CEH Exam Questions and Answers

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Perform a full TCP connect scan with UDP service detection on all ports

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting

-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.

Perform an aggressive scan of all open ports and enumerate SMB shares

Perform a UDP scan on the four specified ports and identify running services

Why: Option B is correct because the `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

theHarvester

theHarvester is a passive OSINT tool that collects emails, subdomains, IPs, and names from public sources like Google, Bing, and LinkedIn.

Nmap

Netcat

Wireshark

Why: theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

The server is performing a DNS lookup to resolve the malicious IP address

The web application is sending log data to a SIEM system for analysis

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker

Port 4444 is commonly used for reverse shells. Outbound traffic to a malicious IP on this port indicates successful exploitation and a backdoor connection.

The vulnerability scan caused a false positive and triggered a legitimate backup process

Why: Option C is correct because outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?

The DNS server is using DNSSEC to secure zone transfers

The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file

A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.

The DNS server is properly configured and only allows zone transfers to authorized secondary servers

The target uses a split-DNS configuration with internal and external views

Why: The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

site:admin login

filetype:pdf admin login

intitle:"login" inurl:admin

inurl:"admin" inurl:"login"

inurl:admin finds URLs containing 'admin', and inurl:login finds URLs containing 'login'. Combined, they find login pages with 'admin' in the URL.

Why: Option D is correct because the Google dork `inurl:"admin" inurl:"login"` specifically searches for pages where both 'admin' and 'login' appear in the URL. This is a precise way to find login pages on administrative interfaces, as it targets URLs containing both terms, which is a common pattern for admin login portals.

A security team wants to identify all live hosts on a large, Class B private IP network (172.16.0.0/16) as quickly as possible while minimizing network load. Which tool and technique should they use?

Masscan with --ping to send ICMP echo requests across the /16 range

Masscan can send ICMP echo requests at very high rates, making it ideal for fast host discovery on large networks.

Use theHarvester to query DNS records for the domain

Nmap with -sn (ping sweep) on all 65536 IPs

hping3 with --icmp on each IP sequentially

Why: Masscan is designed for high-speed scanning and can send ICMP echo requests across a /16 range (65,536 IPs) in seconds, far faster than Nmap or hping3, while its --ping mode minimizes network load by using stateless packet transmission. This makes it the optimal choice for quickly identifying live hosts on a large private network without overwhelming the network.

Want more Footprinting, Reconnaissance and Scanning practice?

All Enumeration and System Hacking questions

Domain 2: Enumeration and System Hacking

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

nslookup

netstat

nbtstat

nbtstat is the correct command for NetBIOS name resolution and enumeration.

net view

Why: The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

During a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?

Execute applications to extract data

Hide files to conceal tools and data

Erase event logs to avoid detection

Escalate privileges to gain higher-level access

Privilege escalation is the third step in CHPSET, following cracking passwords and hiding files, and is appropriate after initial low-privileged access.

Why: The CEH methodology follows: Cracking passwords, Hiding files, Privilege escalation, Executing applications, Spying, Erasing tracks. After gaining initial access as a low-privileged user, the next logical step is to escalate privileges to gain higher access (e.g., administrator or root).

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

Information disclosure; read sensitive files

Privilege escalation; gain root access

SUID binaries allow execution with elevated permissions; a root-owned SUID binary can be used to escalate to root.

Denial of service; crash the system

Buffer overflow; execute arbitrary code

Why: A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

Use enum4linux -a 192.168.1.10 to enumerate users and policies

enum4linux is a tool for SMB enumeration; -a runs all enumeration options, which is appropriate after discovering shares.

Attempt to crack the administrator password using a dictionary attack

Perform a port scan to check for open ports

Run snmpwalk to retrieve SNMP community strings

Why: The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

EXPN enumeration

SMTP banner grabbing

RCPT TO enumeration

VRFY enumeration

The VRFY command verifies whether a mailbox exists, and the response codes confirm this technique.

Why: The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Spying

Executing applications

Cracking passwords

Erasing tracks

Deleting log entries is a classic example of erasing tracks to avoid detection.

Why: The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Want more Enumeration and System Hacking practice?

All Malware, Social Engineering and Network Attacks questions

Domain 3: Malware, Social Engineering and Network Attacks

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

UDP flood

Ping of Death

Smurf attack

Correct. The large number of ICMP Echo Replies from multiple sources to a single target is characteristic of a Smurf attack.

ICMP flood

Why: A Smurf attack sends ICMP Echo Request packets to a network broadcast address with a spoofed source IP (the target). All hosts on the network reply to the target, flooding it with ICMP Echo Replies.

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Phishing

Pretexting

Correct. The attacker uses a false pretext (IT support) to obtain sensitive information.

Baiting

Vishing

Why: Pretexting involves creating a fabricated scenario (pretext) to obtain information. Here the attacker pretends to be IT support to trick the user into revealing their password.

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Wireshark

Nmap

tcpdump

Ettercap

Correct. Ettercap is specifically designed for MITM attacks using ARP poisoning.

Why: Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning, DNS spoofing, and packet sniffing.

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

An attacker is performing TCP sequence prediction to hijack the session.

Correct. The sequence numbers show successful prediction, and the RST may be used to reset the connection after hijacking.

A normal TCP connection establishment followed by an immediate termination.

A man-in-the-middle attack using ARP spoofing.

A TCP SYN flood attack is in progress.

Why: The sequence numbers (100, 300) suggest the attacker correctly guessed the TCP sequence numbers to spoof a connection. The three-way handshake completes (SYN, SYN-ACK, ACK), then the attacker sends a RST to close. This is indicative of TCP sequence prediction attack (session hijacking attempt).

