CEH Practice Test 18 — 15 Questions

Question 1

During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.

Answer

The DNS server is not running

Answer

The zone transfer requires TCP port 443

Answer

The domain does not exist

Question 2

Which of the following tools is specifically designed to search the internet for exposed devices and services, such as industrial control systems and webcams, using banners and metadata?

Accepted Answer

Shodan. Shodan is a search engine specifically designed to scan the internet for exposed devices and services by collecting banners and metadata from protocols such as HTTP, SSH, FTP, and SNMP. Unlike general-purpose search engines, Shodan indexes device-specific information, making it ideal for discovering industrial control systems (ICS), webcams, and other IoT devices that respond to network probes.

Answer

Maltego

Answer

Nmap

Answer

Google

Question 3

An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?

Accepted Answer

Implement DNSSEC. DNSSEC (Domain Name System Security Extensions) is the most effective measure against DNS spoofing because it cryptographically signs DNS data using public-key cryptography, allowing resolvers to verify the authenticity and integrity of responses. This prevents an attacker from injecting forged DNS records into the cache, as any tampered response would fail signature validation per RFC 4033–4035.

Answer

Use IPsec

Answer

Use a firewall

Answer

Disable DNS recursion

Question 4

During a vulnerability scan using Nessus, a security analyst discovers that the target host shows a 'High' severity vulnerability for 'SSL/TLS Renegotiation DoS'. What does this vulnerability indicate?

Accepted Answer

An attacker can force the server to renegotiate TLS handshakes repeatedly, causing resource exhaustion. The SSL/TLS Renegotiation DoS vulnerability (CVE-2011-1473) occurs when a server supports TLS renegotiation without proper rate limiting. An attacker can open multiple connections and repeatedly request renegotiation, causing the server to consume excessive CPU resources for cryptographic handshake calculations, effectively leading to a denial of service. Nessus flags this as 'High' severity because it can exhaust server resources even with a single attacker.

Answer

The server does not validate SSL certificates

Answer

The server supports SSLv2

Answer

The server allows weak cipher suites

Question 5

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

Accepted Answer

LoRaWAN. LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.

Answer

4G LTE

Answer

Wi-Fi 6

Answer

Bluetooth 5

Question 6

A security analyst uses the nbtstat -a command against a target IP address. What information is the analyst MOST likely attempting to retrieve?

Accepted Answer

NetBIOS name table of the remote machine. The nbtstat -a command is used to query the NetBIOS name table of a remote machine by its IP address. This table contains the NetBIOS names registered by the remote host, such as the computer name, workgroup/domain, and any services running over NetBIOS (e.g., file sharing). The analyst is most likely attempting to enumerate these names for reconnaissance or to identify potential targets for further exploitation.

Answer

Active directory domain controllers

Answer

List of all open TCP ports

Answer

The MAC address of the target

Question 7

A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?

Accepted Answer

Using a gelatin mold of an authorized user's fingerprint. Gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.

Answer

Shoulder surfing the authorized user's fingerprint pattern

Answer

Picking the lock on the server room door

Answer

Tailgating behind an authorized employee

Question 8

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

Use vim's shell escape via `:!bash` to get a root shell. The `sudo -l` output shows that the user can run `/usr/bin/vim` as root without a password. Vim has a built-in shell escape feature: from within vim, typing `:!bash` (or `:!sh`) executes a shell with the privileges of the user running vim. Since vim is run via sudo as root, the spawned shell will be a root shell, directly escalating privileges without needing additional exploits.

Answer

Perform token impersonation using SeImpersonatePrivilege

Answer

Exploit a kernel vulnerability (CVE-2023-xxxx)

Answer

Abuse the SUID bit on vim

Question 9

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. When a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 10

A penetration tester uses the following command to extract the contents of a SAM file: 'samdump2 SYSTEM /mnt/windows/Windows/System32/config/SAM'. What is the primary purpose of this action?

Accepted Answer

To capture NTLM hashes for offline cracking. The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.

Answer

To escalate privileges on the system

Answer

To enumerate users via LDAP

Answer

To perform a pass-the-hash attack

Question 11

A security analyst receives an alert indicating that a workstation is sending outbound connections to a known malicious IP address. The analyst suspects a Trojan. Which tool is BEST for performing dynamic analysis of the suspicious binary?

Accepted Answer

Sandbox. Dynamic analysis involves executing the suspicious binary in a controlled environment to observe its runtime behavior, such as outbound connections, registry changes, and file system modifications. A sandbox provides an isolated environment specifically designed for this purpose, allowing the analyst to safely monitor the Trojan's actions without risking the production network. This makes it the best choice for analyzing the workstation's outbound connections to a known malicious IP address.

Answer

VirusTotal

Answer

String analysis

Answer

PEiD

Question 12

Which of the following tools is specifically designed to perform MAC flooding to force a switch into fail-open mode, allowing packet sniffing?

Accepted Answer

macof. The macof tool (part of the dsniff suite) is specifically designed to perform MAC flooding attacks. It floods a switch with thousands of random MAC addresses, exhausting the Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode and begins flooding all frames out all ports, effectively turning it into a hub and allowing an attacker to sniff traffic that was not originally destined for their port.

Answer

Ettercap

Answer

Wireshark

Answer

Nmap

Question 13

A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?

Accepted Answer

Masscan. Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.

Answer

Maltego

Answer

dnsenum

Answer

Nessus

Question 14

Which of the following is a primary purpose of the enumeration phase in a penetration test?

Accepted Answer

To gather in-depth information about the target system and its resources. The enumeration phase is the active process of extracting detailed information about a target system, such as user accounts, network shares, services, and system policies, using direct queries. This phase goes beyond passive reconnaissance by establishing connections to the target to gather data that can be used to identify attack vectors. In a CEH context, enumeration is specifically defined as the step where the tester collects in-depth information about the target's resources and potential entry points.

Answer

To exploit identified vulnerabilities and gain access

Answer

To perform a vulnerability scan on the target network

Answer

To delete logs and cover tracks after a successful compromise

Question 15

You are a security analyst at a financial institution. The SOC has detected anomalous outbound traffic from a server in the DMZ to an unknown IP address on TCP port 8443. The server runs a custom application that normally communicates with internal databases on port 1433. The server's OS is Windows Server 2019. Preliminary analysis shows that a new service named 'UpdateSvc' was installed three days ago, set to start automatically, and runs under the LocalSystem account. The service binary is located at C:\Windows\System32\svchost.exe (the legitimate one). However, the service's 'ImagePath' registry key points to 'C:\Windows\System32\svchost.exe -k UpdateSvc'. Additionally, a scheduled task named 'HealthCheck' runs every hour and executes 'powershell.exe -EncodedCommand <base64>'. The encoded command decodes to a script that downloads a payload from the same unknown IP on port 8443 and executes it in memory. The server has antivirus installed that detected nothing. As the analyst, which of the following is the BEST immediate course of action?

Accepted Answer

Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.. The immediate priority is to contain the threat by isolating the compromised server from the network (disconnecting the cable) and blocking the command-and-control IP at the firewall. This stops the ongoing outbound communication on TCP port 8443 and prevents further payload downloads or data exfiltration. Initiating incident response procedures ensures proper forensic collection and analysis, which is critical before any remediation steps like reimaging or deleting artifacts.

Answer

Reimage the server immediately to ensure the malware is completely removed.

Answer

Uninstall the current antivirus and install a different endpoint protection solution, then perform a full scan.

Answer

Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled task, then run a full antivirus scan.