CEH Practice Test 25 — 15 Questions

Question 1

A penetration tester uses the SMTP commands VRFY and EXPN on a mail server. What is the tester MOST likely trying to accomplish?

Accepted Answer

To enumerate valid email addresses and distribution lists. The VRFY command asks the mail server to verify whether a given email address exists, while EXPN requests the members of a mailing list or alias. By issuing these commands, the tester can enumerate valid user accounts and distribution lists on the server, which is a key step in building a target list for further attacks such as password guessing or phishing.

Answer

To extract email content from the server

Answer

To perform a mail relay attack

Answer

To test for open relay

Question 2

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

Accepted Answer

Cross-Site Scripting (XSS). The scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.

Answer

SQL Injection

Answer

Cross-Site Request Forgery (CSRF)

Answer

Command Injection

Question 3

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

Accepted Answer

The port is closed. When hping3 sends a SYN packet to a closed port, the target responds with an RST/ACK packet per TCP RFC 793. This indicates that the port is reachable but no service is listening on it, hence the immediate reset.

Answer

The port is open and listening

Answer

The port is filtered by a firewall

Answer

The port is in a TIME_WAIT state

Question 4

Which SNMP community string is typically used for read-only access by default on many devices?

Accepted Answer

public. The default read-only community string in SNMPv1 and SNMPv2c is 'public'. This string acts as a password that allows an SNMP manager to query device MIB objects for monitoring purposes without making configuration changes. It is widely documented in RFC 1157 and is the standard default across most networking equipment.

Answer

snmp

Answer

private

Answer

admin

Question 5

Which TWO of the following are examples of hybrid password attacks? (Select 2 correct answers)

Accepted Answer

Using a dictionary file and appending random numbers to each word. A hybrid password attack combines a dictionary or wordlist with additional modifications, such as appending random numbers to each word. This approach leverages common password patterns where users often add digits to a base word to meet complexity requirements, making it more effective than a simple dictionary attack.

Answer

Using a wordlist to try every possible password in the list

Answer

Generating all possible character combinations up to a certain length

Answer

Cracking passwords using precomputed rainbow tables

Question 6

Which TWO of the following are common weaknesses in IoT devices that are often exploited by attackers?

Accepted Answer

Use of default or hard-coded credentials. Option C is correct because many IoT devices ship with factory-default or hard-coded credentials (e.g., admin/admin, root/root) that users never change, giving attackers trivial access via services like Telnet or SSH on ports 23/22. Option D is correct because IoT devices frequently run lightweight protocols such as MQTT, CoAP, or HTTP without TLS encryption, allowing attackers to eavesdrop on, tamper with, or inject messages on the network. Options A and B are incorrect because hardware security modules and secure boot are security hardening measures that protect keys and verify firmware integrity, not weaknesses. Option E is incorrect because firmware updates signed with cryptographic signatures are a security best practice that prevents malicious or tampered firmware from being installed, rather than a common exploitable weakness.

Answer

Use of hardware security modules (HSM)

Answer

Implementation of secure boot

Answer

Firmware update mechanism with signed updates

Question 7

Which TWO of the following are valid port states that Nmap can report? (Select 2)

Accepted Answer

Open. Nmap reports a port as Open (option C) when a TCP SYN/connect scan or UDP probe receives a response indicating a service is actively listening on that port, making it one of the six standard states (open, closed, filtered, unfiltered, open|filtered, closed|filtered). Nmap reports a port as Filtered (option D) when packet filtering (e.g., a firewall dropping packets) prevents Nmap from determining whether the port is open or closed, typically resulting in no response or an ICMP unreachable error. The other options are not part of Nmap's port state vocabulary: 'Unknown' (A) is not a state Nmap outputs, 'Secured' (B) is not an Nmap state, and 'Blocked' (E) is not used by Nmap—filtering is the term Nmap uses instead.

Answer

Unknown

Answer

Secured

Answer

Blocked

Question 8

Which of the following is a method of hiding files on a system using steganography?

