Lateral Movement and Pivoting CPENT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a network with multiple segments, how does pivoting enable an attacker to access a target on a different segment?

   • ABy directly connecting to the target's IP address from the attacker's machine
   • BBy using a DNS tunnel to bypass network segmentation
   • CBy using a compromised host on that segment as a relay to forward traffic
   • DBy disabling the firewall on the target segment
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an internal penetration test, you have compromised a domain-joined workstation and obtained the NTLM hash of a local administrator account that is also used on several servers. You need to move laterally to a target server without knowing the plaintext password. Which technique should you use?

   • APass-the-Hash with PsExec
   • BKerberoasting the target server
   • CLLMNR poisoning to capture the password
   • DPass-the-Ticket with RDP
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which pivoting technique involves forwarding traffic from a local port on the attacker's machine to a specific port on a target system through a compromised host?

   • ASOCKS proxy
   • BVPN
   • CPort forwarding
   • DSSH tunneling
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which pivoting technique allows an attacker to route traffic to multiple destinations through a compromised host using a dynamic proxy?

   • AICMP tunneling
   • BSSH tunneling
   • CPort forwarding
   • DSOCKS proxy
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You have compromised a Windows server and obtained the local administrator hash. You need to execute a command on another Windows server in the same subnet. The target has Windows Firewall enabled, but SMB (port 445) is open. Which tool would be most appropriate for executing a command remotely using the hash?

   • AWinRM with the -Credential parameter
   • BSMB with the net use command
   • CWMI with the -ArgumentList parameter
   • DPsExec with the -hashes parameter
   Reveal Solution Discussion Select an answer first