CEH Practice Test 21 — 15 Questions

Question 1

Which of the following is a primary purpose of the enumeration phase in a penetration test?

Accepted Answer

To gather in-depth information about the target system and its resources. The enumeration phase is the active process of extracting detailed information about a target system, such as user accounts, network shares, services, and system policies, using direct queries. This phase goes beyond passive reconnaissance by establishing connections to the target to gather data that can be used to identify attack vectors. In a CEH context, enumeration is specifically defined as the step where the tester collects in-depth information about the target's resources and potential entry points.

Answer

To exploit identified vulnerabilities and gain access

Answer

To perform a vulnerability scan on the target network

Answer

To delete logs and cover tracks after a successful compromise

Question 2

You are a security analyst at a financial institution. The SOC has detected anomalous outbound traffic from a server in the DMZ to an unknown IP address on TCP port 8443. The server runs a custom application that normally communicates with internal databases on port 1433. The server's OS is Windows Server 2019. Preliminary analysis shows that a new service named 'UpdateSvc' was installed three days ago, set to start automatically, and runs under the LocalSystem account. The service binary is located at C:\Windows\System32\svchost.exe (the legitimate one). However, the service's 'ImagePath' registry key points to 'C:\Windows\System32\svchost.exe -k UpdateSvc'. Additionally, a scheduled task named 'HealthCheck' runs every hour and executes 'powershell.exe -EncodedCommand <base64>'. The encoded command decodes to a script that downloads a payload from the same unknown IP on port 8443 and executes it in memory. The server has antivirus installed that detected nothing. As the analyst, which of the following is the BEST immediate course of action?

Accepted Answer

Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.. The immediate priority is to contain the threat by isolating the compromised server from the network (disconnecting the cable) and blocking the command-and-control IP at the firewall. This stops the ongoing outbound communication on TCP port 8443 and prevents further payload downloads or data exfiltration. Initiating incident response procedures ensures proper forensic collection and analysis, which is critical before any remediation steps like reimaging or deleting artifacts.

Answer

Reimage the server immediately to ensure the malware is completely removed.

Answer

Uninstall the current antivirus and install a different endpoint protection solution, then perform a full scan.

Answer

Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled task, then run a full antivirus scan.

Question 3

Which of the following commands would a tester use to enumerate NetBIOS names and their associated IP addresses on a local subnet?

Accepted Answer

nbtstat -A 192.168.1.10. The `nbtstat -A` command (with a capital 'A') performs a NetBIOS name table lookup against a remote IP address, listing the NetBIOS names registered by that host along with their associated IP addresses. This is the standard method for enumerating NetBIOS names on a specific target within a local subnet, as it queries the NetBIOS name service (UDP port 137) directly.

Answer

nbtstat -n

Answer

nbtstat -c

Answer

nbtstat -a 192.168.1.10

Question 4

A penetration tester is attempting to escalate privileges on a Linux target. The tester runs `find / -perm -4000 -type f 2>/dev/null` and discovers that `/usr/bin/pkexec` has the SUID bit set. The target runs Ubuntu 20.04 with default configurations. Which of the following is the MOST likely next step?

Accepted Answer

Exploit the pkexec vulnerability (CVE-2021-4034) to gain root access. CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in pkexec that allows unprivileged users to escalate privileges to root by exploiting an out-of-bounds write in the argument parsing logic. On Ubuntu 20.04 with default configurations, the pkexec binary is SUID root and vulnerable to this exploit, making it the most direct and effective next step for privilege escalation.

Answer

Change the ownership of the pkexec binary to root:root

Answer

Use pkexec to execute a command as root directly

Answer

Remove the SUID bit from pkexec to prevent misuse

Question 5

Which of the following is a passive OS fingerprinting technique that does NOT send any packets to the target?

Accepted Answer

Analyzing TTL and window size from captured packets. Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the Time-to-Live (TTL) and TCP window size from captured packets is a classic passive technique because these values are OS-specific defaults (e.g., Linux often uses TTL 64 and window size 5840, while Windows uses TTL 128 and window size 65535). Since no packets are sent to the target, this method is entirely passive and undetectable.

