CPENT Practice Questions

Question 1

A penetration tester is analyzing the firmware of an IoT smart bulb extracted via a flash dump. Using Binwalk, the tester extracts the squashfs-root file system. Which command should the tester execute to search for hardcoded private RSA keys within the extracted directory?

Accepted Answer

grep -rn 'BEGIN RSA PRIVATE KEY' squashfs-root/. The grep command with the -r (recursive) and -n (line number) flags searches through all files in the squashfs-root directory for the string 'BEGIN RSA PRIVATE KEY'. This pattern is the standard header for PEM-encoded RSA private keys, making it an effective way to locate hardcoded keys in extracted firmware. The command is simple, fast, and does not require additional tools.

Answer

strings -k squashfs-root/

Answer

firmadyne -s squashfs-root/

Answer

binwalk -A squashfs-root/

Question 2

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

Accepted Answer

Hardcoding cloud provider API access keys directly into public application source code repositories.. Option B is correct because hardcoding cloud provider API access keys into public source code repositories exposes long-lived credentials to anyone who can view the repo, enabling unauthorized API calls, resource creation, and data exfiltration; secrets should instead be stored in a secrets manager or KMS-backed vault and injected at runtime. Option D is correct because disabling centralized audit logging such as AWS CloudTrail or Azure Activity Logs destroys the tamper-evident record of control-plane and data-plane activity, eliminating detection, forensic investigation, and compliance evidence, which is a critical monitoring deficiency regardless of storage cost savings. The unmarked options do not belong: A is a sound detection practice that surfaces anomalous resource creation, C is a recommended key-management practice using cloud-native KMS with automatic rotation, and E is a foundational IAM control that reduces blast radius by enforcing least privilege.

Answer

Configuring automated alerts for unusual spikes in cloud resource creation.

Answer

Using cloud-native Key Management Services with automatic key rotation enabled.

Answer

Enforcing least-privilege access principles across all IAM service accounts.

Question 3

A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?

Accepted Answer

Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.. With CAP_SYS_ADMIN and a read-write cgroup v1 mount, the attacker can write a path to the release_agent file and then trigger a cgroup release, causing the kernel to execute that path as root in the host's initial namespace. This is the canonical cgroup v1 container escape (CVE-2022-0492 is a related kernel-side variant). No other listed vector is available from inside a standard container without additional host misconfigurations.

Answer

Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.

Answer

Using the ptrace system call to inject code into the host's systemd daemon process.

Answer

Issuing a mount command to repartition the host's primary storage block device.

Question 4

An internal penetration tester is performing reconnaissance using BloodHound to map out attack paths in an Active Directory domain. Which automated data collection tool is officially supported and widely utilized to gather ACLs, session information, and object relationships for BloodHound ingestion?

Accepted Answer

SharpHound. SharpHound is the official data collector for BloodHound, written in C#, designed to query Active Directory via LDAP and WinAPI to gather telemetry for mapping attack paths.

Answer

BloodHound-Collector-GUI

Answer

AD-Collector-Pro

Answer

Responder

Question 5

A penetration tester is analyzing a Linux host for potential privilege escalation vectors related to sudo rights. Which THREE commands or checks should the tester perform to identify misconfigured sudo privileges? Choose three.

Accepted Answer

ls -la /etc/sudoers.d/. Option D, `sudo -l`, is correct because it lists the sudo privileges of the invoking user, showing exactly which commands they may run as root or other users (including NOPASSWD entries and wildcard rules) — the primary way to spot exploitable sudo rights. Option E, `cat /etc/sudoers`, is correct because the main sudoers policy file defines user/group specifications, command aliases, and defaults; reading it (if permissions allow) reveals misconfigurations such as overly broad ALL=(ALL) ALL grants. Option C, `ls -la /etc/sudoers.d/`, is correct because sudoers drop-in files in /etc/sudoers.d/ are included via #includedir and often contain custom privilege rules that are easy to overlook; listing them identifies additional policy files to inspect. Option A, `arp -a`, is not relevant because it only displays the ARP cache for network mapping, not sudo configuration. Option B, `uname -r`, is not relevant because it only prints the kernel release version, which does not reveal sudo privilege settings.

