Lateral Movement and Pivoting CPENT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the context of Active Directory post-exploitation, what is the primary purpose of lateral movement?

   • ATo escalate privileges on the current compromised host
   • BTo establish persistence by creating scheduled tasks on the compromised host
   • CTo exfiltrate data from the compromised host to an external server
   • DTo move from one compromised system to another within the network
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You have obtained the NTLM hash of a local administrator account on a Windows server. You need to move laterally to another server that has the same local administrator password. Which technique would allow you to authenticate without knowing the plaintext password?

   • APass-the-Ticket using a Kerberos ticket.
   • BUse the hash to create a new domain account.
   • CPass-the-Hash using a tool like Mimikatz or Impacket.
   • DCrack the hash to obtain the plaintext password.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   You have compromised a Linux host that is behind a strict egress firewall allowing only DNS (UDP 53) and HTTPS (TCP 443). You need to tunnel traffic to an internal network that the Linux host can reach. Which technique is most likely to succeed given the firewall restrictions?

   • AUse HTTP tunneling over port 80
   • BUse SOCKS proxy on port 1080
   • CUse DNS tunneling to encapsulate traffic in DNS queries
   • DUse SSH over port 443
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You have compromised a Linux server that is accessible via SSH from your workstation. The server has access to an internal web application on port 8080 that is not accessible from your workstation. You need to access the web application's admin interface from your browser. Which command would you run on your workstation to set up a tunnel?

   • Assh -D 8080 user@linux-server
   • Bssh -L 8080:internal-web:8080 user@linux-server
   • Cssh -R 8080:internal-web:8080 user@linux-server
   • Dssh -L 8080:localhost:8080 user@linux-server
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You have compromised a Windows host that has access to an internal network. You want to use this host as a pivot to scan internal hosts with Nmap from your attack machine. Which approach is most effective?

   • AAdd a static route to the internal network via the compromised host
   • BUse Proxychains with a SOCKS proxy on the compromised host
   • CUse SSH local port forwarding for each port you want to scan
   • DRun Nmap directly on the compromised host
   Reveal Solution Discussion Select an answer first