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Upload to VirusTotal

Dynamic analysis in a sandbox

Static analysis using strings and PEiD

Correct. Static analysis can reveal suspicious strings, packed executables, or invalid signatures without execution.

Run the file on a production system to observe behavior

Why: Static analysis (e.g., examining strings, digital signatures, PE headers) is the first step because it is safe and can quickly identify suspicious indicators without executing the file.

An organization is experiencing repeated DDoS attacks that consume all available bandwidth. Which mitigation technique is MOST effective for handling such volumetric attacks?

Blackholing all traffic to the target IP

Anycast network distribution

Rate limiting on the firewall

Scrubbing centers

Correct. Scrubbing centers are designed to filter out attack traffic and allow clean traffic through.

Why: Scrubbing centers filter malicious traffic and forward clean traffic to the target, handling high-volume attacks effectively.

Want more Malware, Social Engineering and Network Attacks practice?

All Web Application and Injection Attacks questions

Domain 4: Web Application and Injection Attacks

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Time-based SQL injection

Time-based SQL injection uses database delay functions (e.g., SLEEP()) to infer information based on response times.

Reflected XSS

Blind boolean-based SQL injection

CSRF

Why: Time-based SQL injection involves injecting SQL code that causes the database to pause if a condition is true, allowing an attacker to infer information based on response times. The observed difference in response times for valid vs. invalid usernames is characteristic of this technique.

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

SQLMap

SQLMap is designed to automate SQL injection detection and exploitation.

Metasploit

Nmap

Burp Suite

Why: SQLMap is a widely used open-source tool that automates the process of detecting and exploiting SQL injection flaws in web applications.

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

SameSite=Strict

HTTPOnly flag

Secure flag

CSRF token

A CSRF token would prevent the attack because the malicious site cannot guess the token.

Why: The presence of a SameSite cookie set to Lax does not prevent CSRF for state-changing requests like password change if the attack uses a GET or POST from a top-level navigation. However, the primary missing mitigation is a CSRF token, which is a unique unpredictable value tied to the session and validated by the server.

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Directory traversal

Command injection

File upload vulnerability

The attacker uploaded a malicious PHP file that executes, indicating a file upload vulnerability.

Stored XSS

Why: The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Directory traversal

The use of '../' to access files outside the web root is directory traversal.

SSRF

LFI

Command injection

Why: The log shows a request attempting to traverse directories using '../' to access a sensitive system file (/etc/passwd), which is directory traversal.

During a penetration test, a tester uses the following payload in a search field: <script>alert(document.cookie)</script>. The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Stored XSS

Reflected XSS

The payload is reflected immediately, making it reflected XSS.

DOM-based XSS

Self-XSS

Why: Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.

Want more Web Application and Injection Attacks practice?

All Introduction to Ethical Hacking questions

Domain 5: Introduction to Ethical Hacking

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

TCP connect scan

UDP scan

SYN scan

SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.

FIN scan

Why: C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Use random source ports

Use a decoy scan

Slow down the scan rate

Reducing packets per second avoids triggering rate-based IDS thresholds.

Use fragmented packets

Why: Option C is correct because slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Black-box test

Black-box test simulates an external attacker with no prior knowledge.

White-box test

Red team engagement

Gray-box test

Why: A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Maintaining Access

Maintaining Access is a phase after gaining access.

Scanning

Reconnaissance

Reconnaissance is the first phase of ethical hacking.

Hiding Evidence

Cracking

Why: Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

open

closed

Closed means reachable but no service listening.

filtered

unfiltered

Why: Option B is correct because a 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Implement a password policy requiring complex passwords for all users.

Enable two-factor authentication on the web server.

Apply the latest security patches to the web server.

Restrict access to the Engineering web server to only the Engineering VLAN.

This immediately reduces the attack surface by limiting unnecessary access.

Why: Option D is correct because the Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

Want more Introduction to Ethical Hacking practice?

All Scanning Networks and Enumeration questions

Domain 6: Scanning Networks and Enumeration

During a penetration test, you discover that an internal web server responds to ICMP echo requests but does not respond to TCP SYN scans on port 80. However, when you browse to the server's IP using a browser, the web page loads successfully. What is the most likely reason for this behavior?

A stateful firewall is blocking inbound SYN packets to port 80 but allowing responses to outbound connections.

Stateful firewalls track connection states; they may block unsolicited SYN but allow replies.

The web server is running on a non-standard port that you did not scan.

The server's TCP/IP stack is misconfigured and does not respond to SYN scans.

A web application firewall is blocking the SYN scan traffic.

Why: A stateful firewall tracks the state of network connections. When you browse to the server, your browser initiates an outbound TCP connection, and the firewall allows the return SYN-ACK packets as part of the established session. However, a standalone TCP SYN scan sends unsolicited SYN packets to port 80, which the firewall sees as a new inbound connection attempt and blocks, preventing the server from responding. The server's ICMP echo reply is allowed because ICMP is stateless and not typically filtered by the same rules.

A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?

TCP SYN scan using `nmap -sS`

ARP scan using `nmap -PR`

Ping sweep using `nmap -sn`

`-sn` disables port scan and sends only ICMP echo, TCP SYN to port 443, etc., minimizing traffic.

UDP scan using `nmap -sU`

Why: Option C is correct because `nmap -sn` (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default, allowing the analyst to discover live hosts without scanning every port or sending packets to every IP individually. This minimizes network traffic compared to full port scans while still efficiently identifying active devices on the 192.168.1.0/24 subnet.

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

Perform banner grabbing on port 22 to identify the SSH version.

