CEH Practice Test 23 — 15 Questions

Question 1

Which type of malware is characterized by its ability to spread without requiring a host file and can replicate across networks automatically?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across networks without requiring a host file or user intervention. It exploits network vulnerabilities, such as unpatched services or weak credentials, to propagate automatically, often using protocols like SMB, RDP, or email transport mechanisms.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 2

A security analyst observes the following in a packet capture: a single source IP sends a large number of ICMP echo request packets to the broadcast address of a subnet, with the source IP spoofed to be the target victim. Which type of attack is being executed?

Accepted Answer

Smurf attack. The Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large volume of ICMP echo request packets with the source IP spoofed to be the victim's IP address, directed to the subnet's broadcast address. Every host on that subnet replies to the victim, overwhelming it with ICMP echo reply traffic, effectively amplifying the attack.

Answer

SYN flood

Answer

Ping of Death

Answer

ICMP flood

Question 3

A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?

Accepted Answer

NetBIOS. The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 4

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

Accepted Answer

Polymorphic virus. Polymorphic virus is correct because it mutates its code signature each time it replicates, using a mutation engine to generate new decryption routines while keeping the payload intact. This allows it to evade signature-based detection, as each copy appears different to antivirus software that relies on static signatures.

Answer

Boot sector virus

Answer

Macro virus

Answer

Worm

Question 5

A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing the malware in a controlled environment (sandbox) to observe its runtime behavior, such as contacting a C2 server and downloading additional payloads. This contrasts with static analysis, which examines the code without execution. The scenario explicitly describes observing behavior during execution, confirming dynamic analysis.

Answer

Static analysis

Answer

Network analysis

Answer

Code analysis

Question 6

An attacker wants to perform a man-in-the-middle attack on a local network. Which two tools from the following list would be most effective? (Select the best answer from the options below; note: this is a multiple choice, not multi-select) A) Wireshark B) Ettercap C) Nmap D) Metasploit E) Aircrack-ng

Accepted Answer

Ettercap and Wireshark. Ettercap is a dedicated man-in-the-middle (MITM) tool that performs ARP spoofing to intercept traffic between hosts on a switched LAN. Wireshark captures and analyzes the intercepted packets, allowing the attacker to view unencrypted data. Together, they form the classic ARP poisoning attack chain: Ettercap redirects traffic, Wireshark inspects it.

Answer

Nmap and Metasploit

Answer

Aircrack-ng and Wireshark

Answer

Ettercap and Nmap

Question 7

Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?

Accepted Answer

Ettercap. Ettercap is a dedicated man-in-the-middle (MITM) attack tool that natively supports ARP poisoning. It sends forged ARP replies to both the victim and the default gateway, mapping the attacker's MAC address to the IP addresses of the other party. This allows the attacker to intercept, inspect, and modify traffic between the victim and the gateway.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 8

An attacker has gained access to a system and wants to erase evidence of their activities. Which of the following actions is MOST effective for covering tracks on a Windows system?

Accepted Answer

Clearing the Security event log. Clearing the Security event log (C) is the most effective action for covering tracks on a Windows system because it removes all logged security events, such as logon attempts, privilege use, and audit failures, which are the primary records that would reveal an attacker's activities. The Security log is maintained by the Windows Event Log service and is the default location for audit records under the Local Security Policy; deleting it eliminates forensic evidence of unauthorized access or changes.

Answer

Disabling the Windows Firewall

Answer

Installing a rootkit

Answer

Changing the administrator password

Question 9

Which of the following tools is specifically designed to exploit WPS vulnerabilities on wireless networks?

Accepted Answer

Reaver. Reaver is specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate limiting and the fact that the PIN is split into two halves, making it feasible to guess the 8-digit PIN in under 10,000 attempts. This allows an attacker to recover the WPA/WPA2 pre-shared key without needing to crack the actual encryption.

Answer

John the Ripper

Answer

aircrack-ng

Answer

Kismet

Question 10

A penetration tester captures the following output from a command: 'smb: \> ls \192.168.1.20\C$'. The tester is able to list the contents of the C$ share without providing credentials. Which of the following is the MOST likely reason for this access?

Accepted Answer

The target has a null session vulnerability that allows access to admin shares. The output shows the tester successfully listing the C$ share (a default administrative share) without providing credentials. This is a classic indicator of a null session vulnerability, where Windows allows unauthenticated access to IPC$ and, in some configurations, admin shares via SMB. The tester is leveraging the default null session to enumerate or access these shares, which is a well-known weakness in older Windows systems or misconfigured Samba servers.

Answer

The C$ share is intentionally shared with Everyone

Answer

The target is running a Samba server with weak permissions

Answer

The tester is using a pass-the-hash attack

Question 11

A security analyst observes repeated log entries showing `EXPN` commands from an external IP address to the company's mail server. What is the MOST likely objective of this activity?

Accepted Answer

Enumerating valid email addresses and mailing list members. The `EXPN` command is part of the SMTP protocol (RFC 5321) and is used to expand a mailing list or alias, revealing the individual email addresses that belong to it. By repeatedly issuing `EXPN` commands, an attacker can enumerate valid email addresses and mailing list members, which is a reconnaissance technique for gathering targets for phishing or social engineering. This aligns with the enumeration phase of system hacking, where the goal is to extract user and service information.

Answer

Testing SMTP authentication mechanisms

Answer

Attempting to perform a denial-of-service attack

Answer

Delivering spam emails through open relay

Question 12

Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?

Accepted Answer

intitle:login. The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.

Answer

inurl:robots.txt

Answer

filetype:pdf

Answer

cache:example.com

Question 13

Which type of malware is characterized by self-replication and spreading across networks without needing a host file?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself to spread to other computers over a network, exploiting vulnerabilities or using social engineering, without requiring a host file or user intervention. Unlike viruses, worms do not need to attach to an existing program; they operate independently, often using network protocols like SMB, HTTP, or email to propagate.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 14

A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?

Accepted Answer

Fragmentation. The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.

Answer

Decoy scan

Answer

ACK scan

Answer

Idle scan

Question 15

A forensic analyst examining a compromised Linux system finds the following entry in /var/log/auth.log: `Mar 15 10:23:45 server sshd[1234]: Accepted password for root from 10.0.0.5 port 54321 ssh2`. However, the analyst also notices that /var/log/auth.log has been truncated and the /etc/ssh/sshd_config file contains `LogLevel QUIET`. Which attack phase is most likely being obscured?

Accepted Answer

Erasing tracks. The presence of `LogLevel QUIET` in sshd_config suppresses all authentication log entries, and the truncation of /var/log/auth.log indicates an attempt to remove evidence of unauthorized access. Together, these actions are classic examples of erasing tracks, as the attacker is modifying logs and configuration to hide their activities from forensic analysis.

Answer

Privilege escalation

Answer

Executing applications

Answer

Spying