You have a shell as a standard user on a Windows 10 machine with UAC enabled at the default level. You need to run an administrative command without triggering a UAC prompt. Which technique is most likely to succeed?

Run the command with 'runas /user:administrator' and provide the password.

Use the 'psexec -s' command to run as SYSTEM.

Disable UAC by modifying HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA.

Use the 'fodhelper.exe' registry hijack to launch a payload with elevated privileges.

You have a standard user shell on a Windows machine. You want to extract the local administrator password hash. Which technique is most appropriate?

Use the 'runas' command to run cmd.exe as administrator.

Use the Windows exploit suggester to find a credential dump vulnerability.

Run mimikatz sekurlsa::logonpasswords to dump credentials from LSASS.

Use a volume shadow copy to access the SAM and SYSTEM registry hives.

What is the typical goal of exploiting a Windows kernel vulnerability for privilege escalation?

To disable Windows Defender and other security controls

To execute code in the context of the SYSTEM account

To dump the contents of the SAM database

To obtain a reverse shell as the current user

During a penetration test, you compromise a Windows service that runs with the 'SeImpersonatePrivilege' enabled. You need to escalate from the service account to SYSTEM. Which tool or technique is most appropriate?

Use JuicyPotato or PrintSpoofer to exploit token impersonation and obtain a SYSTEM shell.

Use the Windows exploit suggester to find a kernel vulnerability.

Modify the service's registry key to run a new binary.

Run Mimikatz to extract the local administrator password hash from LSASS.

EC-CouncilCertified Penetration Testing Professional

Domain 4Objective 2

Windows Exploitation and Privilege Escalation CPENT Practice Questions (Page 1)

Part of the Perimeter Evasion and Host Exploitation domain, which makes up ~13% of our current practice bank.

40questions here

8free pages

10concepts

Questions 1–5

1application · medium
You have a shell as a standard user on a Windows 10 machine with UAC enabled at the default level. You need to run an administrative command without triggering a UAC prompt. Which technique is most likely to succeed?
Select an answer first
2application · hard
You have a standard user shell on a Windows machine. You want to extract the local administrator password hash. Which technique is most appropriate?
Select an answer first
3foundation · easy
What is the typical goal of exploiting a Windows kernel vulnerability for privilege escalation?
Select an answer first
4application · medium
During a penetration test, you compromise a Windows service that runs with the 'SeImpersonatePrivilege' enabled. You need to escalate from the service account to SYSTEM. Which tool or technique is most appropriate?
Select an answer first
5foundation · easy
Which tool is commonly used to extract plaintext passwords and Kerberos tickets from memory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.