CPENT Exam Testbank: 200 Practice Questions with
Detailed Rationales & Exam Updates 2026
CPENT Exam Overview (2026)
CPENT Practice Questions & Rationales
1. You are performing a DNS analysis and suspect
the target's nameserver is misconfigured to allow
Zone Transfers. Using the dig command, which
syntax would you use to attempt a full zone
transfer for example.com from ns1.example.com?
A. dig @ns1.example.com example.com AXFR
B. dig example.com @ns1.example.com ANY
C. dig ns1.example.com example.com
ZONETRANSFER
D. dig @example.com ns1.example.com IXFR
☑VERIFIED ANSWER: A. dig @ns1.example.com
example.com AXFR
,Rationale: The AXFR (Authoritative Transfer) query
type is used to request a full zone transfer. The
correct syntax is dig @nameserver domain AXFR.
This misconfiguration can reveal all DNS records,
exposing internal infrastructure.
2. Which Nmap scan type sends SYN packets
without completing the TCP handshake, making it
less likely to be logged?
A. TCP connect scan (-sT)
B. SYN stealth scan (-sS)
C. UDP scan (-sU)
D. FIN scan (-sF)
☑VERIFIED ANSWER: B. SYN stealth scan (-sS)
Rationale: A SYN scan sends a SYN packet and
analyzes the response without completing the
three-way handshake. Because the connection is
never fully established, many legacy logging
mechanisms do not record the attempt. This
makes -sS the default and most popular Nmap scan
type.
,3. What does the LLMNR protocol do, and why is it
a security concern?
A. It encrypts DNS queries; it can be bypassed with
certificate spoofing.
B. It resolves hostnames on the local network when
DNS fails; it can be poisoned to capture credentials.
C. It manages DHCP leases; attackers can exhaust
the address pool.
D. It handles multicast routing; attackers can
redirect traffic.
☑VERIFIED ANSWER: B. It resolves hostnames on
the local network when DNS fails; it can be
poisoned to capture credentials.
Rationale: Link-Local Multicast Name Resolution
(LLMNR) is a fallback name resolution protocol.
Because responses are unauthenticated, an attacker
can respond to LLMNR queries, directing the victim
to a malicious host and capturing NTLMv2 hashes
(e.g., with Responder).
, 4. During a penetration test, you discover an
internal host with SMB signing disabled. Which
attack becomes feasible?
A. DNS cache poisoning
B. NTLM relay attack
C. ARP spoofing
D. SSL stripping
☑VERIFIED ANSWER: B. NTLM relay attack
Rationale: SMB signing prevents message
tampering. When disabled, an attacker can intercept
NTLM authentication traffic and relay it to another
service, gaining unauthorized access to a target
server.
5. What is the primary purpose of a "pivot" during
a penetration test?
A. To escalate privileges on the current host.
B. To use a compromised system to attack other
systems on an internal network.
C. To exfiltrate data through an encrypted tunnel.
D. To modify firewall rules.
Detailed Rationales & Exam Updates 2026
CPENT Exam Overview (2026)
CPENT Practice Questions & Rationales
1. You are performing a DNS analysis and suspect
the target's nameserver is misconfigured to allow
Zone Transfers. Using the dig command, which
syntax would you use to attempt a full zone
transfer for example.com from ns1.example.com?
A. dig @ns1.example.com example.com AXFR
B. dig example.com @ns1.example.com ANY
C. dig ns1.example.com example.com
ZONETRANSFER
D. dig @example.com ns1.example.com IXFR
☑VERIFIED ANSWER: A. dig @ns1.example.com
example.com AXFR
,Rationale: The AXFR (Authoritative Transfer) query
type is used to request a full zone transfer. The
correct syntax is dig @nameserver domain AXFR.
This misconfiguration can reveal all DNS records,
exposing internal infrastructure.
2. Which Nmap scan type sends SYN packets
without completing the TCP handshake, making it
less likely to be logged?
A. TCP connect scan (-sT)
B. SYN stealth scan (-sS)
C. UDP scan (-sU)
D. FIN scan (-sF)
☑VERIFIED ANSWER: B. SYN stealth scan (-sS)
Rationale: A SYN scan sends a SYN packet and
analyzes the response without completing the
three-way handshake. Because the connection is
never fully established, many legacy logging
mechanisms do not record the attempt. This
makes -sS the default and most popular Nmap scan
type.
,3. What does the LLMNR protocol do, and why is it
a security concern?
A. It encrypts DNS queries; it can be bypassed with
certificate spoofing.
B. It resolves hostnames on the local network when
DNS fails; it can be poisoned to capture credentials.
C. It manages DHCP leases; attackers can exhaust
the address pool.
D. It handles multicast routing; attackers can
redirect traffic.
☑VERIFIED ANSWER: B. It resolves hostnames on
the local network when DNS fails; it can be
poisoned to capture credentials.
Rationale: Link-Local Multicast Name Resolution
(LLMNR) is a fallback name resolution protocol.
Because responses are unauthenticated, an attacker
can respond to LLMNR queries, directing the victim
to a malicious host and capturing NTLMv2 hashes
(e.g., with Responder).
, 4. During a penetration test, you discover an
internal host with SMB signing disabled. Which
attack becomes feasible?
A. DNS cache poisoning
B. NTLM relay attack
C. ARP spoofing
D. SSL stripping
☑VERIFIED ANSWER: B. NTLM relay attack
Rationale: SMB signing prevents message
tampering. When disabled, an attacker can intercept
NTLM authentication traffic and relay it to another
service, gaining unauthorized access to a target
server.
5. What is the primary purpose of a "pivot" during
a penetration test?
A. To escalate privileges on the current host.
B. To use a compromised system to attack other
systems on an internal network.
C. To exfiltrate data through an encrypted tunnel.
D. To modify firewall rules.
