CEH Practice Test 12 — 15 Questions

Question 1

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting

Question 2

An attacker sends an email to the CEO of a company, pretending to be a board member and requesting a wire transfer for a confidential acquisition. Which social engineering attack is this?

Accepted Answer

Whaling. Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like C-suite executives or board members. In this scenario, the attacker impersonates a board member to trick the CEO into authorizing a wire transfer, which is a classic whaling tactic because it exploits the authority and trust associated with senior leadership.

Answer

Vishing

Answer

Spear phishing

Answer

Phishing

Question 3

During a penetration test, an analyst uses enum4linux with the -a flag against a target. Which of the following is the MOST comprehensive set of information that can be obtained?

Accepted Answer

User list, share list, OS information, password policy, and group memberships. enum4linux with the -a flag performs a comprehensive enumeration against a target, leveraging SMB, RPC, and NetBIOS over TCP/IP. It retrieves user lists, share lists, OS information, password policy details, and group memberships by querying the remote Windows system via SMB RPC calls (e.g., SAMR, LSA, SRVSVC). This makes it the most complete set of information obtainable from a single command, as the -a flag essentially runs all available enumeration modules.

Answer

Only the domain admins and local admins

Answer

Only the SMB shares and open sessions

Answer

Only the NetBIOS name table

Question 4

Which TWO of the following are examples of amplification attacks used in DDoS?

Accepted Answer

DNS amplification. DNS amplification is a classic DDoS amplification attack where an attacker sends a small DNS query (e.g., an ANY or TXT record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a much larger response (up to 50x the query size), flooding the victim with traffic. This exploits the UDP protocol's lack of handshake and the resolver's willingness to respond to any source.

Answer

Slowloris

Answer

SYN flood

Answer

Ping of Death

Question 5

During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?

Accepted Answer

A zone transfer request. The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.

Answer

A subdomain brute-force

Answer

A reverse DNS lookup

Answer

A SRV record enumeration

Question 6

Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)

Accepted Answer

Configuring port security on switches. Configuring port security on switches is effective against ARP poisoning because it limits the number of MAC addresses allowed on a port, preventing an attacker from flooding the network with spoofed MAC addresses. By restricting the port to a single or limited set of MAC addresses, it stops unauthorized devices from injecting fake ARP replies. This is a Layer 2 security control that directly mitigates the ability to perform ARP cache poisoning at the access edge.

Answer

Enabling DHCP snooping

Answer

Disabling STP on all ports

Question 7

Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)

Accepted Answer

Installing a rootkit. Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.

Answer

Running a vulnerability scanner

Answer

Enabling firewall rules

Answer

Creating new user accounts

Question 8

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

Accepted Answer

An attacker is performing TCP sequence prediction to hijack the session.. The observed sequence numbers (initial seq=100, ack=300, then seq=300, ack=101) indicate that the ACK packet acknowledges a sequence number that was never sent by the original sender, which is a classic sign of TCP sequence number prediction. An attacker who predicts the next expected sequence number can inject a spoofed packet to hijack the session, and the subsequent RST is often used by the attacker to tear down the legitimate connection or cover their tracks.

Answer

A normal TCP connection establishment followed by an immediate termination.

Answer

A man-in-the-middle attack using ARP spoofing.

Answer

A TCP SYN flood attack is in progress.

Question 9

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 10

A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?

Accepted Answer

Username enumeration. The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 11

An analyst notices that a web application's login page returns a generic 'Invalid credentials' message regardless of whether the username is valid. This is an example of which security control?

Accepted Answer

Generic error messages. Providing generic error messages prevents attackers from enumerating valid usernames, which is a common mitigation against brute-force attacks.

Answer

Anti-CSRF token

Answer

Account lockout policy

Answer

Rate limiting

Question 12

A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?

Accepted Answer

Error-based SQL injection. Error-based SQL injection (in-band) relies on error messages from the database to extract information. The presence of database details in errors indicates error-based injection.

Answer

Blind SQL injection (boolean-based)

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 13

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Accepted Answer

Intruder. Burp Intruder is designed for automated request customization and repetition, allowing fuzzing of parameters for injection flaws, brute-force attacks, and other vulnerability testing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 14

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review

Question 15

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)