CEH Practice Test 22 — 15 Questions

Question 1

An organization receives an email that appears to be from the CEO, urgently requesting that the recipient wire funds to a new vendor. The email contains the CEO's name and title but the sender address is slightly misspelled. Which type of social engineering attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Whaling. This is a whaling attack because the attacker impersonates a high-profile executive (the CEO) to deceive the recipient into transferring funds. Whaling is a subtype of spear phishing that specifically targets individuals with authority or financial access, often by spoofing a senior executive's email address. In this scenario, the CEO's identity is used to exploit trust and urgency, making it a whaling attack.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 2

An attacker successfully escalates privileges on a Windows server using a known vulnerability in the Print Spooler service (PrintNightmare). Which type of privilege escalation does this represent?

Accepted Answer

Local exploit in a service. The PrintNightmare vulnerability (CVE-2021-34527) allows an attacker to execute arbitrary code with SYSTEM privileges via the Windows Print Spooler service. Since the attacker exploits a vulnerability in a running service (spoolsv.exe) to elevate from a lower-privileged user to SYSTEM, this is a classic local exploit in a service. The attack does not involve hijacking DLLs, abusing SUID bits (a Unix concept), or impersonating tokens, making option A the correct classification.

Answer

DLL hijacking

Answer

SUID abuse

Answer

Token impersonation

Question 3

Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?

Accepted Answer

A firewall, router rule, or host-based firewall is blocking the probes.. When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.

Answer

The port is closed and the target sent a RST packet.

Answer

The port is open but the service is not responding to the scan.

Answer

The port is open but Nmap cannot determine the service.

Question 4

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

Accepted Answer

Ettercap. Ettercap is specifically designed for ARP poisoning and man-in-the-middle (MITM) attacks on a local network. It exploits the Address Resolution Protocol (ARP) by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, thereby intercepting traffic between two hosts on the same subnet.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 5

A penetration tester is scanning a target and receives the output: 'PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https'. Which Nmap flag was MOST likely used to obtain this output?

Accepted Answer

-sS. The output shows open ports with their service names (ssh, http, https) but no version information. The -sS flag performs a SYN stealth scan, which by default probes common ports and uses the /etc/services file to map port numbers to service names. This matches the output format exactly, as -sS does not perform version detection or OS fingerprinting.

Answer

-O

Answer

-A

Answer

-sV

Question 6

Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is designed for both live packet capture and offline analysis of pcap files. It provides a rich graphical interface with advanced filtering, protocol dissection, and statistical analysis capabilities, making it ideal for examining captured traffic for signs of an attack such as suspicious patterns, malformed packets, or known exploit signatures.

Answer

Ettercap

Answer

tcpdump

Answer

Nmap

Question 7

An attacker uses a tool that sends crafted RCPT TO commands to an SMTP server to verify email addresses. Which SMTP enumeration technique is being used?

Accepted Answer

RCPT TO. The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

Answer

AUTH

Answer

EXPN

Answer

VRFY

Question 8

During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?

Accepted Answer

Ettercap. Ettercap is the correct answer because it is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing (poisoning) capabilities. It actively sends forged ARP replies to associate the tester's MAC address with the IP address of the target hosts, allowing interception of traffic between them on the same subnet. Other tools like Wireshark, Metasploit, and Nmap are not primarily designed for ARP spoofing.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 9

An analyst runs the following command: dnsenum --enum example.com. Which of the following actions is dnsenum performing?

Accepted Answer

Attempts a zone transfer and brute-forces subdomains. The `dnsenum` tool is designed for DNS enumeration, and its `--enum` flag performs a comprehensive scan that includes attempting a zone transfer (AXFR query) to retrieve all DNS records from the nameserver, and if that fails, it brute-forces subdomains using a wordlist. This matches option A exactly.

Answer

Scans for open ports on the DNS server

Answer

Queries the DNS server for its version information

Answer

Performs a reverse DNS lookup to find PTR records for the IP range

Question 10

A penetration tester runs 'nmap -sS -p 80 --script http-title 192.168.1.100' and receives output indicating port 80 is 'filtered'. What does the 'filtered' state imply?

