CEH Practice Test 5 — 25 Questions

Question 1

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anti-VM / sandbox evasion. Checking the number of CPU cores is a classic anti-VM/sandbox evasion technique. Virtual machines and sandboxes often allocate minimal resources (e.g., a single core) to remain lightweight, so malware uses this check to detect an analysis environment and terminate execution to avoid detection.

Answer

Code obfuscation

Answer

Anti-debugging

Answer

Packing

Question 2

Which TWO of the following are valid enumeration techniques? (Select 2)

Accepted Answer

LDAP enumeration. LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.

Answer

ARP poisoning

Answer

DNS cache poisoning

Answer

ICMP flooding

Question 3

Drag and drop the steps to conduct a penetration test using the CEH methodology into the correct order.

Accepted Answer

Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks. The CEH methodology follows: Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks.

Answer

Scanning, Reconnaissance, Gaining Access, Maintaining Access, Covering Tracks

Answer

Reconnaissance, Scanning, Gaining Access, Covering Tracks, Maintaining Access

Answer

Gaining Access, Reconnaissance, Scanning, Maintaining Access, Covering Tracks

Question 4

A security analyst is analyzing a suspicious file and runs the command 'strings malware.exe | grep -i http'. The output shows several URLs ending with '.exe'. What does this indicate?

Accepted Answer

The malware may download additional payloads from remote servers. The `strings` command extracts printable strings from a binary file, and `grep -i http` filters for HTTP-related content. The presence of URLs ending with `.exe` indicates that the malware contains embedded references to executable files hosted on remote servers, which is a common technique for downloading additional payloads or updates. This strongly suggests the malware has a downloader or dropper component that fetches further malicious code from those URLs.

Answer

The malware has a keylogger component

Answer

The malware is a boot sector virus

Answer

The malware is a worm that spreads via email

Question 5

An analyst observes the following SNMP walk output on a network device: `SNMPv2-SMI::enterprises.9.9.23.1.2.1.1.5.1 = STRING: "cisco"`. Which finding is most significant?

Accepted Answer

The SNMP community string is "cisco" and likely weak. The SNMP walk output reveals the community string 'cisco' in the OID `enterprises.9.9.23.1.2.1.1.5.1`, which corresponds to the SNMP community string (ciscoSnmpCommunityString) in Cisco's private MIB. A default or easily guessable community string like 'cisco' is a critical security weakness because it allows unauthorized read or read-write access to the device, enabling enumeration of system information or configuration changes. This finding is the most significant because it directly indicates a weak authentication mechanism that can be exploited for further enumeration or system compromise.

Answer

The SNMP service is using version 2c

Answer

The device is running Cisco IOS version 12.0

Answer

The device is configured for read-write access

Question 6

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting

Question 7

An attacker sends an email to the CEO of a company, pretending to be a board member and requesting a wire transfer for a confidential acquisition. Which social engineering attack is this?

Accepted Answer

Whaling. Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like C-suite executives or board members. In this scenario, the attacker impersonates a board member to trick the CEO into authorizing a wire transfer, which is a classic whaling tactic because it exploits the authority and trust associated with senior leadership.

Answer

Vishing

Answer

Spear phishing

Answer

Phishing

Question 8

During a penetration test, an analyst uses enum4linux with the -a flag against a target. Which of the following is the MOST comprehensive set of information that can be obtained?

Accepted Answer

User list, share list, OS information, password policy, and group memberships. enum4linux with the -a flag performs a comprehensive enumeration against a target, leveraging SMB, RPC, and NetBIOS over TCP/IP. It retrieves user lists, share lists, OS information, password policy details, and group memberships by querying the remote Windows system via SMB RPC calls (e.g., SAMR, LSA, SRVSVC). This makes it the most complete set of information obtainable from a single command, as the -a flag essentially runs all available enumeration modules.

Answer

Only the domain admins and local admins

Answer

Only the SMB shares and open sessions

Answer

Only the NetBIOS name table

Question 9

Which TWO of the following are examples of amplification attacks used in DDoS?

Accepted Answer

DNS amplification. DNS amplification is a classic DDoS amplification attack where an attacker sends a small DNS query (e.g., an ANY or TXT record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a much larger response (up to 50x the query size), flooding the victim with traffic. This exploits the UDP protocol's lack of handshake and the resolver's willingness to respond to any source.