SSH version information can reveal outdated versions with known exploits.

Perform SNMP enumeration to gather system information.

Attempt a DNS zone transfer from the server.

Enumerate NetBIOS names using `nbtstat`.

Why: Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

Conduct a full TCP port scan of the entire network using SYN scan.

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.

Scanning only the relevant port with version detection minimizes traffic and focuses on the vulnerable service.

Use a ping sweep to identify live hosts, then perform a version scan on each.

Perform an ARP scan of the entire subnet and then check each host manually.

Why: Option B is correct because it targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Traceroute

Traceroute increments TTL to get ICMP time-exceeded messages from routers, revealing the path.

Banner grabbing

DNS enumeration

SNMP walk

Why: Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

List of running processes

SNMP can retrieve hrSWRunTable which lists running processes.

Captured network packets

User account passwords

Modify network interface settings

Routing table entries

SNMP can read the ipRouteTable MIB object.

Why: SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Want more Scanning Networks and Enumeration practice?

All Vulnerability Analysis and System Hacking questions

Domain 7: Vulnerability Analysis and System Hacking

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Nikto

Hydra

Nmap

enum4linux

Correct: enum4linux extracts SMB information like users, shares, and OS details.

Why: enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Craft a request with a local file inclusion parameter pointing to /etc/passwd

This safely confirms RFI by reading a local file, proving the vulnerability.

Use SQLMap to test for SQL injection

Scan the server with Nikto to detect known RFI signatures

Attempt to include a remote URL containing a web shell

Why: Option A is correct because it uses a local file inclusion (LFI) parameter to test for file inclusion without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include files, which is a direct indicator of an RFI vulnerability if the server returns the file contents. This approach is safe and non-destructive, as it only reads a standard system file.

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Exploit a kernel vulnerability using a local exploit

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell

less allows command execution via ! when run with elevated privileges.

Use the find command with -exec to execute a shell

Check for world-writable scripts in cron jobs

Why: Option B is correct because when a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Update Log4j to version 2.17.1 or later

Patching directly addresses the vulnerability.

Remove the JndiLookup class from the Log4j jar

Disable JDBC appender in Log4j configuration

Block outbound traffic from the server to the internet

Why: Option A is correct because CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

SQL injection

Cross-site request forgery (CSRF)

Session hijacking via cross-site scripting (XSS)

XSS can steal cookies if HttpOnly is not set.

Clickjacking

Why: Option C is correct because the absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Which TWO of the following are valid techniques for password cracking?

Brute-force attack

Tries all possible passwords until correct.

Phishing

Man-in-the-middle attack

Rainbow table attack

Uses precomputed hash chains to reverse hashes.

Keylogging

Why: A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. It is computationally intensive but guaranteed to succeed given enough time, making it a fundamental method in password auditing and recovery.

Want more Vulnerability Analysis and System Hacking practice?

All Advanced Topics: Wireless, Cloud, IoT, Cryptography questions

Domain 8: Advanced Topics: Wireless, Cloud, IoT, Cryptography

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

WPS PIN brute-force attack

Evil twin AP deployment

WEP key recovery using aircrack-ng

Correct. WEP cracking relies on collecting many unique IVs to exploit statistical weaknesses in the RC4 algorithm.

WPA handshake capture

Why: WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Perform a de-authentication attack on the target AP

Capture the 4-way handshake for WPA cracking

Brute-force the WPS PIN to recover the Wi-Fi passphrase

Correct. Reaver performs a brute-force attack on the WPS PIN, exploiting the weak PIN-based authentication.

Scan for nearby access points and their BSSIDs

Why: Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

AWS is responsible for physical security of data centers

The customer is responsible for patching the S3 service

The customer is responsible for configuring access controls and permissions

Correct. S3 bucket policies and permissions are customer-managed security controls.

AWS is responsible for network infrastructure; the customer for data classification

Why: Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Disable the MQTT broker entirely and switch to HTTP

Implement client authentication and enable TLS encryption

Correct. Enforcing authentication and TLS protects the MQTT communication from unauthorized access and sniffing.

Change the default topic names to obfuscated strings

Use a VPN for all IoT device communication

Why: MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

RC4

3DES

AES

Correct. AES is a symmetric block cipher with 128-bit blocks and variable key sizes.

RSA

Why: AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Server-Side Request Forgery (SSRF)

Correct. The request to the cloud metadata service is a classic SSRF attack to obtain instance credentials.

SQL Injection

Container escape

Cross-Site Scripting (XSS)

Why: The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

Want more Advanced Topics: Wireless, Cloud, IoT, Cryptography practice?

All Footprinting and Reconnaissance questions

Domain 9: Footprinting and Reconnaissance

A penetration tester is performing a footprinting exercise on a target company. The tester wants to identify the network range and ISP of the target. Which of the following tools or techniques is MOST appropriate for this purpose?

Query the Netcraft site for the domain

Perform a WHOIS lookup against the domain

WHOIS provides IP range and ISP info.

Use nslookup to query the authoritative name servers

Run a traceroute to the target web server

Why: A WHOIS lookup against the target domain returns registration details that include the organization's network range (via the 'NetRange' or 'CIDR' fields) and the ISP (via the 'OrgName' or 'descr' fields). This directly maps to the footprinting goal of identifying the target's IP address block and upstream provider, as defined in RFC 3912 and common WHOIS database schemas.

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

DNS cache poisoning

Email enumeration

DSN responses can confirm valid addresses.

Man-in-the-middle attack

Phishing attack

Why: Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

Engage in social engineering via phone calls

Use Shodan to search for target infrastructure

Shodan indexes public data passively.

