CEH Practice Exam 3 — 20 Questions

Question 1

A security analyst notices that an internal server is sending a high volume of DNS queries to external servers for non-existent domains. Which type of malware behavior is MOST likely being observed?

Accepted Answer

A worm spreading across the network. A high volume of DNS queries to external servers for non-existent domains is a classic indicator of a worm using DNS as a covert channel for command-and-control (C2) communication or propagation. Worms often generate random domain names (e.g., Domain Generation Algorithm, DGA) to evade static blocklists, and the high query rate reflects attempts to resolve these domains to locate a C2 server or to spread to new hosts via DNS-based discovery.

Answer

Spyware exfiltrating data

Answer

A keylogger capturing keystrokes

Answer

Ransomware encrypting files

Question 2

An analyst runs the following command: `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap`. What is the primary purpose of this command?

Accepted Answer

To capture only HTTP traffic from a specific source IP and save it to a file. The command `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap` uses a BPF (Berkeley Packet Filter) expression to capture only packets originating from source IP 192.168.1.10 and destined for TCP port 80 (HTTP). The `-w` flag writes the filtered packets directly to a pcap file, not to standard output, making the primary purpose to capture and save specific HTTP traffic for later analysis.

Answer

To perform a man-in-the-middle attack on HTTP traffic

Answer

To capture all traffic on eth0 and display it in real-time

Answer

To analyze the payload of HTTP packets in real-time

Question 3

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

Accepted Answer

Masscan. Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Answer

OpenVAS

Answer

hping3

Answer

Nmap

Question 4

During a security assessment, a tester uses Maltego to gather information about a target organization. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. Maltego is a tool that collects publicly available information from sources like DNS records, WHOIS databases, and social media without directly interacting with the target's systems. This aligns with passive reconnaissance, which relies on open-source intelligence (OSINT) and does not send any packets to the target's network. The CEH defines passive reconnaissance as gathering information without engaging the target, making option A correct.

Answer

Active reconnaissance

Answer

Vulnerability scanning

Answer

Social engineering

Question 5

During a penetration test, you run the following command: nmap -sV -p 80 --script http-title 192.168.1.10. The output shows that port 80 is open and the HTTP title is 'Login Portal'. Which phase of the penetration testing methodology does this activity represent?

Accepted Answer

Scanning and enumeration. The nmap command with -sV (service version detection) and --script http-title performs service fingerprinting and banner grabbing on port 80, which is a core activity of the scanning and enumeration phase. This phase follows footprinting and involves actively probing target systems to discover open ports, running services, and application details like the HTTP title 'Login Portal'. It does not involve exploiting vulnerabilities (exploitation) or maintaining access (post-exploitation), nor is it passive information gathering (footprinting).

Answer

Exploitation

Answer

Post-exploitation

Answer

Footprinting

Question 6

During a penetration test, you enumerate a Linux NFS server and discover that the /export directory is mounted with 'no_root_squash' and 'world_readable' permissions. Which of the following actions would allow you to escalate to root access on the NFS client?

Accepted Answer

Mount the share, create a setuid binary owned by root, then execute it on the client. Mounting an NFS export with 'no_root_squash' means that root on the client is treated as root on the server. By creating a setuid binary owned by root on the mounted share, any user on the client can execute that binary and gain root privileges on the client system, effectively escalating from a regular user to root.

Answer

Create a symbolic link to /etc/shadow on the server from the client

Answer

Use 'showmount -e' to list exports and then mount the share with 'mount -t nfs -o vers=3'

Answer

Run 'sudo nmap --script nfs-ls' to list files on the export

Question 7

A penetration tester is performing reconnaissance and wants to identify email addresses associated with a target domain. Which tool is specifically designed for this purpose?

Accepted Answer

theHarvester. TheHarvester is specifically designed for passive reconnaissance to gather email addresses, subdomains, and other open-source intelligence (OSINT) from public sources like search engines, PGP key servers, and the SHODAN database. It directly queries these sources to extract email addresses associated with a target domain, making it the correct tool for this task.

Answer

Nmap

Answer

Shodan

Answer

Maltego

Question 8

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

Accepted Answer

Rootkit. The attacker is most likely using a rootkit to cover tracks because rootkits are designed to hide malicious activity by intercepting system calls (e.g., via LD_PRELOAD or kernel modules) to hide processes, files, and network connections. The truncated auth.log and modified timestamps on binaries in /bin/ indicate the rootkit is actively tampering with system logs and file metadata to evade detection, which aligns with rootkit behavior rather than simpler tools.