Accepted Answer

Embedding a secret message in an image file. Steganography is the practice of concealing a secret message within a non-secret file, such as an image, audio, or video file. By embedding data into the least significant bits (LSB) of pixel values in an image, the file appears unchanged to the casual observer, effectively hiding the secret message in plain sight.

Answer

Encrypting a file with AES

Answer

Renaming a file to a system filename

Answer

Using a rootkit to hide processes

Question 9

A security analyst runs 'strings malware.exe' and finds several URLs and IP addresses. The analyst then uploads the file to VirusTotal and gets a detection ratio of 5/70. What type of analysis has been performed?

Accepted Answer

Static analysis. The analyst used the 'strings' command to extract readable text from the binary without executing it, and then uploaded the file to VirusTotal for signature-based scanning. Both actions examine the file's static properties (embedded strings, hash-based detection) without running the code, which defines static analysis. Dynamic analysis would require executing the malware in a sandbox to observe runtime behavior.

Answer

Memory analysis

Answer

Reverse engineering

Answer

Dynamic analysis

Question 10

An employee receives a text message claiming to be from the company's IT department, stating that their account will be suspended unless they click a link to verify their credentials. Which type of social engineering attack is this?

Accepted Answer

SMiShing. SMiShing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) rather than email or voice. The message impersonates the IT department and uses a link to harvest credentials, which is the hallmark of SMiShing — phishing conducted via Short Message Service.

Answer

Vishing

Answer

Phishing

Answer

Baiting

Question 11

An attacker has compromised a Linux machine and wants to hide a rootkit by replacing system binaries with trojaned versions. Which technique is being used to maintain persistent access while evading detection?

Accepted Answer

Rootkit installation via binary replacement. Replacing system binaries (e.g., `ls`, `ps`, `netstat`) with trojaned versions is a classic rootkit technique. The rootkit intercepts system calls or filters output to hide its own processes, files, and network connections, allowing the attacker to maintain persistent access while evading detection by standard administrative tools.

Answer

Log manipulation

Answer

Token impersonation

Answer

Steganography

Question 12

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

Accepted Answer

The group cipher is TKIP, which is deprecated and vulnerable.. TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.

Answer

The pairwise cipher is CCMP, which is outdated.

Answer

The network uses WPA2-PSK, which is easily cracked.

Answer

The beacon frame reveals the BSSID, which is a security risk.

Question 13

Which TWO of the following are valid methods for enumerating users on a SMTP server? (Select 2)

Accepted Answer

EXPN. EXPN (Expand) and VRFY (Verify) are SMTP commands defined in RFC 821 that allow an attacker to enumerate valid email addresses and mailing list members on a mail server. EXPN reveals the members of a mailing list, while VRFY confirms whether a specific mailbox exists. Both commands are often disabled in production to prevent user enumeration.

Answer

MAIL FROM

Answer

RCPT TO

Answer

AUTH

Question 14

A penetration tester obtains a list of password hashes and uses RainbowCrack. Which statement BEST describes how RainbowCrack works?

Accepted Answer

It uses time-memory trade-off with precomputed hash chains. RainbowCrack implements a time-memory trade-off attack by precomputing hash chains for a given set of passwords and storing them in rainbow tables. When a password hash is provided, the tool looks up the hash in these tables to reverse it, avoiding the need to recompute hashes for every possible password. This makes it far faster than brute-force for cracking hashes, provided the password is covered by the precomputed chains.

Answer

It uses a dictionary attack with word mangling rules

Answer

It uses online password guessing against the target service

Answer

It uses a brute-force attack by trying all possible character combinations

Question 15

Which TWO of the following Nmap flags can be used to bypass firewall restrictions? (Select 2)

Accepted Answer

-f (fragment packets). The -f flag fragments packets into smaller 8-byte chunks, which can evade simple firewall rules that inspect packet headers for known signatures or block oversized packets. Option E is correct because the -D flag performs a decoy scan by spoofing multiple source IP addresses, making it difficult for a firewall to identify the true scanning host and block it.

Answer

-P0 (disable ping)

Answer

-T4 (aggressive timing)

Answer

-sS (SYN scan)