CEH Practice Test 15 — 15 Questions

Question 1

An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?

Accepted Answer

The zombie host must have an incremental IP ID sequence that is not reset by other traffic. The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.

Answer

The zombie host must be running a Windows operating system

Answer

The attacker must have root access on the target machine

Answer

The target must be running a Linux server with SSH enabled

Question 2

A penetration tester receives an email that appears to be from the company's CEO, urgently requesting that the tester click a link to review a document. The email contains several grammatical errors and the sender's address is slightly misspelled. Which type of social engineering attack is this MOST likely?

Accepted Answer

Spear phishing. This attack is spear phishing because the email is targeted at a specific individual (the penetration tester) and impersonates a trusted source (the CEO) to trick the recipient into clicking a malicious link. While whaling targets high-level executives, spear phishing targets any specific person, and here the recipient is not a senior executive. The grammatical errors and misspelled sender address are common indicators of phishing, but the targeted nature distinguishes it from generic phishing.

Answer

Whaling

Answer

Baiting

Answer

Vishing

Question 3

A security analyst receives an alert about a scan originating from an IP address that appears to be using a 'sIdle scan' technique. Which of the following characteristics would confirm this?

Accepted Answer

The scan sends SYN packets with the zombie host's IP address as the source and monitors IPID changes on the zombie to determine open ports. An idle scan (also known as a zombie scan) relies on sending SYN packets to the target with the spoofed source IP address of a zombie host, then monitoring the IPID sequence on that zombie to infer whether the target port is open, closed, or filtered. The key characteristic is the use of the zombie's IP as the source and the observation of IPID changes on the zombie, which is exactly what option C describes.

Answer

The scan uses fragmented packets and decoy IP addresses

Answer

The scan uses FTP bounce to hide the true source IP

Answer

The scan shows a SYN packet with the attacker's real IP but uses a zombie host to relay replies

Question 4

You are a security analyst for a medium-sized e-commerce company. The company hosts its web application on a single server running Apache on Ubuntu. Recently, the operations team noticed that the server's CPU usage spikes to 100% every few minutes, causing the website to become unresponsive. They have ruled out hardware issues. The web server logs show repeated requests to the same URL with varying parameters, such as /product?id=1, /product?id=2, etc., all originating from a single IP address. Each request returns a 200 OK response, but the server takes several seconds to generate the page. The application uses a relational database backend with an ORM. You suspect an attack is occurring. What is the most likely attack and the best immediate course of action?

Accepted Answer

Block the IP address of the attacker at the firewall. The attack is a resource exhaustion or application-layer DoS attack, where repeated requests to a database-backed endpoint (e.g., /product?id=1, /product?id=2) cause high CPU usage due to expensive ORM queries. The immediate best course is to block the single attacking IP at the firewall, as it stops the malicious traffic at the network perimeter with minimal overhead, preserving server resources for legitimate users.

Answer

Implement rate limiting on the /product endpoint

Answer

Install a web application firewall (WAF) to detect and block malicious requests

Answer

Apply input validation to ensure product IDs are positive integers

Question 5

During a penetration test, a security analyst observes that Nmap SYN scans to a target server are not returning any results, but TCP connect scans succeed. The server is running an IDS. Which evasion technique is the analyst MOST likely encountering?

Accepted Answer

The IDS is dropping packets with the SYN flag set. The IDS is configured to drop packets with only the SYN flag set, which is the hallmark of a SYN scan. This evasion technique forces the attacker to use a full TCP connect scan (which completes the three-way handshake) to bypass the IDS detection. The IDS drops the initial SYN packet, preventing the scan from receiving any response, while a full connect scan is allowed because it mimics legitimate traffic.

Answer

The server is using a firewall that blocks all inbound SYN packets

Answer

The analyst's packets are being fragmented, causing them to be dropped

Answer

The target is using a honeypot that responds to all connection attempts

Question 6

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Using SameSite cookies. SameSite cookies (option A) are effective against CSRF because they restrict the browser from sending cookies on cross-origin requests, preventing forged requests from carrying authentication credentials. CSRF tokens (option E) are also effective because they require a unique token in each request that the attacker cannot predict. Option C (anti-CSRF tokens) is essentially the same technique as option E, so it is not considered a distinct mitigation; thus, only options A and E are correct.

Answer

Input validation

Answer

Using anti-CSRF tokens

Answer

Using HTTPOnly cookies

Question 7

You are a security analyst for a medium-sized company. The company uses a custom web application for internal project management. The application uses AES-256-CBC for encrypting sensitive data stored in the database. Recently, the company experienced a data breach where an attacker exfiltrated the entire database. Although the data was encrypted, the attacker was able to decrypt some records. Investigation reveals that the encryption key is stored in a configuration file on the same server, and the initialization vector (IV) is hardcoded in the application code. Additionally, the application uses the same key for all records. Which of the following is the most effective remediation to prevent future decryption of stolen encrypted data?

Accepted Answer

Implement per-record encryption keys derived from a master key combined with a unique salt. Using per-record encryption keys derived from a master key combined with a unique salt ensures that even if an attacker exfiltrates the entire database, each encrypted record requires a separate key derivation operation. Without the unique salt per record, the attacker cannot decrypt all records even if they compromise the master key. This approach mitigates the risk of a single key compromise leading to bulk decryption, which is the core vulnerability in the current setup where the same AES-256-CBC key and hardcoded IV are reused across all records.

Answer

Change the encryption mode from CBC to GCM to provide authentication

Answer

Store the encryption key in a hardware security module (HSM) and use the same key

Answer

Rotate the encryption key every 24 hours

Question 8

A security team wants to identify all live hosts on a large, Class B private IP network (172.16.0.0/16) as quickly as possible while minimizing network load. Which tool and technique should they use?