Answer

Sending TCP SYN packets and analyzing responses

Answer

Performing a NULL scan

Answer

Using Nmap -O flag

Question 6

Which tool is specifically designed to crack Windows LM and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted use case.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 7

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Question 8

A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?

Accepted Answer

It identifies the version of the SSH service running. The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.

Answer

It confirms the OS is Linux 2.6.x

Answer

It checks if the port is filtered by a firewall

Answer

It performs a UDP scan on port 22

Question 9

A security analyst runs the command: nmap -sS -p 80,443,8080 --script http-headers scanme.nmap.org. The output shows that port 80 is filtered. What does 'filtered' mean in this context?

Accepted Answer

A firewall or IDS is preventing the probe from reaching the port. In Nmap, a 'filtered' port status indicates that the port is being blocked by a firewall, IDS, or other network filtering device, preventing the probe from reaching the target service. The -sS (SYN stealth scan) sends a SYN packet; if no response is received or an ICMP unreachable (type 3, code 13) is returned, Nmap marks the port as filtered. This does not mean the port is open or closed—it means the scan could not determine the state due to filtering.

Answer

The port is open, but the service is not responding

Answer

The port is open and actively listening

Answer

The port is closed, but the target is responding with RST packets

Question 10

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Accepted Answer

The file is authentic and has not been tampered with.. The SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Answer

The file has been tampered with because the hash is from a different file.

Answer

The SHA256 hash is not reliable; the analyst should use MD5 instead.

Answer

The file is malicious because the hash is too long.

Question 11

A user reports that their system has become sluggish and they see pop-up advertisements even when no browser is open. Additionally, unknown processes are running in Task Manager. Which type of malware is most likely responsible?

Accepted Answer

Adware. Adware is designed to display unwanted advertisements, often in the form of pop-ups, and can degrade system performance by consuming CPU and memory resources. The presence of unknown processes in Task Manager indicates that the adware has installed additional components or bundled software that runs persistently, even when no browser is open, which is a hallmark of adware behavior.

Answer

Worm

Answer

Ransomware

Answer

Spyware

Question 12

During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is the correct answer because the attacker fabricates a scenario (the pretext of being a new employee with a locked account) to manipulate the help desk into performing a password reset. This technique relies on a crafted story to gain trust and bypass security procedures, rather than using technical exploits or direct requests for information.

Answer

Phishing

Answer

Vishing

Answer

Quid pro quo

Question 13

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Accepted Answer

The attacker extracted hashed passwords that can be cracked offline. The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Answer

The attacker successfully performed a blind SQL injection to enumerate the database structure

Answer

The attacker caused a denial of service by sending an invalid query

Answer

The attacker modified the database records to update user passwords

Question 14

A penetration tester is trying to evade an IDS that detects out-of-order TCP packets. The tester uses Nmap with the -f flag. What is the PRIMARY effect of this flag?

Accepted Answer

Splits the TCP header into multiple packets to bypass simple packet filters. The `-f` flag in Nmap fragments the IP packet into smaller pieces, typically 8-byte fragments, which splits the TCP header across multiple packets. This fragmentation causes the IDS to see out-of-order or incomplete TCP headers, making it harder for signature-based detection to reassemble and match malicious patterns, thus bypassing simple packet filters that do not perform full TCP reassembly.

Answer

Slows down the scan to avoid triggering rate-based alarms

Answer

Sends packets from multiple decoy IP addresses to obscure the source

Answer

Spoofs the source IP address to hide the attacker's identity

Question 15

A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?

Accepted Answer

Slowloris attack. The Slowloris attack works by opening multiple HTTP connections to the target web server and sending partial HTTP headers, then keeping those connections alive by sending periodic small packets to prevent timeout. This exhausts the server's connection pool, leading to slow response times and denial of service for legitimate users, matching the described symptoms of incomplete requests and long-held connections.

Answer

HTTP flood

Answer

SYN flood

Answer

UDP flood