CEH Practice Test 23 — 15 Questions

Question 1

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Token impersonation using RottenPotato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

SUID abuse

Question 2

Which of the following Nmap flags would an attacker use to evade IDS by sending fragmented IP packets?

Accepted Answer

-f. The -f flag in Nmap instructs the tool to fragment the transmitted packets into smaller pieces (typically 8-byte fragments). This fragmentation is used to evade Intrusion Detection Systems (IDS) that rely on signature matching against complete, unfragmented packets, as the IDS may not reassemble the fragments before inspection or may fail to detect the malicious payload when spread across multiple fragments.

Answer

-D

Answer

-g

Answer

-sS

Question 3

Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?

Accepted Answer

logon.bat script. Logon.bat scripts are commonly used in Windows environments to map network drives or perform startup tasks, and administrators often embed plaintext credentials in such scripts for automation. An attacker who compromises the workstation can read this batch file to extract stored passwords, making it a high-value target for credential theft.

Answer

User profile (C:\Users\jdoe)

Answer

Home directory on \fileserver\home\jdoe

Answer

Active Directory database (NTDS.dit)

Question 4

Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?

Accepted Answer

ARP spoofing attack. The combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.

Answer

Distributed denial of service (DDoS) attack

Answer

MAC flooding attack

Answer

Ping flood attack

Question 5

Which TWO of the following tools are specifically designed for footprinting and reconnaissance tasks? (Select two.)

Accepted Answer

Shodan. Shodan is a search engine specifically designed for footprinting and reconnaissance by scanning and indexing internet-connected devices, such as IoT devices, servers, and industrial control systems. It allows attackers to gather information about open ports, services, and banners without direct interaction with the target, making it a primary tool for passive reconnaissance in the CEH context.

Answer

Nmap

Answer

Metasploit

Answer

John the Ripper

Question 6

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern with each infection to evade detection. A polymorphic virus is designed to change its code pattern—often by using a mutation engine that generates new decryption routines or alters the payload's signature—each time it infects a new file or system. This constant mutation makes it difficult for signature-based antivirus solutions to detect it because the virus's binary fingerprint is never the same across infections.

Answer

It remains dormant until a specific date

Answer

It spreads without user interaction

Answer

It attaches to the boot sector of a hard drive

Question 7

A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?

Accepted Answer

-f. The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.

Answer

-sI

Answer

-D

Answer

--mtu

Question 8

A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?

Accepted Answer

Perform a NetBIOS name table lookup of the remote host. The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.

Answer

Perform an SNMP walk to enumerate the remote host's MIB

Answer

Execute a dictionary attack against the remote host's passwords

Answer

Enumerate all SMB shares on the remote host

Question 9

Which TWO techniques are considered active reconnaissance? (Choose TWO.)

Accepted Answer

Port scanning with Nmap. Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.

Answer

Using Google dorking to find exposed files

Answer

Querying Shodan for exposed devices

Answer

Performing a WHOIS lookup

Question 10

A security analyst is conducting passive reconnaissance on a target organization. Which THREE of the following are examples of passive reconnaissance techniques? (Select 3)

Accepted Answer

Performing a WHOIS lookup on the target's domain. WHOIS queries are a classic passive reconnaissance technique because they retrieve publicly registered domain ownership data from WHOIS databases (e.g., registrar, creation date, name servers) without sending any packets directly to the target's infrastructure. This information is stored by third-party registries and is accessible via standard WHOIS protocol (RFC 3912) or web-based lookup tools, making it completely non-intrusive.

Answer

Running an Nmap SYN scan against the target's web server

Answer

Banner grabbing with Netcat on port 80

Question 11

Which Google dork would a penetration tester use to find login pages that are indexed by Google?

Accepted Answer

inurl:login. The Google dork 'inurl:login' specifically searches for URLs containing the word 'login', which commonly appear in login page paths (e.g., /login.php, /login.aspx). This allows a penetration tester to quickly identify indexed login portals for further reconnaissance, such as testing for default credentials or brute-force attacks.

Answer

filetype:xls username password

Answer

intitle:"index of"

Answer

site:example.com intext:password

Question 12

A penetration tester uses the Social Engineering Toolkit (SET) to create a malicious USB drive that autoruns when inserted. Which social engineering technique is being employed?

Accepted Answer

Baiting. Baiting is the correct answer because the penetration tester is using a physical device (USB drive) to exploit human curiosity or greed, enticing the target to insert it into a system. The Social Engineering Toolkit (SET) can create an autorun.inf file that triggers a payload upon insertion, which is a classic baiting attack that relies on the victim's action to compromise the system.

Answer

Tailgating

Answer

Pretexting

Answer

Phishing

Question 13

You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?

Accepted Answer

Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.. The server allows file uploads with .phtml extension, which Apache processes as PHP due to its configuration. Uploading a PHP web shell with .phtml extension to the /uploads/ directory and accessing it directly allows command execution, escalating the attack. This bypasses the 403 Forbidden restriction on .php files while leveraging the existing upload functionality.

Answer

Use the PUT method to upload a malicious file directly to the web root.

Answer

Exploit the IIS WebDAV vulnerability to execute commands.

Answer

Attempt SQL injection in the login form to extract database credentials.

Question 14

An analyst executes 'nmap -sU -p 161,162 10.0.0.1'. What is the primary purpose of this scan?

Accepted Answer

Discover SNMP services running on the target. The `-sU` flag instructs Nmap to perform a UDP scan, and the `-p 161,162` targets the default SNMP ports (UDP 161 for SNMP queries, UDP 162 for SNMP traps). This combination is specifically designed to discover SNMP services running on the target host, as SNMP operates exclusively over UDP. Option C is correct because the command's primary purpose is to probe for SNMP services.

Answer

Detect TCP services on the target

Answer

Enumerate all open ports on the target

Answer

Perform a SYN flood attack

Question 15

During a forensic investigation, an analyst finds a suspicious file that changes its code signature each time it replicates. The file uses encryption and polymorphism to evade signature-based detection. Which type of virus is this?

Accepted Answer

Polymorphic virus. D is correct because a polymorphic virus is specifically designed to change its code signature each time it replicates, using encryption and mutation engines to evade signature-based detection. The description of altering the signature with each replication while maintaining the same core functionality is the defining characteristic of a polymorphic virus.

Answer

Macro virus

Answer

File infector virus

Answer

Boot sector virus