Initiate a DNS zone transfer request

Perform a port scan with Nmap

Why: Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

Run a traceroute to the main domain

Check the WHOIS record for the domain

Use the site: operator in search engines

Search engines index subdomains.

Perform a reverse DNS lookup on the target IP range

Why: The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.

During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?

Unauthorized zone transfers are possible

The DNS server can be used for denial of service (amplification)

The DNS cache can be poisoned easily

The DNS server can be used for denial of service

Open recursion enables amplification DDoS.

Why: Option D is correct because a DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Performing a ping sweep on the target network

Conducting a port scan with Nmap

Using Google dorking to find exposed documents

Uses search engine index, passive.

Examining job postings for technology clues

Public info gathering, no direct interaction.

Brute forcing subdomains via DNS queries

Why: Option C is correct because Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Want more Footprinting and Reconnaissance practice?

All Network and Web Application Attacks questions

Domain 10: Network and Web Application Attacks

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

SQL Injection

Cross-Site Request Forgery (CSRF)

Cross-Site Scripting (XSS)

Reflected XSS is the direct result of unsanitized input displayed in the browser.

Command Injection

Why: Option C is correct because the scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

UDP flood

SYN flood

SYN flood sends many SYN packets without completing handshake.

ARP spoofing

ICMP flood

Why: A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Query string parameters

Query string parameters are a common vector for SQL injection.

Request body (POST data)

Cookie headers

User-Agent header

Why: SQL injection attacks commonly target query string parameters because user input in URLs is often directly concatenated into SQL queries without proper sanitization. A WAF configured to inspect and filter query string parameters can block malicious SQL payloads before they reach the database server, as these parameters are the most frequent vector for such attacks.

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Directory traversal

Parameter tampering

Parameter tampering modifies hidden fields or URL parameters.

Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF)

Why: Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

SNMP

FTP

HTTPS

HTTPS encrypts data with TLS.

HTTP

Why: HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Brute Force

Cross-Site Scripting (XSS)

XSS injects client-side scripts.

Path Traversal

SQL Injection

SQL injection injects SQL queries.

Cross-Site Request Forgery (CSRF)

Why: Cross-Site Scripting (XSS) is a common web application vulnerability that allows an attacker to inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. This occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling the attacker to execute arbitrary code in the victim's browser within the context of the trusted site.

Want more Network and Web Application Attacks practice?

All Wireless, IoT and Cloud Security questions

Domain 11: Wireless, IoT and Cloud Security

A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?

Install a host-based firewall on the IoT device to restrict outbound traffic.

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Configure egress filtering on the firewall to block outbound connections to known malicious domains.

Egress filtering prevents malicious outbound traffic.

Disable DNS resolution on the IoT device to prevent any external communication.

Why: Option C is correct because egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.

A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?

Anyone on the internet can read objects in the bucket if they know the object URL.

Public read access is granted to all objects.

The data is encrypted at rest, so no exposure risk exists.

The bucket policy is misconfigured but only affects objects with server-side encryption.

Only authenticated AWS users can access the bucket, so the risk is limited.

Why: The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Perform a PMKID attack on the WPA3 client to capture the handshake.

Use a WPS PIN brute-force attack against the WPA3 client.

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.

Rogue AP can entice client to downgrade.

Why: Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

4G LTE

Wi-Fi 6

Bluetooth 5

LoRaWAN

Optimized for low-power, long-range IoT.

Why: LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.

A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?

Disable password authentication and use SSH key-based authentication.

Keys are resistant to brute-force.

Install fail2ban to automatically block IPs after failures.

Implement rate-limiting on SSH connections per IP.

Change the SSH port to a non-standard port.

Why: Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.

During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?

Decrypt the traffic using the captured handshake to get the credentials.

WPS PIN brute-force to recover the PSK.

PMKID attack to crack the pre-shared key.

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.

Rogue RADIUS can capture hashes for cracking.

Why: In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.

Want more Wireless, IoT and Cloud Security practice?

All Cryptography and Malware Analysis questions

Domain 12: Cryptography and Malware Analysis

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

Nmap

John the Ripper

VirusTotal

VirusTotal accepts file hashes and returns detection results from many AV engines.

Wireshark

Why: VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

Weak TLS cipher suite

Lack of application-layer encryption

The data is encrypted in transit but not at rest or before being sent; the application does not encrypt sensitive fields.

SSL stripping attack

Man-in-the-middle attack

Why: The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

The CRL published by the certificate authority that signed the issuing CA's certificate

The CRL published by the intermediate CA, if any

The CRL published by the online issuing CA

The issuing CA is responsible for revoking certificates it issued.

The CRL published by the offline root CA

Why: The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

Check running processes for suspicious entries

Physically inspect the connection between the keyboard and the computer

Hardware keyloggers are physical devices inserted inline.

Review USB device history in Event Viewer

Run an antivirus scan

Why: A hardware keylogger is a physical device inserted between the keyboard and the computer, typically at the PS/2 or USB connector. Unlike software-based keyloggers, it operates independently of the operating system, so it cannot be detected by process lists, event logs, or antivirus scans. The only reliable detection method is a physical inspection of the keyboard cable and connection point for any unusual inline devices.

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

GCM

CFB

ECB

ECB encrypts each block independently; no IV, no expansion beyond padding.

CBC

Why: ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

Code obfuscation

Anti-debugging

Anti-VM / sandbox evasion

Checking for low resource counts is a common sandbox evasion technique.

Packing

Why: Option C is correct because checking the number of CPU cores is a classic anti-VM/sandbox evasion technique. Virtual machines and sandboxes often allocate minimal resources (e.g., a single core) to remain lightweight, so malware uses this check to detect an analysis environment and terminate execution to avoid detection.

