CEH Practice Test 10 — 10 Questions

Question 1

A penetration tester runs the following command: `macof -i eth0 -s 192.168.1.100 -d 10.0.0.1`. Which attack is being performed?

Accepted Answer

MAC flooding. The `macof` tool is designed to flood a switch with packets containing random source MAC addresses, overwhelming the Content Addressable Memory (CAM) table. Once the CAM table is full, the switch enters a fail-open state and broadcasts all frames, allowing the attacker to sniff traffic that would normally be isolated to specific ports. This is a classic MAC flooding attack, not ARP poisoning or DHCP starvation.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

DHCP starvation

Question 2

A security analyst performs a passive reconnaissance of a target domain using public resources. Which of the following techniques would be considered passive reconnaissance?

Accepted Answer

Performing a WHOIS lookup for the target domain. Passive reconnaissance involves gathering information without directly interacting with the target's systems, thus avoiding any network traffic that could be detected. A WHOIS lookup queries a public registry database (e.g., whois.arin.net) over port 43 or via a web interface, retrieving domain registration details without sending any packets to the target's own infrastructure. This makes it a purely passive technique.

Answer

Using Netcat to grab banners from the target's email server

Answer

Running Nmap SYN scan on the target's web server

Answer

Sending a ping sweep to the target's public IP range

Question 3

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Accepted Answer

Black-box test. A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Answer

White-box test

Answer

Red team engagement

Answer

Gray-box test

Question 4

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

Accepted Answer

ECB. ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

Answer

GCM

Answer

CFB

Answer

CBC

Question 5

A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?

Accepted Answer

DNS amplification. The attack described involves DNS queries with spoofed source IPs sent to a DNS server, which then responds with large replies to the victim (the spoofed IP). This is a classic DNS amplification attack, a type of reflection-based DDoS that exploits the large response-to-query ratio (e.g., an ANY query can yield a response up to 70x larger) to overwhelm the target. The surge in incoming UDP traffic to the DNS server is the attacker's queries, while the amplified responses are directed at the spoofed victim.

Answer

SYN flood

Answer

UDP flood

Answer

ICMP flood

Question 6

An attacker has gained access to a Linux server and wants to cover their tracks. They edit the `.bash_history` file, modify system logs in `/var/log`, and install a kernel module that hides their processes. Which two steps of the system hacking methodology (CHPSET) are being performed?

Accepted Answer

Erasing tracks and Spying. The attacker is performing 'Erasing tracks' by editing .bash_history and modifying logs in /var/log, and 'Spying' by installing a kernel module to hide processes, which allows continued covert monitoring. These correspond to the 'Erasing tracks' and 'Spying' steps in the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Executing applications, Erasing tracks) methodology.

Answer

Erasing tracks and Privilege escalation

Answer

Cracking passwords and Covering tracks

Answer

Executing applications and Spying

Question 7

Which password cracking technique involves trying every possible combination of characters until the correct password is found?

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters from a defined character set (e.g., lowercase, uppercase, digits, special symbols) until the correct password is found. This method guarantees eventual success but is computationally expensive and time-consuming, especially for long or complex passwords. It is the most exhaustive form of password cracking, as it does not rely on any precomputed data or wordlists.

Answer

Rainbow table attack

Answer

Dictionary attack

Answer

Hybrid attack

Question 8

An incident responder notices unusual outbound traffic from a host that is communicating with an external IP on port 4444. The traffic appears to be encrypted. Which tool could be used to initiate a connection to that external IP to gather a banner for service identification?

Accepted Answer

Telnet. Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.

Answer

traceroute

Answer

nslookup

Answer

ping

Question 9

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.

Accepted Answer

Check current rules, add drop rule for SSH, verify the new rule, save the rules, test connectivity. The correct sequence for configuring an iptables rule to block incoming SSH is to first check the current rules (e.g., with `iptables -L`) to avoid conflicts, then add the drop rule for SSH (e.g., `iptables -A INPUT -p tcp --dport 22 -j DROP`), next verify that the rule is in place (`iptables -L`), then save the rules permanently (e.g., `iptables-save`), and finally test the block by attempting an SSH connection from an external host.

Answer

Add drop rule for SSH, check current rules, verify the new rule, test connectivity, save the rules

Answer

Check current rules, add drop rule for SSH, test connectivity, verify the new rule, save the rules

Answer

Save the rules, check current rules, add drop rule for SSH, verify the new rule, test connectivity

Question 10

During a penetration test, you need to enumerate SMB shares on a Windows target. Which of the following tools is specifically designed for this purpose?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

Answer

ldapsearch

Answer

nmap

Answer

snmpwalk