EC-Council Certified Penetration Testing Professional (CPENT) (CPENT) (CPENT) — Questions 76–150

An attacker has established a foothold inside a corporate network and needs to scan an internal subnet without generating noisy network connections that trigger host-based IDS alerts. They decide to use an idle scan. Which Nmap argument implements an idle scan via a zombie host?

During an internal assessment, a tester wants to extract cleartext credentials from network traffic passing through a switched network segment where they have achieved ARP spoofing positioning. Which Wireshark display filter isolates SMB authentication handshakes to locate cleartext credential exchanges?

An auditor is reviewing an ICS network architecture and notes that a Supervisory Control and Data Acquisition (SCADA) server communicates with remote terminal units (RTUs) via DNP3 over serial-to-ethernet terminal servers. The auditor wants to test if unauthenticated DNP3 control commands can be accepted. Which default port should the auditor probe for DNP3 traffic?

During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?

A penetration tester has obtained execution on a Linux host and needs to exfiltrate a sensitive archive file through a tightly restricted firewall that only permits outbound DNS traffic. Which tool and technique should the tester use?

A penetration tester is auditing an organization's wireless network and discovers an enterprise WPA2-Enterprise deployment utilizing PEAP-MSCHAPv2. Which tool can be used to set up a rogue RADIUS authentication server to capture enterprise user credentials when clients mistakenly associate?

Which TWO methods can an operator use to mitigate or prevent detection while performing Kerberoasting during an internal penetration test?

During an assessment of a smart water treatment facility, an analyst notices an HTTP-based web interface running on an embedded PLC. The analyst wants to discover hidden administrative backup directories and configuration files on the web server. Which command-line tool is specifically designed for brute-forcing web server directories and files?

An engineer is conducting a security audit on a smart grid device that uses CoAP over DTLS. The engineer attempts to intercept the handshake and notices pre-shared key (PSK) cipher suites are enabled. Which OpenSSL command can the engineer use to test connecting to the DTLS service using a specific Pre-Shared Key identifier and hex-encoded key?

During an internal penetration test, an operator compromises a Windows workstation and needs to harvest clear-text credentials or NTLM hashes from memory without generating excessive security alerts. Which built-in Windows administrative tool or mechanism can be leveraged legitimately to dump the lsass.exe process memory for offline analysis?

A penetration tester is analyzing an Azure environment and discovers that an Azure Function App has been configured with managed identity enabled and possesses 'Contributor' access to the subscription. The function code contains a Server-Side Request Forgery (SSRF) vulnerability. How can the tester exploit the Azure Instance Metadata Service (IMDS) via this SSRF to elevate privileges?

A penetration tester has compromised an account that possesses the 'GenericAll' permission over a Group Policy Object (GPO) linked to the domain. How can this permission be leveraged to achieve remote code execution across systems affected by the GPO?

An IoT penetration tester is analyzing the security of a Zigbee smart lighting installation. Which TWO of the following tools or frameworks are specifically utilized when assessing 802.15.4 and Zigbee wireless security? (Choose TWO)

A penetration tester is conducting an assessment of an MQTT-based smart home ecosystem. Which THREE of the following security configuration checks should the tester perform on the MQTT broker? (Choose THREE)

A penetration tester is evaluating a smart home IoT hub and needs to extract the firmware to analyze hardcoded cryptographic keys. The device exposes a physical debugging interface on the board with clock, data, ground, and power pins. Which hardware hacking tool should the tester connect to these pins to interact with the internal flash memory and dump the firmware?

A penetration tester is evaluating an embedded IoT device that exposes a Telnet service on port 23. The tester suspects default credentials are in use. Which command-line tool can the tester use to perform a fast dictionary attack against the Telnet service using a username and password list?

A penetration tester has gained a standard user shell on a Windows machine and wants to check for unquoted service paths. Which PowerShell command should they run to identify services with unquoted paths and spaces in their names without administrative privileges?

An operator has compromised an account with GenericAll permissions over a computer object in Active Directory. How can this permission be leveraged to achieve code execution on the target host?

