CEH Practice Test 11 — 15 Questions

Question 1

A security analyst examines a compromised Linux server and finds a hidden directory `/usr/share/.syslog` containing a modified version of `sshd` and a log cleaner script. This is indicative of which technique used to erase tracks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rootkit installation. The presence of a hidden directory containing a modified `sshd` binary and a log cleaner script is a classic sign of a rootkit installation. Rootkits replace core system binaries (like `sshd`) to maintain backdoor access and use log cleaners to erase evidence of their activity, directly aligning with the technique of erasing tracks.

Answer

Token impersonation

Answer

DLL injection

Answer

Steganography

Question 2

What is the primary purpose of using the Nmap flag -sS?

Accepted Answer

Perform a SYN stealth scan. The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.

Answer

Enable OS detection

Answer

Perform a UDP scan

Answer

Perform a TCP connect scan

Question 3

A Linux system has a script named 'backup' owned by root with the SUID bit set and world-executable permissions. A standard user executes the script and discovers it runs a command that reads /etc/shadow and writes output to a world-readable file. What is the most likely intended exploitation path?

Accepted Answer

SUID abuse to read sensitive files. The SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

Answer

GUID abuse

Answer

LD_PRELOAD injection

Answer

Token impersonation

Question 4

A tester runs 'snmpwalk -v2c -c public 192.168.1.1' and receives a large amount of system information. What does this command do?

Accepted Answer

It walks the SNMP MIB tree using version 2c and the public community string.. The `snmpwalk` command is used to retrieve a subtree of management values from an SNMP agent. The `-v2c` flag specifies SNMP version 2c, which uses community-based security, and `-c public` provides the community string 'public' (often the default read-only community). The command walks the entire MIB tree starting from the root, returning all available OID values, which explains the large amount of system information received.

Answer

It performs a brute-force attack on SNMP community strings.

Answer

It enumerates users on a Windows domain.

Answer

It sets SNMP values using the private community string.

Question 5

Which TWO of the following are types of malware analysis? (Select two.)

Accepted Answer

Static analysis. Static analysis involves examining malware without executing it, such as inspecting file headers, strings, and disassembled code. Dynamic analysis executes the malware in a controlled sandbox to observe its runtime behavior, including network traffic, registry changes, and process creation. Both are fundamental malware analysis methodologies recognized in CEH.

Answer

Memory analysis

Answer

Signature analysis

Answer

Heuristic analysis

Question 6

Which TWO of the following are effective physical security controls to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and the system verifies that only one person enters before allowing the second door to open. This design directly prevents tailgating by trapping unauthorized individuals who attempt to follow an authorized person through the first door.

Answer

Biometric door lock

Answer

CCTV cameras

Answer

Security guard

Question 7

During a penetration test, an analyst obtains a dump of password hashes from a Windows server. The hashes are in LM:NT format. The analyst wants to crack the NT portion using a brute-force attack on 8-character alphanumeric passwords. Which tool is BEST suited for this task?

Accepted Answer

Hashcat. Hashcat is the best tool for this task because it is optimized for high-speed GPU-accelerated brute-force attacks, making it ideal for cracking 8-character alphanumeric NT hashes. It supports the LM:NT format natively and allows precise control over attack modes, including brute-force with custom character sets, which is essential for exhaustive enumeration of 62^8 possibilities.

Answer

John the Ripper

Answer

RainbowCrack

Answer

Ophcrack

Question 8

Which type of malware is designed to replicate itself across networks without requiring a host file, often exploiting vulnerabilities to spread?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across networks without needing a host file, typically exploiting vulnerabilities such as unpatched SMB services (e.g., EternalBlue in WannaCry) or weak credentials to propagate autonomously. Unlike viruses, worms do not require attachment to an existing executable or document, and they spread by scanning for vulnerable targets and transferring their code over network protocols like TCP/IP.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 9

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

Answer

UDP flood

Answer

ARP spoofing

Answer

ICMP flood

Question 10

An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?

Accepted Answer

Use the site: operator in search engines. The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.

Answer

Run a traceroute to the main domain

Answer

Check the WHOIS record for the domain

Answer

Perform a reverse DNS lookup on the target IP range

Question 11

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

Accepted Answer

Anti-VM / sandbox evasion. Checking the number of CPU cores is a classic anti-VM/sandbox evasion technique. Virtual machines and sandboxes often allocate minimal resources (e.g., a single core) to remain lightweight, so malware uses this check to detect an analysis environment and terminate execution to avoid detection.

Answer

Code obfuscation

Answer

Anti-debugging

Answer

Packing

Question 12

Which TWO of the following are valid enumeration techniques? (Select 2)

Accepted Answer

LDAP enumeration. LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.

Answer

ARP poisoning

Answer

DNS cache poisoning

Answer

ICMP flooding

Question 13

Drag and drop the steps to conduct a penetration test using the CEH methodology into the correct order.

Accepted Answer

Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks. The CEH methodology follows: Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks.

Answer

Scanning, Reconnaissance, Gaining Access, Maintaining Access, Covering Tracks

Answer

Reconnaissance, Scanning, Gaining Access, Covering Tracks, Maintaining Access

Answer

Gaining Access, Reconnaissance, Scanning, Maintaining Access, Covering Tracks

Question 14

A security analyst is analyzing a suspicious file and runs the command 'strings malware.exe | grep -i http'. The output shows several URLs ending with '.exe'. What does this indicate?

Accepted Answer

The malware may download additional payloads from remote servers. The `strings` command extracts printable strings from a binary file, and `grep -i http` filters for HTTP-related content. The presence of URLs ending with `.exe` indicates that the malware contains embedded references to executable files hosted on remote servers, which is a common technique for downloading additional payloads or updates. This strongly suggests the malware has a downloader or dropper component that fetches further malicious code from those URLs.

Answer

The malware has a keylogger component

Answer

The malware is a boot sector virus

Answer

The malware is a worm that spreads via email

Question 15

An analyst observes the following SNMP walk output on a network device: `SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.5.1 = STRING: "cisco"`. Which finding is most significant?

Accepted Answer

The SNMP community string is "cisco" and likely weak. The SNMP walk output reveals the community string 'cisco' in the OID `enterprises.9.9.23.1.2.1.1.5.1`, which corresponds to the SNMP community string (ciscoSnmpCommunityString) in Cisco's private MIB. A default or easily guessable community string like 'cisco' is a critical security weakness because it allows unauthorized read or read-write access to the device, enabling enumeration of system information or configuration changes. This finding is the most significant because it directly indicates a weak authentication mechanism that can be exploited for further enumeration or system compromise.

Answer

The SNMP service is using version 2c

Answer

The device is running Cisco IOS version 12.0

Answer

The device is configured for read-write access