CertArea
All EC-Council exams

Free Certified Penetration Testing Professional (CPENT) practice test: 30 questions with answers

30 original questions for Certified Penetration Testing Professional (CPENT), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified Penetration Testing Professional (CPENT) exam guide: topics, cost and format

All 30 Certified Penetration Testing Professional (CPENT) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Web and API Exploitation (6 questions)

  1. Question 1

    Which vulnerability class occurs when untrusted input changes the structure of a query sent to the backend database?

    1. ACross-site request forgery, which tricks a logged-in user's browser into sending unintended requests
    2. BInsecure direct object reference, which exposes objects through predictable identifiers without authorisation checks
    3. CClickjacking, which overlays a hidden frame over a legitimate page to capture the user's clicks invisibly
    4. DSQL injection, where untrusted input alters the query that the database executes for the application
    Show answer and explanation
    Correct answer: D

    SQL injection occurs when untrusted input changes the structure of the query executed by the database. CSRF, IDOR and clickjacking are different classes of web flaw.

  2. Question 2

    Which JWT weakness allows an attacker to forge tokens when the server accepts them without a valid signature?

    1. AAccepting the none algorithm or unsigned tokens, so that the claims in the token can be altered freely
    2. BA short expiry time, which forces the user to sign in again more frequently than they would like to
    3. CStoring the token in an HTTP-only cookie that the page's script cannot read in the browser at all
    4. DIncluding a role claim in the token that the server then validates against its own user database
    Show answer and explanation
    Correct answer: A

    Accepting the none algorithm or unsigned tokens lets an attacker change claims and forge a valid-looking token. Short expiry, HTTP-only cookies and server-validated roles reduce rather than create this weakness.

  3. Question 3

    What makes stored cross-site scripting more severe than reflected XSS?

    1. AIt requires the victim to click a crafted link, which is the only delivery method that is used in practice
    2. BIt affects only the attacker's own browser session, so no other user of the application is ever impacted
    3. CIt is persisted by the application and executes for every user who views the stored content afterwards
    4. DIt needs physical access to the victim's machine to be delivered, which limits how many users can be reached
    Show answer and explanation
    Correct answer: C

    Stored XSS is persisted by the application and runs for every viewer, which makes it broader than reflected XSS. The other options describe reflected or non-impacting cases.

  4. Question 4

    An API returns another user's record when the record identifier in the request is changed. Which flaw is this?

    1. AMissing rate limiting, which allows a large number of requests per second to be sent from one client
    2. BBroken object-level authorisation, where the server does not check ownership of each requested object
    3. CVerbose error messages, which reveal the framework version in use on the server to any attacker
    4. DMissing HTTP security headers, which allow the content to be framed by other sites on the internet
    Show answer and explanation
    Correct answer: B

    Broken object-level authorisation occurs when changing an identifier returns another user's data because ownership is not checked. Rate limits, verbose errors and missing headers are different weaknesses.

  5. Question 5

    Which control best prevents server-side request forgery (SSRF) to internal services?

    1. AAllowing all outbound requests from the application, which keeps the integrations working reliably
    2. BValidating and allowlisting destination hosts, and blocking internal address ranges for fetched URLs
    3. CDisabling HTTPS on the application, so that the server does not follow redirects to other hosts
    4. DHiding the server's version in its response headers, which prevents attackers from choosing targets
    Show answer and explanation
    Correct answer: B

    Allowlisting destinations and blocking internal address ranges prevent the server from being used to reach internal services. Open outbound requests, disabling HTTPS and hiding versions do not stop SSRF.

  6. Question 6

    Which TWO are valid defences against SQL injection? (Choose two.)

    1. AParameterised queries or prepared statements for all database access made by the application
    2. BBuilding queries by concatenating user input directly with the query string, since it is faster to write
    3. CTrusting input from authenticated users, since they are known to the system and therefore safe to use
    4. DUsing a least-privilege database account for the application's queries, with minimal rights granted
    5. EDisplaying full database error messages to users, to help them correct their input when it fails
    Show answer and explanation
    Correct answer: A, D

    Parameterised queries and least-privilege database accounts both defend against SQL injection. Concatenation, trusting authenticated input and verbose database errors all increase exposure.

