CEH Practice Exam 2 — 20 Questions

Question 1

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

theHarvester. theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

Answer

Nmap

Answer

Netcat

Answer

Wireshark

Question 2

An ethical hacker is analyzing a suspicious file using static analysis. Which of the following actions is part of static malware analysis?

Accepted Answer

Examining the file's strings and metadata without executing it. Static malware analysis involves examining the file without executing it. Option C is correct because analyzing strings and metadata (e.g., file headers, embedded URLs, IP addresses, or suspicious function calls) is a core static analysis technique, often performed using tools like `strings`, `binwalk`, or `PEview`. This approach avoids the risks of execution and helps identify indicators of compromise (IOCs) before dynamic analysis.

Answer

Running the file in a sandboxed environment and monitoring its behavior

Answer

Uploading the file to VirusTotal for scanning

Answer

Using Wireshark to capture packets sent by the file

Question 3

A security analyst observes that an Nmap SYN scan against a target network returns all ports as 'filtered'. The analyst suspects an IDS/IPS is dropping inbound SYN packets. Which Nmap technique would MOST likely bypass this detection while still identifying open ports?

Accepted Answer

Enable IP fragmentation with the -f flag. When an IDS/IPS drops inbound SYN packets, a standard SYN scan (-sS) is detected because the probe packets are easily recognized. Enabling IP fragmentation with the -f flag splits the TCP header across multiple fragments, making it harder for the IDS/IPS to reassemble and inspect the full packet, thus potentially bypassing the filter while still allowing Nmap to determine open ports based on responses.

Answer

Use the -sU flag for UDP scanning

Answer

Use the -sT flag for a TCP connect scan

Answer

Increase scanning speed with -T5

Question 4

A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?

Accepted Answer

ldapsearch. ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.

Answer

smbclient

Answer

snmpwalk

Answer

enum4linux

Question 5

Which of the following tools is PRIMARILY used for passive OSINT gathering and can query multiple search engines, social media platforms, and public databases to collect information about a target?

Accepted Answer

Maltego. Maltego is primarily used for passive OSINT gathering because it leverages open-source intelligence feeds, search engines, social media platforms, and public databases to collect and correlate information about a target without directly interacting with the target's systems. Its transform-based architecture allows it to query multiple data sources simultaneously, making it the correct choice for passive reconnaissance.

Answer

Nmap

Answer

Wireshark

Answer

theHarvester

Question 6

During a vulnerability assessment, which of the following tools is a comprehensive vulnerability scanner that uses a plugin architecture to detect thousands of vulnerabilities?

Accepted Answer

Nessus. Nessus is a comprehensive vulnerability scanner that uses a plugin-based architecture to detect thousands of vulnerabilities across a wide range of systems and services. Each plugin corresponds to a specific vulnerability check, and the Nessus engine executes them in sequence or in parallel against the target, making it highly extensible and up-to-date with the latest CVEs.

Answer

Wireshark

Answer

OpenVAS

Answer

Nmap

Question 7

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

Accepted Answer

Use ldapsearch to query the directory for all attributes. `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Answer

Run nmap with the smb-enum-shares script

Answer

Perform a DNS zone transfer

Answer

Use net view to list domain resources

Question 8

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 9

A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?

Accepted Answer

Masscan can scan a large number of hosts and ports at very high speed. Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.

Answer

Masscan provides more detailed service version detection than Nmap

Answer

Masscan is stealthier than Nmap and less likely to be detected

Answer

Masscan can scan all 65535 ports faster than Nmap

Question 10

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). ECDHE is prioritized for Perfect Forward Secrecy because it generates a unique, ephemeral session key for each TLS handshake using elliptic curve cryptography, ensuring that if the server's long-term private key is compromised, past session keys remain secure. Unlike static Diffie-Hellman, ECDHE does not reuse key material, and it offers stronger security per bit compared to traditional DH, making it the recommended choice for PFS in modern HTTPS configurations.

Answer

Diffie-Hellman (DH) key exchange

Answer

Pre-Shared Key (PSK)

Answer

RSA key exchange

Question 11

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

Accepted Answer

UDP flood. A UDP flood attack works by overwhelming a target server with a high volume of UDP packets sent to random high-numbered ports. The server checks each port for a listening application, and when none is found, it responds with ICMP Destination Unreachable messages, consuming CPU and bandwidth until the server becomes unresponsive. The use of spoofed source IP addresses makes it difficult to filter the attack traffic based on source alone.

