CEH Practice Exam 2 — 20 Questions

Question 1

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use ldapsearch to query the directory for all attributes. `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Answer

Run nmap with the smb-enum-shares script

Answer

Perform a DNS zone transfer

Answer

Use net view to list domain resources

Question 2

Which THREE of the following are valid techniques in the system hacking methodology (CHPSET)? (Choose three.)

Accepted Answer

Privilege escalation. In the CEH system hacking methodology (often summarized as CHPSET: Cracking passwords, Hiding files, Privilege escalation, Executing applications, Covering tracks/erasing tracks, and Creating backdoors), privilege escalation (A) is a core step because after gaining initial access the attacker elevates from a low-privileged account to root/SYSTEM or administrator rights to fully control the target. Erasing tracks (C) is also a core step, covering log tampering, clearing event logs, disabling auditing, and removing artifacts so the intrusion is not detected or attributed. Cracking passwords (E) is the first phase of CHPSET, where techniques such as dictionary, brute-force, rainbow-table, and hybrid attacks recover or bypass credentials to obtain valid access. Social engineering (B) is not part of the system hacking methodology; it belongs to the earlier footprinting/scanning or social-engineering phase of the CEH attack lifecycle. Network sniffing (D) is likewise a separate CEH domain (sniffing), used for capturing traffic, not a step in the CHPSET system hacking sequence.

Answer

Social engineering

Answer

Network sniffing

Question 3

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 4

A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?

Accepted Answer

Masscan can scan a large number of hosts and ports at very high speed. Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.

Answer

Masscan provides more detailed service version detection than Nmap

Answer

Masscan is stealthier than Nmap and less likely to be detected

Answer

Masscan can scan all 65535 ports faster than Nmap

Question 5

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). ECDHE is prioritized for Perfect Forward Secrecy because it generates a unique, ephemeral session key for each TLS handshake using elliptic curve cryptography, ensuring that if the server's long-term private key is compromised, past session keys remain secure. Unlike static Diffie-Hellman, ECDHE does not reuse key material, and it offers stronger security per bit compared to traditional DH, making it the recommended choice for PFS in modern HTTPS configurations.

Answer

Diffie-Hellman (DH) key exchange

Answer

Pre-Shared Key (PSK)

Answer

RSA key exchange

Question 6

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

Accepted Answer

UDP flood. A UDP flood attack works by overwhelming a target server with a high volume of UDP packets sent to random high-numbered ports. The server checks each port for a listening application, and when none is found, it responds with ICMP Destination Unreachable messages, consuming CPU and bandwidth until the server becomes unresponsive. The use of spoofed source IP addresses makes it difficult to filter the attack traffic based on source alone.

Answer

ICMP flood

Answer

SYN flood

Answer

Smurf attack

Question 7

Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?

Accepted Answer

Distributed denial-of-service (DDoS) attack. Multiple ESTABLISHED connections on port 443 (HTTPS) from different external IPs to the same process ID indicate a distributed denial-of-service (DDoS) attack. In a DDoS, many compromised hosts (botnet) simultaneously establish legitimate TCP handshakes and maintain connections to exhaust server resources, such as connection slots or memory, at the application layer. The key clue is the diversity of source IPs targeting a single process, which is characteristic of a coordinated flood from many distinct sources.

Answer

SSL/TLS renegotiation DoS

Answer

Slowloris attack

Answer

Man-in-the-middle attack

Question 8

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

Accepted Answer

Decoy scan. The command `nmap -sS -D RND:10` performs a SYN stealth scan with 10 randomly generated decoy IP addresses. The IDS logs show multiple SYN packets from different source IPs, but the tester's true IP is not among them because Nmap sends the decoy packets with spoofed source addresses while the real scan packet is interleaved among them. This is the definition of a decoy scan, which aims to obscure the attacker's true origin by blending it with fake sources.

Answer

Idle scan

Answer

SYN flood

Answer

Fragmentation attack

Question 9

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.

Answer

John the Ripper

Answer

Ophcrack

Answer

Hashcat

Question 10

Which tool is specifically designed to crack Windows LM and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 11

During a ransomware incident response, a forensic analyst recovers a suspicious file that appears to be a PE executable. The analyst wants to quickly check if the file is known malware without executing it. Which of the following is the BEST first step?

Accepted Answer

Submit the file hash to VirusTotal. Submitting the file hash to VirusTotal is the best first step because it leverages aggregated antivirus engines and threat intelligence to quickly determine if the file is known malware, without any execution risk. This approach is fast, non-invasive, and provides immediate reputation data from over 70 security vendors, making it ideal for triage during incident response.

Answer

Disassemble the file using IDA Pro

Answer

Perform static analysis using PEiD to identify compiler and packer

Answer

Run the file in a sandbox and observe its behavior

Question 12

A security analyst wants to identify all live hosts on a network without generating excessive traffic. Which of the following techniques is MOST appropriate for this purpose?