Answer

Slowloris

Answer

SYN flood

Answer

Ping of Death

Question 10

During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?

Accepted Answer

A zone transfer request. The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.

Answer

A subdomain brute-force

Answer

A reverse DNS lookup

Answer

A SRV record enumeration

Question 11

During a penetration test, the tester runs `enum4linux -U 192.168.1.20` and obtains a list of usernames. What service is being enumerated, and what is the primary risk associated with this information disclosure?

Accepted Answer

SMB; it can facilitate password spraying or brute‑force attacks. enum4linux is a tool that queries SMB (Server Message Block) services on a target, typically over TCP ports 139 or 445. The `-U` flag specifically enumerates users from the SAM database via the SMB protocol. The primary risk of obtaining a valid username list is that it enables password spraying or brute-force attacks against SMB authentication, which can lead to unauthorized access.

Answer

NFS; it can lead to unauthorized file access

Answer

SNMP; it can reveal community strings

Answer

LDAP; it can expose directory structure

Question 12

A network administrator notices that the switch's CAM table is full, causing the switch to flood all incoming traffic out of all ports. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table by sending thousands of frames with unique, random source MAC addresses. Once the CAM table is full, the switch enters a fail-open state and begins flooding all incoming frames out every port, effectively turning it into a hub and allowing the attacker to sniff traffic. This directly matches the scenario where a full CAM table causes flooding.

Answer

ARP poisoning

Answer

DHCP starvation

Answer

DNS spoofing

Question 13

An ethical hacker is analyzing a suspicious file using static analysis. Which of the following actions is part of static malware analysis?

Accepted Answer

Examining the file's strings and metadata without executing it. Static malware analysis involves examining the file without executing it. Option C is correct because analyzing strings and metadata (e.g., file headers, embedded URLs, IP addresses, or suspicious function calls) is a core static analysis technique, often performed using tools like `strings`, `binwalk`, or `PEview`. This approach avoids the risks of execution and helps identify indicators of compromise (IOCs) before dynamic analysis.

Answer

Running the file in a sandboxed environment and monitoring its behavior

Answer

Uploading the file to VirusTotal for scanning

Answer

Using Wireshark to capture packets sent by the file

Question 14

Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)

Accepted Answer

Configuring port security on switches. Configuring port security on switches is effective against ARP poisoning because it limits the number of MAC addresses allowed on a port, preventing an attacker from flooding the network with spoofed MAC addresses. By restricting the port to a single or limited set of MAC addresses, it stops unauthorized devices from injecting fake ARP replies. This is a Layer 2 security control that directly mitigates the ability to perform ARP cache poisoning at the access edge.

Answer

Enabling DHCP snooping

Answer

Disabling STP on all ports

Question 15

Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)

Accepted Answer

Installing a rootkit. Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.

Answer

Running a vulnerability scanner

Answer

Enabling firewall rules

Answer

Creating new user accounts

Question 16

A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.

Answer

Vulnerability scanning

Answer

Social engineering

Answer

Active reconnaissance

Question 17

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 18

During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?

Accepted Answer

MAC flooding. MAC flooding. When a switch's MAC address table is full, it can no longer learn new MAC addresses and enters a fail-open state, flooding all incoming frames out every port except the ingress port. This allows the tester to capture traffic destined for other hosts on the same VLAN by placing their NIC in promiscuous mode and using Wireshark, effectively performing a MAC flooding attack to turn the switch into a hub-like device.

Answer

DNS spoofing

Answer

Session hijacking

Answer

ARP poisoning

Question 19

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review

Question 20

A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?

Accepted Answer

Man-in-the-middle using a rogue certificate. A certificate issued by an intermediate CA chaining to an untrusted root is the classic signature of a rogue or self-signed CA used in a man-in-the-middle attack. The attacker presents a certificate for www.example.com signed by their own CA; because the root is not in the client's trust store, the chain fails validation, but the log event reveals the attempt. This is exactly how TLS interception proxies and malicious MITM setups appear in logs.

Answer

Birthday attack on the certificate signature

Answer

Downgrade attack to SSLv3

Answer

Replay attack on the TLS handshake