Want more Cryptography and Malware Analysis practice?

All Social Engineering and Physical Security questions

Domain 13: Social Engineering and Physical Security

A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?

Shoulder surfing the authorized user's fingerprint pattern

Picking the lock on the server room door

Using a gelatin mold of an authorized user's fingerprint

Gelatin molds can create replicas of fingerprints that may be accepted by some scanners.

Tailgating behind an authorized employee

Why: Option C is correct because gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.

During a social engineering engagement, a tester calls the help desk posing as an employee from the IT department. The tester claims to be working on a critical system update and needs the employee's password to proceed. Which type of social engineering attack is being executed?

Quid pro quo

Baiting

Pretexting

Pretexting involves creating a false identity or scenario to extract information.

Phishing

Why: Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into divulging information. In this case, the tester falsely claims to be from the IT department working on a critical system update, which is a classic pretext to gain trust and obtain the employee's password. This differs from other social engineering types because it relies on a constructed identity and false narrative rather than a technical lure or direct exchange.

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Hiring security guards

Reviewing keycard access logs

Installing CCTV cameras

Implementing a mantrap at the entrance

Mantraps physically enforce one-person entry, preventing tailgating.

Why: A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Pharming

Spear phishing

Whaling

Whaling targets senior executives or impersonates them.

Vishing

Why: This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

Which TWO of the following are effective methods to prevent dumpster diving attacks? (Choose two.)

Storing all data on encrypted digital media only

Shredding sensitive documents before disposal

Shredding renders documents unreadable.

Using locked bins for discarded materials

Locked bins restrict physical access.

Placing documents in recycling bins

Burning all discarded paper documents

Why: Shredding sensitive documents before disposal (Option B) is effective because it physically destroys the information, making it impossible to reconstruct from discarded paper. This directly counters dumpster diving, where attackers retrieve documents to extract confidential data like passwords or network diagrams.

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

The communication includes verifiable contact information

The sender uses a generic greeting like 'Dear Customer'

The communication creates a sense of urgency

Attackers often pressure targets to act quickly.

The message contains spelling or grammatical errors

Errors can indicate a fake message.

The request comes from someone claiming to be in authority

Impersonating authority figures is common.

Why: Option C is correct because social engineers frequently fabricate a sense of urgency to bypass the victim's rational decision-making. By claiming an immediate deadline or threat (e.g., 'Your account will be locked in 24 hours'), the attacker pressures the target into acting without verifying the request, a tactic rooted in the psychological principle of scarcity.

Want more Social Engineering and Physical Security practice?

Browse all CEH questions Take a timed practice test

Frequently asked questions

How many questions are on the CEH exam?

The CEH exam has 125 questions and must be completed in 240 minutes. The passing score is 700/1000.

What types of questions appear on the CEH exam?

Scenario-based questions covering exam objectives with detailed answer explanations.

How are CEH questions organised by domain?

The exam covers 13 domains: Footprinting, Reconnaissance and Scanning, Enumeration and System Hacking, Malware, Social Engineering and Network Attacks, Web Application and Injection Attacks, Introduction to Ethical Hacking, Scanning Networks and Enumeration, Vulnerability Analysis and System Hacking, Advanced Topics: Wireless, Cloud, IoT, Cryptography, Footprinting and Reconnaissance, Network and Web Application Attacks, Wireless, IoT and Cloud Security, Cryptography and Malware Analysis, Social Engineering and Physical Security. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual CEH exam questions?

No. These are original exam-style practice questions written against the official EC-Council CEH exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 125 CEH questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.

EC-Council · Free Practice Questions · Last reviewed May 2026

CEH Exam Questions and Answers

78real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

125 exam questions

240 min time limit

Pass: 700/1000 / 1000

13 exam domains

Overview Domain Blueprint Study Guide All QuestionsSample by Domain

Domain 1: Footprinting, Reconnaissance and Scanning

All Footprinting, Reconnaissance and Scanning questions

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Perform a full TCP connect scan with UDP service detection on all ports

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting

-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.

Perform an aggressive scan of all open ports and enumerate SMB shares

Perform a UDP scan on the four specified ports and identify running services

theHarvester

theHarvester is a passive OSINT tool that collects emails, subdomains, IPs, and names from public sources like Google, Bing, and LinkedIn.

Nmap

Netcat

Wireshark

The server is performing a DNS lookup to resolve the malicious IP address

The web application is sending log data to a SIEM system for analysis

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker

Port 4444 is commonly used for reverse shells. Outbound traffic to a malicious IP on this port indicates successful exploitation and a backdoor connection.

The vulnerability scan caused a false positive and triggered a legitimate backup process

The DNS server is using DNSSEC to secure zone transfers

The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file

A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.

The DNS server is properly configured and only allows zone transfers to authorized secondary servers

The target uses a split-DNS configuration with internal and external views

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

site:admin login

filetype:pdf admin login

intitle:"login" inurl:admin

inurl:"admin" inurl:"login"

inurl:admin finds URLs containing 'admin', and inurl:login finds URLs containing 'login'. Combined, they find login pages with 'admin' in the URL.

A security team wants to identify all live hosts on a large, Class B private IP network (172.16.0.0/16) as quickly as possible while minimizing network load. Which tool and technique should they use?

Masscan with --ping to send ICMP echo requests across the /16 range

Masscan can send ICMP echo requests at very high rates, making it ideal for fast host discovery on large networks.

