Lateral Movement and Pivoting CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which operational security practice is most effective in minimizing footprint during lateral movement?

   • ALimiting the number of systems accessed
   • BUsing the same user account for all lateral moves
   • CUsing the same IP address for all connections
   • DDisabling Windows Defender on each target
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which statement best describes the role of lateral movement in an Active Directory penetration test?

   • AIt is the initial exploitation step that gains a foothold on the first victim machine.
   • BIt is the process of covering tracks by clearing event logs on compromised hosts.
   • CIt is the method of transferring data out of the network to an attacker-controlled server.
   • DIt is used to move between systems to locate high-value targets and expand control.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You have compromised a Linux server that is in a DMZ and has outbound internet access. You need to access an internal database server that is only reachable from the Linux server. Your workstation is behind a corporate firewall that blocks inbound connections. You want to use a tool that can create a reverse tunnel to your workstation, allowing you to access the database server. Which tool and configuration would be most suitable?

   • AUse a SOCKS proxy on the Linux server and connect to it from your workstation.
   • BUse SSH with remote port forwarding from the Linux server to your workstation.
   • CUse netcat to create a reverse shell from the Linux server to your workstation.
   • DUse SSH with local port forwarding from your workstation to the Linux server.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You have compromised a Windows server that has a VPN connection to a partner network. You need to access a resource in the partner network from your workstation, but the partner network is not directly reachable. The Windows server has SSH enabled. Which technique would allow you to route traffic to the partner network?

   • AUse SSH dynamic port forwarding to create a SOCKS proxy on the Windows server.
   • BUse SSH remote port forwarding to expose a port on your workstation to the partner network.
   • CUse SSH local port forwarding to map a specific port on the partner network to your workstation.
   • DUse SSH to create a VPN tunnel between your workstation and the Windows server.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   You have compromised a Linux host in a segmented network. The host has SSH access to your attack machine but is behind a firewall that blocks outbound connections except SSH (port 22). You need to access an internal web server (port 80) on a different subnet that the Linux host can reach. Which technique is the most reliable given the outbound firewall restriction?

   • ASSH local port forwarding from your attack machine to the Linux host
   • BSOCKS proxy on the Linux host
   • CUse a reverse shell from the Linux host
   • DSSH remote port forwarding from the Linux host to your attack machine
   Reveal Solution Discussion Select an answer first