Accepted Answer

Ping sweep using ICMP echo requests. A ping sweep using ICMP Echo Requests (Type 8) is the most efficient method to identify live hosts on a network because it sends a single packet per target and listens for ICMP Echo Replies (Type 0). This generates minimal traffic compared to full port scans, making it ideal for initial reconnaissance without overwhelming the network or triggering intrusion detection systems.

Answer

Banner grabbing with Netcat

Answer

Full TCP connect scan on all ports

Answer

UDP scan on common ports

Question 13

A user receives a phone call from someone claiming to be from IT support, asking for their password to perform a system update. This is an example of which social engineering technique?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (pretext) to manipulate a target into divulging sensitive information. In this case, the caller creates a false identity (IT support) and a false reason (system update) to trick the user into revealing their password. This differs from other techniques because it relies on a constructed narrative rather than malicious software or direct impersonation via email or phone alone.

Answer

Baiting

Answer

Phishing

Answer

Vishing

Question 14

An attacker uses a tool that precomputes hash chains for common passwords to crack password hashes quickly. Which technique is the attacker employing?

Accepted Answer

Rainbow table attack. Rainbow table attack. This technique involves precomputing hash chains for common passwords and storing them in a table, allowing the attacker to reverse password hashes quickly by looking up the hash in the table rather than computing hashes on the fly. The tool described matches the core concept of a rainbow table, which uses a time-memory trade-off to crack hashes efficiently.

Answer

Dictionary attack

Answer

Brute-force attack

Answer

Hybrid attack

Question 15

A security analyst notices that an internal server is sending a high volume of DNS queries to external servers for non-existent domains. Which type of malware behavior is MOST likely being observed?

Accepted Answer

A worm spreading across the network. A high volume of DNS queries to external servers for non-existent domains is a classic indicator of a worm using DNS as a covert channel for command-and-control (C2) communication or propagation. Worms often generate random domain names (e.g., Domain Generation Algorithm, DGA) to evade static blocklists, and the high query rate reflects attempts to resolve these domains to locate a C2 server or to spread to new hosts via DNS-based discovery.

Answer

Spyware exfiltrating data

Answer

A keylogger capturing keystrokes

Answer

Ransomware encrypting files

Question 16

An analyst runs the following command: `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap`. What is the primary purpose of this command?

Accepted Answer

To capture only HTTP traffic from a specific source IP and save it to a file. The command `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap` uses a BPF (Berkeley Packet Filter) expression to capture only packets originating from source IP 192.168.1.10 and destined for TCP port 80 (HTTP). The `-w` flag writes the filtered packets directly to a pcap file, not to standard output, making the primary purpose to capture and save specific HTTP traffic for later analysis.

Answer

To perform a man-in-the-middle attack on HTTP traffic

Answer

To capture all traffic on eth0 and display it in real-time

Answer

To analyze the payload of HTTP packets in real-time

Question 17

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

Accepted Answer

Masscan. Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Answer

OpenVAS

Answer

hping3

Answer

Nmap

Question 18

During a security assessment, a tester uses Maltego to gather information about a target organization. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. Maltego is a tool that collects publicly available information from sources like DNS records, WHOIS databases, and social media without directly interacting with the target's systems. This aligns with passive reconnaissance, which relies on open-source intelligence (OSINT) and does not send any packets to the target's network. The CEH defines passive reconnaissance as gathering information without engaging the target, making option A correct.

Answer

Active reconnaissance

Answer

Vulnerability scanning

Answer

Social engineering

Question 19

During a penetration test, you run the following command: nmap -sV -p 80 --script http-title 192.168.1.10. The output shows that port 80 is open and the HTTP title is 'Login Portal'. Which phase of the penetration testing methodology does this activity represent?

Accepted Answer

Scanning and enumeration. The nmap command with -sV (service version detection) and --script http-title performs service fingerprinting and banner grabbing on port 80, which is a core activity of the scanning and enumeration phase. This phase follows footprinting and involves actively probing target systems to discover open ports, running services, and application details like the HTTP title 'Login Portal'. It does not involve exploiting vulnerabilities (exploitation) or maintaining access (post-exploitation), nor is it passive information gathering (footprinting).

Answer

Exploitation

Answer

Post-exploitation

Answer

Footprinting

Question 20

During a penetration test, you enumerate a Linux NFS server and discover that the /export directory is mounted with 'no_root_squash' and 'world_readable' permissions. Which of the following actions would allow you to escalate to root access on the NFS client?

Accepted Answer

Mount the share, create a setuid binary owned by root, then execute it on the client. Mounting an NFS export with 'no_root_squash' means that root on the client is treated as root on the server. By creating a setuid binary owned by root on the mounted share, any user on the client can execute that binary and gain root privileges on the client system, effectively escalating from a regular user to root.

Answer

Create a symbolic link to /etc/shadow on the server from the client

Answer

Use 'showmount -e' to list exports and then mount the share with 'mount -t nfs -o vers=3'

Answer

Run 'sudo nmap --script nfs-ls' to list files on the export