CEH Exam Questions and Answers

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting

-sS = SYN/stealth scan, -sV = version detection, -O = OS fingerprinting, -p 22,80,443,3389 = scan only these four ports. This is a targeted reconnaissance scan.

theHarvester

theHarvester is a passive OSINT tool that collects emails, subdomains, IPs, and names from public sources like Google, Bing, and LinkedIn.

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker

Port 4444 is commonly used for reverse shells. Outbound traffic to a malicious IP on this port indicates successful exploitation and a backdoor connection.

The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file

A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.

inurl:"admin" inurl:"login"

This dork effectively leverages the `inurl:` operator, which specifically restricts search results to pages where the specified keyword appears within the URL string. By combining `inurl:"admin"` and `inurl:"login"`, the search precisely targets web pages that contain both "admin" and "login" within their URL paths. This combination is highly effective for identifying administrative login interfaces, as these keywords frequently appear together in the URLs of such sensitive portals.

Masscan with --ping to send ICMP echo requests across the /16 range

Masscan is specifically engineered for high-speed network scanning, capable of transmitting millions of packets per second. Utilizing the `--ping` option directs Masscan to send ICMP echo request packets across the entire /16 range, efficiently identifying live hosts. Its asynchronous design allows it to discover active devices across 65,536 IP addresses in a fraction of the time compared to traditional scanners, making it the optimal tool for rapid, large-scale host discovery.

nbtstat

nbtstat is the correct command for NetBIOS name resolution and enumeration.

Privilege escalation; gain root access

A SUID (Set User ID) bit on an executable allows it to run with the permissions of its owner, regardless of the user executing it. If a binary is owned by the root user and has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that execution. This mechanism is specifically designed for privilege escalation, enabling a low-privileged user to perform actions typically reserved for root, such as gaining a root shell or modifying system configurations.

Use enum4linux -a 192.168.1.10 to enumerate users and policies

After discovering open SMB shares, the next logical step in a penetration test is to enumerate specific details about the SMB service. enum4linux is a specialized tool designed for this purpose, leveraging various SMB/Samba enumeration techniques. The -a flag instructs enum4linux to perform all available enumeration options, including listing users, groups, shares, and security policies, which provides critical information for subsequent exploitation attempts. This comprehensive enumeration helps identify valid usernames, potential weak policies, and further attack vectors.

VRFY enumeration

The VRFY command verifies whether a mailbox exists, and the response codes confirm this technique.

Erasing tracks

Erasing tracks, also known as anti-forensics or covering one's tracks, is a critical post-exploitation phase where an attacker attempts to remove or alter evidence of their presence and activities on a compromised system. This often involves deleting or modifying system logs, clearing command history, manipulating timestamps, or using secure deletion tools to prevent forensic analysis and maintain stealth. The goal is to avoid detection and hinder incident response efforts by making it difficult to reconstruct the attack chain.

RainbowCrack

RainbowCrack is a pioneering and highly specialized tool explicitly engineered for password cracking using the rainbow table technique. It not only performs efficient lookups against pre-computed rainbow tables but also includes functionalities for generating these large, memory-intensive tables for various hash algorithms. Its design is centered around the mathematical principles of rainbow tables, making it the definitive tool for both their creation and utilization in password recovery.

Smurf attack

A Smurf attack is a classic distributed denial-of-service (DDoS) attack that leverages ICMP reflection and amplification. An attacker sends ICMP Echo Request packets with a spoofed source IP address (the victim's IP) to the IP broadcast address of a large network. All active hosts on that network then respond with ICMP Echo Reply packets to the spoofed source IP, overwhelming the victim with a massive flood of replies from numerous legitimate sources. This perfectly matches the observation of a high volume of ICMP echo replies from multiple sources.

Pretexting

Correct. The attacker uses a false pretext (IT support) to obtain sensitive information.