Answer

arp -a

Answer

uname -r

Question 6

During an Azure assessment, an attacker discovers that an App Service web application has Managed Identity enabled and the underlying application code is vulnerable to Server-Side Request Forgery (SSRF). How can the attacker chain these vulnerabilities?

Accepted Answer

By using the SSRF vulnerability to query the Azure Instance Metadata Service (IMDS) and retrieve access tokens for the Managed Identity.. An attacker exploiting SSRF can query the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254 to acquire OAuth access tokens for the managed identity.

Answer

By extracting the plaintext storage account keys from the kudu SCM debug console logs.

Answer

By forcing the App Service to downgrade its TLS version to SSLv3.

Answer

By injecting malicious PowerShell commands into the Microsoft Entra ID synchronization pipe.

Question 7

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

Accepted Answer

AddMember. In BloodHound, the 'AddMember' edge indicates that a user or group has the ability to add members to a group. This is a direct privilege escalation path because adding a user to a high-privileged group (e.g., Domain Admins) grants that user the group's privileges. Therefore, the visual edge that indicates user 'A' can modify the membership of group 'B' is 'AddMember'.

Answer

AllowedToDelegate

Answer

ReadLAPSPassword

Answer

CoerceTo

Question 8

A penetration tester has gained a standard user shell on a Linux target and discovers that the user can execute a specific backup binary using sudo without a password. The binary internally calls the system() function to invoke the tar command using a relative path instead of an absolute path. Which technique should the tester use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to include a malicious directory containing a crafted tar binary and execute the sudo command. By manipulating the PATH environment variable to point to a directory controlled by the attacker containing a malicious script named tar, executing the sudo binary will cause it to run the malicious script with elevated privileges via the relative path invocation.

Answer

Append a new user account to the /etc/passwd file by leveraging a kernel exploit

Answer

Modify the /etc/sudoers file directly using a buffer overflow vulnerability

Answer

Inject shellcode into the target binary's memory space using GDB while running under sudo

Question 9

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

Accepted Answer

Testing if Access Control Lists (ACLs) are enforced to restrict topic publishing and subscribing rights. Option B is correct because MQTT brokers rely on ACLs to authorize which clients may publish or subscribe to specific topics, and a tester should verify that these restrictions are actually enforced to prevent unauthorized topic access. Option D is correct because many brokers ship with anonymous access enabled by default, so confirming whether unauthenticated clients can connect is a fundamental MQTT hardening check. Option E is correct because MQTT traffic is frequently deployed in cleartext on TCP port 1883, and verifying that TLS is used (typically on port 8883) ensures confidentiality and integrity of the smart home communications. Option A does not belong because Modbus/TCP function code 0x10 (Write Multiple Registers) is an industrial control protocol unrelated to MQTT broker configuration. Option C does not belong because an 802.11 deauthentication flood is a wireless-layer denial-of-service attack against Wi-Fi clients, not a broker security configuration check.

Answer

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Answer

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Question 10

A pentester is performing a security review of a smart meter that utilizes an unencrypted CoAP (Constrained Application Protocol) service running over UDP. Using Python and Scapy, the tester crafts a packet to interact with the device. Which default UDP port should the tester target for standard unencrypted CoAP communications?

Accepted Answer

UDP 5683. CoAP is designed for resource-constrained internet devices and typically operates over UDP port 5683 for unencrypted traffic and port 5684 for secure DTLS traffic.

Answer

UDP 1900

Answer

UDP 5353

Answer

UDP 5060

Question 11

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

Accepted Answer

Rubeus (rubeus.exe asreproast). Option C is correct because Rubeus is a dedicated Kerberos attack toolkit, and its `asreproast` command specifically enumerates and extracts AS-REP hashes from accounts whose UserAccountControl flag does not have Kerberos preauthentication required (UF_DONT_REQUIRE_PREAUTH, 0x400000), which an unprivileged domain user can perform. Option E is correct because PowerView's `Get-DomainUser -PreauthNotRequired` queries Active Directory via LDAP for user objects with the DONT_REQUIRE_PREAUTH flag set, directly identifying AS-REP roasting candidates without elevated privileges. Option A is wrong because cleanmgr.exe is a disk cleanup utility with no AD enumeration capability. Option B is wrong because Mimikatz's `lsadump::dcsync` requires DCSync rights (typically Domain Admin or Replicating Directory Changes permissions), so it is not usable by an unprivileged domain user. Option D is wrong because secpol.msc edits local security policy on a single host and does not enumerate domain accounts.

