CPENT Cloud And Hybrid Infrastructure Security Practice Question
A penetration tester gains shell access inside a Docker container running on a Linux host. They inspect the container's capabilities using capsh --print and notice CAP_SYS_ADMIN is enabled, and the cgroup v1 filesystem is mounted read-write inside the container. Which specific container escape vector is immediately available?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.
Writing a malicious payload to the release_agent file in cgroups combined with triggering a notification via the notify_on_release mechanism allows executing commands on the host as root.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Writing directly to the host's /etc/passwd file via a shared memory segment mounted at /dev/shm.
Why it's wrong here
/dev/shm is namespaced to the container and does not share host system files by default.
- ✓
Leveraging the cgroups release_agent notification mechanism to execute arbitrary commands on the host operating system.
Why this is correct
CAP_SYS_ADMIN and write access to cgroups allow release_agent exploitation.
- ✗
Using the ptrace system call to inject code into the host's systemd daemon process.
Why it's wrong here
PID namespaces isolate processes; the host's systemd is not visible inside a standard container.
- ✗
Issuing a mount command to repartition the host's primary storage block device.
Why it's wrong here
Block devices are restricted unless privileged or explicitly mapped.
About these practice questions
One of 274 original CPENT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.