CEH Practice Test 17 — 15 Questions

Question 1

A penetration tester has obtained a copy of the SAM database from a Windows system. The hashes extracted include both LM and NTLM hashes. Which of the following tools would be MOST efficient to crack the NTLM hashes using a dictionary attack with GPU acceleration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hashcat. Hashcat is the most efficient tool for GPU-accelerated dictionary attacks against NTLM hashes because it is purpose-built for high-speed password cracking using OpenCL and CUDA, directly leveraging GPU parallelism. It supports the NTLM hash mode (1000) and can process millions of hashes per second, far outperforming CPU-based tools like John the Ripper for this specific task.

Answer

John the Ripper

Answer

Ophcrack

Answer

RainbowCrack

Question 2

A security analyst runs the following command: 'python macof -i eth0 -n 1000'. Shortly after, the switch begins flooding traffic to all ports. What is the analyst trying to achieve?

Accepted Answer

MAC flooding to force the switch into hub mode for sniffing. The command 'python macof -i eth0 -n 1000' runs the macof tool, which generates a large number of frames with random source MAC addresses. This is a classic MAC flooding attack designed to overflow the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch can no longer learn new MAC addresses and falls back to flooding all incoming frames out of every port, effectively behaving like a hub, which allows the attacker to sniff traffic that would normally be isolated.

Answer

DHCP starvation to exhaust IP addresses

Answer

STP manipulation to cause network loops

Answer

ARP cache poisoning to redirect traffic

Question 3

Which of the following tools is commonly used for dynamic malware analysis by executing the malware in an isolated environment and monitoring system changes?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files in an isolated, virtualized environment (e.g., VirtualBox, KVM) and monitors system changes such as file system modifications, registry changes, network connections, and process behavior in real time, providing a detailed report of the malware's runtime activities.

Answer

Strings

Answer

PEiD

Answer

VirusTotal

Question 4

After compromising a system, an attacker wants to erase their tracks. They clear the Windows Event Logs using `wevtutil cl` commands. However, the logs are forwarded to a remote SIEM. Which covering tracks technique would be MOST effective to avoid detection?

Accepted Answer

Modify specific event log entries to remove evidence of their actions. Modifying specific event log entries directly removes the incriminating evidence without disrupting the logging pipeline. Since logs are forwarded to a remote SIEM, simply clearing or disabling local logs would trigger an alert due to a gap in log forwarding. By surgically editing only the relevant entries (e.g., using PowerShell or API calls to alter Event Log records), the attacker avoids detection while the SIEM continues to receive logs, maintaining the appearance of normal operation.

Answer

Disable Windows Event Log service (EventLog)

Answer

Use a rootkit to hide files and processes

Answer

Encrypt the log files

Question 5

A forensic analyst discovers that an attacker used a rootkit to hide malicious processes and files on a compromised Linux system. The rootkit also intercepts system calls to `open()` and `stat()` to return clean results. Which of the following techniques is the rootkit using to cover its tracks?

Accepted Answer

Syscall hooking to modify the return values of userland commands. The rootkit intercepts system calls like `open()` and `stat()` to return clean results, which is a classic example of syscall hooking. By hooking these kernel-level functions, the rootkit can filter out any information about its own malicious files and processes, making them invisible to userland commands such as `ls`, `ps`, or `cat`. This technique operates at the kernel level, not in user space, allowing it to control what data is returned to any process that makes those syscalls.

Answer

Steganography to conceal malicious files in image metadata

Answer

Token impersonation to gain administrator privileges

Answer

Log manipulation by clearing entries in /var/log

Question 6

A security analyst observes a sudden flood of ICMP echo request packets from multiple external IPs to a single internal server. The packets have varying sizes and spoofed source addresses. Which type of attack is MOST likely occurring?

Accepted Answer

ICMP flood. An ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request (ping) packets, often with spoofed source addresses and varying packet sizes, to consume bandwidth and processing resources. The description matches this exactly: multiple external IPs sending a flood of ICMP echo requests to a single server, which is the classic behavior of a distributed ICMP flood.

Answer

Ping of Death

Answer

Smurf attack

Answer

SYN flood

Question 7

During a penetration test, you run the command `enum4linux -a 192.168.1.10` and receive output containing user account names, group memberships, and share listings. Which protocol is primarily being enumerated?

Accepted Answer

SMB. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via the SMB (Server Message Block) protocol. The command `enum4linux -a 192.168.1.10` performs a comprehensive scan that retrieves user accounts, group memberships, and share listings, all of which are exposed through SMB's named pipe and RPC mechanisms. SMB is the correct protocol because it is the primary means for file and printer sharing in Windows networks, and enum4linux leverages SMB's IPC$ share and SAMR/LSA RPC services to extract this data.

Answer

NFS

Answer

SNMP

Answer

SMTP

Question 8

A security analyst notices unusual traffic from a smart thermostat to an external IP address. The thermostat is on a separate IoT VLAN. Which action should the analyst take to investigate and mitigate the threat?