Answer

Windows Disk Cleanup utility (cleanmgr.exe)

Answer

Mimikatz (lsadump::dcsync)

Answer

Local Security Policy snap-in (secpol.msc)

Question 12

You have gained initial access to a Windows host and need to move laterally to a domain controller using Pass-the-Hash. What is the mandatory prerequisite for this attack to succeed?

Accepted Answer

The target must have NTLM authentication enabled in the local security policy.. Pass-the-Hash (PtH) works by using the NTLM hash of a user's password to authenticate via NTLM, bypassing the need for the plaintext password. For this to succeed, the target system must accept NTLM authentication. If NTLM is disabled in the local security policy (e.g., via 'Network security: Restrict NTLM' settings), the attack fails because the hash cannot be used. Thus, the mandatory prerequisite is that NTLM authentication is enabled on the target.

Answer

The target must have the Remote Registry service disabled.

Answer

The target must be running Windows 10 or higher.

Answer

You must have the plaintext password of the target account.

Question 13

When reviewing container security and Kubernetes cluster configurations, which THREE practices or misconfigurations commonly lead to container escapes or host compromise? (Choose three)

Accepted Answer

Exposing sensitive host directories (such as '/' or '/proc') via 'hostPath' volumes.. Option B is correct because mounting sensitive host directories such as '/' or '/proc' through a hostPath volume gives the container direct read/write access to host files, kernel interfaces, and process information, which an attacker can abuse to modify host binaries, read secrets, or escape the container boundary. Option C is correct because setting privileged: true disables most container isolation, grants all Linux capabilities, and removes seccomp/AppArmor restrictions, effectively giving the container root-level control over the host devices and kernel. Option D is correct because mounting /var/run/docker.sock exposes the Docker daemon API to the container, allowing an attacker to create a new privileged container that mounts the host filesystem and thereby compromise the node. Option A is not a risk but a hardening practice, since running as a non-root UID (USER 1000) reduces the impact of a compromise. Option E is also a security best practice, as RBAC with least-privilege bindings limits what identities can do in the cluster rather than enabling escapes.

Answer

Using a non-root user directive (USER 1000) inside the Dockerfile.

Answer

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Question 14

An IoT penetration tester is assessing a smart camera that communicates with a cloud service using MQTT. The tester captures network traffic and notices that the MQTT CONNECT packet includes a username and password in cleartext. Which of the following is the MOST likely reason for this exposure?

Accepted Answer

The MQTT connection is not using TLS encryption.. MQTT does not encrypt traffic by default. Without TLS, the CONNECT packet, which contains username and password, is transmitted in cleartext. The observation of cleartext credentials directly points to the absence of TLS encryption on the MQTT connection. Other options describe scenarios that would either prevent connection or are specific subsets of the same root cause.

Answer

The MQTT broker is configured to use TLS, but the client is not.

Answer

The MQTT client is configured to use MQTT over WebSocket without TLS.

Answer

The MQTT broker is using a self-signed certificate that the client rejects.

Question 15

A tester is analyzing an IoT gateway that runs a web management interface. During discovery, the tester finds that the device exposes an unauthenticated API endpoint that accepts JSON input. Which command-line HTTP client should the tester use to send a custom POST request containing JSON data to test for command injection?

Accepted Answer

curl -X POST -H 'Content-Type: application/json' -d '{"cmd":"id"}' http://192.168.1.100/api. cURL is the standard command-line utility for transferring data with URLs, supporting custom HTTP methods, headers, and data payloads.

Answer

ping -c 4 -p '{"cmd":"id"}' 192.168.1.100

Answer

netstat -an | grep 80

Answer

traceroute -p 80 192.168.1.100

EC-Council Certified Penetration Testing Professional CPENT practice test

Three ways to study

Study CPENT by domain

Study CPENT by topic

Network And Perimeter Exploitation practice questions

Active Directory Attacks practice questions

Iot And OT Exploitation practice questions

Cloud And Hybrid Infrastructure Security practice questions

Privilege Escalation Lateral Movement And Post Exploitation practice questions

CPENT fundamentals practice questions

CPENT scenario practice questions

CPENT troubleshooting practice questions

EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) practice questions