Ettercap

Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on a LAN, specifically designed to intercept traffic, perform live content filtering, and establish various forms of active and passive eavesdropping. Its core functionality includes robust ARP poisoning capabilities, allowing it to redirect traffic between two hosts through the attacker's machine by sending forged ARP replies. This enables the penetration tester to intercept, modify, and inject data into network communications, making it the ideal tool for demonstrating MITM vulnerabilities.

An attacker is performing TCP sequence prediction to hijack the session.

Correct. The sequence numbers show successful prediction, and the RST may be used to reset the connection after hijacking.

Static analysis using strings and PEiD

Static analysis, particularly utilizing tools like `strings` and PEiD, is the safest and most appropriate initial step for examining a suspicious executable without execution. The `strings` utility can extract human-readable text from the binary, revealing potential commands, URLs, or error messages that often indicate malicious intent. PEiD (PE Identifier) helps analysts identify the compiler, packer, or cryptor used, which is crucial for understanding obfuscation techniques and guiding further analysis, all while minimizing risk.

Worm

A worm is a standalone malicious program designed to self-replicate and propagate across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to spread autonomously, often scanning for vulnerable systems and then infecting them to continue their replication cycle. This independent self-replication and network-based propagation are their defining characteristics, allowing them to consume network bandwidth and system resources rapidly.

Time-based SQL injection

Time-based SQL injection is the correct answer because the scenario explicitly describes inferring information based on *timing differences* in the web application's response. This technique is employed when direct error messages or content changes are not visible to the attacker. Attackers inject SQL queries containing database-specific time-delay functions (e.g., SLEEP() in MySQL, WAITFOR DELAY in MS SQL Server) within a conditional statement. If the injected condition evaluates to true, the database pauses for a specified duration, causing a noticeable delay in the application's response, thereby confirming the truthfulness of the condition and allowing data exfiltration character by character.

SQLMap

SQLMap is an open-source penetration testing tool specifically designed to automate the detection and exploitation of SQL injection flaws and database server takeovers. It supports a wide array of SQL injection techniques, including boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries, and out-of-band methods. Its primary function is to identify vulnerable parameters, extract data, and even access the underlying file system or execute commands on the compromised database server, making it the definitive choice for automated SQLi.

CSRF token

A CSRF token is a unique, unpredictable, and secret value generated by the server and included with every state-changing request, typically embedded in hidden form fields or request headers. The server validates this token upon receiving the request, ensuring it matches the token associated with the user's session. Since a malicious attacker operating from a different origin cannot obtain or guess this secret token, they cannot craft a valid forged request that the server would accept, thereby effectively preventing CSRF attacks.

File upload vulnerability

A file upload vulnerability arises when a web application permits users to upload files without sufficient validation of their type, content, or proper handling of their storage and execution. The ability for an attacker to upload a malicious PHP file, which is then executed by the web server, perfectly exemplifies this vulnerability. This allows for remote code execution (RCE) on the server, directly matching the described attack where a 'profile picture' turns out to be an executable script.

Directory traversal

Directory traversal, also known as path traversal, is an attack that exploits vulnerabilities in web server software or applications to access files and directories stored outside the intended web root directory. The '../' sequence observed in the log entry is a classic technique used to navigate up the directory hierarchy, allowing an attacker to read sensitive files like configuration files, password files, or source code that should not be publicly accessible. This specific request clearly demonstrates an attempt to traverse directories to access '/etc/passwd'.

Reflected XSS

Reflected XSS occurs when a malicious script embedded in an HTTP request (e.g., a URL parameter or form field) is immediately echoed back in the server's HTTP response without proper sanitization. The victim's browser then executes this script upon rendering the page, but the payload itself is not stored on the server for future use or delivery to other users. This type of attack typically requires an attacker to trick a victim into clicking a specially crafted malicious link that contains the payload.

SYN scan

SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.

Slow down the scan rate

Slowing down the scan rate directly reduces the number of packets sent per second (PPS) or connections attempted per minute. This strategic reduction keeps the scanning activity below the predefined thresholds set by rate-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), which are designed to detect anomalous traffic volumes. By maintaining a low packet rate, the ethical hacker can conduct reconnaissance without triggering alerts that would otherwise flag the activity as a potential port scan or denial-of-service attempt, thus evading detection.

