CEH Practice Test 16 — 15 Questions

Question 1

During a penetration test, you successfully gain access to a web server with a low-privileged shell. You want to escalate privileges to root. Which of the following techniques is MOST likely to achieve privilege escalation on a misconfigured Linux system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Search for and exploit a SUID binary that allows privilege escalation. SUID (Set User ID) binaries execute with the privileges of the file owner, typically root. On a misconfigured Linux system, a low-privileged user can run a SUID-root binary (e.g., `find`, `vim`, `nmap`) to spawn a shell with root privileges, directly achieving privilege escalation without needing credentials or additional exploits.

Answer

Use the `netcat` tool to establish a reverse shell back to the attacker

Answer

Use a password cracking tool like John the Ripper on the system's shadow file

Answer

Perform a brute force attack on the root password

Question 2

An attacker uses the Social Engineering Toolkit (SET) to craft a phishing email that appears to come from the company's CEO, requesting the recipient to urgently wire funds to a new vendor. This attack is BEST described as which type of social engineering?

Accepted Answer

Whaling. Whaling is a targeted phishing attack aimed at high-profile individuals like the CEO or CFO. In this scenario, the attacker uses SET to impersonate the CEO and requests an urgent wire transfer, which is a classic whaling tactic because it targets a senior executive (the recipient) with a business-critical request. The attack is not generic phishing but specifically targets a 'big fish' within the organization.

Answer

Pretexting

Answer

Spear phishing

Answer

Quid pro quo

Question 3

An attacker has obtained password hashes from a Windows system. They plan to use rainbow tables to crack them. Which tool would be most appropriate for generating and using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is the tool specifically designed for generating and using rainbow tables, which are precomputed hash chains used to reverse cryptographic hash functions. The question explicitly asks for the tool most appropriate for generating and using rainbow tables, and RainbowCrack directly supports both creating rainbow tables (with rtgen) and performing lookups (with rcsort and rcrack).

Answer

Hashcat

Answer

Ophcrack

Answer

John the Ripper

Question 4

A penetration tester uses the following Google dork: site:example.com filetype:pdf inurl:confidential. What is the MOST likely goal of this search?

Accepted Answer

Find PDF files on example.com that have 'confidential' in their filename or path. The Google dork `site:example.com filetype:pdf inurl:confidential` combines the `site` operator to restrict results to example.com, `filetype:pdf` to filter for PDF files, and `inurl:confidential` to require that the URL or path contains the word 'confidential'. This targets PDF files whose filename or directory path includes 'confidential', making option C correct. The `inurl` operator matches the URL string, not the file content, so it does not search within the PDF text.

Answer

Retrieve all PDF files from example.com regardless of content

Answer

Identify all web pages on example.com that link to PDF files

Answer

Discover PDF files that contain the word 'confidential' on example.com

Question 5

A security analyst receives an alert from the IDS indicating a port scan originating from IP 10.0.0.5. Upon investigation, the analyst finds that 10.0.0.5 is a legitimate internal server. Which type of scan is the attacker likely using to evade detection?

Accepted Answer

Decoy scan. A decoy scan (option C) is the correct answer because it allows the attacker to blend their real IP address with multiple spoofed IP addresses, making it appear as though the scan originates from several hosts. In this scenario, the IDS alerts on IP 10.0.0.5, which is a legitimate internal server, indicating that the attacker is using that server's IP as a decoy to evade detection and misdirect the analyst's investigation.

Answer

SYN scan

Answer

Idle scan

Answer

Fragmentation scan

Question 6

A penetration tester is conducting a vulnerability scan against a target network. Which of the following tools is BEST suited for this task?

Accepted Answer

Nessus. Nessus is a dedicated vulnerability scanner that automates the process of identifying known vulnerabilities, misconfigurations, and missing patches across a target network. It uses a large plugin database (e.g., NASL scripts) to perform non-intrusive checks against services and operating systems, making it the best tool for a vulnerability scan. Unlike general-purpose tools, Nessus is specifically designed to correlate scan results with CVE entries and provide risk ratings, which is the core requirement of a vulnerability assessment.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 7

A penetration tester observes that an Nmap SYN scan shows all 1000 TCP ports as open. The tester suspects the target is using a security appliance that responds with SYN-ACK to all connection attempts, regardless of the actual port state. Which type of Nmap scan would be MOST effective in determining the true state of the ports?

Accepted Answer

TCP connect scan (-sT). A TCP connect scan (-sT) completes the full three-way handshake, which forces the target to respond with a RST if the port is actually closed, even if a security appliance initially sends SYN-ACK to all ports. This distinguishes between ports that are truly open (where the handshake completes) and those that are falsely reported as open by the appliance (where the handshake fails or a RST is received).

Answer

UDP scan (-sU)

Answer

Ping sweep (-sn)

Answer

Idle scan (-sI)

Question 8

Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?

