CEH Practice Test 12 — 15 Questions

Question 1

A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Passive reconnaissance. Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.

Answer

Vulnerability scanning

Answer

Social engineering

Answer

Active reconnaissance

Question 2

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 3

During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?

Accepted Answer

MAC flooding. MAC flooding. When a switch's MAC address table is full, it can no longer learn new MAC addresses and enters a fail-open state, flooding all incoming frames out every port except the ingress port. This allows the tester to capture traffic destined for other hosts on the same VLAN by placing their NIC in promiscuous mode and using Wireshark, effectively performing a MAC flooding attack to turn the switch into a hub-like device.

Answer

DNS spoofing

Answer

Session hijacking

Answer

ARP poisoning

Question 4

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review

Question 5

A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?

Accepted Answer

Man-in-the-middle using a rogue certificate. A certificate issued by an intermediate CA chaining to an untrusted root is the classic signature of a rogue or self-signed CA used in a man-in-the-middle attack. The attacker presents a certificate for www.example.com signed by their own CA; because the root is not in the client's trust store, the chain fails validation, but the log event reveals the attempt. This is exactly how TLS interception proxies and malicious MITM setups appear in logs.

Answer

Birthday attack on the certificate signature

Answer

Downgrade attack to SSLv3

Answer

Replay attack on the TLS handshake

Question 6

An ethical hacker needs to crack a set of NTLM hashes obtained from a Windows system. Which tool would be MOST efficient for performing a dictionary attack with hybrid rules?

Accepted Answer

Hashcat. Hashcat is the most efficient tool for performing a dictionary attack with hybrid rules because it is GPU-accelerated, supports the NTLM hash mode (1000), and allows the application of rule-based mutations (e.g., appending digits or special characters) directly to dictionary words. Its speed and flexibility in handling large wordlists with complex rule sets make it superior for cracking NTLM hashes in a professional penetration test.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 7

A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?

Accepted Answer

SYN scan (-sS). A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.

Answer

Ping sweep (-sn)

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Question 8

A penetration tester uses theHarvester to gather information about a target domain. Which of the following data types is theHarvester PRIMARILY designed to collect?

Accepted Answer

Email addresses and subdomains. theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.

Answer

Live network traffic captures

Answer

Passwords hashes

Answer

Vulnerability scan results

Question 9

You are a penetration tester assessing a client's internal network. The client has provided you with a non-administrative domain user account. The target network consists of 200 Windows workstations and 5 Windows servers (one domain controller, one file server, two application servers, and one database server). All systems are fully patched and have host-based firewalls enabled. The client wants you to identify vulnerabilities that could be exploited from the internal network. After initial reconnaissance, you discover that all servers have SMB (port 445) open only to the domain controller and the file server has SMB open to all workstations. You have gained a foothold on a workstation via a phishing attack. From this workstation, you can reach the file server on port 445. What is the most effective next step to enumerate potential vulnerabilities on the file server?

Accepted Answer

Enumerate SMB shares and session information using `net view \fileserver` and `smbclient -L //fileserver`.. The client's objective is to enumerate potential vulnerabilities on the file server from the compromised workstation. Since SMB (port 445) is open between workstations and the file server, using `net view \fileserver` and `smbclient -L //fileserver` allows you to list SMB shares, sessions, and other information without requiring administrative privileges or additional tools. This is a standard enumeration technique that reveals accessible resources, which can then be tested for misconfigurations or weak permissions.

Answer

Attempt to connect to the file server via RDP (port 3389) using the compromised user's credentials.

Answer

Use PsExec to execute commands remotely on the file server using the compromised user account.

Answer

Run a full vulnerability scan (e.g., Nessus) against the entire subnet to identify weaknesses.

Question 10

Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)

Accepted Answer

smbclient -L //target -U ''. `smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.

Answer

snmpwalk -v2c -c public target

Answer

nmap -sU -p 445 target

Answer

nbtstat -A target

Question 11

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Accepted Answer

Applies mutations like appending numbers or symbols. A hybrid attack applies mutations such as appending numbers or symbols to dictionary words, which is a core characteristic of this attack type. This technique combines the efficiency of a wordlist with the flexibility of brute-force modifications, making it effective against passwords that follow common patterns like 'password123'.

Answer

Tries every possible combination of characters

Answer

Relies on precomputed hash chains

Question 12

A penetration tester uses the tool 'Pacu' during an assessment. Which of the following actions is Pacu designed to perform?

Accepted Answer

Automate penetration testing tasks in AWS environments. Pacu is an open-source AWS exploitation framework designed to automate penetration testing tasks in AWS environments. It provides a modular structure with modules for enumeration, privilege escalation, persistence, and data exfiltration, specifically targeting AWS services like IAM, S3, EC2, and Lambda. It is not used for Azure, network scanning, or wireless attacks.

Answer

Exploit vulnerabilities in Azure cloud infrastructure

Answer

Perform network scanning and service enumeration

Answer

Crack WPA2 handshakes using dictionary attacks

Question 13

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

Accepted Answer

Physically inspect the connection between the keyboard and the computer. A hardware keylogger is a physical device inserted between the keyboard and the computer, typically at the PS/2 or USB connector. Unlike software-based keyloggers, it operates independently of the operating system, so it cannot be detected by process lists, event logs, or antivirus scans. The only reliable detection method is a physical inspection of the keyboard cable and connection point for any unusual inline devices.

Answer

Check running processes for suspicious entries

Answer

Review USB device history in Event Viewer

Answer

Run an antivirus scan

Question 14

During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?

Accepted Answer

The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file. The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.

Answer

The DNS server is using DNSSEC to secure zone transfers

Answer

The DNS server is properly configured and only allows zone transfers to authorized secondary servers

Answer

The target uses a split-DNS configuration with internal and external views

Question 15

A security analyst reviews the iptables firewall configuration on a Linux server acting as a gateway for a small office. The server has two interfaces: eth0 (external) and eth1 (internal, 192.168.1.0/24). Based on the exhibit, which of the following is a valid security concern?

Accepted Answer

All traffic to the loopback interface is accepted, which could allow local attacks to bypass firewall rules.. The iptables rules show that all traffic to the loopback interface (lo) is accepted in the INPUT chain. This means any process on the local host can send packets to 127.0.0.1 without being filtered, potentially allowing local privilege escalation or local attacks to bypass firewall restrictions. In a gateway configuration, this can be exploited if an attacker gains local access and uses the loopback to communicate with services that should be protected.

Answer

The OUTPUT chain policy is set to ACCEPT, which allows any outbound traffic.

Answer

The FORWARD chain only allows traffic from 192.168.1.0/24 to any destination, which is too permissive.

Answer

UDP port 53 is allowed, which could permit DNS tunneling attacks.