Lateral Movement and Pivoting CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common detection mechanism for lateral movement in Windows environments?

   • AMonitoring network traffic for HTTP requests
   • BMonitoring event ID 4624 (successful logon) for unusual logon patterns
   • CMonitoring CPU usage on domain controllers
   • DMonitoring DNS queries for external domains
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which routing technique is commonly used to redirect traffic through a compromised host to access an internal network?

   • AUsing ICMP redirect
   • BUsing DNS tunneling
   • CUsing a SOCKS proxy
   • DAdding a static route on the attacker's machine
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You have compromised a Windows server and need to execute a command on another server in the same domain. The target server has WinRM enabled and you have valid credentials for a domain user who is in the remote management users group. Which tool would be the most appropriate to execute the command?

   • ASMB (net use)
   • BPsExec
   • CWMI
   • DWinRM (winrs)
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You have compromised a Linux jump host in a DMZ that has connectivity to an internal Windows network. Your workstation cannot reach the internal network directly. You need to use RDP to access a Windows server on the internal network. Which command would you run on your workstation to establish a secure tunnel through the jump host?

   • Assh -R 3389:internal-server:3389 user@jump-host
   • Bssh -D 3389 user@jump-host
   • Cssh -L 3389:internal-server:3389 user@jump-host
   • Dssh -L 3389:localhost:3389 user@jump-host
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You have compromised a web server that has outbound internet access but no inbound access from your workstation. You need to access an internal database server that is only reachable from the web server. You want to use a tool that can create a reverse tunnel to your workstation, allowing you to route traffic to the internal database. Which tool would be most suitable for this?

   • Achisel with reverse port forwarding
   • BSSH with local port forwarding
   • Csocat with a reverse shell
   • Dnetcat with a bind shell
   Reveal Solution Discussion Select an answer first