Active Directory, Network and Lateral Movement (6 questions)

  1. Question 7

    Which Active Directory attack requests service tickets for accounts with service principal names, then cracks their password hashes offline?

    1. AGolden ticket forging, which requires a password reset on the domain controller's own computer account first
    2. BKerberoasting, which requests service tickets and cracks the account's password hash offline
    3. CPassword spraying of a single account across many days, which is designed to avoid lockout entirely
    4. DDNS cache poisoning, which redirects Kerberos requests to a fake domain controller the attacker has run
    Show answer and explanation
    Correct answer: B

    Kerberoasting requests service tickets for service accounts and cracks the hashes offline. Golden tickets, spraying and DNS poisoning are different techniques against different components.

  2. Question 8

    What does a pass-the-hash attack use to authenticate to a remote service?

    1. AThe plaintext password that the user typed at the workstation during the sign-in session on that host
    2. BA one-time code from an authenticator app that was used during the logon of the account on that host
    3. CThe NTLM hash of a password, presented in place of the password itself for authentication to the service
    4. DThe user's session cookie stored in the browser of the workstation, which is replayed to the remote service
    Show answer and explanation
    Correct answer: C

    Pass-the-hash presents the NTLM hash in place of the password for authentication. Plaintext passwords, one-time codes and browser cookies are different credential types.

  3. Question 9

    Which technique moves laterally by using a compromised host as a relay to reach an internal network segment?

    1. AScanning the public internet from the attacker's own laptop with a standard port scanner over the internet
    2. BPivoting through the compromised host with a tunnel, such as SSH dynamic port forwarding
    3. CBrute-forcing a web login page on the external site of the organisation from outside its network
    4. DExploiting a flaw in the organisation's printer driver to gain local system rights on the printer server
    Show answer and explanation
    Correct answer: B

    Pivoting through a compromised host with a tunnel, such as SSH dynamic forwarding, reaches internal segments through it. External scanning, brute forcing and driver exploits do not relay into internal networks.

  4. Question 10

    Which firewall evasion approach is most likely to get past a simple packet-filtering rule?

    1. ATurning off the attacker's own host firewall so that responses from the target are not blocked on the attacker side
    2. BSending traffic over an already-permitted port with a clearly identifiable payload and no changes made to it
    3. CFragmenting packets or varying transport options, so the filter cannot match its signatures easily
    4. DUsing a stronger password on the attacking machine, to avoid detection by the packet filter on the path
    Show answer and explanation
    Correct answer: C

    Fragmentation and variation can defeat simple packet filters that rely on exact matches. Obvious payloads, the attacker's own firewall and passwords do not evade a packet filter.

  5. Question 11

    Which Windows privilege escalation route depends on a service running with weak permissions that a low-privileged user can modify?

    1. AAn unquoted service path or weak service binary permissions, which let the binary be replaced with malicious code
    2. BRansomware that encrypts the user's personal documents, which gives the user administrator rights on the host
    3. CA correctly configured group policy that restricts local administrators to a set of named accounts only
    4. DEnabling BitLocker on the system drive, which blocks any local privilege change made by the user at all
    Show answer and explanation
    Correct answer: A

    Weak service permissions or unquoted paths let a low-privileged user replace a service binary and run code as the service account. Ransomware, correct group policy and BitLocker do not give escalation.

  6. Question 12

    Which TWO are good practices for documenting a lateral movement path in a penetration test report? (Choose two.)

    1. AListing only the final domain administrator compromise, without the steps that led to it at all
    2. BDescribing the attack in vague terms, so that the client cannot easily reproduce the path it contains
    3. CRecording each step with the commands run, the evidence obtained and the access gained at that step
    4. DOmitting the affected hosts to keep the report short, since they are internal details that do not matter
    5. EIncluding remediation for each step on the path, mapped to the weakness that the step exploited
    Show answer and explanation
    Correct answer: C, E

    Recording each step with commands, evidence and access, and mapping remediation to each step, makes the path reproducible and fixable. Listing only the end state, vague descriptions and omitted hosts all prevent that.

