CEH Practice Test 16 — 15 Questions

Question 1

A penetration tester runs the following command against a target Linux server: smbclient -L 192.168.1.10 -N. The output lists several shares including 'Admin$', 'C$', and 'IPC$'. Which of the following is the MOST likely next step for further enumeration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use enum4linux -a 192.168.1.10 to enumerate users and policies. The `smbclient -L` command with the `-N` flag (null session) successfully lists SMB shares on the target, including administrative shares like `Admin$`, `C$`, and `IPC$`. This indicates that null session authentication is enabled, which is a classic entry point for SMB enumeration. The most logical next step is to use `enum4linux -a` to extract detailed information such as user lists, group policies, and share permissions, leveraging the same null session to deepen the enumeration without yet attempting password attacks.

Answer

Attempt to crack the administrator password using a dictionary attack

Answer

Perform a port scan to check for open ports

Answer

Run snmpwalk to retrieve SNMP community strings

Question 2

A penetration tester uses the following command to scan a target: nmap -sU -sV -p 53,161,162 10.0.0.1. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

UDP scan on three ports with service version detection. The `-sU` flag initiates a UDP scan, `-p 53,161,162` limits the scan to those three specific ports, and `-sV` enables service version detection. This combination performs a UDP scan on only the specified ports and attempts to identify the versions of services running on them.

Answer

Full port scan of all 65535 UDP ports

Answer

Ping sweep and OS detection on the target

Answer

TCP SYN scan on ports 53, 161, 162 with version detection

Question 3

During a penetration test, you run the following command: hping3 -S -p 80 --flood 192.168.1.100. What is the PRIMARY purpose of this command?

Accepted Answer

Execute a denial-of-service (DoS) attack against the target's web server. The command `hping3 -S -p 80 --flood 192.168.1.100` sends a high volume of TCP SYN packets to port 80 of the target without completing the three-way handshake. The `--flood` flag disables packet rate limiting, causing a rapid stream of SYN packets that exhausts the target's connection queue, effectively performing a SYN flood denial-of-service (DoS) attack against the web server.

Answer

Banner grab the HTTP service on port 80

Answer

Fingerprint the operating system of the target

Answer

Perform a TCP connect scan to identify open ports

Question 4

Drag and drop the steps to perform a buffer overflow exploit in a controlled lab environment into the correct order.

Accepted Answer

Identify vulnerability, then find offset, then generate shellcode, then craft exploit, then execute. Identify vulnerability, find offset, generate shellcode, craft exploit, execute.

Answer

Generate shellcode, then identify vulnerability, then find offset, then craft exploit, then execute

Answer

Identify vulnerability, then generate shellcode, then find offset, then craft exploit, then execute

Answer

Find offset, then identify vulnerability, then generate shellcode, then craft exploit, then execute

Question 5

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Accepted Answer

Traceroute. Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Answer

Banner grabbing

Answer

DNS enumeration

Answer

SNMP walk

Question 6

An organization wants to mitigate the impact of a DDoS attack by distributing incoming traffic across multiple servers in different geographic locations. Which technique is BEST suited?

Accepted Answer

Anycast. Anycast routing allows the same IP address to be advertised from multiple geographically dispersed servers. When a DDoS attack occurs, traffic is naturally distributed to the nearest or least congested anycast node, effectively absorbing and dispersing the attack load across the global infrastructure. This technique is specifically designed to mitigate volumetric DDoS attacks by leveraging BGP to route traffic to the closest available server, preventing any single server from being overwhelmed.

Answer

Scrubbing center

Answer

Rate limiting

Answer

Load balancing

Question 7

During a security assessment, a tester runs hping3 with the command: hping3 -S -p 80 -c 5 10.0.0.1. The response shows that packets with the SYN flag set receive SYN-ACK replies. Which of the following conclusions is MOST accurate?

Accepted Answer

Port 80 is open on 10.0.0.1. The hping3 command with the -S flag sends TCP SYN packets to port 80 on 10.0.0.1. Receiving SYN-ACK replies indicates that the target responded with the second step of the TCP three-way handshake, which only occurs when the port is open and listening. This confirms that port 80 is open on the target host.

Answer

A firewall is blocking the scan

Answer

Port 80 is closed on 10.0.0.1

Answer

The target is using a stateful firewall that allows the connection

Question 8

An attacker uses SMTP commands to verify the existence of email accounts on a mail server. Which sequence of SMTP commands is used for this purpose?

