CEH Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?

Accepted Answer

CVE-2021-41773 (Apache Path Traversal)

Answer

CVE-2017-5638 (Struts2 RCE)

Answer

CVE-2014-0160 (Heartbleed)

Answer

CVE-2020-1472 (Zerologon)

Question 2

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

Accepted Answer

SQL injection in SOAP service

Answer

XML External Entity (XXE) injection

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 3

Which TWO of the following are features of a Remote Access Trojan (RAT)?

Accepted Answer

It often includes a backdoor to bypass authentication. A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.

Answer

It encrypts files and demands ransom

Answer

It infects the Master Boot Record

Answer

It replicates itself across the network autonomously

Question 4

Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)

Accepted Answer

Performing an SMB null session and querying the SAM database.. Option B is correct because an SMB null session (connecting to IPC$ without credentials) can be used to query the SAM database via the SAMR protocol, allowing an attacker to enumerate local user accounts and groups on a Windows system. This technique exploits the default configuration of older Windows versions or improperly secured systems where the null session is not restricted.

Answer

Requesting a DNS zone transfer to obtain a list of user account names from the SRV records.

Answer

Sending Kerberos AS-REQ packets and analyzing the error codes (e.g., KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN).

Question 5

A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?

Accepted Answer

Persistence mechanism. The malware adds a startup entry in the Windows registry (e.g., Run or RunOnce keys), which ensures the executable is automatically launched each time the user logs in. This is a classic persistence mechanism, as defined by MITRE ATT&CK technique T1547.003, because it maintains the malware's presence across system reboots.

Answer

Keylogging

Answer

Fileless execution

Answer

Privilege escalation

Question 6

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Accepted Answer

MySQL (3306) - exploit CVE-2016-6662. MySQL (3306) is the correct target because CVE-2016-6662 is a critical remote code execution vulnerability in MySQL that allows an attacker to inject malicious configuration directives via a crafted `my.cnf` file, leading to arbitrary code execution with the privileges of the MySQL daemon (typically root). This provides a reliable, high-impact initial access vector without requiring authentication or brute-forcing, making it the highest-chance option among the listed services.

Answer

HTTP (80) - exploit Apache vulnerability

Answer

SSH (22) - brute force user credentials

Answer

Proxy (8080) - exploit Squid vulnerability

Question 7

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Accepted Answer

Hosting provider and country. Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Answer

Internal IP addresses of the servers

Answer

Employee email addresses

Question 8

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Accepted Answer

The attacker extracted hashed passwords that can be cracked offline. The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Answer

The attacker successfully performed a blind SQL injection to enumerate the database structure

Answer

The attacker caused a denial of service by sending an invalid query

Answer

The attacker modified the database records to update user passwords

Question 9

Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?

Accepted Answer

The action was performed by the AWS root account, which should be avoided for routine tasks.. The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.

Answer

The AMI ID (ami-0abcdef1234567890) is from a trusted source.

Answer

The source IP address (203.0.113.5) is suspicious.

Answer

The instance type is t2.micro, which may be vulnerable.

Question 10

Which TWO of the following tools are commonly used for passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API without directly interacting with the target network. It collects email addresses, subdomains, IPs, and employee names by querying publicly available data, making it a purely passive technique.

Answer

nmap

Answer

Netcat

Answer

Metasploit

Question 11

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Accepted Answer

Email enumeration. Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer

DNS cache poisoning

Answer

Man-in-the-middle attack

Answer

Phishing attack

Question 12

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Accepted Answer

Apache Tomcat 8.5.5. Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.

Answer

MAC Address 00:1A:2B:3C:4D:5E

Answer

Apache httpd 2.4.18

Answer

OpenSSH 7.2p2

Question 13

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Question 14

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. This is a standard DNS query type defined in RFC 1035.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)

Question 15

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Directory Traversal

CEH Practice Test 11 — 15 Questions

Exhibit

CEH Practice Test 11 — 15 Questions

Exhibit