Black-box test

A black-box test simulates an external attacker with no prior knowledge of the target system's internal architecture, source code, or credentials. Testers interact with the web application solely through its public interfaces, mimicking real-world threat actors attempting to exploit vulnerabilities from the outside. This approach is ideal for assessing the effectiveness of perimeter defenses and identifying externally exploitable flaws, directly aligning with a company's goal to test its web application's security from an external perspective.

closed

A 'closed' port indicates that the target host is reachable and received Nmap's probe, but no application is currently listening on that specific port. For TCP scans, the target typically responds with an RST (reset) packet, confirming the port's accessibility while explicitly stating that no service is active there. This state is crucial as it differentiates between an inactive port and one that is blocked by a firewall, accurately reflecting the scenario where the host is up but the service is not running.

Restrict access to the Engineering web server to only the Engineering VLAN.

Restricting access to the Engineering web server solely to the Engineering VLAN directly implements the principle of least privilege at the network layer. This action significantly reduces the attack surface by ensuring the server is only reachable by authorized clients within its designated operational segment. By preventing unnecessary network connectivity from other VLANs, it drastically limits the opportunities for unauthorized reconnaissance and exploitation attempts, regardless of the server's internal security controls.

Maintaining Access

Maintaining Access is a phase after gaining initial entry.

Scanning

Scanning involves active probing of the target network.

Reconnaissance

Reconnaissance is the first phase, involving information gathering.

Perform banner grabbing on port 22 to identify the SSH version.

Banner grabbing on port 22, typically used for SSH, is a fundamental reconnaissance technique. By connecting to the port and observing the initial response, an attacker can identify the specific SSH server software and its version number. This version information is crucial for cross-referencing against public vulnerability databases (e.g., CVEs) to discover known exploits, potentially leading to unauthorized access or privilege escalation if an outdated or misconfigured version is in use.

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.

This approach is highly efficient and targeted for identifying devices running a specific service. A TCP SYN scan on port 22 (SSH) across the target IP range quickly identifies hosts listening on this port without establishing a full connection, thus minimizing network overhead and remaining relatively stealthy. Enabling version detection simultaneously gathers crucial information about the SSH service's software version, which is essential for identifying potential vulnerabilities without further extensive scanning.

Traceroute

Traceroute is a fundamental network diagnostic tool that maps the path a packet takes to reach a destination by strategically manipulating the IP packet's Time To Live (TTL) field. It sends a series of packets, starting with a TTL of 1 and incrementing it, causing intermediate routers to decrement the TTL to zero and respond with an ICMP Time Exceeded message. Each ICMP response reveals an intermediate router (hop), effectively tracing the full network path hop-by-hop and identifying the sequence of devices. This method is precisely designed for network topology discovery.

List of running processes

SNMP agents can provide a comprehensive list of running processes on a managed device. This information is typically found within the Host Resources MIB (RFC 2790), specifically by querying objects like `hrSWRunTable`. This table contains details such as process ID, name, path, and current status, which is crucial for system monitoring and troubleshooting.

Routing table entries

SNMP agents can readily provide detailed routing table entries from a managed network device. This critical network information is typically exposed through the `ipRouteTable` object within the IP-MIB (RFC 4293), which contains entries for all active routes, including destination, next hop, interface, and metric. Obtaining this data is fundamental for network topology mapping and performance analysis.

-f (fragment packets)

The -f option instructs Nmap to fragment the IP packets into smaller, non-standard-sized pieces. This technique can bypass stateless firewalls or Intrusion Detection Systems (IDS) that only inspect the initial fragments, as critical header information (like TCP flags or port numbers) might be split across multiple segments. When the fragmented packets reach the target, the operating system reassembles them before processing, potentially allowing the scan to proceed undetected by intermediate network devices.

