EC-Council CPENT Certified Penetration Testing Professional Exam Practice Test
Gana confianza para EC-Council CPENT Certified Penetration Testing Professional Exam. Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
The EC-Council Certified Penetration Testing Professional (CPENT) certification is an advanced, performance-based credential designed for cybersecurity professionals seeking to validate elite penetration testing skills. This certification distinguishes itself by focusing on real-world application, requiring candidates to demonstrate proficiency in attacking hardened enterprise networks, pivoting through segmented environments, and exploiting modern infrastructure, including IoT, OT, and cloud systems. Unlike foundational certifications, CPENT emphasizes hands-on exploitation, advanced binary analysis, and weaponization of custom exploits against live targets in a controlled lab environment. It validates a professional's ability to conduct comprehensive penetration tests that mirror sophisticated adversary tactics, moving beyond automated scanning to manual, in-depth compromise and persistence. Earning the CPENT signals to employers a practitioner's capability to lead complex security assessments, manage advanced persistent threat (APT) simulations, and provide actionable intelligence for hardening critical organizational assets. It represents a significant milestone for ethical hackers aiming to operate at the highest technical echelons of the security testing field.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
The CIS Critical Security Controls v8 are referenced in a CPENT engagement scope. Which control most directly drives the requirement that a penetration test be conducted, rather than only a vulnerability scan?
NIST SP 800-115 organizes technical security assessment into three categories. A tester is reviewing firewall rule sets for misconfigurations without running any active scan against the device. Which NIST SP 800-115 category does this activity fall under?
Following an engagement that exfiltrated proof-of-impact data (sanitized samples only) for a HIPAA-regulated client, which post-engagement step is mandated by the RoE and consistent with NIST SP 800-115 reporting guidance?
La eliminación segura de todos los artefactos del cliente (muestras sanitizadas, hashes capturados, documentación interna) de los sistemas del tester dentro del perÃodo de retención contractual, con un certificado de destrucción firmado proporcionado al cliente, es el paso post-contratación canónico. Retener los datos indefinidamente para estudios de caso viola el NDA. Enviar a terceros es una infracción. Publicar el método en un blog sin anonimización pone en riesgo la identificación del cliente.
A CPENT report executive summary is being drafted for the Board. Which design choice is the highest-quality professional practice for the executive-summary section?
Un resumen ejecutivo debe comunicar el riesgo empresarial en un lenguaje empresarial: postura de riesgo agregada, los 3-5 hallazgos más importantes expresados en términos de impacto (exposición de datos, interrupción operativa, implicación regulatoria), y un plan de remediación con categorÃas de esfuerzo/costo estimadas. Los resultados de comando técnico (nmap, sqlmap, payloads) pertenecen a los detalles de los hallazgos y el anexo. Los vectores CVSS pertenecen a las secciones por hallazgo. Los nombres de las herramientas son parte de la metodologÃa, no del resumen ejecutivo.
An LSASS-protected (Credential Guard / RunAsPPL) target prevents standard Mimikatz `sekurlsa::logonpasswords`. Which alternative, blueprint-relevant approach does NOT require disabling LSASS protection on the target?
Capturando credenciales a través de la red mediante Responder + ntlmrelayx durante la actividad normal del usuario no requiere dumper LSASS en absoluto - recoge material de autenticación en tránsito. Deshabilitar la protección de LSA requiere cambios en el registro (y Secure Boot puede bloquear esto). Utilizar un conocido dumper de LSASS (por ejemplo, mimidrv.sys) requiere administrador local y un driver firmado vulnerable al abuso. PsExec en un proceso fresco y luego dumper sigue bloqueado por la protección de LSA. La ruta de relé de credenciales es la alternativa que evita LSASS.