Binary Exploitation, Reverse Engineering and IoT (6 questions)

  1. Question 13

    What is the main purpose of a buffer overflow exploit against a vulnerable program?

    1. ATo crash the program on purpose so that the logs look busy to the monitoring team during the test window
    2. BTo compress the program's data in memory to free up space for other processes running on the same host
    3. CTo read the program's configuration file in a read-only manner for evaluation purposes by the tester
    4. DTo overwrite control data, such as a saved return address, so that execution is redirected to attacker code
    Show answer and explanation
    Correct answer: D

    A buffer overflow overwrites control data such as a return address to redirect execution to attacker-chosen code. Crashing, reading configuration and compression are not the purpose of the exploit.

  2. Question 14

    Which protection makes it harder to run injected code from a stack buffer?

    1. ARunning the program with the highest privileges by default for every user who starts it on the host
    2. BData Execution Prevention (NX), which marks the stack as non-executable so that injected code will not run
    3. CDisabling address space layout randomisation, so that the addresses that the program uses are easy to predict
    4. DAllowing all memory pages to be writable and executable at the same time, to keep the program flexible
    Show answer and explanation
    Correct answer: B

    NX marks the stack non-executable, which blocks running injected code from it. Elevated privileges, disabled randomisation and writable executable memory all make exploitation easier.

  3. Question 15

    Which type of tool is commonly used to disassemble and analyse a compiled binary?

    1. AA word processor, which can open the binary and display its readable instructions to the analyst clearly
    2. BA spreadsheet application, which can compute checksums of binary files only and nothing more
    3. CA debugger or disassembler, such as Ghidra or IDA, which displays assembly and decompiled code
    4. DAn email client, which inspects the attachments that are sent to the analyst and renders binaries as text
    Show answer and explanation
    Correct answer: C

    A debugger or disassembler such as Ghidra or IDA shows assembly and decompiled code for analysis. Word processors, spreadsheets and email clients do not disassemble binaries.

  4. Question 16

    Which IoT weakness is commonly exploited because devices ship with credentials that are never changed?

    1. ADefault credential access, where factory usernames and passwords remain active on the device after deployment
    2. BPhysical sealing of the device's case, which stops anyone from opening it to reach the internal board
    3. CStrong certificate pinning for all device-to-cloud traffic in the deployment, which blocks any interception
    4. DEncryption of firmware updates with a unique key per device serial number, which is applied at manufacture
    Show answer and explanation
    Correct answer: A

    Default credentials that remain active are a widespread IoT weakness. Physical sealing, certificate pinning and encrypted updates are protections, not weaknesses.

  5. Question 17

    What does firmware analysis help a tester identify in an IoT device?

    1. AThe colour scheme of the device's status LEDs, which can sometimes reveal the model of the device
    2. BThe number of ports on the device's enclosure, which is used to estimate the sale price of the unit
    3. CThe device's warranty period, as recorded on the label that is printed on the outside of the enclosure
    4. DEmbedded credentials, hard-coded keys, insecure services and outdated components inside the firmware image
    Show answer and explanation
    Correct answer: D

    Firmware analysis reveals embedded credentials, hard-coded keys, insecure services and outdated components. LED colours, warranty labels and port counts do not reveal security weaknesses.

  6. Question 18

    Which TWO are valid mitigations for binary exploitation? (Choose two.)

    1. AEnabling stack canaries and non-executable memory protections in compiled binaries
    2. BCompiling production code with debugging symbols and running the resulting program as the root user
    3. CDisabling compiler warnings so that unsafe functions are not reported at build time to the developers
    4. DUsing bounds-checked functions and memory-safe languages where it is practical for the project to do so
    5. EAllowing all input to be copied into fixed-size buffers without any length checks in the code
    Show answer and explanation
    Correct answer: A, D

    Stack canaries, non-executable memory, bounds checking and memory-safe languages all reduce binary exploitation. Debug symbols with root, disabled warnings and unchecked copies all make it easier.

