CEH Practice Test 17 — 15 Questions

Question 1

An employee receives an email that appears to be from the CEO, requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ceo@cornpany.com instead of ceo@company.com). This is an example of which type of attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or organization, using personalized information to increase credibility. In this scenario, the attacker spoofs the CEO's identity and uses a misspelled domain (typosquatting) to trick the employee into performing a wire transfer, which is a classic spear phishing technique. Unlike generic phishing, spear phishing tailors the message to the victim's role and context, making it more effective.

Answer

Whaling

Answer

Phishing

Answer

Pretexting

Question 2

A security analyst reviews logs and notices that an attacker crafted a packet with a source IP address matching the target's IP address, and sent it to a network's broadcast address. Which type of attack does this describe?

Accepted Answer

Smurf attack. The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets. The attacker spoofs the source IP address to be the target's IP and sends these packets to a network's broadcast address. All hosts on that network then reply to the target, overwhelming it with ICMP echo replies.

Answer

UDP flood

Answer

Ping of Death

Answer

SYN flood

Question 3

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Erasing tracks, Hiding files) methodology specifically involves concealing malicious files from the OS and security tools. Techniques like NTFS alternate data streams (ADS) allow data to be stored in a file's metadata stream (e.g., type echo payload > file.txt:stream) without affecting the visible file size, while steganography hides data within images or audio files. This phase occurs after gaining access and before covering tracks.

Answer

Privilege escalation

Answer

Erasing tracks

Answer

Cracking passwords

Question 4

A security team wants to mitigate a DNS amplification DDoS attack. Which of the following techniques would be MOST effective in preventing the attack from leveraging open DNS resolvers?

Accepted Answer

Disable recursion on DNS servers for external queries. Disabling recursion on DNS servers for external queries prevents them from acting as open resolvers. In a DNS amplification attack, the attacker sends a small query with a spoofed source IP to an open resolver, which then sends a large response to the victim. By blocking recursion for external clients, the server will only answer for domains it authoritatively hosts, thus eliminating the amplification vector.

Answer

Deploy a web application firewall

Answer

Use anycast routing for DNS servers

Answer

Implement rate limiting on DNS responses

Question 5

A penetration tester wants to perform a stealthy TCP scan that does not complete the three-way handshake. Which Nmap flag should be used?

Accepted Answer

-sS. (-sS) is correct because it performs a SYN scan, which sends a TCP SYN packet and waits for a SYN-ACK response without completing the three-way handshake (i.e., it sends a RST instead of an ACK). This makes the scan stealthy as it avoids establishing a full TCP connection, reducing the chance of being logged by the target.

Answer

-sU

Answer

-sV

Answer

-sT

Question 6

A penetration tester runs the following Nmap command: nmap -sU -sS -p 53,161,162,500 10.0.0.1 and receives no responses for UDP scans but standard results for TCP. The tester suspects the target is dropping all UDP packets. Which Nmap option could help increase the likelihood of UDP responses by fragmenting the probe?

Accepted Answer

-f. The -f option fragments the probe packets into smaller IP fragments. When a target drops unfragmented UDP packets, fragmenting the probes can sometimes bypass simple packet filters or IDS/IPS that drop larger or complete UDP datagrams, increasing the chance that the target will process and respond to the fragments.

Answer

-T4

Answer

--reason

Answer

-Pn

Question 7

During a penetration test, you run the command: 'macof -i eth0 -s 192.168.1.1 -d 192.168.2.1 -e 00:11:22:33:44:55'. What is the intended effect of this command?

Accepted Answer

Perform MAC flooding to cause switch to fail open. The `macof` tool generates a flood of random MAC addresses on the specified interface, overwhelming the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch fails open and begins flooding all frames out all ports, effectively turning it into a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

Execute a SYN flood against the target

Answer

Perform ARP poisoning

Answer

Spoof DNS responses

Question 8

A security auditor is assessing the physical security of a corporate office building that houses a data center. The building has a single main entrance with a reception desk staffed during business hours (8 AM to 6 PM). After hours, employees use a keycard reader to access the building. The data center itself requires a separate keycard and a 6-digit PIN. The auditor notices that during lunch hours (12-1 PM), the reception desk is often unattended, and employees frequently hold the door for others to avoid using their keycard. Additionally, a recent social engineering test revealed that an attacker was able to call the help desk, claim to be a new employee, and request a password reset, which was granted without proper verification. Based on this scenario, which of the following is the MOST effective combination of controls to mitigate both the physical and social engineering weaknesses?

Accepted Answer

Install a mantrap at the main entrance and require multi-factor authentication (MFA) for all password reset requests.. It addresses both weaknesses: a mantrap prevents tailgating at the main entrance (physical security), and requiring MFA for password reset requests mitigates the social engineering attack by adding an authentication factor beyond just a phone call. This combination directly counters the observed vulnerabilities—unattended reception and weak identity verification—without over-engineering or leaving gaps.

