CEH Practice Test 22 — 15 Questions

Question 1

A security analyst is investigating a potential SMB-based attack. They notice unusual traffic on port 445 from a host running `enum4linux`. Which of the following enumeration actions could `enum4linux` perform that would generate such traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enumerating SMB shares and user accounts. enum4linux is a tool specifically designed for enumerating information from Windows and Samba systems via the SMB protocol (port 445). It can list SMB shares, retrieve user account lists, and gather other system details by querying the SMB service, which directly generates traffic on port 445.

Answer

Scanning for open ports on the target system

Answer

Performing a DNS zone transfer

Answer

Querying SNMP MIB values using community strings

Question 2

A junior penetration tester runs the command: whois example.com. What type of information are they MOST likely trying to obtain?

Accepted Answer

Domain registration details such as registrar, creation date, and contact information. The `whois` command queries a WHOIS server (typically operated by a Regional Internet Registry or domain registrar) to retrieve domain registration details. This includes the registrar name, creation and expiration dates, name servers, and often administrative/technical contact information. It is a core footprinting technique used to gather publicly available metadata about a domain owner and infrastructure.

Answer

DNS zone transfer information

Answer

The IP address of the web server

Answer

Open ports on the target server

Question 3

After gaining initial access to a Windows server, a penetration tester wants to escalate privileges. The tester finds that the current user has the 'SeImpersonatePrivilege' enabled. Which attack technique could the tester use to abuse this privilege?

Accepted Answer

Token impersonation via Juicy Potato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. Juicy Potato (and its variants like RoguePotato) exploits this by coercing the SYSTEM account to connect to a malicious named pipe, capturing its token, and using it to spawn a process with SYSTEM privileges. This is a well-known privilege escalation technique on Windows systems where the user has the SeImpersonatePrivilege.

Answer

SUID bit abuse

Answer

Pass-the-Hash attack

Answer

Log manipulation to hide tracks

Question 4

A security analyst wants to gather information about a target domain without sending any packets to the target. Which technique should the analyst use?

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., RDAP or WHOIS servers) for domain registration details such as registrar, creation date, and administrative contacts. It requires no packets to be sent to the target domain's infrastructure, making it ideal for information gathering without direct interaction.

Answer

Ping sweep

Answer

Netcat banner grab

Answer

Nmap SYN scan

Question 5

Which THREE of the following are components of the CHPSET system hacking methodology? (Select three.)

Accepted Answer

Sniffing network traffic. The CHPSET system hacking methodology includes six phases: Cracking (C), Hiding (H), Privilege Escalation (P), Sniffing (S), Executing (E), and Targeting (T). Among the given options, Sniffing network traffic (A) corresponds to Sniffing, Cracking passwords (C) to Cracking, and Executing applications (E) to Executing. Hiding files (B) is a specific activity under the Hiding phase but is not a distinct phase itself. Scanning ports (D) is a reconnaissance step performed during the pre-hacking phase, not part of CHPSET. Therefore, the three correct components are A, C, and E.

Answer

Hiding files

Answer

Scanning ports

Question 6

A security analyst observes a gradual increase in network traffic from an internal host to an external IP address on port 443, with the host also connecting to a known command-and-control (C2) domain. Which type of malware is MOST likely responsible?

Accepted Answer

Backdoor Trojan. The gradual increase in traffic to an external IP on port 443 (HTTPS) combined with connections to a known C2 domain indicates a backdoor Trojan. Backdoor Trojans establish stealthy, encrypted command-and-control channels to exfiltrate data or receive instructions, often mimicking legitimate HTTPS traffic to evade detection. This behavior aligns with a backdoor Trojan's purpose of providing unauthorized remote access while blending into normal network activity.