Answer

ICMP flood

Answer

SYN flood

Answer

Smurf attack

Question 12

Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?

Accepted Answer

Distributed denial-of-service (DDoS) attack. Multiple ESTABLISHED connections on port 443 (HTTPS) from different external IPs to the same process ID indicate a distributed denial-of-service (DDoS) attack. In a DDoS, many compromised hosts (botnet) simultaneously establish legitimate TCP handshakes and maintain connections to exhaust server resources, such as connection slots or memory, at the application layer. The key clue is the diversity of source IPs targeting a single process, which is characteristic of a coordinated flood from many distinct sources.

Answer

SSL/TLS renegotiation DoS

Answer

Slowloris attack

Answer

Man-in-the-middle attack

Question 13

A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection on open ports, and `-O` attempts OS fingerprinting. The scan is limited to ports 22, 80, 443, and 3389 across the 192.168.1.0/24 subnet. This combination performs a half-open scan on those four ports, identifies the versions of services running on them, and tries to determine the operating system of each host.

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services

Question 14

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

Accepted Answer

Decoy scan. The command `nmap -sS -D RND:10` performs a SYN stealth scan with 10 randomly generated decoy IP addresses. The IDS logs show multiple SYN packets from different source IPs, but the tester's true IP is not among them because Nmap sends the decoy packets with spoofed source addresses while the real scan packet is interleaved among them. This is the definition of a decoy scan, which aims to obscure the attacker's true origin by blending it with fake sources.

Answer

Idle scan

Answer

SYN flood

Answer

Fragmentation attack

Question 15

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.

Answer

John the Ripper

Answer

Ophcrack

Answer

Hashcat

Question 16

Which tool is specifically designed to crack Windows LM and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 17

During a ransomware incident response, a forensic analyst recovers a suspicious file that appears to be a PE executable. The analyst wants to quickly check if the file is known malware without executing it. Which of the following is the BEST first step?

Accepted Answer

Submit the file hash to VirusTotal. Submitting the file hash to VirusTotal is the best first step because it leverages aggregated antivirus engines and threat intelligence to quickly determine if the file is known malware, without any execution risk. This approach is fast, non-invasive, and provides immediate reputation data from over 70 security vendors, making it ideal for triage during incident response.

Answer

Disassemble the file using IDA Pro

Answer

Perform static analysis using PEiD to identify compiler and packer

Answer

Run the file in a sandbox and observe its behavior

Question 18

A security analyst wants to identify all live hosts on a network without generating excessive traffic. Which of the following techniques is MOST appropriate for this purpose?

Accepted Answer

Ping sweep using ICMP echo requests. A ping sweep using ICMP Echo Requests (Type 8) is the most efficient method to identify live hosts on a network because it sends a single packet per target and listens for ICMP Echo Replies (Type 0). This generates minimal traffic compared to full port scans, making it ideal for initial reconnaissance without overwhelming the network or triggering intrusion detection systems.

Answer

Banner grabbing with Netcat

Answer

Full TCP connect scan on all ports

Answer

UDP scan on common ports

Question 19

A user receives a phone call from someone claiming to be from IT support, asking for their password to perform a system update. This is an example of which social engineering technique?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (pretext) to manipulate a target into divulging sensitive information. In this case, the caller creates a false identity (IT support) and a false reason (system update) to trick the user into revealing their password. This differs from other techniques because it relies on a constructed narrative rather than malicious software or direct impersonation via email or phone alone.

Answer

Baiting

Answer

Phishing

Answer

Vishing

Question 20

An attacker uses a tool that precomputes hash chains for common passwords to crack password hashes quickly. Which technique is the attacker employing?

Accepted Answer

Rainbow table attack. Rainbow table attack. This technique involves precomputing hash chains for common passwords and storing them in a table, allowing the attacker to reverse password hashes quickly by looking up the hash in the table rather than computing hashes on the fly. The tool described matches the core concept of a rainbow table, which uses a time-memory trade-off to crack hashes efficiently.

Answer

Dictionary attack

Answer

Brute-force attack

Answer

Hybrid attack