CEH Practice Test 20 — 15 Questions

Question 1

During an internal penetration test, you run 'smbclient -L //192.168.1.100 -N' and get an empty response. Which of the following is the MOST likely reason?

Accepted Answer

Null sessions are disabled on the target. The `-N` flag in smbclient suppresses password prompts, attempting a null session. An empty response (no error, no output) typically indicates the SMB service is running but null sessions are explicitly disabled, often via the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous` set to 1 or 2. This prevents anonymous enumeration of shares and users, which is a common security hardening measure on Windows systems.

Answer

The target is not running SMB

Answer

The target requires NTLM authentication

Answer

The target is a Linux server

Question 2

After a security incident, an analyst retrieves a suspicious file. The analyst runs the 'strings' command on it and sees references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique does this indicate?

Accepted Answer

Process injection. The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the output of the 'strings' command is a strong indicator of process injection. These Windows API functions are commonly used together to allocate memory in a target process (VirtualAllocEx), write malicious code into that memory (WriteProcessMemory), and then execute it in the context of the remote process (CreateRemoteThread). This technique allows an attacker to run arbitrary code within a legitimate process, bypassing security controls.

Answer

DLL hijacking

Answer

Privilege escalation

Answer

Buffer overflow

Question 3

During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.

Answer

The DNS server is not running

Answer

The zone transfer requires TCP port 443

Answer

The domain does not exist

Question 4

Which of the following tools is specifically designed to search the internet for exposed devices and services, such as industrial control systems and webcams, using banners and metadata?

Accepted Answer

Shodan. Shodan is a search engine specifically designed to scan the internet for exposed devices and services by collecting banners and metadata from protocols such as HTTP, SSH, FTP, and SNMP. Unlike general-purpose search engines, Shodan indexes device-specific information, making it ideal for discovering industrial control systems (ICS), webcams, and other IoT devices that respond to network probes.

Answer

Maltego

Answer

Nmap

Answer

Google

Question 5

An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?

Accepted Answer

Implement DNSSEC. DNSSEC (Domain Name System Security Extensions) is the most effective measure against DNS spoofing because it cryptographically signs DNS data using public-key cryptography, allowing resolvers to verify the authenticity and integrity of responses. This prevents an attacker from injecting forged DNS records into the cache, as any tampered response would fail signature validation per RFC 4033–4035.

Answer

Use IPsec

Answer

Use a firewall

Answer

Disable DNS recursion

Question 6

During a vulnerability scan using Nessus, a security analyst discovers that the target host shows a 'High' severity vulnerability for 'SSL/TLS Renegotiation DoS'. What does this vulnerability indicate?

Accepted Answer

An attacker can force the server to renegotiate TLS handshakes repeatedly, causing resource exhaustion. The SSL/TLS Renegotiation DoS vulnerability (CVE-2011-1473) occurs when a server supports TLS renegotiation without proper rate limiting. An attacker can open multiple connections and repeatedly request renegotiation, causing the server to consume excessive CPU resources for cryptographic handshake calculations, effectively leading to a denial of service. Nessus flags this as 'High' severity because it can exhaust server resources even with a single attacker.

Answer

The server does not validate SSL certificates

Answer

The server supports SSLv2

Answer

The server allows weak cipher suites

Question 7

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

Accepted Answer

LoRaWAN. LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.

Answer

4G LTE

Answer

Wi-Fi 6

Answer

Bluetooth 5

Question 8

A security analyst uses the nbtstat -a command against a target IP address. What information is the analyst MOST likely attempting to retrieve?

Accepted Answer

NetBIOS name table of the remote machine. The nbtstat -a command is used to query the NetBIOS name table of a remote machine by its IP address. This table contains the NetBIOS names registered by the remote host, such as the computer name, workgroup/domain, and any services running over NetBIOS (e.g., file sharing). The analyst is most likely attempting to enumerate these names for reconnaissance or to identify potential targets for further exploitation.

Answer

Active directory domain controllers

Answer

List of all open TCP ports

Answer

The MAC address of the target

Question 9

A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?

Accepted Answer

Using a gelatin mold of an authorized user's fingerprint. Gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.

Answer

Shoulder surfing the authorized user's fingerprint pattern

Answer

Picking the lock on the server room door

Answer

Tailgating behind an authorized employee

Question 10

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

Use vim's shell escape via `:!bash` to get a root shell. The `sudo -l` output shows that the user can run `/usr/bin/vim` as root without a password. Vim has a built-in shell escape feature: from within vim, typing `:!bash` (or `:!sh`) executes a shell with the privileges of the user running vim. Since vim is run via sudo as root, the spawned shell will be a root shell, directly escalating privileges without needing additional exploits.

Answer

Perform token impersonation using SeImpersonatePrivilege

Answer

Exploit a kernel vulnerability (CVE-2023-xxxx)

Answer

Abuse the SUID bit on vim

Question 11

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. When a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 12

A penetration tester uses the following command to extract the contents of a SAM file: 'samdump2 SYSTEM /mnt/windows/Windows/System32/config/SAM'. What is the primary purpose of this action?

Accepted Answer

To capture NTLM hashes for offline cracking. The `samdump2` tool extracts password hash data from the SAM (Security Account Manager) registry hive file. By providing the SYSTEM hive (which contains the boot key) and the SAM file, the tool decrypts and dumps the NTLM hashes of local user accounts. These hashes can then be used in offline cracking attacks (e.g., with John the Ripper or Hashcat) to recover plaintext passwords, making option C correct.

Answer

To escalate privileges on the system

Answer

To enumerate users via LDAP

Answer

To perform a pass-the-hash attack

Question 13

A security analyst receives an alert indicating that a workstation is sending outbound connections to a known malicious IP address. The analyst suspects a Trojan. Which tool is BEST for performing dynamic analysis of the suspicious binary?

Accepted Answer

Sandbox. Dynamic analysis involves executing the suspicious binary in a controlled environment to observe its runtime behavior, such as outbound connections, registry changes, and file system modifications. A sandbox provides an isolated environment specifically designed for this purpose, allowing the analyst to safely monitor the Trojan's actions without risking the production network. This makes it the best choice for analyzing the workstation's outbound connections to a known malicious IP address.

Answer

VirusTotal

Answer

String analysis

Answer

PEiD

Question 14

Which of the following tools is specifically designed to perform MAC flooding to force a switch into fail-open mode, allowing packet sniffing?

Accepted Answer

macof. The macof tool (part of the dsniff suite) is specifically designed to perform MAC flooding attacks. It floods a switch with thousands of random MAC addresses, exhausting the Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode and begins flooding all frames out all ports, effectively turning it into a hub and allowing an attacker to sniff traffic that was not originally destined for their port.

Answer

Ettercap

Answer

Wireshark

Answer

Nmap

Question 15

A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?

Accepted Answer

Masscan. Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.

Answer

Maltego

Answer

dnsenum

Answer

Nessus