CEH Practice Test 19 — 15 Questions

Question 1

Which of the following commands would a tester use to enumerate NetBIOS names and their associated IP addresses on a local subnet?

Accepted Answer

nbtstat -A 192.168.1.10. The `nbtstat -A` command (with a capital 'A') performs a NetBIOS name table lookup against a remote IP address, listing the NetBIOS names registered by that host along with their associated IP addresses. This is the standard method for enumerating NetBIOS names on a specific target within a local subnet, as it queries the NetBIOS name service (UDP port 137) directly.

Answer

nbtstat -n

Answer

nbtstat -c

Answer

nbtstat -a 192.168.1.10

Question 2

A penetration tester is attempting to escalate privileges on a Linux target. The tester runs `find / -perm -4000 -type f 2>/dev/null` and discovers that `/usr/bin/pkexec` has the SUID bit set. The target runs Ubuntu 20.04 with default configurations. Which of the following is the MOST likely next step?

Accepted Answer

Exploit the pkexec vulnerability (CVE-2021-4034) to gain root access. CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in pkexec that allows unprivileged users to escalate privileges to root by exploiting an out-of-bounds write in the argument parsing logic. On Ubuntu 20.04 with default configurations, the pkexec binary is SUID root and vulnerable to this exploit, making it the most direct and effective next step for privilege escalation.

Answer

Change the ownership of the pkexec binary to root:root

Answer

Use pkexec to execute a command as root directly

Answer

Remove the SUID bit from pkexec to prevent misuse

Question 3

Which of the following is a passive OS fingerprinting technique that does NOT send any packets to the target?

Accepted Answer

Analyzing TTL and window size from captured packets. Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the Time-to-Live (TTL) and TCP window size from captured packets is a classic passive technique because these values are OS-specific defaults (e.g., Linux often uses TTL 64 and window size 5840, while Windows uses TTL 128 and window size 65535). Since no packets are sent to the target, this method is entirely passive and undetectable.

Answer

Sending TCP SYN packets and analyzing responses

Answer

Performing a NULL scan

Answer

Using Nmap -O flag

Question 4

Which tool is specifically designed to crack Windows LM and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted use case.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 5

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Question 6

A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?

Accepted Answer

It identifies the version of the SSH service running. The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.

Answer

It confirms the OS is Linux 2.6.x

Answer

It checks if the port is filtered by a firewall

Answer

It performs a UDP scan on port 22

Question 7

A security analyst runs the command: nmap -sS -p 80,443,8080 --script http-headers scanme.nmap.org. The output shows that port 80 is filtered. What does 'filtered' mean in this context?

Accepted Answer

A firewall or IDS is preventing the probe from reaching the port. In Nmap, a 'filtered' port status indicates that the port is being blocked by a firewall, IDS, or other network filtering device, preventing the probe from reaching the target service. The -sS (SYN stealth scan) sends a SYN packet; if no response is received or an ICMP unreachable (type 3, code 13) is returned, Nmap marks the port as filtered. This does not mean the port is open or closed—it means the scan could not determine the state due to filtering.

Answer

The port is open, but the service is not responding

Answer

The port is open and actively listening

Answer

The port is closed, but the target is responding with RST packets

Question 8

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Accepted Answer

The file is authentic and has not been tampered with.. The SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Answer

The file has been tampered with because the hash is from a different file.

Answer

The SHA256 hash is not reliable; the analyst should use MD5 instead.

Answer

The file is malicious because the hash is too long.

Question 9

A user reports that their system has become sluggish and they see pop-up advertisements even when no browser is open. Additionally, unknown processes are running in Task Manager. Which type of malware is most likely responsible?

Accepted Answer

Adware. Adware is designed to display unwanted advertisements, often in the form of pop-ups, and can degrade system performance by consuming CPU and memory resources. The presence of unknown processes in Task Manager indicates that the adware has installed additional components or bundled software that runs persistently, even when no browser is open, which is a hallmark of adware behavior.

Answer

Worm

Answer

Ransomware

Answer

Spyware

Question 10

During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is the correct answer because the attacker fabricates a scenario (the pretext of being a new employee with a locked account) to manipulate the help desk into performing a password reset. This technique relies on a crafted story to gain trust and bypass security procedures, rather than using technical exploits or direct requests for information.

Answer

Phishing

Answer

Vishing

Answer

Quid pro quo

Question 11

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Accepted Answer

The attacker extracted hashed passwords that can be cracked offline. The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Answer

The attacker successfully performed a blind SQL injection to enumerate the database structure

Answer

The attacker caused a denial of service by sending an invalid query

Answer

The attacker modified the database records to update user passwords

Question 12

A penetration tester is trying to evade an IDS that detects out-of-order TCP packets. The tester uses Nmap with the -f flag. What is the PRIMARY effect of this flag?

Accepted Answer

Splits the TCP header into multiple packets to bypass simple packet filters. The `-f` flag in Nmap fragments the IP packet into smaller pieces, typically 8-byte fragments, which splits the TCP header across multiple packets. This fragmentation causes the IDS to see out-of-order or incomplete TCP headers, making it harder for signature-based detection to reassemble and match malicious patterns, thus bypassing simple packet filters that do not perform full TCP reassembly.

Answer

Slows down the scan to avoid triggering rate-based alarms

Answer

Sends packets from multiple decoy IP addresses to obscure the source

Answer

Spoofs the source IP address to hide the attacker's identity

Question 13

A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?

Accepted Answer

Slowloris attack. The Slowloris attack works by opening multiple HTTP connections to the target web server and sending partial HTTP headers, then keeping those connections alive by sending periodic small packets to prevent timeout. This exhausts the server's connection pool, leading to slow response times and denial of service for legitimate users, matching the described symptoms of incomplete requests and long-held connections.

Answer

HTTP flood

Answer

SYN flood

Answer

UDP flood

Question 14

An organization receives an email that appears to be from the CEO, urgently requesting that the recipient wire funds to a new vendor. The email contains the CEO's name and title but the sender address is slightly misspelled. Which type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack because the attacker impersonates a high-profile executive (the CEO) to deceive the recipient into transferring funds. Whaling is a subtype of spear phishing that specifically targets individuals with authority or financial access, often by spoofing a senior executive's email address. In this scenario, the CEO's identity is used to exploit trust and urgency, making it a whaling attack.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 15

An attacker successfully escalates privileges on a Windows server using a known vulnerability in the Print Spooler service (PrintNightmare). Which type of privilege escalation does this represent?

Accepted Answer

Local exploit in a service. The PrintNightmare vulnerability (CVE-2021-34527) allows an attacker to execute arbitrary code with SYSTEM privileges via the Windows Print Spooler service. Since the attacker exploits a vulnerability in a running service (spoolsv.exe) to elevate from a lower-privileged user to SYSTEM, this is a classic local exploit in a service. The attack does not involve hijacking DLLs, abusing SUID bits (a Unix concept), or impersonating tokens, making option A the correct classification.

Answer

DLL hijacking

Answer

SUID abuse

Answer

Token impersonation