Accepted Answer

VRFY, EXPN, RCPT TO. The VRFY command asks the mail server to verify whether a given email address exists, EXPN expands a mailing list to reveal individual addresses, and RCPT TO (used in the SMTP transaction) can also be used to check address validity by observing the server's response. Together, these commands allow an attacker to enumerate valid email accounts on the server.

Answer

EHLO, AUTH, STARTTLS

Answer

HELO, MAIL FROM, RCPT TO, DATA

Answer

NOOP, QUIT, RSET

Question 9

A security team observes that a switch's MAC address table is full, and the switch has started flooding unicast traffic to all ports. Which attack has MOST likely been performed?

Accepted Answer

MAC flooding. MAC flooding attacks exploit the limited size of a switch's CAM (Content Addressable Memory) table. By sending thousands of frames with random source MAC addresses, the attacker fills the table to capacity. Once full, the switch enters a fail-open state and begins flooding all unknown unicast traffic out every port, effectively turning it into a hub and allowing the attacker to capture traffic not destined for them.

Answer

ARP poisoning

Answer

MAC spoofing

Answer

DHCP starvation

Question 10

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a dedicated, open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. It supports a wide range of database management systems (e.g., MySQL, Oracle, PostgreSQL) and injection techniques (e.g., boolean-based blind, time-based blind, UNION query, stacked queries), making it the standard choice for this specific task.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 11

During a social engineering engagement, a tester calls the help desk posing as an employee from the IT department. The tester claims to be working on a critical system update and needs the employee's password to proceed. Which type of social engineering attack is being executed?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into divulging information. In this case, the tester falsely claims to be from the IT department working on a critical system update, which is a classic pretext to gain trust and obtain the employee's password. This differs from other social engineering types because it relies on a constructed identity and false narrative rather than a technical lure or direct exchange.

Answer

Quid pro quo

Answer

Baiting

Answer

Phishing

Question 12

Which of the following is the BEST defense against a TCP SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies are the best defense against TCP SYN flood attacks because they allow the server to avoid allocating resources for half-open connections until the handshake is completed. When a SYN cookie is used, the server encodes connection state information into the initial sequence number (ISN) sent in the SYN-ACK, and only commits memory upon receiving a valid ACK from the client. This prevents the exhaustion of the SYN backlog queue, which is the primary target of a SYN flood.

Answer

Ingress filtering

Answer

Intrusion detection system

Answer

Rate limiting

Question 13

An attacker has gained access to a Windows server and wants to crack the password hashes extracted from the SAM file. The attacker knows the passwords are complex but wants to maximize speed. Which tool is BEST suited for high-speed password cracking using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct answer because it is specifically designed for high-speed password cracking using GPU acceleration, leveraging OpenCL or CUDA to offload computation to the GPU. This allows it to achieve millions of hashes per second, making it ideal for cracking complex passwords from SAM hashes (NTLM) when speed is the priority.

Answer

Ophcrack

Answer

RainbowCrack

Answer

John the Ripper

Question 14

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

Accepted Answer

The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist. The SMTP response code 252 for VRFY root typically indicates that the user exists but is disabled or cannot receive mail at this time (the server knows the user but restricts verification). A 250 response for EXPN admin confirms that the admin mailing list exists. The 550 response for RCPT TO:unknown@domain.com definitively indicates that the recipient does not exist on the server. Therefore, option A correctly interprets these responses: root exists but is disabled, the admin list exists, and the unknown user does not exist.

Answer

The server has open relay enabled

Answer

The server is vulnerable to SMTP injection

Answer

The server is not running SMTP

Question 15

A penetration tester uses the tool 'ScoutSuite' against an AWS target. Which of the following BEST describes the purpose of this tool?

Accepted Answer

Audit cloud infrastructure for misconfigurations and compliance. ScoutSuite is an open-source multi-cloud security auditing tool that assesses cloud environments (AWS, Azure, GCP) by scanning for misconfigurations and compliance violations. It does not perform exploitation or penetration testing; instead, it checks for issues like overly permissive security groups, unencrypted S3 buckets, or unused IAM roles, aligning with option D's description of auditing cloud infrastructure for misconfigurations and compliance.

Answer

Enumerate IAM users and roles for privilege escalation

Answer

Perform automated penetration testing of web applications

Answer

Exploit vulnerabilities in cloud services