-T0 (paranoid timing)

The -T0 option sets the scan timing template to "paranoid," which is the slowest and most stealthy timing profile available in Nmap. This extremely slow pace, sending probes at irregular and infrequent intervals, is designed to evade rate-based detection mechanisms and anomaly-based Intrusion Detection Systems (IDS) that might flag rapid, consecutive scans as malicious. While significantly increasing scan duration, it minimizes the likelihood of triggering alarms by mimicking legitimate, sporadic network traffic.

-D (decoy)

The -D option allows Nmap to send scan packets from multiple decoy source IP addresses in addition to the real scanning machine's IP. By interspersing legitimate scan packets with those originating from spoofed decoy IPs, this technique aims to confuse firewalls, IDS, and network administrators by making it difficult to pinpoint the actual source of the scan. This obfuscation complicates forensic analysis and attribution, distributing the "blame" across several non-existent or innocent hosts.

A firewall, router rule, or host-based firewall is blocking the probes.

When Nmap reports a port as 'filtered', it signifies that the TCP or UDP probes sent to that port did not elicit any response from the target host. This behavior is characteristic of network security devices, such as firewalls (both network-based and host-based) or routers configured with Access Control Lists (ACLs), which are designed to silently drop incoming packets that do not match allowed rules. The probes are effectively absorbed into a "black hole," preventing Nmap from determining the true state of the port.

enum4linux

enum4linux is a dedicated command-line tool specifically designed for enumerating information from Windows and Samba hosts using NetBIOS and SMB protocols. It effectively leverages null sessions and other SMB/RPC queries to extract a wealth of data, including user lists, group memberships, share names, OS version, service pack level, and even password policies. This makes it an ideal choice for detailed reconnaissance against Windows systems to uncover potential vulnerabilities and gather intelligence.

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell

This method correctly leverages a common sudo misconfiguration where a user is permitted to execute /usr/bin/less with root privileges. Inside less, typing '!' allows the execution of arbitrary shell commands. Since less is running as root via sudo, any command executed through '!', such as !/bin/bash, will also inherit root privileges, effectively spawning a root shell.

Update Log4j to version 2.17.1 or later

Updating Log4j to version 2.17.1 or later directly addresses the Log4Shell vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) by completely disabling JNDI lookups by default. This version ensures that untrusted input can no longer trigger remote code execution (RCE) via LDAP, RMI, or other JNDI-enabled services. Applying this patch is the most comprehensive and recommended solution, as it eliminates the underlying flaw rather than merely mitigating symptoms. It ensures the application's logging functionality remains secure and fully operational.

Session hijacking via cross-site scripting (XSS)

Session hijacking via Cross-Site Scripting (XSS) occurs when an attacker injects malicious client-side scripts into a web page viewed by other users. If the session cookie lacks the HttpOnly flag, the injected script can access document.cookie to read and exfiltrate the victim's session identifier. With the stolen session cookie, the attacker can then impersonate the victim, gaining unauthorized access to their authenticated session without needing their credentials. This directly targets the client-side session token.

Unexpected program crashes or segmentation faults

A buffer overflow writes data beyond the intended buffer's boundaries, corrupting adjacent memory. This corruption can overwrite critical program data, function pointers, or the stack frame itself. When the program attempts to access or execute corrupted instructions or data, it leads to an illegal memory access, triggering a segmentation fault or an unexpected program termination.

Access violation errors when writing to memory

Buffer overflows specifically involve writing data past the allocated size of a buffer. When this write operation attempts to access memory pages that are not mapped to the process or are marked as read-only, the operating system's memory management unit detects an unauthorized access attempt. This triggers an access violation error, indicating a critical memory integrity issue.

Overwritten adjacent memory regions

The fundamental mechanism of a buffer overflow is writing more data into a buffer than it was designed to hold. This excess data spills over into contiguous memory locations immediately following the buffer. This overwriting can corrupt other variables, data structures, or even critical control flow information like return addresses on the stack, directly demonstrating the overflow condition.

