or go back to the CPENT question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the CPENT exam covers. They are not copied from any real exam or dump site.