Perimeter Defense Evasion Techniques CPENT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are delivering a web shell to a target behind a WAF that blocks requests containing 'cmd' or 'exec' in the query string. The web application allows file upload. Which technique is most likely to bypass the WAF while still allowing command execution?

   • AUse a different extension like .php5 to bypass the WAF's file type check.
   • BUse a double URL-encoding for the command parameter.
   • CUse a POST request with the command in the body instead of the query string.
   • DUpload a PHP file with a backdoor that uses base64_decode to hide the command.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an internal penetration test, you need to reach a management interface on a server inside a DMZ. The perimeter firewall only permits inbound TCP 443 to the DMZ web server. You have valid credentials for an SSH service on the DMZ web server, but the management interface is not directly reachable. Which technique should you use to access the management interface while staying within the allowed port?

   • ACreate an SSH local port forward from your workstation to the DMZ web server, mapping a local port to the management interface's IP and port.
   • BSend fragmented TCP packets to the management interface to bypass the firewall rule.
   • CUse an HTTP CONNECT proxy on the DMZ web server to relay requests to the management interface.
   • DUse IP spoofing to make the connection appear to come from the DMZ web server.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What should a penetration tester document after validating an evasion technique in a controlled environment?

   • AThe source code of any custom tools used, but not the configuration
   • BThe IP addresses of all systems in the controlled environment
   • COnly the success or failure of the technique, without details
   • DThe exact steps, tools, and configurations used, along with the observed results
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which firewall evasion technique involves splitting a packet into smaller pieces so that the firewall's inspection engine cannot reassemble them in the correct order?

   • AProxy usage
   • BIP spoofing
   • CEncryption
   • DFragmentation
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A stateful firewall is configured to allow outbound TCP connections but blocks inbound connections. You need to establish a reverse shell from a compromised host inside the network to your external server. Which technique is most effective?

   • AUse a reverse shell that connects to your external server on TCP 443.
   • BUse a bind shell on the compromised host and connect to it from your server.
   • CUse IP spoofing to make the connection appear to come from an allowed source.
   • DUse a tunnel over ICMP to send shell commands.
   Reveal Solution Discussion Select an answer first