Certified Penetration Testing Professional (CPENT)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Web and API Exploitation

   Which vulnerability class occurs when untrusted input changes the structure of a query sent to the backend database?

   1. ACross-site request forgery, which tricks a logged-in user's browser into sending unintended requests
   2. BInsecure direct object reference, which exposes objects through predictable identifiers without authorisation checks
   3. CClickjacking, which overlays a hidden frame over a legitimate page to capture the user's clicks invisibly
   4. DSQL injection, where untrusted input alters the query that the database executes for the application
   Show answer and explanationHide answer

   Correct answer: D

   SQL injection occurs when untrusted input changes the structure of the query executed by the database. CSRF, IDOR and clickjacking are different classes of web flaw.

2. Question 2Active Directory, Network and Lateral Movement

   Which Active Directory attack requests service tickets for accounts with service principal names, then cracks their password hashes offline?

   1. AGolden ticket forging, which requires a password reset on the domain controller's own computer account first
   2. BKerberoasting, which requests service tickets and cracks the account's password hash offline
   3. CPassword spraying of a single account across many days, which is designed to avoid lockout entirely
   4. DDNS cache poisoning, which redirects Kerberos requests to a fake domain controller the attacker has run
   Show answer and explanationHide answer

   Correct answer: B

   Kerberoasting requests service tickets for service accounts and cracks the hashes offline. Golden tickets, spraying and DNS poisoning are different techniques against different components.

3. Question 3Binary Exploitation, Reverse Engineering and IoT

   What is the main purpose of a buffer overflow exploit against a vulnerable program?

   1. ATo crash the program on purpose so that the logs look busy to the monitoring team during the test window
   2. BTo compress the program's data in memory to free up space for other processes running on the same host
   3. CTo read the program's configuration file in a read-only manner for evaluation purposes by the tester
   4. DTo overwrite control data, such as a saved return address, so that execution is redirected to attacker code
   Show answer and explanationHide answer

   Correct answer: D

   A buffer overflow overwrites control data such as a return address to redirect execution to attacker-chosen code. Crashing, reading configuration and compression are not the purpose of the exploit.

4. Question 4Planning, Scoping and Reconnaissance

   Before testing begins, what does a signed rules of engagement document define?

   1. AThe tester's personal hourly rate and the invoice schedule that the client will be billed against
   2. BThe scope, testing windows, permitted techniques and escalation contacts for the engagement
   3. CA list of exploits the tester has written in the past, which shows the team's skill to the client
   4. DThe internal IP addresses of the client's competitors, which are used for benchmarking purposes
   Show answer and explanationHide answer

   Correct answer: B

   Rules of engagement define the scope, testing windows, permitted techniques and escalation contacts, which govern the test legally and operationally. Rates, past exploits and competitor addresses are not part of the rules.

5. Question 5Reporting, Social Engineering and Post-Test Actions

   Which element is required in a penetration test report for each finding?

   1. AA clear description, the supporting evidence, the risk rating and the recommended remediation
   2. BThe tester's personal favourite exploit name, listed for their own portfolio of work for the firm
   3. CThe names of the client's competitors, used as examples of similar weaknesses found across the market
   4. DA list of every command typed during the test, with no explanation of the impact on the business
   Show answer and explanationHide answer

   Correct answer: A

   Each finding needs a clear description, evidence, risk rating and remediation so the client can act on it. Exploit names for portfolios, competitor names and raw command lists do not give the client what it needs.