Exploit the privilege escalation vulnerability on the web server to gain SYSTEM access, then dump the SQL Server service account credentials (e.g., from the SQL Server error logs or registry) and use them to log into the database server with sysadmin privileges

Exploiting a local privilege escalation vulnerability on the web server to gain SYSTEM access provides full control over the underlying operating system. With SYSTEM privileges, an attacker can access memory, registry hives, or log files where the SQL Server service account credentials are often stored or cached. Since the SQL Server service account typically holds sysadmin privileges on its own instance to perform its functions, these credentials can then be used to log into the database with the highest level of access.

WEP key recovery using aircrack-ng

WEP key recovery using tools like aircrack-ng is the correct answer because WEP's fundamental cryptographic weakness stems from its inefficient use of Initialization Vectors (IVs) with the RC4 stream cipher. Attackers exploit the small 24-bit IV space and the plaintext transmission of IVs, leading to frequent IV reuse with the same WEP key. By collecting a large number of unique IVs, often hundreds of thousands to millions, statistical analysis can be performed to deduce the WEP key by observing patterns in the keystream generated from the IV and the key.

Brute-force the WPS PIN to recover the Wi-Fi passphrase

Reaver is a specialized tool engineered to exploit a design flaw in the Wi-Fi Protected Setup (WPS) protocol. It systematically attempts to guess the 8-digit WPS PIN by brute-forcing the first four digits, then the next three, and finally the checksum digit. This method leverages the fact that WPS validates the PIN in two halves, significantly reducing the number of possible combinations and allowing Reaver to recover the Wi-Fi passphrase.

The customer is responsible for configuring access controls and permissions

This statement is correct because, within the AWS shared responsibility model, the customer is solely responsible for the "security in the cloud." For S3, this explicitly includes defining and implementing appropriate access controls and permissions. This involves configuring S3 bucket policies, Access Control Lists (ACLs), and AWS Identity and Access Management (IAM) policies to restrict who can access, modify, or delete data within their S3 buckets. A misconfiguration in these controls directly leads to data exposure.

Implement client authentication and enable TLS encryption

Implementing client authentication ensures that only authorized IoT devices can connect to the MQTT broker, preventing unauthorized actors from publishing or subscribing to sensitive data streams. Concurrently, enabling TLS encryption secures the communication channel itself, protecting all data transmitted between devices and the broker from eavesdropping, tampering, and man-in-the-middle attacks. This combination establishes robust confidentiality, integrity, and access control for MQTT communications, directly addressing the core security vulnerabilities.

AES

Advanced Encryption Standard (AES) is the correct answer because it is a symmetric block cipher that processes data in fixed-size blocks of 128 bits. AES supports various key sizes, including 128, 192, and 256 bits, providing strong security. Its design as a robust and efficient block cipher has established it as the global standard for symmetric encryption, fulfilling both the symmetric classification and the 128-bit block size requirement.

Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) occurs when a web server is tricked into making requests to an arbitrary domain specified by an attacker. The log entry showing a request to `http://169.254.169.254/latest/meta-data/iam/security-credentials/` is a classic example targeting a cloud instance metadata service. This allows the attacker to obtain sensitive information, such as temporary IAM credentials, which can then be used to escalate privileges within the cloud environment.

Email enumeration

Email enumeration is a reconnaissance technique used to discover valid email addresses within an organization. When an email is sent to a non-existent address, the mail server often returns a Delivery Status Notification (DSN) or Non-Delivery Report (NDR) indicating the address was invalid. Conversely, the *absence* of such a bounce, or a specific DSN indicating a deferred delivery rather than an immediate rejection, can confirm the validity of an email address, making DSN responses a valuable tool for identifying active accounts.

Use Shodan to search for target infrastructure

Utilizing Shodan for target infrastructure searches is a quintessential passive reconnaissance technique because it relies entirely on pre-collected, publicly available data. Shodan continuously scans the internet and indexes information about internet-connected devices, services, and their configurations, storing this data in its own databases. An analyst querying Shodan does not send any direct network traffic to the target's systems, thereby avoiding detection and remaining completely non-intrusive.

