CEH Practice Test 5 — 25 Questions

Question 1

Match each CEH phase to its key activity.

Accepted Answer

Reconnaissance: Passive information gathering. The five phases of ethical hacking (as per EC-Council) are Reconnaissance, Scanning & Enumeration, Gaining Access, Maintaining Access, and Clearing Tracks. In this set, options A-D correctly match phases to their key activities, while options E and F are distractors with swapped definitions.

Answer

Reconnaissance: Active scanning of target network

Answer

Clearing Tracks: Gaining initial access

Question 2

Match each IDS/IPS term to its meaning.

Accepted Answer

Signature-based IDS: Uses predefined patterns of known attacks. These concepts are essential for understanding intrusion detection and prevention.

Answer

False positive: When the IDS fails to detect an attack

Answer

True positive: When the IDS incorrectly flags benign activity

Question 3

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts the victim's files using symmetric encryption (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. Unlike other malware types, its primary purpose is data hostage for financial extortion, often leveraging asymmetric encryption (e.g., RSA) to secure the symmetric key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 4

A security analyst reviews logs and notices that an attacker crafted a packet with a source IP address matching the target's IP address, and sent it to a network's broadcast address. Which type of attack does this describe?

Accepted Answer

Smurf attack. The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets. The attacker spoofs the source IP address to be the target's IP and sends these packets to a network's broadcast address. All hosts on that network then reply to the target, overwhelming it with ICMP echo replies.

Answer

UDP flood

Answer

Ping of Death

Answer

SYN flood

Question 5

Which TWO of the following are features of a Remote Access Trojan (RAT)?

Accepted Answer

It often includes a backdoor to bypass authentication. A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.

Answer

It encrypts files and demands ransom

Answer

It infects the Master Boot Record

Answer

It replicates itself across the network autonomously

Question 6

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review

Question 7

An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed for social engineering attacks, including crafting convincing phishing emails that mimic internal departments like IT. It automates the creation of fake login pages and email templates, making it the most effective tool for testing employee susceptibility to password reset requests.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 8

Which THREE of the following are indicators that a system may be infected with a backdoor Trojan? (Select three)

Accepted Answer

Unexpected network traffic on ports typically used for remote administration. A backdoor Trojan often opens a port on the infected system to allow remote access. Unexpected traffic on ports commonly used for remote administration (e.g., TCP 3389 for RDP, TCP 22 for SSH, or TCP 23 for Telnet) indicates that the Trojan may be listening for or communicating with an attacker, as legitimate use of these ports would be known and expected.

Answer

Persistent high CPU usage by a single process

Answer

Increased number of DNS queries to known legitimate sites

Question 9

Drag and drop the steps to perform a SQL injection attack manually into the correct order.

Accepted Answer

Identify vulnerability, then test injection points, then find number of columns, then use UNION to combine results, then extract data. The correct sequence for manual SQL injection starts with identifying a vulnerable input (e.g., by observing error messages or behavior), then testing injection (e.g., adding a single quote), finding the number of columns using ORDER BY or UNION SELECT, using UNION to combine attacker-controlled queries, and finally extracting sensitive data. This order ensures each step builds on the previous one.

Answer

Test injection points, then identify vulnerability, then find number of columns, then use UNION, then extract data

Answer

Identify vulnerability, then find number of columns, then test injection points, then use UNION, then extract data

Answer

Test injection points, then find number of columns, then identify vulnerability, then use UNION, then extract data

Question 10

Which type of malware is characterized by its ability to spread without requiring a host file and can replicate across networks automatically?

Accepted Answer

Worm. Option C is correct because a worm is a standalone malware program that replicates itself across networks without requiring a host file or user intervention. It exploits network vulnerabilities, such as unpatched services or weak credentials, to propagate automatically, often using protocols like SMB, RDP, or email transport mechanisms.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 11

Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)

Accepted Answer

Performing an SMB null session and querying the SAM database.. Option B is correct because an SMB null session (connecting to IPC$ without credentials) can be used to query the SAM database via the SAMR protocol, allowing an attacker to enumerate local user accounts and groups on a Windows system. This technique exploits the default configuration of older Windows versions or improperly secured systems where the null session is not restricted.

Answer

Requesting a DNS zone transfer to obtain a list of user account names from the SRV records.

Answer

Sending Kerberos AS-REQ packets and analyzing the error codes (e.g., KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN).

Question 12

A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?

Accepted Answer

Persistence mechanism. The malware adds a startup entry in the Windows registry (e.g., Run or RunOnce keys), which ensures the executable is automatically launched each time the user logs in. This is a classic persistence mechanism, as defined by MITRE ATT&CK technique T1547.003, because it maintains the malware's presence across system reboots.

Answer

Keylogging

Answer

Fileless execution

Answer

Privilege escalation

Question 13

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Accepted Answer

MySQL (3306) - exploit CVE-2016-6662. MySQL (3306) is the correct target because CVE-2016-6662 is a critical remote code execution vulnerability in MySQL that allows an attacker to inject malicious configuration directives via a crafted `my.cnf` file, leading to arbitrary code execution with the privileges of the MySQL daemon (typically root). This provides a reliable, high-impact initial access vector without requiring authentication or brute-forcing, making it the highest-chance option among the listed services.

Answer

HTTP (80) - exploit Apache vulnerability

Answer

SSH (22) - brute force user credentials

Answer

Proxy (8080) - exploit Squid vulnerability

Question 14

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Accepted Answer

Hosting provider and country. Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Answer

Internal IP addresses of the servers

Answer

Employee email addresses

Question 15

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Accepted Answer

The attacker extracted hashed passwords that can be cracked offline. The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Answer

The attacker successfully performed a blind SQL injection to enumerate the database structure

Answer

The attacker caused a denial of service by sending an invalid query

Answer

The attacker modified the database records to update user passwords

Question 16

Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?

Accepted Answer

The action was performed by the AWS root account, which should be avoided for routine tasks.. The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.

Answer

The AMI ID (ami-0abcdef1234567890) is from a trusted source.

Answer

The source IP address (203.0.113.5) is suspicious.

Answer

The instance type is t2.micro, which may be vulnerable.

Question 17

Which TWO of the following tools are commonly used for passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API without directly interacting with the target network. It collects email addresses, subdomains, IPs, and employee names by querying publicly available data, making it a purely passive technique.

Answer

nmap

Answer

Netcat

Answer

Metasploit

Question 18

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Accepted Answer

Email enumeration. Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer

DNS cache poisoning

Answer

Man-in-the-middle attack

Answer

Phishing attack

Question 19

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Accepted Answer

Apache Tomcat 8.5.5. Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.

Answer

MAC Address 00:1A:2B:3C:4D:5E

Answer

Apache httpd 2.4.18

Answer

OpenSSH 7.2p2

Question 20

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.