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
01Active Directory Penetration Testing
Temas
- AD reconnaissance and enumeration
- Password spraying and hash extraction
- Kerberos attacks (Kerberoasting, Golden/Silver Ticket)
- Lateral movement in AD
Objetivos de aprendizaje
- AD reconnaissance and enumeration
- Password spraying and hash extraction
- Kerberos attacks (Kerberoasting, Golden/Silver Ticket)
- Lateral movement in AD
02API and JSON Web Token Penetration Testing
Temas
- API reconnaissance
- Authentication and authorization testing
- JWT security evaluation
Objetivos de aprendizaje
- API reconnaissance
- Authentication and authorization testing
- JWT security evaluation
03Introduction to Penetration Testing and Methodologies
Temas
- Principles and objectives of penetration testing
- Penetration testing methodologies and frameworks (MITRE ATT&CK)
- Compliance-driven penetration testing
Objetivos de aprendizaje
- Principles and objectives of penetration testing
- Penetration testing methodologies and frameworks (MITRE ATT&CK)
- Compliance-driven penetration testing
04IoT Penetration Testing
Temas
- IoT firmware acquisition, extraction, and analysis
- IoT network and protocol security testing
- Persistence in IoT environments
Objetivos de aprendizaje
- IoT firmware acquisition, extraction, and analysis
- IoT network and protocol security testing
- Persistence in IoT environments
05Lateral Movement and Pivoting
Temas
- Pass-the-Hash, Pass-the-Ticket attacks
- Advanced pivoting and tunneling (HTTP, DNS, SSH, ICMP)
- Double pivoting
Objetivos de aprendizaje
- Pass-the-Hash, Pass-the-Ticket attacks
- Advanced pivoting and tunneling (HTTP, DNS, SSH, ICMP)
- Double pivoting
06Linux Exploitation and Privilege Escalation
Temas
- Linux reconnaissance and vulnerability scanning
- Initial access to Linux systems
- Linux privilege escalation
Objetivos de aprendizaje
- Linux reconnaissance and vulnerability scanning
- Initial access to Linux systems
- Linux privilege escalation
07Open-Source Intelligence (OSINT)
Temas
- OSINT on target domain, web, and employees
- OSINT automation tools
- Attack surface mapping
Objetivos de aprendizaje
- OSINT on target domain, web, and employees
- OSINT automation tools
- Attack surface mapping
08Penetration Testing Scoping and Engagement
Temas
- Pre-engagement activities and RFP response
- Rules of Engagement (ROE) drafting
- Legal and regulatory considerations
Objetivos de aprendizaje
- Pre-engagement activities and RFP response
- Rules of Engagement (ROE) drafting
- Legal and regulatory considerations
09Perimeter Defense Evasion Techniques
Temas
- Firewall penetration testing
- IDS evasion techniques
- Router and switch security testing
Objetivos de aprendizaje
- Firewall penetration testing
- IDS evasion techniques
- Router and switch security testing
10Report Writing and Post-Testing Actions
Temas
- Report structure and components
- Report development and delivery
- Post-testing actions, retesting, and validation
Objetivos de aprendizaje
- Report structure and components
- Report development and delivery
- Post-testing actions, retesting, and validation
11Reverse Engineering, Fuzzing, and Binary Exploitation
Temas
- Linux and Windows binary analysis
- Buffer overflow and heap overflow exploitation
- Application fuzzing
Objetivos de aprendizaje
- Linux and Windows binary analysis
- Buffer overflow and heap overflow exploitation
- Application fuzzing
12Social Engineering Penetration Testing
Temas
- Off-site social engineering (phishing, phone)
- On-site social engineering
- Countermeasures documentation
Objetivos de aprendizaje
- Off-site social engineering (phishing, phone)
- On-site social engineering
- Countermeasures documentation
13Web Application Penetration Testing
Temas
- Web application footprinting and enumeration
- Vulnerability scanning (OWASP framework)
- SQL injection and other injection vulnerabilities
- Business logic and client-side testing
Objetivos de aprendizaje
- Web application footprinting and enumeration
- Vulnerability scanning (OWASP framework)
- SQL injection and other injection vulnerabilities
- Business logic and client-side testing
14Windows Exploitation and Privilege Escalation
Temas
- Windows reconnaissance and vulnerability assessment
- Privilege escalation and UAC bypass
- Post-exploitation and antivirus evasion
Objetivos de aprendizaje
- Windows reconnaissance and vulnerability assessment
- Privilege escalation and UAC bypass
- Post-exploitation and antivirus evasion