CEH Practice Test 14 — 15 Questions

Question 1

Which cryptographic algorithm is classified as symmetric and uses a block cipher with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits, and is widely used for encryption.

Answer

ECC

Answer

Diffie-Hellman

Answer

RSA

Question 2

A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?

Accepted Answer

Reflected XSS. The payload is URL-encoded HTML and is decoded and reflected, indicating reflected XSS.

Answer

HTTP Response Splitting

Answer

DOM-based XSS

Answer

Stored XSS

Question 3

Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)

Accepted Answer

smbclient -L //target -U ''. `smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.

Answer

snmpwalk -v2c -c public target

Answer

nmap -sU -p 445 target

Answer

nbtstat -A target

Question 4

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Accepted Answer

Applies mutations like appending numbers or symbols. A hybrid attack applies mutations such as appending numbers or symbols to dictionary words, which is a core characteristic of this attack type. This technique combines the efficiency of a wordlist with the flexibility of brute-force modifications, making it effective against passwords that follow common patterns like 'password123'.

Answer

Tries every possible combination of characters

Answer

Relies on precomputed hash chains

Question 5

In PKI, what is the primary role of a Certificate Authority (CA)?

Accepted Answer

To issue and digitally sign certificates. A CA issues and signs digital certificates, validating the identity of certificate requestors.

Answer

To revoke user passwords

Answer

To generate random session keys

Answer

To encrypt data between client and server

Question 6

Which Burp Suite tool is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is used for automating customized attacks, including brute force and fuzzing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 7

Which cloud security assessment tool is specifically designed to audit AWS environments against best practices and CIS benchmarks?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations.

Answer

Pacu

Answer

Nessus

Answer

Metasploit

Question 8

Which of the following describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker forces the web server to make HTTP requests to arbitrary destinations, potentially accessing internal resources.. SSRF occurs when an attacker can induce the server to make HTTP requests to internal or external resources. This can lead to accessing internal services (e.g., cloud metadata endpoints) that are not normally accessible from the outside.

Answer

An attacker tricks a user into clicking a link that executes unwanted actions on a web application where the user is authenticated.

Answer

An attacker injects malicious scripts into a web page that executes in other users' browsers.

Answer

An attacker manipulates input to execute system commands on the server.

Question 9

Which THREE of the following are valid defenses against WPA2 attacks? (Select three)

Accepted Answer

Disable WPS. Using a strong passphrase makes dictionary attacks harder. 802.1X/EAP provides enterprise authentication. Disabling WPS removes PIN brute-force vector. WPA2-Mixed mode still allows TKIP clients, reducing security.

Answer

Use WEP instead of WPA2

Answer

Enable WPA2-Mixed mode

Question 10

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

Accepted Answer

Physically inspect the connection between the keyboard and the computer. A hardware keylogger is a physical device inserted between the keyboard and the computer, typically at the PS/2 or USB connector. Unlike software-based keyloggers, it operates independently of the operating system, so it cannot be detected by process lists, event logs, or antivirus scans. The only reliable detection method is a physical inspection of the keyboard cable and connection point for any unusual inline devices.

Answer

Check running processes for suspicious entries

Answer

Review USB device history in Event Viewer

Answer

Run an antivirus scan

Question 11

A security analyst reviews the iptables firewall configuration on a Linux server acting as a gateway for a small office. The server has two interfaces: eth0 (external) and eth1 (internal, 192.168.1.0/24). Based on the exhibit, which of the following is a valid security concern?

Accepted Answer

All traffic to the loopback interface is accepted, which could allow local attacks to bypass firewall rules.. The iptables rules show that all traffic to the loopback interface (lo) is accepted in the INPUT chain. This means any process on the local host can send packets to 127.0.0.1 without being filtered, potentially allowing local privilege escalation or local attacks to bypass firewall restrictions. In a gateway configuration, this can be exploited if an attacker gains local access and uses the loopback to communicate with services that should be protected.

Answer

The OUTPUT chain policy is set to ACCEPT, which allows any outbound traffic.

Answer

The FORWARD chain only allows traffic from 192.168.1.0/24 to any destination, which is too permissive.

Answer

UDP port 53 is allowed, which could permit DNS tunneling attacks.

Question 12

A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?

Accepted Answer

Time-based. Boolean-based, time-based, and out-of-band are all types of blind SQL injection. Error-based and union-based are in-band techniques, not blind.

Answer

Error-based

Answer

Union-based

Question 13

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. CSRF tokens are unique per request and validated server-side. SameSite cookies restrict cookie sending to same-site requests.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 14

An attacker sets up a rogue access point with the same SSID as a legitimate corporate network and broadcasts a stronger signal. Clients connect to the rogue AP. What type of attack is this?

Accepted Answer

Evil twin attack. An evil twin attack involves a rogue AP mimicking a legitimate SSID to intercept traffic.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

MAC spoofing attack

Question 15

An employee receives an email that appears to be from the company's CEO, requesting an urgent wire transfer to a vendor. The email address is slightly different from the CEO's actual address. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted social engineering attack aimed at a specific individual or organization. In this scenario, the email is personalized to appear from the CEO but targets an employee, making it spear phishing. Unlike whaling, which targets high-profile executives, spear phishing can target any individual. The slightly spoofed email address and urgent request for a wire transfer are common spear phishing tactics, exploiting trust and authority to trick the victim.

Answer

Phishing

Answer

Vishing

Answer

Whaling