What is the primary purpose of using SSH tunneling in a penetration test?

To bypass antivirus detection on the compromised host

To escalate privileges on the compromised host

To create a secure channel to route traffic through a compromised host to internal networks

To encrypt traffic between the attacker and the compromised host

Why is it important to use separate credentials for different lateral movement steps?

To increase the speed of lateral movement

To reduce the risk of credential compromise and limit the blast radius

To avoid triggering account lockout policies

To avoid password reuse policies

You have compromised a Windows host that is domain-joined and has access to an internal network. You need to pivot to a Linux server on that network, but the Windows host does not have an SSH client installed. Which technique is most appropriate for pivoting from the Windows host?

Use Meterpreter's pivot command to route traffic through the Windows host

Use a reverse SSH tunnel from the Linux server

Use SSH local port forwarding from your attack machine

You have compromised a Windows workstation and extracted a Kerberos ticket-granting ticket (TGT) for a domain user. You need to access a file server that the user is authorized to access. The file server is in the same domain. Which technique would allow you to use the TGT to access the file server?

Pass-the-Hash by using the user's NTLM hash to authenticate to the file server.

Convert the TGT to an NTLM hash using a tool like mimikatz.

Use the TGT to crack the user's password and then use standard authentication.

Pass-the-Ticket by injecting the TGT into your current session and accessing the file server.

You have valid credentials for a domain user and need to execute a command on a remote Windows server that has WinRM enabled. Which tool or protocol is specifically designed for remote command execution over WinRM?

WinRM via PowerShell Remoting (Enter-PSSession)

EC-CouncilCertified Penetration Testing Professional

Domain 5Objective 2

Lateral Movement and Pivoting CPENT Practice Questions (Page 3)

Part of the Active Directory and Lateral Movement domain, which makes up ~8% of our current practice bank.

38questions here

8free pages

8concepts

Questions 11–15

11foundation · easy
What is the primary purpose of using SSH tunneling in a penetration test?
Select an answer first
12foundation · easy
Why is it important to use separate credentials for different lateral movement steps?
Select an answer first
13expert · hard
You have compromised a Windows host that is domain-joined and has access to an internal network. You need to pivot to a Linux server on that network, but the Windows host does not have an SSH client installed. Which technique is most appropriate for pivoting from the Windows host?
Select an answer first
14application · medium
You have compromised a Windows workstation and extracted a Kerberos ticket-granting ticket (TGT) for a domain user. You need to access a file server that the user is authorized to access. The file server is in the same domain. Which technique would allow you to use the TGT to access the file server?
Select an answer first
15application · medium
You have valid credentials for a domain user and need to execute a command on a remote Windows server that has WinRM enabled. Which tool or protocol is specifically designed for remote command execution over WinRM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.