CEH Practice Exam 1 — 20 Questions

Question 1

A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add -f to fragment IP packets. Using the `-f` flag fragments the IP packets, splitting the TCP header across multiple packets. This helps evade simple IDS/IPS signatures that rely on detecting a complete SYN scan in a single packet, as the fragmented packets may bypass pattern-matching rules or reassembly buffers.

Answer

Use -sT instead of -sS to perform a full TCP connect scan

Answer

Increase timing to -T5 for a faster scan

Answer

Replace -sV with -sU to scan UDP services

Question 2

A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?

Accepted Answer

The zombie host is not truly idle, causing false results. The -sI flag in Nmap performs an idle scan, which relies on a zombie host (192.168.1.50) with a globally predictable IP ID sequence to probe the target. If the zombie host is not truly idle—meaning it is sending or receiving other traffic during the scan—its IP ID values will increment unpredictably, corrupting the side-channel analysis and causing Nmap to report all ports as filtered or closed. This is the most likely reason for the false 'no open ports' result.

Answer

The analyst used the wrong port number

Answer

The target has a firewall blocking the decoy packets

Answer

The target host is offline

Question 3

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

Accepted Answer

Hashcat. Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 4

Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)

Accepted Answer

Restrict SNMP access to trusted IP addresses using ACLs. Effective SNMP enumeration countermeasures include (A) restricting SNMP access to trusted IP addresses via ACLs, which prevents unauthorized hosts from querying SNMP agents, and (C) changing default community strings to strong, unique values, making it harder for attackers to guess them. Option B (disabling SNMP) is impractical in many environments because SNMP is needed for network monitoring. Option D (enabling SNMPv3 with default passwords) is ineffective because default passwords are easily guessed. Option E (using SNMPv1 with community string 'private') is the default and well-known, making enumeration trivial. Therefore, A and C are the correct choices.

Answer

Disable SNMP on all devices

Answer

Enable SNMPv3 with default passwords

Answer

Use SNMPv1 with community string 'private'

Question 5

A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?

Accepted Answer

dnsrecon. D (dnsrecon) is correct because it is a dedicated DNS enumeration tool that performs multiple types of DNS record queries (A, AAAA, CNAME, MX, NS, SOA, SRV, TXT, etc.) using techniques like brute‑forcing subdomains and performing SRV record enumeration, all without attempting a full zone transfer (AXFR). It is specifically designed for reconnaissance and can discover hidden or non‑obvious DNS records efficiently.

Answer

theHarvester

Answer

dig

Answer

nslookup

Question 6

A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?

Accepted Answer

SNMP. Port 161/udp is the default port for SNMP (Simple Network Management Protocol) used by SNMP agents to receive management queries (GET, SET) from SNMP managers. The `-sU` flag performs a UDP scan, and the open result on 161/udp strongly indicates an SNMP service is listening, as defined in RFC 1157.

Answer

DHCP

Answer

TFTP

Answer

DNS

Question 7

Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.

Answer

Burp Suite

Answer

Metasploit

Answer

Nmap

Question 8

A security team suspects a session hijacking attack. The analyst examines network traffic and sees packets with sequence numbers that increment by predictable values. Which attack is MOST likely occurring?

Accepted Answer

TCP sequence prediction. TCP sequence prediction attacks exploit the ability to guess the next sequence number in a TCP connection, allowing an attacker to inject forged packets and hijack the session. The analyst observed packets with sequence numbers incrementing by predictable values, which is the hallmark of weak or static sequence number generation in older TCP implementations.

Answer

ARP poisoning

Answer

DNS spoofing

Answer

MAC flooding

Question 9

Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)

Accepted Answer

Clearing event logs using wevtutil. A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.

Answer

Exploiting SUID binaries to gain root

Answer

Disabling Windows Defender via Group Policy

Question 10

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers periodically to prevent timeout. It exploits the server's connection handling at Layer 7, exhausting the connection pool without requiring high bandwidth.

Answer

SYN flood

Answer

Smurf attack

Answer

UDP flood

Question 11

Which command-line tool is specifically designed to extract email addresses, subdomains, and other information from public sources (e.g., search engines, social media) for a given domain?

