CEH Practice Exam 3 — 20 Questions

Question 1

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

Accepted Answer

Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.. Option B is correct because the symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

Answer

Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.

Answer

Increase the number of application servers to handle the load.

Answer

Run a SQL injection scanner on the application.

Question 2

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Accepted Answer

The file is authentic and has not been tampered with.. Option C is correct because the SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Answer

The file has been tampered with because the hash is from a different file.

Answer

The SHA256 hash is not reliable; the analyst should use MD5 instead.

Answer

The file is malicious because the hash is too long.

Question 3

During a penetration test, an ethical hacker captures a WPA2 handshake and successfully cracks the PSK. Which additional action must be taken to decrypt previously captured traffic?

Accepted Answer

Compute the Pairwise Master Key Identifier (PMKID) from the PSK and AP MAC.. Option A is correct because after cracking the WPA2 Pre-Shared Key (PSK), the Pairwise Master Key (PMK) is derived from the PSK, SSID, and hashing iterations (PBKDF2). To decrypt previously captured traffic, you need the Pairwise Transient Key (PTK), which is computed from the PMK, the client nonce (SNonce), the AP nonce (ANonce), and both MAC addresses. However, the nonces are exchanged during the 4-way handshake and are present in the captured handshake; the missing piece is the PMKID, which is derived from the PMK, AP MAC, and STA MAC. Computing the PMKID from the cracked PSK and AP MAC allows tools like aircrack-ng to verify the correct PMK and then derive the PTK to decrypt the traffic.

Answer

Capture the nonce values from the access point.

Answer

Use the PSK directly to compute the Michael Integrity Check (MIC).

Answer

Obtain the Group Temporal Key (GTK) from the access point.

Question 4

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

Accepted Answer

Enforce HTTPS using TLS 1.2 or higher.. HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Answer

Implement password hashing with bcrypt on the server side.

Answer

Use digital signatures to sign the login request.

Answer

Encrypt the password field using AES-256 before sending via HTTP.

Question 5

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Accepted Answer

Parameter tampering. Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer

Directory traversal

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 6

A cloud security engineer wants to ensure that only authorized users can access an S3 bucket containing sensitive data. Which AWS service should be used to enforce fine-grained access control?

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS CloudFront

Question 7

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Accepted Answer

Query string parameters. SQL injection attacks commonly target query string parameters because user input in URLs is often directly concatenated into SQL queries without proper sanitization. A WAF configured to inspect and filter query string parameters can block malicious SQL payloads before they reach the database server, as these parameters are the most frequent vector for such attacks.

Answer

Request body (POST data)

Answer

Cookie headers

Answer

User-Agent header

Question 8

During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?

Accepted Answer

The DNS server can be used for denial of service. Option D is correct because a DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.

Answer

Unauthorized zone transfers are possible

Answer

The DNS server can be used for denial of service (amplification)

Answer

The DNS cache can be poisoned easily

Question 9

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

Accepted Answer

Restrict recursive queries to trusted sources. Option B is correct because restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning.

Answer

Use a single DNS server for all queries

Answer

Disable DNS caching

Question 10

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. Option B is correct because a 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 11

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

Answer

UDP flood

Answer

ARP spoofing

Answer

ICMP flood

Question 12

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) is a common web application vulnerability that allows an attacker to inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. This occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling the attacker to execute arbitrary code in the victim's browser within the context of the trusted site.

Answer

Brute Force

Answer

Path Traversal

Answer

Cross-Site Request Forgery (CSRF)

Question 13

A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. The attacker is fabricating a scenario (IT help desk performing a security update) to manipulate the target into revealing sensitive information. This is the essence of pretexting, where the attacker creates a false identity or situation to gain trust and extract data. Unlike phishing, which typically uses malicious links or attachments, this attack relies purely on verbal impersonation and social manipulation.

Answer

Tailgating

Answer

Quid pro quo

Answer

Phishing

Question 14

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Accepted Answer

SYN scan. C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

Answer

TCP connect scan

Answer

UDP scan

Answer

FIN scan

Question 15

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

Accepted Answer

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.. Option B is correct because it targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

Answer

Conduct a full TCP port scan of the entire network using SYN scan.

Answer

Use a ping sweep to identify live hosts, then perform a version scan on each.

Answer

Perform an ARP scan of the entire subnet and then check each host manually.

Question 16

A penetration tester is performing a footprinting exercise on a target company. The tester wants to identify the network range and ISP of the target. Which of the following tools or techniques is MOST appropriate for this purpose?

Accepted Answer

Perform a WHOIS lookup against the domain. A WHOIS lookup against the target domain returns registration details that include the organization's network range (via the 'NetRange' or 'CIDR' fields) and the ISP (via the 'OrgName' or 'descr' fields). This directly maps to the footprinting goal of identifying the target's IP address block and upstream provider, as defined in RFC 3912 and common WHOIS database schemas.

Answer

Query the Netcraft site for the domain

Answer

Use nslookup to query the authoritative name servers

Answer

Run a traceroute to the target web server

Question 17

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Accepted Answer

A firewall, router rule, or host-based firewall is blocking the probes.. When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Answer

The port is closed and the target sent a RST packet.

Answer

The port is open but the service is not responding to the scan.

Answer

The port is open but Nmap cannot determine the service.

Question 18

You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?

Accepted Answer

Traceroute. Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.

Answer

Banner grabbing

Answer

DNS enumeration

Answer

SNMP walk

Question 19

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Accepted Answer

-f (fragment packets). Option A is correct because the -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Answer

-sT (TCP connect scan)

Answer

-sV (version detection)

Question 20

A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?

Accepted Answer

Ping sweep using `nmap -sn`. Option C is correct because `nmap -sn` (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default, allowing the analyst to discover live hosts without scanning every port or sending packets to every IP individually. This minimizes network traffic compared to full port scans while still efficiently identifying active devices on the 192.168.1.0/24 subnet.

Answer

TCP SYN scan using `nmap -sS`

Answer

ARP scan using `nmap -PR`

Answer

UDP scan using `nmap -sU`