CEH Practice Test 24 — 15 Questions

Question 1

A penetration tester runs `snmpwalk -c public -v2c 192.168.1.50 1.3.6.1.2.1.1` and receives a list of system descriptions, uptime, and contact information. Which type of information is the tester primarily gathering?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System information and version details. The `snmpwalk` command with the OID `1.3.6.1.2.1.1` (the system group in MIB-II, defined in RFC 1213) queries the SNMP agent for system-level information. The output includes system description, uptime, contact, and version details, which are all part of the system group. This is a classic enumeration technique to gather system information and version details from a target device using SNMP with the default public community string.

Answer

SMB share names and permissions

Answer

Network topology and routing tables

Answer

Active directory users and groups

Question 2

During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?

Accepted Answer

ldapsearch. ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.

Answer

nbtstat

Answer

smbclient

Answer

snmpwalk

Question 3

A user reports that their system has become very slow and numerous pop-up ads appear even when browsing is not active. Which type of malware is MOST likely installed?

Accepted Answer

Adware. Adware is designed to automatically deliver advertisements, often generating pop-up ads even when the browser is not active, and it consumes system resources, causing slowdowns. The user's symptoms—persistent pop-ups and performance degradation—are classic indicators of adware infection, as adware typically runs background processes to fetch and display ads.

Answer

Ransomware

Answer

Keylogger

Answer

Spyware

Question 4

A security analyst is investigating a potential SMB-based attack. They notice unusual traffic on port 445 from a host running `enum4linux`. Which of the following enumeration actions could `enum4linux` perform that would generate such traffic?

Accepted Answer

Enumerating SMB shares and user accounts. enum4linux is a tool specifically designed for enumerating information from Windows and Samba systems via the SMB protocol (port 445). It can list SMB shares, retrieve user account lists, and gather other system details by querying the SMB service, which directly generates traffic on port 445.

Answer

Scanning for open ports on the target system

Answer

Performing a DNS zone transfer

Answer

Querying SNMP MIB values using community strings

Question 5

A junior penetration tester runs the command: whois example.com. What type of information are they MOST likely trying to obtain?

Accepted Answer

Domain registration details such as registrar, creation date, and contact information. The `whois` command queries a WHOIS server (typically operated by a Regional Internet Registry or domain registrar) to retrieve domain registration details. This includes the registrar name, creation and expiration dates, name servers, and often administrative/technical contact information. It is a core footprinting technique used to gather publicly available metadata about a domain owner and infrastructure.

Answer

DNS zone transfer information

Answer

The IP address of the web server

Answer

Open ports on the target server

Question 6

After gaining initial access to a Windows server, a penetration tester wants to escalate privileges. The tester finds that the current user has the 'SeImpersonatePrivilege' enabled. Which attack technique could the tester use to abuse this privilege?

Accepted Answer

Token impersonation via Juicy Potato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. Juicy Potato (and its variants like RoguePotato) exploits this by coercing the SYSTEM account to connect to a malicious named pipe, capturing its token, and using it to spawn a process with SYSTEM privileges. This is a well-known privilege escalation technique on Windows systems where the user has the SeImpersonatePrivilege.

Answer

SUID bit abuse

Answer

Pass-the-Hash attack

Answer

Log manipulation to hide tracks

Question 7

A security analyst wants to gather information about a target domain without sending any packets to the target. Which technique should the analyst use?

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., RDAP or WHOIS servers) for domain registration details such as registrar, creation date, and administrative contacts. It requires no packets to be sent to the target domain's infrastructure, making it ideal for information gathering without direct interaction.

Answer

Ping sweep

Answer

Netcat banner grab

Answer

Nmap SYN scan

Question 8

Which THREE of the following are components of the CHPSET system hacking methodology? (Select three.)

Accepted Answer

Sniffing network traffic. The CHPSET system hacking methodology includes six phases: Cracking (C), Hiding (H), Privilege Escalation (P), Sniffing (S), Executing (E), and Targeting (T). Among the given options, Sniffing network traffic (A) corresponds to Sniffing, Cracking passwords (C) to Cracking, and Executing applications (E) to Executing. Hiding files (B) is a specific activity under the Hiding phase but is not a distinct phase itself. Scanning ports (D) is a reconnaissance step performed during the pre-hacking phase, not part of CHPSET. Therefore, the three correct components are A, C, and E.

Answer

Hiding files

Answer

Scanning ports

Question 9

A security analyst observes a gradual increase in network traffic from an internal host to an external IP address on port 443, with the host also connecting to a known command-and-control (C2) domain. Which type of malware is MOST likely responsible?

Accepted Answer

Backdoor Trojan. The gradual increase in traffic to an external IP on port 443 (HTTPS) combined with connections to a known C2 domain indicates a backdoor Trojan. Backdoor Trojans establish stealthy, encrypted command-and-control channels to exfiltrate data or receive instructions, often mimicking legitimate HTTPS traffic to evade detection. This behavior aligns with a backdoor Trojan's purpose of providing unauthorized remote access while blending into normal network activity.

Answer

Ransomware

Answer

Worm

Answer

Boot sector virus

Question 10

An attacker uses the Social Engineering Toolkit (SET) to send a malicious email to employees of a company, claiming to be from IT support and urging them to click a link to reset their password. Which social engineering attack is being performed?

Accepted Answer

Phishing. The Social Engineering Toolkit (SET) is used to craft and send fraudulent emails that appear to come from a trusted source (IT support), urging the recipient to click a link and enter credentials. This is a classic phishing attack because it uses email as the vector and relies on deception to steal sensitive information. Unlike vishing (voice) or SMiShing (SMS), the attack is executed via email, which is the defining characteristic of phishing.

Answer

Vishing

Answer

Baiting

Answer

SMiShing

Question 11

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

Accepted Answer

UDP scan. The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.

Answer

TCP SYN scan

Answer

Ping sweep

Answer

OS fingerprinting

Question 12

After gaining initial access, an attacker attempts to escalate privileges by exploiting a misconfigured service running as SYSTEM. They find that the service's binary path is writable by the Everyone group. Which privilege escalation technique is the attacker MOST likely using?

Accepted Answer

Weak service permissions. The attacker can exploit weak service permissions where the binary path of a service running as SYSTEM is writable by the Everyone group. This allows the attacker to replace the legitimate service binary with a malicious executable, and when the service restarts (or the system reboots), the malicious code executes with SYSTEM privileges, achieving privilege escalation.

Answer

SUID/GUID abuse

Answer

Unquoted service path

Answer

Token impersonation

Question 13

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Accepted Answer

Parameter tampering. Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer

Directory traversal

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 14

An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed for social engineering attacks, including crafting convincing phishing emails that mimic internal departments like IT. It automates the creation of fake login pages and email templates, making it the most effective tool for testing employee susceptibility to password reset requests.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 15

A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?

Accepted Answer

To enumerate NetBIOS names and services on the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.

Answer

To perform a DNS zone transfer

Answer

To enumerate SNMP community strings on the remote host

Answer

To enumerate SMB shares on the remote host