CEH Practice Test 25 — 15 Questions

Question 1

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

Accepted Answer

nbtstat. The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

Answer

nslookup

Answer

netstat

Answer

net view

Question 2

A penetration tester executes the command: snmpwalk -c public -v2c 192.168.1.50. Which of the following BEST describes the purpose of this command?

Accepted Answer

Enumerate the MIB tree of the SNMP agent using the 'public' community string. The `snmpwalk` command is used to retrieve a subtree of management information from an SNMP agent. By specifying `-c public` (the community string) and `-v2c` (SNMP version 2c), the command performs a GETNEXT request cycle to walk the entire MIB tree, enumerating all accessible OIDs and their values. Option D correctly identifies this as enumerating the MIB tree using the 'public' community string.

Answer

Modify SNMP settings on the remote device

Answer

Perform a brute-force attack on the SNMP community string

Answer

Test the SNMP agent for denial of service vulnerabilities

Question 3

An attacker has gained initial access to a Windows system and wants to escalate privileges to SYSTEM. They find that the SeImpersonatePrivilege is enabled for their current user. Which tool or technique is specifically designed to leverage this privilege for elevation?

Accepted Answer

Token impersonation using RottenPotato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. RottenPotato (and its variants like JuicyPotato) exploits this privilege by forcing a high-integrity service (e.g., DCOM or RPC) to authenticate to a malicious server under the attacker's control, capturing a SYSTEM-level token and using it to execute code with elevated privileges.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

SUID abuse

Question 4

Which of the following Nmap flags would an attacker use to evade IDS by sending fragmented IP packets?

Accepted Answer

-f. The -f flag in Nmap instructs the tool to fragment the transmitted packets into smaller pieces (typically 8-byte fragments). This fragmentation is used to evade Intrusion Detection Systems (IDS) that rely on signature matching against complete, unfragmented packets, as the IDS may not reassemble the fragments before inspection or may fail to detect the malicious payload when spread across multiple fragments.

Answer

-D

Answer

-g

Answer

-sS

Question 5

Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?

Accepted Answer

logon.bat script. Logon.bat scripts are commonly used in Windows environments to map network drives or perform startup tasks, and administrators often embed plaintext credentials in such scripts for automation. An attacker who compromises the workstation can read this batch file to extract stored passwords, making it a high-value target for credential theft.

Answer

User profile (C:\Users\jdoe)

Answer

Home directory on \fileserver\home\jdoe

Answer

Active Directory database (NTDS.dit)

Question 6

Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?

Accepted Answer

ARP spoofing attack. The combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.

Answer

Distributed denial of service (DDoS) attack

Answer

MAC flooding attack

Answer

Ping flood attack

Question 7

Which THREE of the following are examples of application-layer DDoS attacks? (Select 3)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers slowly to exhaust the server's connection pool. It exploits the HTTP protocol's design where servers wait for complete requests before releasing resources, making it a classic Layer 7 attack.

Answer

SYN flood

Answer

UDP flood

Question 8

During a penetration test, the tester runs `enum4linux -U 192.168.1.20` and obtains a list of usernames. What service is being enumerated, and what is the primary risk associated with this information disclosure?

Accepted Answer

SMB; it can facilitate password spraying or brute‑force attacks. enum4linux is a tool that queries SMB (Server Message Block) services on a target, typically over TCP ports 139 or 445. The `-U` flag specifically enumerates users from the SAM database via the SMB protocol. The primary risk of obtaining a valid username list is that it enables password spraying or brute-force attacks against SMB authentication, which can lead to unauthorized access.

Answer

NFS; it can lead to unauthorized file access

Answer

SNMP; it can reveal community strings

Answer

LDAP; it can expose directory structure

Question 9

Which TWO of the following tools are specifically designed for footprinting and reconnaissance tasks? (Select two.)

Accepted Answer

Shodan. Shodan is a search engine specifically designed for footprinting and reconnaissance by scanning and indexing internet-connected devices, such as IoT devices, servers, and industrial control systems. It allows attackers to gather information about open ports, services, and banners without direct interaction with the target, making it a primary tool for passive reconnaissance in the CEH context.

Answer

Nmap

Answer

Metasploit

Answer

John the Ripper

Question 10

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern with each infection to evade detection. A polymorphic virus is designed to change its code pattern—often by using a mutation engine that generates new decryption routines or alters the payload's signature—each time it infects a new file or system. This constant mutation makes it difficult for signature-based antivirus solutions to detect it because the virus's binary fingerprint is never the same across infections.

Answer

It remains dormant until a specific date

Answer

It spreads without user interaction

Answer

It attaches to the boot sector of a hard drive

Question 11

A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?

Accepted Answer

-f. The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.

Answer

-sI

Answer

-D

Answer

--mtu

Question 12

A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?

Accepted Answer

Perform a NetBIOS name table lookup of the remote host. The command 'nbtstat -A' performs a NetBIOS name table lookup against a remote host using its IP address. It queries the NetBIOS over TCP/IP (NBT) service on UDP port 137 to retrieve the remote machine's NetBIOS name table, which includes the computer name and logged-in user. This is a standard enumeration technique to gather information about Windows hosts on a local network.

Answer

Perform an SNMP walk to enumerate the remote host's MIB

Answer

Execute a dictionary attack against the remote host's passwords

Answer

Enumerate all SMB shares on the remote host

Question 13

Which TWO techniques are considered active reconnaissance? (Choose TWO.)

Accepted Answer

Port scanning with Nmap. Port scanning with Nmap (Option C) is active reconnaissance because it sends crafted packets (e.g., TCP SYN, UDP probes) directly to target systems and analyzes the responses to determine open ports, running services, and operating system details. Banner grabbing with Netcat (Option D) is also active reconnaissance as it establishes a TCP connection to a target service (e.g., HTTP, FTP) and reads the service banner, which involves direct interaction with the target. Both techniques generate detectable network traffic and can be logged by intrusion detection systems.

Answer

Using Google dorking to find exposed files

Answer

Querying Shodan for exposed devices

Answer

Performing a WHOIS lookup

Question 14

A security analyst is conducting passive reconnaissance on a target organization. Which THREE of the following are examples of passive reconnaissance techniques? (Select 3)

Accepted Answer

Performing a WHOIS lookup on the target's domain. WHOIS queries are a classic passive reconnaissance technique because they retrieve publicly registered domain ownership data from WHOIS databases (e.g., registrar, creation date, name servers) without sending any packets directly to the target's infrastructure. This information is stored by third-party registries and is accessible via standard WHOIS protocol (RFC 3912) or web-based lookup tools, making it completely non-intrusive.

Answer

Running an Nmap SYN scan against the target's web server

Answer

Banner grabbing with Netcat on port 80

Question 15

Which Google dork would a penetration tester use to find login pages that are indexed by Google?

Accepted Answer

inurl:login. The Google dork 'inurl:login' specifically searches for URLs containing the word 'login', which commonly appear in login page paths (e.g., /login.php, /login.aspx). This allows a penetration tester to quickly identify indexed login portals for further reconnaissance, such as testing for default credentials or brute-force attacks.

Answer

filetype:xls username password

Answer

intitle:"index of"

Answer

site:example.com intext:password