Planning, Scoping and Reconnaissance (6 questions)

  1. Question 19

    Before testing begins, what does a signed rules of engagement document define?

    1. AThe tester's personal hourly rate and the invoice schedule that the client will be billed against
    2. BThe scope, testing windows, permitted techniques and escalation contacts for the engagement
    3. CA list of exploits the tester has written in the past, which shows the team's skill to the client
    4. DThe internal IP addresses of the client's competitors, which are used for benchmarking purposes
    Show answer and explanation
    Correct answer: B

    Rules of engagement define the scope, testing windows, permitted techniques and escalation contacts, which govern the test legally and operationally. Rates, past exploits and competitor addresses are not part of the rules.

  2. Question 20

    Which OSINT activity best maps the external attack surface before active scanning begins?

    1. APort-scanning the client's entire public address range without any prior permission from the client
    2. BSending phishing emails to every employee listed on the company's public website without any approval
    3. CEnumerating domains, subdomains, certificates and exposed services from public sources
    4. DBrute-forcing the administrator password on the company's public login page at the start of the test
    Show answer and explanation
    Correct answer: C

    Enumerating domains, subdomains, certificates and exposed services from public sources maps the attack surface passively. Phishing, unauthorised scanning and brute forcing are active or unauthorised actions.

  3. Question 21

    Why should testers verify scope before active scanning?

    1. ATo avoid testing systems that the client does not own or has not authorised, which could be unlawful
    2. BBecause scanning tools only work on pre-approved scope lists that are stored in the client's own database
    3. CTo find out whether the client's firewall logs can be read by the tester during the engagement window
    4. DTo decide which report template the client will prefer, once the findings have been collected together
    Show answer and explanation
    Correct answer: A

    Scope verification prevents testing unowned or unauthorised systems, which can be unlawful. The other options do not reflect why scope is verified.

  4. Question 22

    A tester finds a third-party SaaS host within the apparent scope. What is the correct action?

    1. ATesting it fully, since it is reachable from the client's network and so must be within the scope
    2. BAssuming that a domain name within scope means that every subdomain beneath it is also authorised
    3. CReporting the host to the provider's competitor, to gain a commercial advantage in the market afterwards
    4. DChecking whether the third party has authorised testing, and pausing that host if it has not been authorised
    Show answer and explanation
    Correct answer: D

    Third-party systems need the provider's authorisation, so the tester should confirm it and pause testing if it is not given. Reachability and domain assumptions do not confer authorisation.

  5. Question 23

    Which TWO are appropriate reconnaissance activities before a penetration test? (Choose two.)

    1. AScanning every port of every IP address on the internet to see what responds, regardless of ownership
    2. BReviewing public DNS records and certificate transparency logs to identify the in-scope hosts
    3. CCompromising a shared email account to read the client's internal planning documents before the test
    4. DSearching public code repositories for credentials or secrets that belong to the in-scope systems
    5. EDeleting logs on in-scope systems to avoid detection during the reconnaissance phase of the engagement
    Show answer and explanation
    Correct answer: B, D

    Reviewing public DNS and certificate logs and searching public repositories for exposed secrets are passive reconnaissance activities. Scanning unowned ranges, compromising accounts and deleting logs are unauthorised or harmful.

  6. Question 24

    Which phase of a penetration test agrees the objectives and constraints with the client before any testing begins?

    1. APre-engagement, which agrees the objectives, constraints and rules before testing begins
    2. BPost-exploitation, which happens after the tester has gained access and begins testing persistence paths
    3. CReporting, which runs after the tester has finished testing and has submitted every finding to the client
    4. DRetesting, which starts once the client has already fixed all of the issues that were reported to it
    Show answer and explanation
    Correct answer: A

    The pre-engagement phase agrees objectives, constraints and rules before any testing. Post-exploitation, reporting and retesting all happen later in the engagement.