Accepted Answer

Create a firewall rule to block traffic from the thermostat's MAC address to the external IP.. Creating a firewall rule to block traffic from the thermostat's MAC address to the specific external IP is a targeted, least-disruptive mitigation. It preserves the IoT VLAN's functionality for other devices while stopping the suspicious communication. This approach allows the analyst to investigate further without losing visibility into the threat, as the thermostat remains on the network for forensic analysis.

Answer

Disconnect the thermostat from the network.

Answer

Block all outbound traffic from the IoT VLAN.

Answer

Uninstall the companion app from the user's smartphone.

Question 9

Which of the following tools is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 10

You are a penetration tester for a financial institution. During the reconnaissance phase, you discover that the target network uses a firewall that only allows inbound TCP connections on ports 80, 443, and 8080. You need to identify live hosts and running services on the internal network (192.168.1.0/24) from an external perspective. To avoid detection, you must minimize the number of packets sent and ensure that your scanning technique does not complete the TCP three-way handshake. Additionally, you have limited time and need to scan all 65535 ports on the most promising target. Based on the firewall rules and the need for stealth, which of the following approaches should you take?

Accepted Answer

First, perform a TCP SYN scan (-sS) on the three allowed ports across the subnet. Once a live host is identified, perform a TCP SYN scan (-sS) on all 65535 ports of that host.. A TCP SYN scan (-sS) sends only a SYN packet and does not complete the three-way handshake, making it stealthy. First scanning only the three allowed ports (80, 443, 8080) across the subnet minimizes packets and identifies live hosts. Once a promising target is found, a full SYN scan on all 65535 ports efficiently maps services while evading the firewall's restrictions.

Answer

Perform a TCP connect scan (-sT) on all ports of the subnet to identify open ports and services.

Answer

Perform an Xmas scan (-sX) on all ports of the subnet to evade detection by sending packets with invalid flag combinations.

Answer

Perform a UDP scan (-sU) on all ports of the subnet because UDP is connectionless and less likely to be logged.

Question 11

During a penetration test, you execute `theHarvester -d example.com -b google,linkedin`. What type of data is this tool primarily designed to collect?

Accepted Answer

Email addresses, subdomains, and employee names from public sources. TheHarvester is an open-source intelligence (OSINT) tool designed to gather publicly available information from search engines, PGP key servers, and social platforms. The command `-d example.com -b google,linkedin` instructs it to scrape Google and LinkedIn for email addresses, subdomains, and employee names associated with the target domain, which are classic footprinting data used in reconnaissance.

Answer

Password hashes and user credentials from compromised databases

Answer

DNS zone transfer information and TXT records

Answer

Vulnerability scan results from Nessus and OpenVAS

Question 12

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP by sending a large number of ICMP Echo Request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All devices on that network then respond with ICMP Echo Reply packets to the victim, overwhelming it. The scenario describes varied source IPs (the responding devices) and a single destination IP (the victim), which is the hallmark of a Smurf attack.

Answer

UDP flood

Answer

Ping of Death

Answer

ICMP flood

Question 13

A SOC analyst observes a high number of incomplete TCP connections with the SYN flag set but no corresponding ACK from the target. The source IPs are spoofed and the connections are targeting port 80 on a web server. Which DDoS mitigation technique would be MOST effective in this scenario?

Accepted Answer

SYN cookies. SYN cookies are the most effective mitigation against SYN flood attacks because they allow the server to avoid allocating resources for half-open connections until the handshake is completed. When the SYN queue is full, the server generates a cookie based on the connection parameters and sends it in the SYN-ACK; only when the client returns a valid ACK with the cookie does the server establish the connection. This technique prevents resource exhaustion from spoofed SYN packets targeting port 80.

Answer

Rate limiting

Answer

Anycast distribution

Answer

Ingress filtering

Question 14

A security analyst suspects an attacker has replaced system binaries with a rootkit to hide malicious processes. Which covering tracks technique is the attacker using?

Accepted Answer

Rootkit installation. The attacker is using rootkit installation to replace system binaries (e.g., ps, ls, netstat) with trojaned versions that filter out malicious processes from system calls like readdir() or /proc listings. This is a classic covering tracks technique because the rootkit hides evidence of compromise by intercepting and modifying kernel or user-space output, making the attacker's activities invisible to standard monitoring tools.

Answer

Timestomping

Answer

Steganography

Answer

Log manipulation

Question 15

A security analyst wants to enumerate users and groups from a Windows domain controller using LDAP. Which of the following queries would return all objects of class 'user' from the domain 'example.com'?

Accepted Answer

ldapsearch -x -b "dc=example,dc=com" "(objectClass=user)". The LDAP filter (objectClass=user) specifically retrieves all entries where the objectClass attribute equals 'user', which in Active Directory corresponds to user objects. Option A is incorrect because it searches for any object with a common name, not limiting to users. Option C is incorrect because objectClass=person includes contact objects as well. Option D is incorrect because it adds the condition objectCategory=person, which is a Microsoft-specific attribute and is redundant; it does not improve the query and may cause compatibility issues in standard LDAP environments.

Answer

ldapsearch -x -b "dc=example,dc=com" "(cn=*)"

Answer

ldapsearch -x -b "dc=example,dc=com" "(objectClass=person)"

Answer

ldapsearch -x -b "dc=example,dc=com" "(&(objectClass=user)(objectCategory=person))"