Answer

Timestamp manipulation tool

Answer

Steganography

Answer

Log cleaner script

Question 9

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

Accepted Answer

Configure Nessus to use a 'safe' scan policy that disables disruptive plugins. Nessus 'safe' scan policies disable plugins known to cause service disruption, such as those performing denial-of-service tests or exploiting vulnerabilities that may crash services. By using a safe policy, the analyst avoids aggressive checks that can degrade server performance or cause unresponsiveness, which is a common risk during vulnerability scanning.

Answer

Increase the scan intensity to complete faster and reduce the load

Answer

Use a different scanner like OpenVAS which is less intrusive

Answer

Run the scan during peak hours to blend in with normal traffic

Question 10

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

Accepted Answer

dnsrecon -d example.com -t axfr. The `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Answer

dig example.com ANY

Answer

nslookup -type=ns example.com

Answer

theHarvester -d example.com -l 500 -b google

Question 11

A security analyst suspects an attacker has used a rainbow table to crack password hashes from a compromised system. Which password cracking technique involves precomputed hash chains?

Accepted Answer

Rainbow table attack. A rainbow table attack is the correct answer because it specifically uses precomputed hash chains to reverse cryptographic hash functions. Rainbow tables are a form of time-memory trade-off where chains of hashes are computed and stored, allowing an attacker to look up a hash and quickly find the original plaintext without recomputing all possible hashes. This technique is distinct from other methods because it relies on precomputation rather than real-time guessing or dictionary lookups.

Answer

Dictionary attack

Answer

Brute force attack

Answer

Hybrid attack

Question 12

Which of the following tools is specifically designed for high-speed port scanning across large address spaces?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.

Answer

Zenmap

Answer

hping3

Answer

Nmap

Question 13

During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 14

During a penetration test, the tester needs to identify the operating system of a remote host without sending any packets to it. Which technique should the tester use?

Accepted Answer

Passive OS fingerprinting using captured packets. Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.

Answer

Banner grabbing with Telnet

Answer

Querying Shodan for the target IP

Answer

Active OS fingerprinting with Nmap -O

Question 15

An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?

Accepted Answer

Session hijacking. The attacker is actively intercepting a TCP session, predicting sequence numbers, and injecting malicious packets, which is the definition of TCP session hijacking. This attack exploits the lack of authentication in TCP connections, where the attacker can take over an established session by correctly guessing or obtaining the next sequence number.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

Man-in-the-middle

Question 16

An attacker attempts to log into a web application by trying many common passwords for a list of known usernames. Which type of authentication attack is this?

Accepted Answer

Password spraying. Password spraying involves using a few common passwords against many usernames to avoid account lockouts, as opposed to brute force (many passwords on one account) or credential stuffing (using known username/password pairs).

Answer

Dictionary attack

Answer

Credential stuffing

Answer

Brute force attack

Question 17

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process

Question 18

During a penetration test, you run the command: nmap -sU -p 161,162 --script=snmp-brute 192.168.1.100. Which of the following is the PRIMARY goal of this scan?

Accepted Answer

Discover SNMP community strings via brute-force. The command uses the `-sU` flag for a UDP scan and targets ports 161 and 162, which are the standard SNMP ports. The `--script=snmp-brute` script attempts to brute-force SNMP community strings (the equivalent of passwords for SNMPv1/v2c). Therefore, the primary goal is to discover valid community strings, which is option A.

Answer

Perform a ping sweep to discover live hosts

Answer

Identify open TCP ports and services on the target

Answer

Enumerate SNMP MIB tree values

Question 19

During a penetration test, the tester uses a tool that queries search engines with specific operators to find sensitive information such as login pages, exposed directories, and file types. Which tool or technique is being used?

Accepted Answer

Google dorking. Google dorking (also known as Google hacking) uses advanced search operators (e.g., intitle:, filetype:, inurl:) to uncover sensitive information indexed by search engines, such as login pages, exposed directories, and specific file types. This technique directly matches the description of querying search engines with operators to find hidden or sensitive data.

Answer

Shodan

Answer

theHarvester

Answer

DNS zone transfer

Question 20

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

Accepted Answer

-sn (ping sweep). The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.

Answer

-O (OS fingerprinting)

Answer

-sS (SYN scan)

Answer

-sV (version detection)