Accepted Answer

Tailgating. The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 9

After gaining initial access to a Linux server, a penetration tester wants to maintain persistence by creating a backdoor. The tester decides to replace a common system binary with a trojanized version. Which of the following techniques is MOST likely to evade detection by file integrity monitoring (FIM) systems?

Accepted Answer

Use a kernel-level rootkit that intercepts read operations to present the original binary's content. A kernel-level rootkit can intercept system calls (e.g., open, read) used by FIM tools to verify file integrity. When the FIM queries the trojanized binary, the rootkit returns the original, unmodified content, so the hash or checksum matches the baseline. This subverts detection at the kernel layer, bypassing user-space integrity checks entirely.

Answer

Replace the binary with a modified version that has the same file size and timestamp

Answer

Place the backdoor in a directory that is excluded from FIM monitoring

Answer

Use steganography to hide the backdoor inside an image file

Question 10

A penetration tester wants to perform a stealth scan without completing the TCP three-way handshake. The target is a web server on port 80. The tester uses Nmap with the -sS flag. What is the expected behavior if the port is open?

Accepted Answer

The tester receives a SYN/ACK and sends an RST to tear down the connection.. The -sS flag in Nmap performs a SYN stealth scan, which sends a SYN packet to the target port. If the port is open, the target responds with a SYN/ACK, and the tester's operating system kernel automatically sends an RST to tear down the connection before the three-way handshake completes. This avoids establishing a full TCP connection, making the scan less detectable by some intrusion detection systems.

Answer

The tester receives an RST, indicating the port is closed.

Answer

The tester receives no response, indicating a filtered port.

Answer

The tester receives a SYN/ACK and sends an ACK to establish the connection.

Question 11

A security analyst notices that their Nmap scan results show all ports as 'filtered' despite the target host being alive and responsive to ping. Which of the following is the MOST likely cause?

Accepted Answer

The target has a host-based firewall that drops all incoming traffic silently. When an Nmap scan shows all ports as 'filtered', it indicates that the target is reachable (since ping succeeds) but the probe packets (e.g., SYN, ACK) are being dropped without any response. A host-based firewall configured to silently drop all incoming traffic is the most likely cause, as it prevents Nmap from receiving RST or SYN/ACK replies, leading to the 'filtered' state for every port.

Answer

The analyst's machine has a misconfigured routing table

Answer

The target is running a honeypot that mimics multiple services

Answer

The target is an idle host that does not respond to any traffic

Question 12

A security analyst notices repeated TCP SYN packets sent to a server without corresponding SYN-ACK replies. The source IP addresses are spoofed and appear to be random. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses to a target server. The server responds with SYN-ACK packets to the spoofed addresses, which never complete the handshake, causing the server to exhaust its memory and CPU resources by maintaining half-open connections. This matches the described behavior of repeated SYN packets without corresponding SYN-ACK replies.

Answer

UDP flood

Answer

ICMP flood

Answer

Ping of Death

Question 13

A security analyst observes the following Nmap output for a target host: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https. The analyst then runs a version detection scan and notices that port 80 reports 'Apache httpd 2.4.41' but port 443 reports 'Apache httpd 2.4.41' as well. What is the MOST likely conclusion?

Accepted Answer

The target is likely running a single web server that handles both HTTP and HTTPS traffic. When both port 80 (HTTP) and port 443 (HTTPS) report the same Apache httpd version (2.4.41), it strongly indicates that the same web server process is listening on both ports. Apache httpd can be configured to handle both plain HTTP and TLS-encrypted HTTPS traffic simultaneously, typically using separate VirtualHost directives or a single configuration that binds to both ports. The identical version string makes it unlikely that two separate web server instances are running, as they would often differ in patch level or configuration.

Answer

The target is running two separate web servers on different ports

Answer

The target is running a reverse proxy that forwards traffic to different backends

Answer

The version detection is incorrect due to false positives

Question 14

During a penetration test, you execute the command `enum4linux -a 192.168.1.20`. The output reveals that the 'backup' account has a blank password and belongs to the 'Domain Admins' group. Which phase of the CHPSET methodology does identifying this vulnerability belong to?

Accepted Answer

Cracking passwords. The command `enum4linux -a` enumerates SMB shares, users, and password policies from a Windows target. Discovering that the 'backup' account has a blank password directly identifies a weak or missing credential, which falls under the 'Cracking passwords' phase of the CHPSET methodology. This phase involves identifying and exploiting weak, default, or blank passwords to gain unauthorized access.

Answer

Privilege escalation

Answer

Spying

Answer

Executing applications

Question 15

Which type of malware spreads by replicating itself across a network without requiring a host file to attach to?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself across a network without needing a host file, exploiting vulnerabilities or using network protocols like SMB, RDP, or email to spread autonomously. Unlike viruses, worms do not attach to a host program; they self-propagate via network connections, often consuming bandwidth and system resources.

Answer

Trojan

Answer

Ransomware

Answer

Virus