CEH Practice Test 19 — 15 Questions

Question 1

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist. The SMTP response code 252 for VRFY root typically indicates that the user exists but is disabled or cannot receive mail at this time (the server knows the user but restricts verification). A 250 response for EXPN admin confirms that the admin mailing list exists. The 550 response for RCPT TO:unknown@domain.com definitively indicates that the recipient does not exist on the server. Therefore, option A correctly interprets these responses: root exists but is disabled, the admin list exists, and the unknown user does not exist.

Answer

The server has open relay enabled

Answer

The server is vulnerable to SMTP injection

Answer

The server is not running SMTP

Question 2

A penetration tester uses the tool 'ScoutSuite' against an AWS target. Which of the following BEST describes the purpose of this tool?

Accepted Answer

Audit cloud infrastructure for misconfigurations and compliance. ScoutSuite is an open-source multi-cloud security auditing tool that assesses cloud environments (AWS, Azure, GCP) by scanning for misconfigurations and compliance violations. It does not perform exploitation or penetration testing; instead, it checks for issues like overly permissive security groups, unencrypted S3 buckets, or unused IAM roles, aligning with option D's description of auditing cloud infrastructure for misconfigurations and compliance.

Answer

Enumerate IAM users and roles for privilege escalation

Answer

Perform automated penetration testing of web applications

Answer

Exploit vulnerabilities in cloud services

Question 3

An employee receives an email that appears to be from the CEO, requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ceo@cornpany.com instead of ceo@company.com). This is an example of which type of attack?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or organization, using personalized information to increase credibility. In this scenario, the attacker spoofs the CEO's identity and uses a misspelled domain (typosquatting) to trick the employee into performing a wire transfer, which is a classic spear phishing technique. Unlike generic phishing, spear phishing tailors the message to the victim's role and context, making it more effective.

Answer

Whaling

Answer

Phishing

Answer

Pretexting

Question 4

A security analyst reviews logs and notices that an attacker crafted a packet with a source IP address matching the target's IP address, and sent it to a network's broadcast address. Which type of attack does this describe?

Accepted Answer

Smurf attack. The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets. The attacker spoofs the source IP address to be the target's IP and sends these packets to a network's broadcast address. All hosts on that network then reply to the target, overwhelming it with ICMP echo replies.

Answer

UDP flood

Answer

Ping of Death

Answer

SYN flood

Question 5

In the context of system hacking methodology (CHPSET), which phase involves hiding malicious files from the operating system and security tools using techniques such as NTFS alternate data streams (ADS) or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking, Hacking, Privilege escalation, Spying, Erasing tracks, Hiding files) methodology specifically involves concealing malicious files from the OS and security tools. Techniques like NTFS alternate data streams (ADS) allow data to be stored in a file's metadata stream (e.g., type echo payload > file.txt:stream) without affecting the visible file size, while steganography hides data within images or audio files. This phase occurs after gaining access and before covering tracks.

Answer

Privilege escalation

Answer

Erasing tracks

Answer

Cracking passwords

Question 6

A security team wants to mitigate a DNS amplification DDoS attack. Which of the following techniques would be MOST effective in preventing the attack from leveraging open DNS resolvers?

Accepted Answer

Disable recursion on DNS servers for external queries. Disabling recursion on DNS servers for external queries prevents them from acting as open resolvers. In a DNS amplification attack, the attacker sends a small query with a spoofed source IP to an open resolver, which then sends a large response to the victim. By blocking recursion for external clients, the server will only answer for domains it authoritatively hosts, thus eliminating the amplification vector.

Answer

Deploy a web application firewall

Answer

Use anycast routing for DNS servers

Answer

Implement rate limiting on DNS responses

Question 7

A penetration tester wants to perform a stealthy TCP scan that does not complete the three-way handshake. Which Nmap flag should be used?

Accepted Answer

-sS. (-sS) is correct because it performs a SYN scan, which sends a TCP SYN packet and waits for a SYN-ACK response without completing the three-way handshake (i.e., it sends a RST instead of an ACK). This makes the scan stealthy as it avoids establishing a full TCP connection, reducing the chance of being logged by the target.

Answer

-sU

Answer

-sV

Answer

-sT

Question 8

A penetration tester runs the following Nmap command: nmap -sU -sS -p 53,161,162,500 10.0.0.1 and receives no responses for UDP scans but standard results for TCP. The tester suspects the target is dropping all UDP packets. Which Nmap option could help increase the likelihood of UDP responses by fragmenting the probe?

Accepted Answer

-f. The -f option fragments the probe packets into smaller IP fragments. When a target drops unfragmented UDP packets, fragmenting the probes can sometimes bypass simple packet filters or IDS/IPS that drop larger or complete UDP datagrams, increasing the chance that the target will process and respond to the fragments.