Use theHarvester to query DNS records for the domain

Nmap with -sn (ping sweep) on all 65536 IPs

hping3 with --icmp on each IP sequentially

Want more Footprinting, Reconnaissance and Scanning practice?

All Enumeration and System Hacking questions

Domain 2: Enumeration and System Hacking

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

nslookup

netstat

nbtstat

nbtstat is the correct command for NetBIOS name resolution and enumeration.

net view

During a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?

Execute applications to extract data

Hide files to conceal tools and data

Erase event logs to avoid detection

Escalate privileges to gain higher-level access

Privilege escalation is the third step in CHPSET, following cracking passwords and hiding files, and is appropriate after initial low-privileged access.

Information disclosure; read sensitive files

Privilege escalation; gain root access

SUID binaries allow execution with elevated permissions; a root-owned SUID binary can be used to escalate to root.

Denial of service; crash the system

Buffer overflow; execute arbitrary code

Use enum4linux -a 192.168.1.10 to enumerate users and policies

enum4linux is a tool for SMB enumeration; -a runs all enumeration options, which is appropriate after discovering shares.

Attempt to crack the administrator password using a dictionary attack

Perform a port scan to check for open ports

Run snmpwalk to retrieve SNMP community strings

EXPN enumeration

SMTP banner grabbing

RCPT TO enumeration

VRFY enumeration

The VRFY command verifies whether a mailbox exists, and the response codes confirm this technique.

Spying

Executing applications

Cracking passwords

Erasing tracks

Deleting log entries is a classic example of erasing tracks to avoid detection.

Want more Enumeration and System Hacking practice?

All Malware, Social Engineering and Network Attacks questions

Domain 3: Malware, Social Engineering and Network Attacks

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

UDP flood

Ping of Death

Smurf attack

Correct. The large number of ICMP Echo Replies from multiple sources to a single target is characteristic of a Smurf attack.

ICMP flood

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Phishing

Pretexting

Correct. The attacker uses a false pretext (IT support) to obtain sensitive information.

Baiting

Vishing

Why: Pretexting involves creating a fabricated scenario (pretext) to obtain information. Here the attacker pretends to be IT support to trick the user into revealing their password.

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Wireshark

Nmap

tcpdump

Ettercap

Correct. Ettercap is specifically designed for MITM attacks using ARP poisoning.

Why: Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning, DNS spoofing, and packet sniffing.

An attacker is performing TCP sequence prediction to hijack the session.

Correct. The sequence numbers show successful prediction, and the RST may be used to reset the connection after hijacking.

A normal TCP connection establishment followed by an immediate termination.

A man-in-the-middle attack using ARP spoofing.

A TCP SYN flood attack is in progress.

Upload to VirusTotal

Dynamic analysis in a sandbox

Static analysis using strings and PEiD

Correct. Static analysis can reveal suspicious strings, packed executables, or invalid signatures without execution.

Run the file on a production system to observe behavior

Why: Static analysis (e.g., examining strings, digital signatures, PE headers) is the first step because it is safe and can quickly identify suspicious indicators without executing the file.

An organization is experiencing repeated DDoS attacks that consume all available bandwidth. Which mitigation technique is MOST effective for handling such volumetric attacks?

Blackholing all traffic to the target IP

Anycast network distribution

Rate limiting on the firewall

Scrubbing centers

Correct. Scrubbing centers are designed to filter out attack traffic and allow clean traffic through.

Why: Scrubbing centers filter malicious traffic and forward clean traffic to the target, handling high-volume attacks effectively.

Want more Malware, Social Engineering and Network Attacks practice?

All Web Application and Injection Attacks questions

Domain 4: Web Application and Injection Attacks

Time-based SQL injection

Time-based SQL injection uses database delay functions (e.g., SLEEP()) to infer information based on response times.

Reflected XSS

Blind boolean-based SQL injection

CSRF

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

SQLMap

SQLMap is designed to automate SQL injection detection and exploitation.

Metasploit

Nmap

Burp Suite

Why: SQLMap is a widely used open-source tool that automates the process of detecting and exploiting SQL injection flaws in web applications.

SameSite=Strict

HTTPOnly flag

Secure flag

CSRF token

A CSRF token would prevent the attack because the malicious site cannot guess the token.

Directory traversal

Command injection

File upload vulnerability

The attacker uploaded a malicious PHP file that executes, indicating a file upload vulnerability.

Stored XSS

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Directory traversal

The use of '../' to access files outside the web root is directory traversal.

SSRF

LFI

Command injection

Why: The log shows a request attempting to traverse directories using '../' to access a sensitive system file (/etc/passwd), which is directory traversal.

Stored XSS

Reflected XSS

The payload is reflected immediately, making it reflected XSS.

DOM-based XSS

Self-XSS

Want more Web Application and Injection Attacks practice?

All Introduction to Ethical Hacking questions

Domain 5: Introduction to Ethical Hacking

TCP connect scan

UDP scan

SYN scan

SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.

FIN scan

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Use random source ports

Use a decoy scan

Slow down the scan rate

Reducing packets per second avoids triggering rate-based IDS thresholds.

Use fragmented packets

Black-box test

Black-box test simulates an external attacker with no prior knowledge.

White-box test

Red team engagement

Gray-box test

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Maintaining Access

Maintaining Access is a phase after gaining access.

Scanning

Reconnaissance

Reconnaissance is the first phase of ethical hacking.

Hiding Evidence

Cracking

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

open

closed

Closed means reachable but no service listening.

filtered

unfiltered

Implement a password policy requiring complex passwords for all users.

Enable two-factor authentication on the web server.

Apply the latest security patches to the web server.