Answer

Ransomware

Answer

Worm

Answer

Boot sector virus

Question 7

Which TWO OSINT tools are commonly used to gather email addresses and subdomains associated with a target domain? (Select 2)

Accepted Answer

theHarvester. theHarvester (C) is correct because it is a dedicated OSINT reconnaissance tool that queries public sources such as search engines, PGP key servers, and certificate transparency logs to harvest email addresses, employee names, hosts, and subdomains for a target domain. Maltego (D) is also correct because it is a graphical link-analysis and OSINT platform whose transforms aggregate data from DNS records, WHOIS, certificate transparency, and other public sources to map domains, subdomains, and associated email addresses. Nmap (A) is a port scanner and host-discovery tool, not an email/subdomain OSINT collector, so it does not fit. Nessus (B) is a vulnerability scanner that assesses hosts for weaknesses rather than enumerating emails and subdomains. Shodan (E) is an internet-connected-device search engine that indexes exposed services and banners, not a tool primarily used to harvest email addresses and subdomains for a domain.

Answer

Nmap

Answer

Nessus

Answer

Shodan

Question 8

An attacker uses the Social Engineering Toolkit (SET) to send a malicious email to employees of a company, claiming to be from IT support and urging them to click a link to reset their password. Which social engineering attack is being performed?

Accepted Answer

Phishing. The Social Engineering Toolkit (SET) is used to craft and send fraudulent emails that appear to come from a trusted source (IT support), urging the recipient to click a link and enter credentials. This is a classic phishing attack because it uses email as the vector and relies on deception to steal sensitive information. Unlike vishing (voice) or SMiShing (SMS), the attack is executed via email, which is the defining characteristic of phishing.

Answer

Vishing

Answer

Baiting

Answer

SMiShing

Question 9

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

Accepted Answer

UDP scan. The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.

Answer

TCP SYN scan

Answer

Ping sweep

Answer

OS fingerprinting

Question 10

Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)

Accepted Answer

Brute-force attack. Hashcat is a GPU-accelerated password recovery tool whose core attack modes include brute-force (option B), where it exhaustively tries every possible character combination within a defined mask or keyspace, and dictionary attack (option D), where it hashes each word from a wordlist and compares it to the target hash. Hashcat also supports hybrid attack (option E), which combines a wordlist with a mask (e.g., appending digits or symbols to dictionary words) to cover mangled passwords, invoked with modes like -a 6 and -a 7. Rainbow table attack (option C) is a legitimate cracking technique in general, but it is not a Hashcat attack mode because Hashcat computes hashes on the fly rather than looking them up in precomputed chains. Token impersonation (option A) is a Windows privilege-escalation technique involving stolen access tokens, not a password cracking method, so it is unrelated to Hashcat.

Answer

Token impersonation

Answer

Rainbow table attack

Question 11

After gaining initial access, an attacker attempts to escalate privileges by exploiting a misconfigured service running as SYSTEM. They find that the service's binary path is writable by the Everyone group. Which privilege escalation technique is the attacker MOST likely using?

Accepted Answer

Weak service permissions. The attacker can exploit weak service permissions where the binary path of a service running as SYSTEM is writable by the Everyone group. This allows the attacker to replace the legitimate service binary with a malicious executable, and when the service restarts (or the system reboots), the malicious code executes with SYSTEM privileges, achieving privilege escalation.

Answer

SUID/GUID abuse

Answer

Unquoted service path

Answer

Token impersonation

Question 12

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Accepted Answer

Parameter tampering. Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer

Directory traversal

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 13

An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed for social engineering attacks, including crafting convincing phishing emails that mimic internal departments like IT. It automates the creation of fake login pages and email templates, making it the most effective tool for testing employee susceptibility to password reset requests.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 14

A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?

Accepted Answer

To enumerate NetBIOS names and services on the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.

Answer

To perform a DNS zone transfer

Answer

To enumerate SNMP community strings on the remote host

Answer

To enumerate SMB shares on the remote host

Question 15

A penetration tester executes the command: snmpwalk -c public -v2c 192.168.1.50. Which of the following BEST describes the purpose of this command?

Accepted Answer

Enumerate the MIB tree of the SNMP agent using the 'public' community string. The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

Answer

Modify SNMP settings on the remote device

Answer

Perform a brute-force attack on the SNMP community string

Answer

Test the SNMP agent for denial of service vulnerabilities