Use the site: operator in search engines

The `site:` operator in search engines like Google restricts search results to a specific domain, including all its indexed subdomains. By querying `site:target.com`, an ethical hacker can leverage the vast indexing capabilities of search engines to passively discover publicly accessible subdomains that have been crawled and cataloged. This provides a quick and effective method for initial reconnaissance without directly interacting with the target's servers.

Using Google dorking to find exposed documents

Using Google dorking involves leveraging advanced search operators to query Google's pre-existing index for publicly available information about a target, such as exposed documents or misconfigured servers. The interaction occurs solely with Google's search engine, not directly with the target's systems. This method is passive because it relies on information already indexed by a third party, leaving no direct trace on the target's network.

Examining job postings for technology clues

Examining publicly available job postings is a passive footprinting technique because it involves gathering information that the target organization has voluntarily published for recruitment purposes. This method does not involve any direct network interaction or queries against the target's infrastructure. It simply observes publicly accessible data to infer technology stacks, organizational structure, and potential vulnerabilities without leaving any digital trace on the target.

Hosting provider and country

Netcraft is highly effective at identifying a website's hosting provider and geographical location. It achieves this by performing comprehensive DNS queries, correlating IP address ranges with registered Autonomous System Numbers (ASNs), and cross-referencing this data with known internet service providers and their physical infrastructure locations. This capability provides critical intelligence regarding the operational footprint and jurisdictional context of a target.

Site's first seen date and uptime history

Netcraft maintains an extensive historical database of websites it has continuously monitored over many years. Through persistent scanning and archiving of website status and configuration changes, it can accurately report the exact date a site was first observed online. Furthermore, it tracks and aggregates uptime and downtime events, providing a detailed history of the site's operational reliability and availability over time.

Web server software and version

Netcraft actively employs various fingerprinting techniques to identify the web server software and its specific version running on a target domain. This involves analyzing HTTP response headers (e.g., the 'Server' header), examining error page signatures, and observing other unique characteristics of the server's behavior. This information is crucial for identifying potential vulnerabilities associated with known software versions.

The domain has two mail exchange servers

When a DNS lookup tool, such as `nslookup`, is used to query for Mail Exchange (MX) records, the response lists the servers designated to receive email for that domain. The presence of two distinct MX records in the output explicitly indicates that the domain has two separate mail exchange servers configured. Each record points to a specific host responsible for handling incoming mail, often with a preference value to guide delivery order.

Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) occurs when a web application incorporates untrusted data into a web page without proper validation or encoding, allowing attackers to inject client-side scripts. In the case of reflected XSS, the malicious script is immediately returned by the web server in its response and executed by the user's browser, directly impacting the content displayed to the user. This vulnerability directly manifests as unsanitized input being rendered in the browser.

SYN flood

SYN flood sends many SYN packets without completing handshake.

Parameter tampering

Parameter tampering involves an attacker manipulating parameters exchanged between a client and server to alter application behavior or data. This can include modifying values in URL query strings, HTTP headers, cookies, or hidden form fields, such as changing a product's price from $100 to $10 before submission. The goal is to bypass authorization, gain unauthorized access, or manipulate transaction details by altering the data the application expects.

HTTPS

Hypertext Transfer Protocol Secure (HTTPS) is the secure version of HTTP, utilizing Transport Layer Security (TLS), or its deprecated predecessor SSL, to encrypt communication between a web browser and a server. This encryption protects the confidentiality and integrity of data exchanged, including sensitive information like login credentials, financial transactions, and personal data, by preventing unauthorized eavesdropping and tampering. HTTPS ensures that an attacker cannot easily intercept and read the web traffic, thereby securing user interactions and preventing data compromise.

Reflected Cross-Site Scripting (XSS)

Reflected Cross-Site Scripting (XSS) occurs when a malicious script, often embedded within a URL parameter or form input, is immediately and unsafely echoed back in the web server's HTTP response. The victim's browser then interprets and executes this injected script as part of the legitimate webpage content. The exhibit clearly shows user input containing script tags being directly reflected into the HTML response without proper sanitization, leading to client-side script execution, which is the hallmark of a reflected XSS vulnerability.

Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.