Accepted Answer

Masscan with --ping to send ICMP echo requests across the /16 range. Masscan is designed for high-speed scanning and can send ICMP echo requests across a /16 range (65,536 IPs) in seconds, far faster than Nmap or hping3, while its --ping mode minimizes network load by using stateless packet transmission. This makes it the optimal choice for quickly identifying live hosts on a large private network without overwhelming the network.

Answer

Use theHarvester to query DNS records for the domain

Answer

Nmap with -sn (ping sweep) on all 65536 IPs

Answer

hping3 with --icmp on each IP sequentially

Question 9

Which of the following tools is used to crack Windows LAN Manager (LM) and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It is optimized for Windows password hashes and provides an efficient time-memory trade-off by looking up hashes in sorted tables.

Answer

Hashcat

Answer

John the Ripper

Answer

Hydra

Question 10

A security analyst uses a tool to capture packets in promiscuous mode on a network segment. The analyst notices that only traffic to and from the analyst's machine is captured, not all traffic on the segment. What is the most likely reason?

Accepted Answer

The network is using a switch instead of a hub. A switch forwards frames only to the specific port associated with the destination MAC address, unlike a hub which floods all traffic to every port. When a security analyst captures packets in promiscuous mode on a switch, the NIC can see only the frames destined for or originating from that port, plus broadcast/multicast frames. Therefore, the most likely reason only traffic to/from the analyst's machine is captured is that the network uses a switch, not a hub.

Answer

The switch is preventing sniffing due to port security

Answer

The analyst is not using the correct filter in Wireshark

Answer

The network interface is not in promiscuous mode

Question 11

You are a penetration tester hired by a medium-sized financial company. The company has a network consisting of 50 Windows workstations (Windows 10 Pro) and 5 Windows Server 2019 servers (domain controller, file server, web server, database server, and mail server). The network is segmented into three VLANs: User VLAN (192.168.1.0/24), Server VLAN (192.168.2.0/24), and DMZ (192.168.3.0/24). The web server is in the DMZ and hosts a public-facing e-commerce application built on ASP.NET with a SQL Server backend. The database server is in the Server VLAN and is not directly accessible from the internet. You are given a standard user account on a workstation in the User VLAN. After initial reconnaissance, you discover that the web server is running an outdated version of IIS (7.5) and is vulnerable to a known privilege escalation vulnerability (CVE-2020-0613) that allows local privilege escalation if an attacker has already gained initial access. You also find that the web application has a SQL injection vulnerability in the login page. You successfully exploit the SQL injection to extract the password hash of the web application's service account, which is 'web_svc'. You crack the hash offline and obtain the plaintext password. The 'web_svc' account has local administrative privileges on the web server. Using these credentials, you authenticate to the web server via RDP. From there, you want to pivot to the database server to extract credit card information stored in the database. The database server only allows connections from the web server on port 1433 (SQL Server). Using the 'web_svc' account, you are able to connect to the database server using SQL Server Management Studio. However, you find that the 'web_svc' account has only 'public' and 'guest' database roles, which do not allow reading any sensitive tables. You need to escalate privileges on the database server. What is the most effective next step?

Accepted Answer

Exploit the privilege escalation vulnerability on the web server to gain SYSTEM access, then dump the SQL Server service account credentials (e.g., from the SQL Server error logs or registry) and use them to log into the database server with sysadmin privileges. The web_svc account lacks sufficient database privileges, but by exploiting the privilege escalation vulnerability (CVE-2020-0613) on the web server to gain SYSTEM access, you can extract the SQL Server service account credentials (e.g., from SQL Server error logs or registry). The SQL Server service account typically runs with sysadmin privileges, allowing you to connect to the database server with full administrative rights and access the credit card data.

Answer

Use the web_svc account to create a new SQL Server login with sysadmin privileges via the SQL Server Management Studio

Answer

Perform a brute-force attack against the 'sa' account on the database server using a wordlist

Answer

Try to use the web_svc account to directly query the credit card table using a SQL injection payload on the web application

Question 12

After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?

Accepted Answer

wevtutil cl Security. The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.

Answer

del *.log

Answer

rm -rf /var/log/*

Answer

clear-eventlog -Log Security

Question 13

A penetration tester receives the following output from a tool: 'Starting dnsrecon.py -d example.com -t axfr' and then a list of all DNS records. Which of the following BEST describes what occurred?

Accepted Answer

A successful DNS zone transfer was performed, revealing all DNS records for the domain. The output shows the dnsrecon tool being run with the '-t axfr' option, which specifically requests a DNS zone transfer (AXFR). A zone transfer is a mechanism for replicating DNS databases across DNS servers, and if misconfigured, it allows an attacker to retrieve all DNS records for a domain. The successful listing of all DNS records confirms that the zone transfer was permitted by the target's DNS server, revealing the entire DNS zone.

Answer

A DNSSEC validation check was completed

Answer

A DNS cache snooping attack was executed

Answer

A reverse DNS lookup was performed to find domain names from IP addresses

Question 14

An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:

Accepted Answer

Idle scan. The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.

Answer

SYN flood

Answer

TCP connect scan

Answer

Half-open scan

Question 15

An analyst wants to perform a SYN flood attack test against a server to evaluate its resilience. Which of the following tools would be the MOST appropriate for this task?

Accepted Answer

hping3. hping3 is the most appropriate tool because it is a command-line packet crafting tool that allows the user to generate custom TCP SYN packets with spoofed source IP addresses, making it ideal for simulating a SYN flood attack. Unlike other tools, hping3 can send a high volume of SYN packets without completing the three-way handshake, which is the core mechanism of a SYN flood that exhausts the server's connection queue.

Answer

Nmap

Answer

Shodan

Answer

Wireshark