Lateral Movement and Pivoting CPENT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which lateral movement technique involves using a Kerberos ticket to authenticate to remote systems?

   • APass-the-Ticket
   • BPass-the-Hash
   • CSMB Relay
   • DRemote Desktop Protocol (RDP)
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of pivoting in a penetration test?

   • ATo route traffic through a compromised host to reach otherwise inaccessible networks
   • BTo hide the attacker's identity by using a VPN
   • CTo escalate privileges on the compromised host
   • DTo create a backdoor for persistent access
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which lateral movement technique uses a user's password hash to authenticate to remote systems without knowing the plaintext password?

   • APass-the-Ticket
   • BOverpass-the-Hash
   • CRemote Service Execution
   • DPass-the-Hash
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   You are performing lateral movement in a high-security environment. The SOC uses UEBA to detect anomalous logon patterns, including unusual source hosts and times. You have valid credentials for a standard user. Which action best minimizes your footprint and reduces the chance of UEBA alerts?

   • AUse RDP from your attack machine directly to the target
   • BPerform the lateral movement at 3 AM to avoid active monitoring
   • CLog in to the target server during business hours from a compromised host in the same department
   • DUse a new domain admin account you created for the test
   Reveal Solution Discussion Select an answer first
6. 25application · hard

   During a penetration test, you have obtained the NTLM hash of a domain admin account. You need to move laterally to a domain controller to complete the objective. The security team has enabled logging for account logon events and is actively monitoring for suspicious activity. Which technique would be least likely to trigger an alert for a new logon?

   • AUse Pass-the-Hash with PsExec to execute a command on the domain controller.
   • BUse SMB to copy a script to the domain controller and then schedule a task to run it.
   • CUse Pass-the-Ticket with a forged Kerberos ticket to access the domain controller.
   • DUse WMI to execute a process on the domain controller using the NTLM hash.
   Reveal Solution Discussion Select an answer first