In the context of AD CS abuse, which THREE vulnerabilities or template settings are categorized under certificate template misconfigurations that allow privilege escalation?

During a post-exploitation phase, a penetration tester wants to perform lateral movement using WMI (Windows Management Instrumentation) from a compromised Windows workstation to a domain controller. Which network port must be accessible through host and network firewalls to initiate the WMI connection?

A penetration tester is performing service enumeration on a target FTP server. To quickly grab the banner and check what FTP software version is running without initiating an interactive login session, which tool is most appropriate?

A penetration tester is performing a network assessment against a target running an advanced Intrusion Prevention System (IPS). To evade signature-based detection that looks for standard Nmap probe payloads, which Nmap option allows the user to append random junk data to generated packets?

You are hardening and analyzing network perimeter defenses against advanced evasion techniques. Which TWO of the following Nmap features or scan modifications are specifically designed to evade packet inspection filters by altering packet headers or timing parameters?

A pentester needs to exploit an AD CS vulnerability where a low-privileged user can enroll in a template that permits Client Authentication and has the 'ENROLLEE_SUPPLIES_SUBJECT' flag set. Which tool from Certipy can be used to request a certificate and subsequently authenticate as a high-privileged user?

During an internal network security assessment, a tester discovers that a legacy application communicates over a custom TCP port with unencrypted traffic. To capture and analyze this traffic without disrupting communications, which passive technique on a managed switch should be configured by the network administrator?

A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?

An elite penetration tester is attempting to evade network intrusion detection systems (IDS) during a port scan. Which THREE techniques can be applied via Nmap command-line options to obscure the scan origin or payload? (Choose THREE)

An ethical hacker is evaluating a Bluetooth Low Energy (BLE) medical sensor. Which TWO of the following vulnerabilities or attack vectors are commonly associated with insecure BLE implementations in IoT devices? (Choose TWO)

During an assessment of a hybrid Active Directory environment, a penetration tester compromises an on-premises user account that is synchronized to Azure AD via Azure AD Connect. The tester notices that the on-premises account is a member of the local 'Backup Operators' group. Which hybrid attack path is most directly enabled by this configuration?

While reviewing a hybrid identity deployment utilizing Azure AD Connect, a penetration tester observes that Password Hash Sync (PHS) is enabled alongside Pass-Through Authentication (PTA). What security implication does this configuration present during an on-premises domain compromise?

An operator wants to perform lateral movement across an internal network using native Windows administrative protocols that do not require installing third-party agent software. Which THREE protocols or services can be leveraged? Choose three.

A penetration tester is performing lateral movement inside an Active Directory domain and wants to use Pass-the-Hash (PtH) attacks to authenticate to other systems without cracking user passwords. Which TWO requirements must be met for a successful Pass-the-Hash attack using NTLM hashes against Windows targets?

A security analyst is auditing an internal network and wishes to identify all active DNS servers that allow unauthorized zone transfers (AXFR). Which tool is specifically designed to test for DNS zone transfer vulnerabilities?

A security engineer discovers that an AWS IAM user has an active access key and permissions to run ec2:RunInstances, iam:PassRole, and iam:CreateRole. What privilege escalation path does this permission combination represent?

A penetration tester is conducting reconnaissance against a web application firewall (WAF) protected perimeter. Which TWO methods can help identify whether a WAF is present in front of a web server? (Choose TWO)

A penetration tester successfully compromises a Linux web server and needs to establish an encrypted interactive reverse shell back to their attacking machine, but standard netcat is not installed. Which native Python command-line snippet can be executed to spawn a bash shell back to the listener?

An ethical hacker has compromised a machine account and discovered that it has 'GenericAll' or 'WriteDacl' privileges over a privileged domain group (such as Domain Admins). Which TWO techniques or actions can the operator perform using these permissions to escalate privileges? (Choose TWO)

An auditor reviews cloud logging and monitoring configurations across an enterprise multi-cloud environment. Which TWO of the following practices represent critical security deficiencies? (Choose TWO)

During an assessment of an enterprise network, you discover an insecure Server Message Block (SMB) configuration. You want to enumerate network shares and user accounts using enum4linux without triggering account lockout policies through brute-force methods. Which underlying protocol implementation does enum4linux primarily leverage to query Windows and Samba hosts for granular domain information?