Answer

Install a mantrap at the main entrance and require two-factor authentication for the data center door.

Answer

Deploy security guards at the entrance 24/7 and implement a policy that all visitors must be escorted.

Answer

Implement a callback verification process for all password reset requests and require a manager approval.

Question 9

A penetration tester needs to perform ARP poisoning to intercept traffic between two hosts on the same subnet. Which tool would be the most appropriate choice for this task?

Accepted Answer

Ettercap. Ettercap is the most appropriate tool for ARP poisoning because it is specifically designed for man-in-the-middle (MITM) attacks on a local area network (LAN). It automates ARP spoofing by sending forged ARP replies to both target hosts, poisoning their ARP caches so that traffic intended for the other host is redirected through the attacker's machine, enabling interception and modification of packets.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 10

A penetration tester finds that a Linux binary has the SUID bit set and is owned by root. Which of the following does this indicate?

Accepted Answer

The binary will run with root privileges when executed by any user. When the SUID (Set User ID) bit is set on a binary owned by root, the binary executes with the effective user ID of the file owner (root), regardless of which user runs it. This allows any user to run the binary with root privileges, which is why option D is correct. The SUID bit is represented by an 's' in the owner's execute position (e.g., -rwsr-xr-x).

Answer

The binary is immutable and cannot be deleted

Answer

The binary can be executed only by the root user

Answer

The binary is a symbolic link to a root-owned file

Question 11

A penetration tester runs the following command against a Linux server: `smbclient -L //192.168.1.10 -N`. The output lists shares including 'IPC$', 'ADMIN$', and 'data'. Which of the following is the BEST next step to enumerate the 'data' share?

Accepted Answer

Use `smbclient //192.168.1.10/data -N` to attempt a null session connection. The command `smbclient -L //192.168.1.10 -N` performs a null session (no password) listing of SMB shares. The output shows that the 'data' share exists and is accessible without authentication (since the -N flag succeeded). The best next step is to attempt a null session connection to that specific share using `smbclient //192.168.1.10/data -N`, which will mount the share and allow file enumeration. This directly leverages the null session already confirmed by the initial scan.

Answer

Run `nmap --script smb-enum-shares -p 445 192.168.1.10`

Answer

Run `enum4linux -a 192.168.1.10` to gather more information

Answer

Use `rpcclient -U '' 192.168.1.10` to enumerate users

Question 12

A security analyst captures the following SMTP conversation: 220 mail.example.com ESMTP;  HELO client; 250 Hello;  VRFY root; 250 Super-User;  VRFY admin; 252 Cannot VRFY user;  VRFY user1; 550 User unknown. Which attack is the analyst performing?

Accepted Answer

SMTP user enumeration via VRFY. The analyst is using the SMTP VRFY command to check if specific usernames (root, admin, user1) exist on the mail server. The responses '250 Super-User' and '252 Cannot VRFY user' confirm valid usernames, while '550 User unknown' indicates an invalid one. This is a classic SMTP user enumeration technique, often used in the reconnaissance phase to gather valid account names for further attacks like password guessing or phishing.

Answer

SMTP header injection

Answer

SMTP open relay testing

Answer

SMTP DDoS attack

Question 13

A cloud security engineer wants to ensure that only authorized users can access an S3 bucket containing sensitive data. Which AWS service should be used to enforce fine-grained access control?

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS CloudFront

Question 14

During an internal penetration test, you run 'smbclient -L //192.168.1.100 -N' and get an empty response. Which of the following is the MOST likely reason?

Accepted Answer

Null sessions are disabled on the target. The `-N` flag in smbclient suppresses password prompts, attempting a null session. An empty response (no error, no output) typically indicates the SMB service is running but null sessions are explicitly disabled, often via the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous` set to 1 or 2. This prevents anonymous enumeration of shares and users, which is a common security hardening measure on Windows systems.

Answer

The target is not running SMB

Answer

The target requires NTLM authentication

Answer

The target is a Linux server

Question 15

After a security incident, an analyst retrieves a suspicious file. The analyst runs the 'strings' command on it and sees references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique does this indicate?

Accepted Answer

Process injection. The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the output of the 'strings' command is a strong indicator of process injection. These Windows API functions are commonly used together to allocate memory in a target process (VirtualAllocEx), write malicious code into that memory (WriteProcessMemory), and then execute it in the context of the remote process (CreateRemoteThread). This technique allows an attacker to run arbitrary code within a legitimate process, bypassing security controls.

Answer

DLL hijacking

Answer

Privilege escalation

Answer

Buffer overflow