These 200 practice questions cover key CPENT
domains: Active Directory, web apps, cloud,
containers, IoT, and pivoting. However, the
exam is hands-on and performance-based.
Prioritize Cyber Range lab practice over
memorizing questions, as practical exploitation
skills determine your ultimate success.
CPENT Practice Questions
Question 1
During a penetration test, you discover an
internal host with SMB signing disabled. Which
attack becomes feasible because of this
misconfiguration?
A. DNS cache poisoning
B. NTLM relay attack
C. ARP spoofing on a switched segment
D. SSL stripping
,☑VERIFIED ANSWER: B. NTLM relay attack
Rationale: When SMB signing is disabled, an
attacker can intercept NTLM authentication
traffic and relay it to another service, gaining
unauthorized access.
Question 2
Which Nmap scan type sends SYN packets and
does not complete the TCP handshake, making
it less likely to be logged by the target system?
A. TCP connect scan (-sT)
B. SYN stealth scan (-sS)
C. UDP scan (-sU)
D. FIN scan (-sF)
☑VERIFIED ANSWER: B. SYN stealth scan (-sS)
Rationale: A SYN stealth scan sends SYN
packets and analyzes the response without
completing the TCP three-way handshake.
,Because the connection is never fully
established, many legacy logging mechanisms
do not record the attempt.
Question 3
What is the primary purpose of a pivot during a
penetration test?
A. To escalate privileges on the current host
B. To use a compromised system to attack other
systems on an internal network
C. To exfiltrate data through an encrypted
tunnel
D. To modify firewall rules to allow inbound
connections
☑VERIFIED ANSWER: B. To use a compromised
system to attack other systems on an internal
network
Rationale: Pivoting uses a compromised host as
, a relay point to access and attack systems on
network segments that are not directly
reachable from the attacker's position. Tools
like SSH tunnels, Meterpreter routes, and
SOCKS proxies facilitate pivoting.
Question 4
Which protocol is commonly targeted when
performing a Man-in-the-Middle (MitM) attack
on a local network?
A. HTTPS with certificate pinning
B. ARP (Address Resolution Protocol)
C. DNSSEC
D. IPsec ESP
☑VERIFIED ANSWER: B. ARP (Address
Resolution Protocol)
Rationale: ARP operates at Layer 2 without
authentication, making it trivially spoofable. By
domains: Active Directory, web apps, cloud,
containers, IoT, and pivoting. However, the
exam is hands-on and performance-based.
Prioritize Cyber Range lab practice over
memorizing questions, as practical exploitation
skills determine your ultimate success.
CPENT Practice Questions
Question 1
During a penetration test, you discover an
internal host with SMB signing disabled. Which
attack becomes feasible because of this
misconfiguration?
A. DNS cache poisoning
B. NTLM relay attack
C. ARP spoofing on a switched segment
D. SSL stripping
,☑VERIFIED ANSWER: B. NTLM relay attack
Rationale: When SMB signing is disabled, an
attacker can intercept NTLM authentication
traffic and relay it to another service, gaining
unauthorized access.
Question 2
Which Nmap scan type sends SYN packets and
does not complete the TCP handshake, making
it less likely to be logged by the target system?
A. TCP connect scan (-sT)
B. SYN stealth scan (-sS)
C. UDP scan (-sU)
D. FIN scan (-sF)
☑VERIFIED ANSWER: B. SYN stealth scan (-sS)
Rationale: A SYN stealth scan sends SYN
packets and analyzes the response without
completing the TCP three-way handshake.
,Because the connection is never fully
established, many legacy logging mechanisms
do not record the attempt.
Question 3
What is the primary purpose of a pivot during a
penetration test?
A. To escalate privileges on the current host
B. To use a compromised system to attack other
systems on an internal network
C. To exfiltrate data through an encrypted
tunnel
D. To modify firewall rules to allow inbound
connections
☑VERIFIED ANSWER: B. To use a compromised
system to attack other systems on an internal
network
Rationale: Pivoting uses a compromised host as
, a relay point to access and attack systems on
network segments that are not directly
reachable from the attacker's position. Tools
like SSH tunnels, Meterpreter routes, and
SOCKS proxies facilitate pivoting.
Question 4
Which protocol is commonly targeted when
performing a Man-in-the-Middle (MitM) attack
on a local network?
A. HTTPS with certificate pinning
B. ARP (Address Resolution Protocol)
C. DNSSEC
D. IPsec ESP
☑VERIFIED ANSWER: B. ARP (Address
Resolution Protocol)
Rationale: ARP operates at Layer 2 without
authentication, making it trivially spoofable. By