Reporting, Social Engineering and Post-Test Actions (6 questions)

  1. Question 25

    Which element is required in a penetration test report for each finding?

    1. AA clear description, the supporting evidence, the risk rating and the recommended remediation
    2. BThe tester's personal favourite exploit name, listed for their own portfolio of work for the firm
    3. CThe names of the client's competitors, used as examples of similar weaknesses found across the market
    4. DA list of every command typed during the test, with no explanation of the impact on the business
    Show answer and explanation
    Correct answer: A

    Each finding needs a clear description, evidence, risk rating and remediation so the client can act on it. Exploit names for portfolios, competitor names and raw command lists do not give the client what it needs.

  2. Question 26

    Which social engineering activity is limited to a sanctioned email with a simulated link?

    1. ASending phishing messages to the personal accounts of employees' families and friends outside the company
    2. BCalling random employees to ask for their passwords, without any agreement with the client beforehand
    3. CLeaving USB sticks in the parking lot without the client's consent, to see who picks them up later
    4. DA phishing simulation within the agreed rules of engagement, with the outcome reported to the client
    Show answer and explanation
    Correct answer: D

    A phishing simulation within agreed rules and reported to the client is a sanctioned activity. Unsanctioned calls, dropped USB sticks and personal account targeting are not authorised.

  3. Question 27

    Why is a retest valuable after the client has remediated the findings?

    1. ATo confirm that the fixes work and that the vulnerabilities are no longer exploitable in practice
    2. BTo produce a second invoice for the same findings without any new testing work being carried out
    3. CTo replace the original report with a shorter summary that omits the evidence collected during the test
    4. DTo find new vulnerabilities only, while ignoring the earlier findings that the client has already reported
    Show answer and explanation
    Correct answer: A

    A retest confirms that remediation works and the vulnerabilities are no longer exploitable. Repeat invoices, replacing evidence and ignoring earlier findings are not valid purposes.

  4. Question 28

    A tester discovers sensitive client data during the test. What should happen?

    1. APublishing the data on social media to show the severity of the finding to the public as an example
    2. BKeeping a copy of the data for personal use after the engagement has finished, as a reference for later
    3. CHandling it according to the rules of engagement, minimising its exposure and reporting it promptly
    4. DSharing the data with other clients to compare their security posture with that of the tested client
    Show answer and explanation
    Correct answer: C

    Handling sensitive data under the rules of engagement, minimising exposure and reporting it promptly is the professional response. Publication, personal retention and sharing with other clients are serious breaches.

  5. Question 29

    Which TWO are appropriate reporting practices for a penetration test? (Choose two.)

    1. AWriting findings in technical jargon only, so that they are not read by management at all in practice
    2. BProviding an executive summary for leadership alongside technical details for the engineers who fix issues
    3. COmitting the risk rating so that the client focuses only on the list of tasks it needs to complete
    4. DIncluding screenshots and reproduction steps that let the client verify each finding for itself
    5. ESending the report without a review by a second tester for accuracy, to keep the engagement on schedule
    Show answer and explanation
    Correct answer: B, D

    An executive summary with technical detail serves both leadership and engineers, and reproduction steps let the client verify findings. Jargon-only reports, unrated findings and unreviewed reports reduce the report's value.

  6. Question 30

    Which metric best communicates the business impact of a finding to leadership?

    1. AThe number of lines of code in the vulnerable file, which shows the size of the affected codebase
    2. BThe count of open ports found on the systems, with no link to the business assets that expose those ports
    3. CThe number of tools used during the test, listed by name in the appendix of the report for reference
    4. DThe business impact in terms of data exposure, downtime and regulatory consequences for the organisation
    Show answer and explanation
    Correct answer: D

    Business impact in terms of data exposure, downtime and regulatory consequences helps leadership prioritise. Line counts, tool lists and bare port counts do not describe business impact.