CEH Practice Test 22 — 15 Questions

Question 1

During an SMTP enumeration, a penetration tester connects to the mail server on port 25 and issues the commands 'VRFY root', 'EXPN admin', and 'RCPT TO:unknown@domain.com'. The server responds with '252' for VRFY, '250' for EXPN, and '550' for RCPT TO. What does this indicate?

Accepted Answer

The root user exists but is disabled, the admin mailing list exists, and unknown@domain.com does not exist. VRFY returns 252 if the user exists but is disabled (or ambiguous), EXPN returns 250 if the mailing list/alias exists, RCPT TO returns 550 if the mailbox does not exist. This allows enumerating valid users on the server.

Answer

The server has open relay enabled

Answer

The server is vulnerable to SMTP injection

Answer

The server is not running SMTP

Question 2

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Accepted Answer

Installing a rootkit to hide files and processes. Covering tracks includes log manipulation (clearing or modifying logs), using rootkits to hide processes/files, and steganography to hide malicious data. Disabling antivirus is more of an evasion technique during the attack, not specifically covering tracks. Privilege escalation is a different phase.

Answer

Escalating privileges to SYSTEM

Answer

Disabling antivirus software

Question 3

An analyst observes the following SNMP walk output on a network device: `SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.5.1 = STRING: "cisco"`. Which finding is most significant?

Accepted Answer

The SNMP community string is "cisco" and likely weak. The string "cisco" indicates the community string is default or easily guessable. SNMP community strings are used as authentication; public/private defaults are a well-known vulnerability.

Answer

The SNMP service is using version 2c

Answer

The device is running Cisco IOS version 12.0

Answer

The device is configured for read-write access

Question 4

During a penetration test, a tester gains a low-privilege shell on a Linux server. The command `sudo -l` reveals that the user can run `/usr/bin/find` as root. Which technique can the tester use to escalate privileges?

Accepted Answer

Use find with the -exec flag to spawn a shell. The `find` command has a `-exec` option that can execute arbitrary commands. With sudo access, the tester can run `sudo find . -exec /bin/sh \;` to obtain a root shell.

Answer

Abuse the SUID bit on find

Answer

Exploit a kernel vulnerability

Answer

Run a buffer overflow on the find binary

Question 5

An attacker modifies system logs to remove entries related to their activities. Which technique is being used to cover tracks?

Accepted Answer

Log manipulation. Log manipulation is the act of altering or deleting log entries to hide evidence of an intrusion. This is part of the covering tracks phase.

Answer

Token impersonation

Answer

Steganography

Answer

Rootkit installation

Question 6

Which enumeration technique would be MOST effective for gathering usernames from an SMTP server that supports the VRFY command?

Accepted Answer

SMTP VRFY enumeration. The VRFY command asks the server to verify a username. Attackers can use it to enumerate valid accounts.

Answer

SNMP enumeration using SNMPwalk

Answer

NetBIOS enumeration using nbtstat

Answer

LDAP anonymous queries

Question 7

An attacker has compromised a Linux machine and wants to hide a rootkit by replacing system binaries with trojaned versions. Which technique is being used to maintain persistent access while evading detection?

Accepted Answer

Rootkit installation via binary replacement. Replacing system binaries (e.g., ls, ps, netstat) with trojaned versions that hide the attacker's processes is a classic rootkit technique to cover tracks.

Answer

Log manipulation

Answer

Token impersonation

Answer

Steganography

Question 8

Which TWO of the following are common techniques for covering tracks after compromising a system? (Select 2)

Accepted Answer

Manipulating event logs to remove evidence of intrusion. Log manipulation (clearing or altering logs) and using steganography (hiding data in plain sight) are common cover-tracks techniques. Deletion of logs is also common, but manipulation is more specific.

Answer

Increasing the frequency of password changes

Answer

Enabling verbose logging for future attacks

Answer

Setting up a honeypot to distract defenders

Question 9

Which of the following is a primary purpose of the enumeration phase in a penetration test?

Accepted Answer

To gather in-depth information about the target system and its resources. Enumeration is the process of extracting detailed information about a target, such as user accounts, network shares, and services, which is used to identify potential attack vectors.

Answer

To exploit identified vulnerabilities and gain access

Answer

To perform a vulnerability scan on the target network

Answer

To delete logs and cover tracks after a successful compromise

Question 10

Which TWO of the following are valid enumeration techniques used to identify user accounts on a system? (Select 2)

Accepted Answer

SMTP VRFY command. SMTP VRFY (verifies user existence) and SMB enumeration (via tools like enum4linux) can both reveal user accounts. SNMPwalk retrieves system information but not directly usernames; DNS and port scanning do not enumerate users.

Answer

Port scanning with nmap

Answer

DNS zone transfer

Answer

SNMPwalk of the entire MIB

Question 11

In the context of privilege escalation on Windows, what is token impersonation, and which tool is commonly used to exploit it?

Accepted Answer

A technique to assume another user's security context; Incognito. Token impersonation allows a process to assume the security context of another user. Tools like `incognito` can list available tokens and impersonate them, often to gain administrator privileges.

Answer

A technique to dump hashes; Hashcat

Answer

A technique to steal session cookies; Mimikatz

Answer

A technique to bypass UAC; Metasploit

Question 12

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Accepted Answer

Applies mutations like appending numbers or symbols. A hybrid attack combines a dictionary with mutations (e.g., appending numbers, prefixing symbols). It does not try all combinations (that's brute-force) and does not use precomputed tables (rainbow tables).

Answer

Tries every possible combination of characters

Answer

Relies on precomputed hash chains

Question 13

Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?

Accepted Answer

smbclient -L //<IP> -N. smbclient -L lists SMB shares on a remote server. It is a standard SMB enumeration tool.

Answer

ldapsearch -x -h <IP>

Answer

snmpwalk -v2c -c public <IP>

Answer

nbtstat -A <IP>

Question 14

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

Accepted Answer

Exploit the SUID binary to execute commands as root. Option C is correct. Exploiting a vulnerable SUID binary is a classic privilege escalation technique that allows a low-privileged user to run the binary with root privileges.

Answer

Perform an SMTP VRFY attack to enumerate users

Answer

Use enum4linux to enumerate SMB shares

Answer

Run 'sudo -l' to list sudo privileges

Question 15

Which TWO of the following tools are used for password cracking?

Accepted Answer

Hashcat. Options B and D are correct. John the Ripper and Hashcat are well-known password cracking tools.

Answer

Wireshark

Answer

Snmpwalk

Answer

Nmap