What is the primary purpose of extracting credentials from the SAM database?

To retrieve the system's network configuration.

To crack password hashes and obtain plaintext passwords for local accounts.

To identify the Windows version and patch level.

To enumerate the list of installed services.

Which of the following is a sign that a Windows service may be vulnerable to privilege escalation due to weak permissions?

The service runs under the LocalSystem account.

The service's executable file is writable by the Everyone group.

The service is set to start automatically.

The service uses a path with spaces but is quoted.

You have a standard user shell on a fully patched Windows 10 21H2 system. You need to escalate to SYSTEM. Which approach is most appropriate?

Run a public kernel exploit for CVE-2020-1472 (Zerologon).

Attempt to dump LSASS with mimikatz.

Use the Windows exploit suggester to find a kernel exploit.

Enumerate for misconfigurations such as unquoted service paths or weak service permissions.

You have gained SYSTEM-level access on a Windows domain-joined server. Your objective is to obtain credentials for a domain administrator account. Which tool and technique is most appropriate?

Run whoami /priv to check for SeDebugPrivilege.

Use Mimikatz to dump LSASS and extract Kerberos tickets and hashes.

Use Windows-Exploit-Suggester to find a kernel exploit for the server.

Use net user administrator /domain to reset the domain admin password.

Which of the following is a common technique used in UAC bypass?

Replacing a service binary with a malicious executable.

Using a kernel exploit to gain SYSTEM privileges.

Modifying the SAM database to change the administrator password.

Exploiting a trusted binary that is auto-elevated to run malicious code.

EC-CouncilCertified Penetration Testing Professional

Domain 4Objective 2

Windows Exploitation and Privilege Escalation CPENT Practice Questions (Page 5)

Part of the Perimeter Evasion and Host Exploitation domain, which makes up ~13% of our current practice bank.

40questions here

8free pages

10concepts

Questions 21–25

21foundation · easy
What is the primary purpose of extracting credentials from the SAM database?
Select an answer first
22foundation · easy
Which of the following is a sign that a Windows service may be vulnerable to privilege escalation due to weak permissions?
Select an answer first
23application · medium
You have a standard user shell on a fully patched Windows 10 21H2 system. You need to escalate to SYSTEM. Which approach is most appropriate?
Select an answer first
24application · medium
You have gained SYSTEM-level access on a Windows domain-joined server. Your objective is to obtain credentials for a domain administrator account. Which tool and technique is most appropriate?
Select an answer first
25foundation · easy
Which of the following is a common technique used in UAC bypass?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.