An ethical hacker is performing a security assessment on an industrial facility and discovers an open Zigbee network. The hacker wants to perform active reconnaissance to map all connected nodes and routing tables. Which open-source toolset provides utilities like 'zigbee-discovery' and packet generation for IEEE 802.15.4 networks?

An IoT penetration tester is conducting a security audit of a Linux-based smart gateway. Which THREE of the following commands or file inspection techniques can the tester use on the device (or extracted rootfs) to identify privilege escalation vectors or misconfigurations? (Choose THREE)

A penetration tester has compromised an internal Windows workstation and wants to extract saved credentials from the Local Security Authority Subsystem Service (LSASS) memory. Which utility from the Sysinternals suite, frequently abused by red teams, can be used to safely dump the lsass.exe process memory?

A penetration tester reviewing a Windows machine identifies that a scheduled task executes a script with administrative privileges, but the script file has weak permissions allowing standard users to modify it. What type of privilege escalation vector does this represent?

An IoT security analyst is performing a firmware security review of an embedded Linux router. Which TWO of the following static analysis techniques or tools should the analyst employ to identify hardcoded secrets and vulnerable binaries within the extracted root file system? (Choose TWO)

An ICS penetration tester is auditing a manufacturing plant floor. Which TWO of the following methodologies or tools are specifically used for identifying and fingerprinting industrial control system devices across the network? (Choose TWO)

A penetration tester identifies a user account with the 'Do not require Kerberos pre-authentication' (DONT_REQUIRE_PREAUTH) property enabled. Which attack can be performed against this account?

A penetration tester is analyzing an enterprise cloud infrastructure utilizing both AWS and Azure. Which THREE of the following attack vectors or misconfigurations are relevant to hybrid and cloud security assessments? (Choose THREE)

A penetration tester is auditing an AWS environment and investigating potential privilege escalation paths via IAM. Which TWO of the following IAM permission combinations represent classic privilege escalation vectors in AWS? (Choose two)

An ethical hacker has obtained the NTLM password hash of a local administrator account on a Windows workstation and wants to perform lateral movement using Pass-the-Hash (PtH). Which tool allows executing a command or spawning an interactive prompt on a remote system using only the NTLM hash without knowing the plaintext password?

An IoT penetration tester successfully dumps the flash memory of an embedded router. The resulting binary image contains a U-Boot bootloader environment. Which command can the tester look for or attempt to inject via the serial console to override the Linux kernel boot arguments and spawn a root shell?

A pentester successfully compromises a machine and obtains a valid Kerberos Ticket Granting Ticket (TGT) file (.ccache). To use this ticket for lateral movement on Linux using Impacket, which environment variable must be exported?

During post-exploitation enumeration on a Windows system, a penetration tester discovers that credentials for a domain administrator were accidentally left in a plaintext file. To prepare for lateral movement and domain dominance, which TWO actions can the tester perform using these credentials without executing a full DCSync attack?

During an Active Directory Certificate Services (AD CS) assessment, a tester discovers that the 'ESC1' vulnerability is present. What specific misconfiguration defines ESC1 on a certificate template?

When analyzing BloodHound output, what visual edge or relationship indicates that user 'A' can modify the membership or attributes of group 'B'?

A penetration tester is assessing an MQTT-based industrial monitoring system where brokers communicate over unencrypted TCP ports. The tester wants to discover hidden topics that are not actively publishing data by brute-forcing topic names. Which tool natively supports MQTT fuzzing and topic discovery through automated subscription testing?

Which THREE techniques are commonly employed by attackers to persist on a Linux system?

A pentester needs to verify whether a remote server is listening on a specific UDP port, say port 123 (NTP). They send a UDP packet, but the target responds with an ICMP Port Unreachable message. What does this response indicate about the port?