Accepted Answer

A firewall is likely blocking the probe packets. The 'filtered' state in Nmap indicates that the probe packets (SYN packets for a SYN scan) were dropped or did not elicit any response, typically due to a firewall or packet filter. Since no SYN/ACK or RST was received, Nmap cannot determine if the port is open or closed, so it marks it as 'filtered'. This is distinct from an 'open' state (SYN/ACK received) or 'closed' state (RST received).

Answer

The port is open and a service is listening

Answer

The service is running but the script failed

Answer

The port is closed and no service is listening

Question 11

You need to perform a fast scan of all 65535 TCP ports on a target IP address. Which tool is specifically designed for high-speed scanning and can surpass Nmap's speed on large-scale networks?

Accepted Answer

Masscan. Masscan is the correct answer because it is specifically engineered for high-speed asynchronous scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which allows it to scan all 65535 TCP ports on a target significantly faster than Nmap, even with the -T5 timing template. Unlike Nmap's synchronous or adaptive scanning, Masscan uses a custom TCP/IP stack and raw sockets to maximize throughput, making it the optimal tool for large-scale network reconnaissance.

Answer

Netcat

Answer

hping3

Answer

Nmap with -T5

Question 12

A security administrator notices repeated failed login attempts from a single IP address targeting the SSH service. The attempts use common usernames (root, admin, test) and a list of passwords from a dictionary. What type of password attack is being conducted?

Accepted Answer

Dictionary attack. This is a dictionary attack because the attacker uses a predefined list of common usernames and passwords (a dictionary) against the SSH service. Unlike a brute-force attack that tries all possible combinations, a dictionary attack only tests likely entries from a wordlist, making it faster but limited to the dictionary's contents.

Answer

Rainbow table attack

Answer

Hybrid attack

Answer

Brute-force attack

Question 13

An incident responder finds that the Windows Event Logs on a compromised server have been cleared, and the Security log shows gaps in coverage. Additionally, a rootkit is suspected. Which phase of the hacking methodology does the clearing of logs represent?

Accepted Answer

Erasing tracks. Clearing Windows Event Logs and creating gaps in the Security log is a classic post-exploitation step to remove forensic evidence of the attacker's actions. In the CEH hacking methodology, this falls under 'Erasing tracks' (also known as covering tracks), which is the final phase after maintaining access. The rootkit suspicion further supports this, as rootkits often include log-wiping or log-modification capabilities to hide their presence.

Answer

Privilege escalation

Answer

Cracking passwords

Answer

Executing applications

Question 14

A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?

Accepted Answer

A DNS tunneling tool used for data exfiltration. DNS tunneling encapsulates non-DNS traffic (e.g., data exfiltration) within DNS queries and responses, typically using UDP port 53. Since the host is not a DNS server, the outbound spike on port 53 indicates it is likely tunneling data to an external command-and-control server, making option C correct.

Answer

A worm that spreads via email attachments

Answer

A polymorphic virus

Answer

A keylogger that sends captured keystrokes via HTTP

Question 15

After gaining initial access to a Linux server, an attacker runs `find / -perm -4000 -o -perm -2000 2>/dev/null`. What is the primary objective of this command?

Accepted Answer

Identify files with SUID or GUID bits set for privilege escalation. The command `find / -perm -4000 -o -perm -2000 2>/dev/null` searches the entire filesystem for files with the SUID (setuid, permission 4000) or SGID (setgid, permission 2000) bits set. These special permission bits allow a file to execute with the privileges of its owner (often root) or group, respectively. An attacker's primary objective is to identify such files because they can be exploited to escalate privileges from a low-privileged user to a higher-privileged user (e.g., root) by running a vulnerable SUID/SGID binary.

Answer

Locate world-writable files for data exfiltration

Answer

List all files owned by the root user

Answer

Find configuration files containing passwords