Restrict access to the Engineering web server to only the Engineering VLAN.

This immediately reduces the attack surface by limiting unnecessary access.

Want more Introduction to Ethical Hacking practice?

All Scanning Networks and Enumeration questions

Domain 6: Scanning Networks and Enumeration

A stateful firewall is blocking inbound SYN packets to port 80 but allowing responses to outbound connections.

Stateful firewalls track connection states; they may block unsolicited SYN but allow replies.

The web server is running on a non-standard port that you did not scan.

The server's TCP/IP stack is misconfigured and does not respond to SYN scans.

A web application firewall is blocking the SYN scan traffic.

TCP SYN scan using `nmap -sS`

ARP scan using `nmap -PR`

Ping sweep using `nmap -sn`

`-sn` disables port scan and sends only ICMP echo, TCP SYN to port 443, etc., minimizing traffic.

UDP scan using `nmap -sU`

Perform banner grabbing on port 22 to identify the SSH version.

SSH version information can reveal outdated versions with known exploits.

Perform SNMP enumeration to gather system information.

Attempt a DNS zone transfer from the server.

Enumerate NetBIOS names using `nbtstat`.

Conduct a full TCP port scan of the entire network using SYN scan.

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.

Scanning only the relevant port with version detection minimizes traffic and focuses on the vulnerable service.

Use a ping sweep to identify live hosts, then perform a version scan on each.

Perform an ARP scan of the entire subnet and then check each host manually.

Traceroute

Traceroute increments TTL to get ICMP time-exceeded messages from routers, revealing the path.

Banner grabbing

DNS enumeration

SNMP walk

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

List of running processes

SNMP can retrieve hrSWRunTable which lists running processes.

Captured network packets

User account passwords

Modify network interface settings

Routing table entries

SNMP can read the ipRouteTable MIB object.

Want more Scanning Networks and Enumeration practice?

All Vulnerability Analysis and System Hacking questions

Domain 7: Vulnerability Analysis and System Hacking

Nikto

Hydra

Nmap

enum4linux

Correct: enum4linux extracts SMB information like users, shares, and OS details.

Craft a request with a local file inclusion parameter pointing to /etc/passwd

This safely confirms RFI by reading a local file, proving the vulnerability.

Use SQLMap to test for SQL injection

Scan the server with Nikto to detect known RFI signatures

Attempt to include a remote URL containing a web shell

Exploit a kernel vulnerability using a local exploit

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell

less allows command execution via ! when run with elevated privileges.

Use the find command with -exec to execute a shell

Check for world-writable scripts in cron jobs

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Update Log4j to version 2.17.1 or later

Patching directly addresses the vulnerability.

Remove the JndiLookup class from the Log4j jar

Disable JDBC appender in Log4j configuration

Block outbound traffic from the server to the internet

SQL injection

Cross-site request forgery (CSRF)

Session hijacking via cross-site scripting (XSS)

XSS can steal cookies if HttpOnly is not set.

Clickjacking

Which TWO of the following are valid techniques for password cracking?

Brute-force attack

Tries all possible passwords until correct.

Phishing

Man-in-the-middle attack

Rainbow table attack

Uses precomputed hash chains to reverse hashes.

Keylogging

Want more Vulnerability Analysis and System Hacking practice?

All Advanced Topics: Wireless, Cloud, IoT, Cryptography questions

Domain 8: Advanced Topics: Wireless, Cloud, IoT, Cryptography

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

WPS PIN brute-force attack

Evil twin AP deployment

WEP key recovery using aircrack-ng

Correct. WEP cracking relies on collecting many unique IVs to exploit statistical weaknesses in the RC4 algorithm.

WPA handshake capture

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Perform a de-authentication attack on the target AP

Capture the 4-way handshake for WPA cracking

Brute-force the WPS PIN to recover the Wi-Fi passphrase

Correct. Reaver performs a brute-force attack on the WPS PIN, exploiting the weak PIN-based authentication.

Scan for nearby access points and their BSSIDs

AWS is responsible for physical security of data centers

The customer is responsible for patching the S3 service

The customer is responsible for configuring access controls and permissions

Correct. S3 bucket policies and permissions are customer-managed security controls.

AWS is responsible for network infrastructure; the customer for data classification

Disable the MQTT broker entirely and switch to HTTP

Implement client authentication and enable TLS encryption

Correct. Enforcing authentication and TLS protects the MQTT communication from unauthorized access and sniffing.

Change the default topic names to obfuscated strings

Use a VPN for all IoT device communication

Why: MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

RC4

3DES

AES

Correct. AES is a symmetric block cipher with 128-bit blocks and variable key sizes.

RSA

Why: AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Server-Side Request Forgery (SSRF)

Correct. The request to the cloud metadata service is a classic SSRF attack to obtain instance credentials.

SQL Injection

Container escape

Cross-Site Scripting (XSS)

Want more Advanced Topics: Wireless, Cloud, IoT, Cryptography practice?

All Footprinting and Reconnaissance questions

Domain 9: Footprinting and Reconnaissance

Query the Netcraft site for the domain

Perform a WHOIS lookup against the domain

WHOIS provides IP range and ISP info.

Use nslookup to query the authoritative name servers

Run a traceroute to the target web server

DNS cache poisoning

Email enumeration

DSN responses can confirm valid addresses.

Man-in-the-middle attack

Phishing attack

Engage in social engineering via phone calls

Use Shodan to search for target infrastructure

Shodan indexes public data passively.

Initiate a DNS zone transfer request

Perform a port scan with Nmap

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

Run a traceroute to the main domain

Check the WHOIS record for the domain

Use the site: operator in search engines

Search engines index subdomains.