A penetration tester has compromised a Linux server and wants to exfiltrate a compressed data archive over the network securely using encrypted protocols. Which THREE standard network tools support encrypted file transfer out of the box? Choose three.

A security auditor is performing a penetration test on an operational technology (OT) network utilizing Modbus/TCP. Which THREE of the following actions can an attacker typically perform if network segmentation and firewall rules are improperly configured? (Choose THREE)

Which post-exploitation action is considered 'Living off the Land' (LotL)?

Which TWO of the following Active Directory enumeration methods or tools can be used by an unprivileged domain user to identify accounts configured with 'Do not require Kerberos preauthentication' (AS-REP roasting candidates)? (Choose TWO)

A penetration tester has gained access to a Linux host and discovers that port forwarding using SSH is restricted, but outbound HTTPS (port 443) traffic is allowed. Which tool creates encrypted TCP tunnels over HTTP or HTTPS and is ideal for egress bypassing?

A security researcher is analyzing an embedded Linux firmware image for potential backdoors. The researcher wants to quickly scan the binary for compressed file systems, bootloader signatures, and kernel versions without extracting it. Which command-line tool is best suited for this initial identification task?

During a wireless penetration test of an industrial plant, an auditor wants to discover all active Wi-Fi access points and associated IoT wireless clients operating in the 2.4 GHz band. Which wireless auditing tool should the auditor use to monitor and dump 802.11 management frames?

During an internal network penetration test, a tester identifies an active DHCP server on the local network. Which TWO attacks can be launched against the DHCP infrastructure to disrupt service or intercept traffic? (Choose TWO)

You are attempting to evade a stateful packet inspection (SPI) firewall that drops TCP packets with invalid TCP flag combinations. You decide to use Nmap to perform a stealth scan against a target web server behind this perimeter. Which Nmap scan type explicitly sends a packet with the FIN, PSH, and URG flags set, relying on RFC 793 behavior where closed ports reply with an RST and open ports ignore the packet?

A penetration tester is analyzing network traffic associated with lateral movement and needs to identify potential Kerberoasting activity in Active Directory. Which THREE indicators or artifacts are typically associated with this attack? (Choose THREE)

A penetration tester is evaluating a smart home hub communicating via Z-Wave protocol. Which TWO of the following characteristics or security mechanisms distinguish Z-Wave from standard Wi-Fi or Zigbee implementations? (Choose TWO)

An operator has compromised a Linux server and wants to establish persistence that survives kernel reboots and operates stealthily by hooking system calls or modifying kernel memory. Which persistence mechanism matches this description?

A security researcher is performing dynamic analysis of an IoT firmware binary inside an emulated MIPS environment using QEMU-user mode. When executing the binary, the application crashes with a segmentation fault due to missing dynamic library dependencies in the emulated root directory. Which environment variable must be exported to instruct QEMU where to search for the target root filesystem's shared libraries?

During a hardware penetration test of an IoT device, the tester identifies a 4-pin header on the PCB. Using a multimeter, the tester measures ground on pin 1, 3.3V on pin 4, and observes fluctuating voltages on pins 2 and 3 during boot. What hardware interface do pins 2 and 3 most likely represent?

A security analyst is performing a penetration test against a building automation system utilizing BACnet over IP. To discover BACnet devices on the local subnet without prior knowledge of their IP addresses, which specific network packet type and destination should the analyst send?

An internal penetration tester needs to scan a local subnet for live hosts quickly and quietly without sending TCP or UDP port traffic. Which TWO methods rely on network layer protocols other than TCP port scanning for host discovery? (Choose TWO)

During a network audit, a tester discovers that a router is running an insecure routing protocol implementation susceptible to routing table poisoning. Which protocol relies on cleartext updates and hop-count metrics up to 16, making it vulnerable to unauthorized route injection?

An external penetration tester is tasked with enumerating valid usernames on an enterprise Microsoft Active Directory environment through the SMB protocol without triggering account lockout policies. Which tool is standard for this task?