Analyzing reverse proxy logs (e.g., NGINX, HAProxy) is crucial because they capture detailed information about incoming HTTP/HTTPS requests, including source IPs, user agents, request methods, and target URLs/API endpoints. Identifying a sudden, high volume of requests directed at a specific API endpoint, especially with diverse source IPs or suspicious user agents, strongly indicates a Layer 7 (application-layer) DDoS attack. This diagnostic step directly confirms the attack type and pinpoints the targeted service, enabling highly focused and effective countermeasures.

Configure egress filtering on the firewall to block outbound connections to known malicious domains.

Configuring egress filtering on the network firewall is a highly effective and proactive measure. This technique inspects and blocks outbound traffic destined for known malicious domains or IP addresses, preventing the compromised IoT device from establishing command and control (C2) communications or exfiltrating data, thereby containing the threat at the network perimeter.

Anyone on the internet can read objects in the bucket if they know the object URL.

This statement is correct because a misconfigured S3 bucket policy or ACL can grant `s3:GetObject` permissions to the `AllUsers` principal, effectively making the bucket publicly readable. In such cases, anyone with an internet connection can retrieve objects directly by knowing or guessing their specific URL, without requiring any AWS authentication. This represents a significant data exposure risk, as the data is accessible to unauthenticated users.

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.

A rogue access point (AP) can be configured to mimic the legitimate network's SSID but broadcast a weaker security protocol like WPA2. Many WPA3-capable clients are configured to prefer WPA3 but will fall back to WPA2 if WPA3 is unavailable or if a stronger WPA2 signal appears more legitimate. By deauthenticating the client from the real WPA3 AP, the rogue WPA2 AP can entice the client to connect, effectively downgrading its security and allowing for WPA2-specific attacks.

LoRaWAN

LoRaWAN (Long Range Wide Area Network) is the optimal choice for IoT sensors in a remote facility with limited power because it is specifically engineered for low-power, wide-area (LPWAN) applications. It provides exceptional long-range communication capabilities, often spanning several kilometers in rural settings, combined with extremely low power consumption. This allows sensors to operate efficiently for many years on small batteries, perfectly aligning with the requirements for remote, power-constrained IoT deployments.

Disable password authentication and use SSH key-based authentication.

SSH key-based authentication significantly enhances security against brute-force attacks by relying on cryptographic key pairs instead of guessable passwords. The private key, stored securely on the client, is mathematically linked to a public key on the server, making it virtually impossible to guess or brute-force due to its immense length and complexity. This method eliminates the vulnerability to dictionary attacks and common password cracking techniques, providing a robust defense.

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.

Setting up a rogue RADIUS server is a highly effective attack against WPA2-Enterprise networks. By impersonating the legitimate authentication server, the rogue RADIUS server can trick clients into authenticating against it. During this process, it captures the challenge-response hashes, such as NTLMv2 hashes from PEAP/MSCHAPv2, which are exchanged during the EAP authentication phase. These captured hashes can then be subjected to efficient offline dictionary or brute-force attacks to recover the actual user credentials, providing unauthorized access.

VirusTotal

VirusTotal is a web-based service that aggregates many antivirus products and online scan engines to check for viruses and other types of malicious content. A security analyst can submit a file's cryptographic hash (e.g., MD5, SHA1, SHA256) to VirusTotal, which then queries its extensive database and provides immediate detection results from numerous security vendors. This capability directly addresses the need to determine if a suspicious file is known malware by comparing its hash against a vast repository of threat intelligence.

Lack of application-layer encryption

This is the correct answer because while HTTPS encrypts data in transit between the client and server, it does not inherently encrypt data at the application layer before it is sent or when it is stored. If sensitive fields are not encrypted by the application itself, they could be exposed in memory, logs, or databases on the server side, even if the network communication is secure. The application's failure to encrypt sensitive data before processing or storage creates a vulnerability independent of transport security.