Perform a reverse DNS lookup on the target IP range

During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?

Unauthorized zone transfers are possible

The DNS server can be used for denial of service (amplification)

The DNS cache can be poisoned easily

The DNS server can be used for denial of service

Open recursion enables amplification DDoS.

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Performing a ping sweep on the target network

Conducting a port scan with Nmap

Using Google dorking to find exposed documents

Uses search engine index, passive.

Examining job postings for technology clues

Public info gathering, no direct interaction.

Brute forcing subdomains via DNS queries

Want more Footprinting and Reconnaissance practice?

All Network and Web Application Attacks questions

Domain 10: Network and Web Application Attacks

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

SQL Injection

Cross-Site Request Forgery (CSRF)

Cross-Site Scripting (XSS)

Reflected XSS is the direct result of unsanitized input displayed in the browser.

Command Injection

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

UDP flood

SYN flood

SYN flood sends many SYN packets without completing handshake.

ARP spoofing

ICMP flood

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Query string parameters

Query string parameters are a common vector for SQL injection.

Request body (POST data)

Cookie headers

User-Agent header

Directory traversal

Parameter tampering

Parameter tampering modifies hidden fields or URL parameters.

Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF)

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

SNMP

FTP

HTTPS

HTTPS encrypts data with TLS.

HTTP

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Brute Force

Cross-Site Scripting (XSS)

XSS injects client-side scripts.

Path Traversal

SQL Injection

SQL injection injects SQL queries.

Cross-Site Request Forgery (CSRF)

Want more Network and Web Application Attacks practice?

All Wireless, IoT and Cloud Security questions

Domain 11: Wireless, IoT and Cloud Security

Install a host-based firewall on the IoT device to restrict outbound traffic.

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Configure egress filtering on the firewall to block outbound connections to known malicious domains.

Egress filtering prevents malicious outbound traffic.

Disable DNS resolution on the IoT device to prevent any external communication.

Anyone on the internet can read objects in the bucket if they know the object URL.

Public read access is granted to all objects.

The data is encrypted at rest, so no exposure risk exists.

The bucket policy is misconfigured but only affects objects with server-side encryption.

Only authenticated AWS users can access the bucket, so the risk is limited.

Perform a PMKID attack on the WPA3 client to capture the handshake.

Use a WPS PIN brute-force attack against the WPA3 client.

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.

Rogue AP can entice client to downgrade.

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

4G LTE

Wi-Fi 6

Bluetooth 5

LoRaWAN

Optimized for low-power, long-range IoT.

Disable password authentication and use SSH key-based authentication.

Keys are resistant to brute-force.

Install fail2ban to automatically block IPs after failures.

Implement rate-limiting on SSH connections per IP.

Change the SSH port to a non-standard port.

Decrypt the traffic using the captured handshake to get the credentials.

WPS PIN brute-force to recover the PSK.

PMKID attack to crack the pre-shared key.

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.

Rogue RADIUS can capture hashes for cracking.

Want more Wireless, IoT and Cloud Security practice?

All Cryptography and Malware Analysis questions

Domain 12: Cryptography and Malware Analysis

Nmap

John the Ripper

VirusTotal

VirusTotal accepts file hashes and returns detection results from many AV engines.

Wireshark

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

Weak TLS cipher suite

Lack of application-layer encryption

The data is encrypted in transit but not at rest or before being sent; the application does not encrypt sensitive fields.

SSL stripping attack

Man-in-the-middle attack

The CRL published by the certificate authority that signed the issuing CA's certificate

The CRL published by the intermediate CA, if any

The CRL published by the online issuing CA

The issuing CA is responsible for revoking certificates it issued.

The CRL published by the offline root CA

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

Check running processes for suspicious entries

Physically inspect the connection between the keyboard and the computer

Hardware keyloggers are physical devices inserted inline.

Review USB device history in Event Viewer

Run an antivirus scan

GCM

CFB

ECB

ECB encrypts each block independently; no IV, no expansion beyond padding.

CBC

Code obfuscation

Anti-debugging

Anti-VM / sandbox evasion

Checking for low resource counts is a common sandbox evasion technique.

Packing

Want more Cryptography and Malware Analysis practice?

All Social Engineering and Physical Security questions

Domain 13: Social Engineering and Physical Security

Shoulder surfing the authorized user's fingerprint pattern

Picking the lock on the server room door

Using a gelatin mold of an authorized user's fingerprint

Gelatin molds can create replicas of fingerprints that may be accepted by some scanners.

Tailgating behind an authorized employee

Quid pro quo

Baiting

Pretexting

Pretexting involves creating a false identity or scenario to extract information.

Phishing

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Hiring security guards

Reviewing keycard access logs

Installing CCTV cameras

Implementing a mantrap at the entrance

Mantraps physically enforce one-person entry, preventing tailgating.

Pharming

Spear phishing

Whaling

Whaling targets senior executives or impersonates them.

Vishing

Which TWO of the following are effective methods to prevent dumpster diving attacks? (Choose two.)

Storing all data on encrypted digital media only

Shredding sensitive documents before disposal

Shredding renders documents unreadable.

Using locked bins for discarded materials

Locked bins restrict physical access.

Placing documents in recycling bins

Burning all discarded paper documents

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

The communication includes verifiable contact information

The sender uses a generic greeting like 'Dear Customer'

The communication creates a sense of urgency

Attackers often pressure targets to act quickly.

The message contains spelling or grammatical errors

Errors can indicate a fake message.

The request comes from someone claiming to be in authority

Impersonating authority figures is common.

Want more Social Engineering and Physical Security practice?