CEH Practice Test 21 — 15 Questions

Question 1

A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?

Accepted Answer

NetBIOS. The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 2

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

Accepted Answer

Polymorphic virus. Polymorphic virus is correct because it mutates its code signature each time it replicates, using a mutation engine to generate new decryption routines while keeping the payload intact. This allows it to evade signature-based detection, as each copy appears different to antivirus software that relies on static signatures.

Answer

Boot sector virus

Answer

Macro virus

Answer

Worm

Question 3

A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing the malware in a controlled environment (sandbox) to observe its runtime behavior, such as contacting a C2 server and downloading additional payloads. This contrasts with static analysis, which examines the code without execution. The scenario explicitly describes observing behavior during execution, confirming dynamic analysis.

Answer

Static analysis

Answer

Network analysis

Answer

Code analysis

Question 4

Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?

Accepted Answer

Ettercap. Ettercap is a dedicated man-in-the-middle (MITM) attack tool that natively supports ARP poisoning. It sends forged ARP replies to both the victim and the default gateway, mapping the attacker's MAC address to the IP addresses of the other party. This allows the attacker to intercept, inspect, and modify traffic between the victim and the gateway.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 5

An attacker has gained access to a system and wants to erase evidence of their activities. Which of the following actions is MOST effective for covering tracks on a Windows system?

Accepted Answer

Clearing the Security event log. Clearing the Security event log (C) is the most effective action for covering tracks on a Windows system because it removes all logged security events, such as logon attempts, privilege use, and audit failures, which are the primary records that would reveal an attacker's activities. The Security log is maintained by the Windows Event Log service and is the default location for audit records under the Local Security Policy; deleting it eliminates forensic evidence of unauthorized access or changes.

Answer

Disabling the Windows Firewall

Answer

Installing a rootkit

Answer

Changing the administrator password

Question 6

Which of the following tools is specifically designed to exploit WPS vulnerabilities on wireless networks?

Accepted Answer

Reaver. Reaver is specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate limiting and the fact that the PIN is split into two halves, making it feasible to guess the 8-digit PIN in under 10,000 attempts. This allows an attacker to recover the WPA/WPA2 pre-shared key without needing to crack the actual encryption.

Answer

John the Ripper

Answer

aircrack-ng

Answer

Kismet

Question 7

A penetration tester captures the following output from a command: 'smb: \> ls \192.168.1.20\C$'. The tester is able to list the contents of the C$ share without providing credentials. Which of the following is the MOST likely reason for this access?

Accepted Answer

The target has a null session vulnerability that allows access to admin shares. The output shows the tester successfully listing the C$ share (a default administrative share) without providing credentials. This is a classic indicator of a null session vulnerability, where Windows allows unauthenticated access to IPC$ and, in some configurations, admin shares via SMB. The tester is leveraging the default null session to enumerate or access these shares, which is a well-known weakness in older Windows systems or misconfigured Samba servers.

Answer

The C$ share is intentionally shared with Everyone

Answer

The target is running a Samba server with weak permissions

Answer

The tester is using a pass-the-hash attack

Question 8

A security analyst observes repeated log entries showing `EXPN` commands from an external IP address to the company's mail server. What is the MOST likely objective of this activity?

Accepted Answer

Enumerating valid email addresses and mailing list members. The `EXPN` command is part of the SMTP protocol (RFC 5321) and is used to expand a mailing list or alias, revealing the individual email addresses that belong to it. By repeatedly issuing `EXPN` commands, an attacker can enumerate valid email addresses and mailing list members, which is a reconnaissance technique for gathering targets for phishing or social engineering. This aligns with the enumeration phase of system hacking, where the goal is to extract user and service information.

Answer

Testing SMTP authentication mechanisms

Answer

Attempting to perform a denial-of-service attack

Answer

Delivering spam emails through open relay

Question 9

Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?

Accepted Answer

intitle:login. The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.

Answer

inurl:robots.txt

Answer

filetype:pdf

Answer

cache:example.com

Question 10

Which type of malware is characterized by self-replication and spreading across networks without needing a host file?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself to spread to other computers over a network, exploiting vulnerabilities or using social engineering, without requiring a host file or user intervention. Unlike viruses, worms do not need to attach to an existing program; they operate independently, often using network protocols like SMB, HTTP, or email to propagate.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 11

A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?

Accepted Answer

Fragmentation. The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.

Answer

Decoy scan

Answer

ACK scan

Answer

Idle scan

Question 12

A forensic analyst examining a compromised Linux system finds the following entry in /var/log/auth.log: `Mar 15 10:23:45 server sshd[1234]: Accepted password for root from 10.0.0.5 port 54321 ssh2`. However, the analyst also notices that /var/log/auth.log has been truncated and the /etc/ssh/sshd_config file contains `LogLevel QUIET`. Which attack phase is most likely being obscured?

Accepted Answer

Erasing tracks. The presence of `LogLevel QUIET` in sshd_config suppresses all authentication log entries, and the truncation of /var/log/auth.log indicates an attempt to remove evidence of unauthorized access. Together, these actions are classic examples of erasing tracks, as the attacker is modifying logs and configuration to hide their activities from forensic analysis.

Answer

Privilege escalation

Answer

Executing applications

Answer

Spying

Question 13

A penetration tester runs `snmpwalk -c public -v2c 192.168.1.50 1.3.6.1.2.1.1` and receives a list of system descriptions, uptime, and contact information. Which type of information is the tester primarily gathering?

Accepted Answer

System information and version details. The `snmpwalk` command with the OID `1.3.6.1.2.1.1` (the system group in MIB-II, defined in RFC 1213) queries the SNMP agent for system-level information. The output includes system description, uptime, contact, and version details, which are all part of the system group. This is a classic enumeration technique to gather system information and version details from a target device using SNMP with the default public community string.

Answer

SMB share names and permissions

Answer

Network topology and routing tables

Answer

Active directory users and groups

Question 14

During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?

Accepted Answer

ldapsearch. ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.

Answer

nbtstat

Answer

smbclient

Answer

snmpwalk

Question 15

A user reports that their system has become very slow and numerous pop-up ads appear even when browsing is not active. Which type of malware is MOST likely installed?

Accepted Answer

Adware. Adware is designed to automatically deliver advertisements, often generating pop-up ads even when the browser is not active, and it consumes system resources, causing slowdowns. The user's symptoms—persistent pop-ups and performance degradation—are classic indicators of adware infection, as adware typically runs background processes to fetch and display ads.

Answer

Ransomware

Answer

Keylogger

Answer

Spyware