CEH Practice Test 24 — 15 Questions

Question 1

A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable password authentication and use SSH key-based authentication.. Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.

Answer

Install fail2ban to automatically block IPs after failures.

Answer

Implement rate-limiting on SSH connections per IP.

Answer

Change the SSH port to a non-standard port.

Question 2

Which of the following is a type of malware that spreads by replicating itself across a network without requiring a host file?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself across a network by exploiting vulnerabilities or using network protocols (e.g., SMB, RDP, or email) without needing a host file. Unlike viruses, worms do not attach to existing programs; they self-propagate via network connections, often consuming bandwidth and creating backdoors.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 3

A security analyst wants to gather information about a target domain without directly interacting with its systems. Which technique would be MOST appropriate?

Accepted Answer

Query WHOIS databases for domain registration information. Querying WHOIS databases is a passive reconnaissance technique that retrieves publicly available domain registration information (e.g., registrar, creation/expiration dates, name servers, and administrative contacts) without sending any packets to the target's systems. This aligns with the goal of gathering information without direct interaction, as defined in the CEH footprinting phase.

Answer

Send ICMP echo requests to the target network

Answer

Run a vulnerability scan with Nessus

Answer

Perform a port scan using Nmap SYN scan

Question 4

Which of the following techniques is considered PASSIVE reconnaissance?

Accepted Answer

Performing a WHOIS lookup. WHOIS queries retrieve domain registration records from public databases like whois.iana.org or RDAP servers. Since the target server is never contacted directly — only public registries are queried — no packets are sent to the target's infrastructure, making it a purely passive reconnaissance technique.

Answer

Ping sweeping a subnet

Answer

Banner grabbing with Telnet

Answer

Running a SYN scan with Nmap

Question 5

Which password cracking method uses a precomputed table of hash chains to reverse password hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses precomputed tables of hash chains to reverse password hashes quickly. Instead of computing the hash for every possible password in real time, the attacker looks up the hash in the table to find the corresponding plaintext, drastically reducing the time needed for cracking.

Answer

Hybrid attack

Answer

Dictionary attack

Answer

Brute-force attack

Question 6

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Accepted Answer

Email enumeration. Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer

DNS cache poisoning

Answer

Man-in-the-middle attack

Answer

Phishing attack

Question 7

A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?

Accepted Answer

Enable multi-factor authentication (MFA) for all users.. Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.

Answer

Enforce complex password policies.

Answer

Implement CAPTCHA on the login page.

Answer

Enable account lockout after 3 failed attempts.

Question 8

Drag and drop the steps to perform a successful social engineering attack in a penetration test into the correct order.

Accepted Answer

Research, Craft Pretext, Choose Channel, Execute, Document. In a social engineering penetration test, the correct sequence is Research (gather intelligence on the target), Craft Pretext (create a believable scenario), Choose Channel (select communication medium), Execute (deliver the attack), and Document (record findings). This order ensures the attack is tailored and effective, as each step builds on the previous one.

Answer

Choose Channel, Research, Craft Pretext, Execute, Document

Answer

Execute, Research, Craft Pretext, Choose Channel, Document

Answer

Research, Choose Channel, Craft Pretext, Execute, Document

Question 9

Which phase of the system hacking methodology (CHPSET) involves hiding files from the operating system using techniques such as rootkits or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking passwords, Hacking, Privilege escalation, Spying, Erasing tracks, Executing applications, Hiding files) methodology involves concealing malicious files from the operating system and security tools. Techniques such as rootkits (which hook system calls like NtQueryDirectoryFile to hide files from directory listings) and steganography (embedding data within innocent files like images or audio) are used to avoid detection. This phase directly follows 'Executing applications' and ensures the attacker's payload remains persistent and covert.

Answer

Cracking passwords

Answer

Erasing tracks

Answer

Executing applications

Question 10

A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?

Accepted Answer

Configure egress filtering on the firewall to block outbound connections to known malicious domains.. Egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.

Answer

Install a host-based firewall on the IoT device to restrict outbound traffic.

Answer

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Answer

Disable DNS resolution on the IoT device to prevent any external communication.

Question 11

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

Accepted Answer

The domain has two mail exchange servers. The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Answer

The DNS server is configured to block zone transfers

Answer

Mail is automatically forwarded to a backup server

Answer

The domain has an SPF record configured

Question 12

Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?

Accepted Answer

Mail server addresses and priority. The nslookup command with the -type=MX query returns mail exchange (MX) records for the domain. The output shows mail server hostnames and their associated priority values (e.g., 10, 20), which indicate the order in which mail servers should be used. This directly reveals the mail server addresses and their priority, making option A correct.

Answer

Name server records

Answer

IP addresses of the web server

Answer

SPF records for email authentication

Question 13

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Accepted Answer

Set up listener on attacker machine, then victim connects back, then attacker gains shell access, then execute commands, then cleanup. In a reverse shell using Netcat, the correct sequence is: first, the attacker sets up a listener on a chosen port; second, the victim executes a command that connects back to the attacker's listener; third, the attacker gains a shell on the victim machine; fourth, the attacker executes commands; and finally, cleanup is performed to close the connection. This order ensures the listener is ready before the victim connects, and that the shell is operational before executing any commands or terminating the session.

Answer

Victim connects back first, then set up listener, then attacker gains shell access, then execute commands, then cleanup

Answer

Set up listener, then victim connects back, then cleanup, then attacker gains shell access, then execute commands

Answer

Set up listener, then attacker gains shell access, then victim connects back, then execute commands, then cleanup

Question 14

A security analyst is planning a reconnaissance activity that must remain undetected. Which TWO of the following techniques should they choose?

Accepted Answer

Gather information from public OSINT sources like Shodan and social media. OSINT sources like Shodan and social media provide publicly available information without interacting with the target's systems, keeping the reconnaissance passive and undetected. Option C is correct because passive reconnaissance via DNS records (e.g., using cached or third-party DNS databases) avoids querying the target's authoritative DNS servers, thus not generating logs or alerts on the target's infrastructure.

Answer

Engage in social engineering to extract network diagrams from employees

Answer

Use Nmap with default scripts to enumerate services

Answer

Perform a full TCP connect scan on all ports

Question 15

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Accepted Answer

Update Log4j to version 2.17.1 or later. CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

Answer

Remove the JndiLookup class from the Log4j jar

Answer

Disable JDBC appender in Log4j configuration

Answer

Block outbound traffic from the server to the internet