Accepted Answer

theHarvester. theHarvester is a dedicated open-source intelligence (OSINT) tool designed to gather emails, subdomains, IPs, and employee names from public sources such as Google, Bing, LinkedIn, and PGP key servers. It specifically targets a given domain and queries search engines and social media APIs to extract this reconnaissance data, making it the correct choice for this task.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 12

Which wireless security standard introduced in 2018 uses Simultaneous Authentication of Equals (SAE) to replace the pre-shared key exchange in WPA2, providing forward secrecy and resistance to offline dictionary attacks?

Accepted Answer

WPA3. WPA3 uses SAE (Dragonfly handshake) to provide forward secrecy and protect against offline dictionary attacks. WPA2 used PSK which is vulnerable to dictionary attacks. WEP and 802.1X are older or different.

Answer

802.1X/EAP

Answer

WEP

Answer

WPA2

Question 13

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

Accepted Answer

Exploit the SUID binary to execute commands as root. The SUID binary owned by root runs with root privileges regardless of the user executing it. Exploiting a vulnerable SUID binary (e.g., via command injection, buffer overflow, or misconfigured capabilities) allows the low-privileged user to execute arbitrary commands as root, directly escalating privileges. This is the most effective method because it leverages a known privilege escalation vector specific to Linux SUID binaries.

Answer

Perform an SMTP VRFY attack to enumerate users

Answer

Use enum4linux to enumerate SMB shares

Answer

Run 'sudo -l' to list sudo privileges

Question 14

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 15

A forensic analyst finds a system where the user's password hash was obtained and cracked offline. The attacker then used stolen credentials to log in and run `wevtutil cl system`. What is the purpose of this command?

Accepted Answer

Clear the System event log. The `wevtutil cl system` command clears the System event log on Windows. After cracking the user's password hash offline, the attacker logs in with stolen credentials and runs this command to erase forensic evidence of their activities, such as logon events or service failures, from the System log. This is a common post-exploitation step to hinder incident response.

Answer

Remove scheduled tasks

Answer

Delete the SAM database

Answer

Disable Windows Defender

Question 16

Which TWO of the following are considered passive reconnaissance techniques? (Choose TWO.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

Answer

Ping sweep

Answer

Banner grabbing with Telnet

Answer

Port scanning

Question 17

An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:

Accepted Answer

Credential stuffing. Credential stuffing (option D) is correct because the attacker uses a list of known username/password pairs from a previous breach to automate login attempts against the web application. This attack exploits password reuse across services, not the weakness of the passwords themselves, and relies on the application's lack of rate limiting or account lockout mechanisms.

Answer

Password spraying

Answer

Brute force attack

Answer

Dictionary attack

Question 18

Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?

Accepted Answer

smbclient -L // -N. The `smbclient -L // -N` command lists SMB shares on a target Windows machine without requiring a password (null session). This is a standard enumeration technique because SMB uses TCP port 445 and the `-L` flag queries the share list, while `-N` suppresses the password prompt, allowing anonymous access if the target permits null sessions.

Answer

ldapsearch -x -h <IP>

Answer

snmpwalk -v2c -c public <IP>

Answer

nbtstat -A <IP>

Question 19

Which of the following is the most effective defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are the most effective defense because they are unique, unpredictable values embedded in each form or request that the server validates. Without a valid token, the server rejects the request, preventing an attacker from forging a legitimate user's action even if the victim is authenticated.

Answer

Content Security Policy (CSP)

Answer

Rate limiting

Answer

Input validation

Question 20

An attacker uses an idle scan with Nmap to probe a target. This technique relies on a third-party host with a predictable IP ID sequence to infer port states. Which Nmap flag enables an idle scan?

Accepted Answer

-sI. The idle scan (-sI) leverages a third-party host (zombie) with a predictable IP ID sequence to indirectly probe a target's ports. By spoofing the zombie's IP and observing changes in its IP ID counter, Nmap can infer whether a port is open, closed, or filtered without sending packets directly from the attacker's IP.

Answer

-sS

Answer

-sA

Answer

-sT