Answer

-T4

Answer

--reason

Answer

-Pn

Question 9

During a penetration test, you run the command: 'macof -i eth0 -s 192.168.1.1 -d 192.168.2.1 -e 00:11:22:33:44:55'. What is the intended effect of this command?

Accepted Answer

Perform MAC flooding to cause switch to fail open. The `macof` tool generates a flood of random MAC addresses on the specified interface, overwhelming the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch fails open and begins flooding all frames out all ports, effectively turning it into a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

Execute a SYN flood against the target

Answer

Perform ARP poisoning

Answer

Spoof DNS responses

Question 10

A security auditor is assessing the physical security of a corporate office building that houses a data center. The building has a single main entrance with a reception desk staffed during business hours (8 AM to 6 PM). After hours, employees use a keycard reader to access the building. The data center itself requires a separate keycard and a 6-digit PIN. The auditor notices that during lunch hours (12-1 PM), the reception desk is often unattended, and employees frequently hold the door for others to avoid using their keycard. Additionally, a recent social engineering test revealed that an attacker was able to call the help desk, claim to be a new employee, and request a password reset, which was granted without proper verification. Based on this scenario, which of the following is the MOST effective combination of controls to mitigate both the physical and social engineering weaknesses?

Accepted Answer

Install a mantrap at the main entrance and require multi-factor authentication (MFA) for all password reset requests.. It addresses both weaknesses: a mantrap prevents tailgating at the main entrance (physical security), and requiring MFA for password reset requests mitigates the social engineering attack by adding an authentication factor beyond just a phone call. This combination directly counters the observed vulnerabilities—unattended reception and weak identity verification—without over-engineering or leaving gaps.

Answer

Install a mantrap at the main entrance and require two-factor authentication for the data center door.

Answer

Deploy security guards at the entrance 24/7 and implement a policy that all visitors must be escorted.

Answer

Implement a callback verification process for all password reset requests and require a manager approval.

Question 11

A penetration tester needs to perform ARP poisoning to intercept traffic between two hosts on the same subnet. Which tool would be the most appropriate choice for this task?

Accepted Answer

Ettercap. Ettercap is the most appropriate tool for ARP poisoning because it is specifically designed for man-in-the-middle (MITM) attacks on a local area network (LAN). It automates ARP spoofing by sending forged ARP replies to both target hosts, poisoning their ARP caches so that traffic intended for the other host is redirected through the attacker's machine, enabling interception and modification of packets.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 12

A penetration tester finds that a Linux binary has the SUID bit set and is owned by root. Which of the following does this indicate?

Accepted Answer

The binary will run with root privileges when executed by any user. When the SUID (Set User ID) bit is set on a binary owned by root, the binary executes with the effective user ID of the file owner (root), regardless of which user runs it. This allows any user to run the binary with root privileges, which is why option D is correct. The SUID bit is represented by an 's' in the owner's execute position (e.g., -rwsr-xr-x).

Answer

The binary is immutable and cannot be deleted

Answer

The binary can be executed only by the root user

Answer

The binary is a symbolic link to a root-owned file

Question 13

A penetration tester runs the following command against a Linux server: `smbclient -L //192.168.1.10 -N`. The output lists shares including 'IPC$', 'ADMIN$', and 'data'. Which of the following is the BEST next step to enumerate the 'data' share?

Accepted Answer

Use `smbclient //192.168.1.10/data -N` to attempt a null session connection. The command `smbclient -L //192.168.1.10 -N` performs a null session (no password) listing of SMB shares. The output shows that the 'data' share exists and is accessible without authentication (since the -N flag succeeded). The best next step is to attempt a null session connection to that specific share using `smbclient //192.168.1.10/data -N`, which will mount the share and allow file enumeration. This directly leverages the null session already confirmed by the initial scan.

Answer

Run `nmap --script smb-enum-shares -p 445 192.168.1.10`

Answer

Run `enum4linux -a 192.168.1.10` to gather more information

Answer

Use `rpcclient -U '' 192.168.1.10` to enumerate users

Question 14

A security analyst captures the following SMTP conversation: 220 mail.example.com ESMTP;  HELO client; 250 Hello;  VRFY root; 250 Super-User;  VRFY admin; 252 Cannot VRFY user;  VRFY user1; 550 User unknown. Which attack is the analyst performing?

Accepted Answer

SMTP user enumeration via VRFY. The analyst is using the SMTP VRFY command to check if specific usernames (root, admin, user1) exist on the mail server. The responses '250 Super-User' and '252 Cannot VRFY user' confirm valid usernames, while '550 User unknown' indicates an invalid one. This is a classic SMTP user enumeration technique, often used in the reconnaissance phase to gather valid account names for further attacks like password guessing or phishing.

Answer

SMTP header injection

Answer

SMTP open relay testing

Answer

SMTP DDoS attack

Question 15

A cloud security engineer wants to ensure that only authorized users can access an S3 bucket containing sensitive data. Which AWS service should be used to enforce fine-grained access control?

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS CloudFront