CEH Practice Test 20 — 15 Questions

Question 1

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Accepted Answer

A firewall, router rule, or host-based firewall is blocking the probes.. When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Answer

The port is closed and the target sent a RST packet.

Answer

The port is open but the service is not responding to the scan.

Answer

The port is open but Nmap cannot determine the service.

Question 2

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

Accepted Answer

Ettercap. Ettercap is specifically designed for ARP poisoning and man-in-the-middle (MITM) attacks on a local network. It exploits the Address Resolution Protocol (ARP) by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, thereby intercepting traffic between two hosts on the same subnet.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 3

A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?

Accepted Answer

-sS. The output shows open ports with their service names (ssh, http, https) but no version information. The -sS flag performs a SYN stealth scan, which by default probes common ports and uses the /etc/services file to map port numbers to service names. This matches the output format exactly, as -sS does not perform version detection or OS fingerprinting.

Answer

-O

Answer

-A

Answer

-sV

Question 4

Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is designed for both live packet capture and offline analysis of pcap files. It provides a rich graphical interface with advanced filtering, protocol dissection, and statistical analysis capabilities, making it ideal for examining captured traffic for signs of an attack such as suspicious patterns, malformed packets, or known exploit signatures.

Answer

Ettercap

Answer

tcpdump

Answer

Nmap

Question 5

During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?

Accepted Answer

Ettercap. Ettercap is the correct answer because it is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing (poisoning) capabilities. It actively sends forged ARP replies to associate the tester's MAC address with the IP address of the target hosts, allowing interception of traffic between them on the same subnet. Other tools like Wireshark, Metasploit, and Nmap are not primarily designed for ARP spoofing.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 6

An analyst runs the following command: dnsenum --enum example.com. Which of the following actions is dnsenum performing?

Accepted Answer

Attempts a zone transfer and brute-forces subdomains. The `dnsenum` tool is designed for DNS enumeration, and its `--enum` flag performs a comprehensive scan that includes attempting a zone transfer (AXFR query) to retrieve all DNS records from the nameserver, and if that fails, it brute-forces subdomains using a wordlist. This matches option A exactly.

Answer

Scans for open ports on the DNS server

Answer

Queries the DNS server for its version information

Answer

Performs a reverse DNS lookup to find PTR records for the IP range

Question 7

A penetration tester runs 'nmap -sS -p 80 --script http-title 192.168.1.100' and receives output indicating port 80 is 'filtered'. What does the 'filtered' state imply?

Accepted Answer

A firewall is likely blocking the probe packets. The 'filtered' state in Nmap indicates that the probe packets (SYN packets for a SYN scan) were dropped or did not elicit any response, typically due to a firewall or packet filter. Since no SYN/ACK or RST was received, Nmap cannot determine if the port is open or closed, so it marks it as 'filtered'. This is distinct from an 'open' state (SYN/ACK received) or 'closed' state (RST received).

Answer

The port is open and a service is listening

Answer

The service is running but the script failed

Answer

The port is closed and no service is listening

Question 8

You need to perform a fast scan of all 65535 TCP ports on a target IP address. Which tool is specifically designed for high-speed scanning and can surpass Nmap's speed on large-scale networks?

Accepted Answer

Masscan. Masscan is the correct answer because it is specifically engineered for high-speed asynchronous scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which allows it to scan all 65535 TCP ports on a target significantly faster than Nmap, even with the -T5 timing template. Unlike Nmap's synchronous or adaptive scanning, Masscan uses a custom TCP/IP stack and raw sockets to maximize throughput, making it the optimal tool for large-scale network reconnaissance.

Answer

Netcat

Answer

hping3

Answer

Nmap with -T5

Question 9

A security administrator notices repeated failed login attempts from a single IP address targeting the SSH service. The attempts use common usernames (root, admin, test) and a list of passwords from a dictionary. What type of password attack is being conducted?

Accepted Answer

Dictionary attack. This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

Answer

Rainbow table attack

Answer

Hybrid attack

Answer

Brute-force attack

Question 10

Which TWO of the following are effective mitigation techniques against DDoS attacks? (Select two)

Accepted Answer

Rate limiting. Rate limiting (C) is correct because it caps the number of requests or packets a client or subnet can send per unit time (e.g., via iptables hashlimit, nginx limit_req, or cloud WAF throttling rules), which blunts volumetric and application-layer floods by preventing any single source from exhausting server or bandwidth resources. Scrubbing centers (D) are correct because they are dedicated, high-capacity traffic-cleaning facilities that divert attack traffic via BGP anycast or GRE tunnels, filter out malicious packets using signature, anomaly, and reputation analysis, and forward only legitimate traffic back to the origin. Port knocking (A) is not a DDoS mitigation; it is a stealth access-control mechanism that hides services behind a sequence of connection attempts and does nothing to absorb or filter high-volume attack traffic. ARP poisoning (B) is itself an attack (Layer 2 man-in-the-middle via forged ARP replies), not a defense. MAC filtering (E) is a Layer 2 access-control list that restricts which hardware addresses can associate with a switch or AP, and it is trivially bypassed by spoofing and irrelevant to mitigating distributed floods.

Answer

Port knocking

Answer

ARP poisoning

Answer

MAC filtering

Question 11

An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?

Accepted Answer

Erasing tracks. Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Answer

Privilege escalation

Answer

Cracking passwords

Answer

Executing applications

Question 12

A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?

Accepted Answer

A DNS tunneling tool used for data exfiltration. DNS tunneling encapsulates non-DNS traffic (e.g., data exfiltration) within DNS queries and responses, typically using UDP port 53. Since the host is not a DNS server, the outbound spike on port 53 indicates it is likely tunneling data to an external command-and-control server, making option C correct.

Answer

A worm that spreads via email attachments

Answer

A polymorphic virus

Answer

A keylogger that sends captured keystrokes via HTTP

Question 13

After gaining initial access to a Linux server, an attacker runs `find / -perm -4000 -o -perm -2000 2>/dev/null`. What is the primary objective of this command?

Accepted Answer

Identify files with SUID or GUID bits set for privilege escalation. The command `find / -perm -4000 -o -perm -2000 2>/dev/null` searches the entire filesystem for files with the SUID (setuid, permission 4000) or SGID (setgid, permission 2000) bits set. These special permission bits allow a file to execute with the privileges of its owner (often root) or group, respectively. An attacker's primary objective is to identify such files because they can be exploited to escalate privileges from a low-privileged user to a higher-privileged user (e.g., root) by running a vulnerable SUID/SGID binary.

Answer

Locate world-writable files for data exfiltration

Answer

List all files owned by the root user

Answer

Find configuration files containing passwords

Question 14

Which type of malware is characterized by its ability to spread without requiring a host file and can replicate across networks automatically?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across networks without requiring a host file or user intervention. It exploits network vulnerabilities, such as unpatched services or weak credentials, to propagate automatically, often using protocols like SMB, RDP, or email transport mechanisms.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 15

A security analyst observes the following in a packet capture: a single source IP sends a large number of ICMP echo request packets to the broadcast address of a subnet, with the source IP spoofed to be the target victim. Which type of attack is being executed?

Accepted Answer

Smurf attack. The Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large volume of ICMP echo request packets with the source IP spoofed to be the victim's IP address, directed to the subnet's broadcast address. Every host on that subnet replies to the victim, overwhelming it with ICMP echo reply traffic, effectively amplifying the attack.

Answer

SYN flood

Answer

Ping of Death

Answer

ICMP flood