The CRL published by the online issuing CA

The online issuing CA is directly responsible for generating, signing, and managing the lifecycle of end-entity certificates within this PKI. When an end-entity certificate needs to be revoked, it is the issuing CA that records this revocation event and publishes it in its own Certificate Revocation List (CRL). Consequently, clients validating an end-entity certificate must consult the CRL published by the online issuing CA to ascertain its current revocation status.

Physically inspect the connection between the keyboard and the computer

Hardware keyloggers are physical devices designed to be inconspicuous, often resembling a standard cable adapter or a small inline dongle. They are typically inserted directly between the keyboard's cable and the computer's keyboard port (e.g., USB or PS/2). A direct physical examination of this connection point is the most reliable and often the only method to visually identify and remove such a device, as it bypasses all software-based detection limitations.

ECB

Electronic Codebook (ECB) mode encrypts each fixed-size block of plaintext independently using the same secret key. It does not employ any chaining mechanism between blocks, nor does it require an Initialization Vector (IV) or nonce. The only potential increase in data length results from padding the final plaintext block to meet the cipher's block size, making it the mode that introduces the absolute minimum cryptographic overhead and data expansion.

Anti-VM / sandbox evasion

Anti-VM and sandbox evasion techniques are employed by malware to determine if it is executing within a virtualized environment or an automated analysis sandbox, which often have deliberately limited resources. Checking for low CPU core counts, minimal RAM, small disk sizes, or generic hardware identifiers are common heuristics used by malware to detect these environments. If such conditions are met, the malware may alter its behavior, remain dormant, or self-terminate to avoid detection and analysis, thus preserving its efficacy.

Using a gelatin mold of an authorized user's fingerprint

Using a gelatin mold is a classic and often effective method for creating a spoofed fingerprint, as gelatin can accurately capture and replicate the unique ridge patterns and valleys of an authorized user's print. When pressed against a scanner, particularly older optical or capacitive types lacking advanced liveness detection, the gelatin replica can mimic the electrical or optical properties of a real finger. This allows the penetration tester to deceive the biometric system into granting access.

Pretexting

Pretexting is a highly targeted social engineering technique where an attacker creates a fabricated scenario or 'pretext' to manipulate a victim into divulging sensitive information or performing an action. This often involves extensive research to develop a believable false identity and backstory, making the attacker appear legitimate and authoritative during direct interactions like phone calls. The tester's action of calling with a false identity to extract information perfectly aligns with this method's characteristics.

Implementing a mantrap at the entrance

Implementing a mantrap at the entrance is the most effective defense because it is a physical security mechanism designed specifically to prevent tailgating. A mantrap consists of two interlocking doors, where the first door must close and lock before the second door can open, typically allowing only one person to pass through at a time after successful authentication. This physically enforces single-person entry, making it virtually impossible for a second individual to follow an authorized person into a restricted area.

Whaling

Whaling is a specialized form of spear phishing that specifically targets high-profile individuals, such as senior executives, CEOs, or government officials, or impersonates them to deceive employees. In this scenario, an email appearing to be from the CEO directly aligns with the definition of whaling, as it leverages the authority of a top executive to induce a specific action. The objective is often to trick recipients into making large financial transfers or divulging sensitive corporate data, exploiting the perceived urgency and command from a C-level executive.

ARP spoofing attack

An ARP spoofing attack, also known as ARP poisoning, involves an attacker sending forged Address Resolution Protocol (ARP) replies to a target system, associating the attacker's MAC address with the IP address of another legitimate device on the local network. The exhibit's indication of duplicate MAC addresses for different IP addresses in the ARP cache is a definitive symptom of this attack. This allows the attacker to intercept, modify, or drop traffic intended for the legitimate device, effectively performing a man-in-the-middle attack.

Implement mantraps and enforce a policy of one person per keycard entry

Mantraps are highly effective physical security controls consisting of two interlocking doors, designed to permit only one person to pass through at a time after successful authentication. This physical barrier directly prevents tailgating by making it impossible for a second individual to enter behind an authorized person. Coupling this technical control with a strictly enforced policy reinforces security protocols, ensuring both physical and administrative measures actively mitigate the tailgating threat.