CEH Practice Test 26 — 15 Questions

Question 1

You are a security analyst for a medium-sized e-commerce company. The company hosts its web application on a single server running Apache on Ubuntu. Recently, the operations team noticed that the server's CPU usage spikes to 100% every few minutes, causing the website to become unresponsive. They have ruled out hardware issues. The web server logs show repeated requests to the same URL with varying parameters, such as /product?id=1, /product?id=2, etc., all originating from a single IP address. Each request returns a 200 OK response, but the server takes several seconds to generate the page. The application uses a relational database backend with an ORM. You suspect an attack is occurring. What is the most likely attack and the best immediate course of action?

Accepted Answer

Block the IP address of the attacker at the firewall. The attack is a resource exhaustion or application-layer DoS attack, where repeated requests to a database-backed endpoint (e.g., /product?id=1, /product?id=2) cause high CPU usage due to expensive ORM queries. The immediate best course is to block the single attacking IP at the firewall, as it stops the malicious traffic at the network perimeter with minimal overhead, preserving server resources for legitimate users.

Answer

Implement rate limiting on the /product endpoint

Answer

Install a web application firewall (WAF) to detect and block malicious requests

Answer

Apply input validation to ensure product IDs are positive integers

Question 2

A penetration tester successfully gains access to a Linux server as a low-privilege user. The goal is to escalate to root. Which THREE methods could the tester use to achieve privilege escalation?

Accepted Answer

Exploit a vulnerable SUID binary to spawn a root shell. Options B, C, and D are correct. Exploiting SUID binaries, kernel exploits, and sudo misconfigurations are common Linux privilege escalation techniques. A and E are enumeration steps, not escalation methods.

Answer

Enumerate SUID binaries with 'find / -perm -4000'

Answer

Check /etc/shadow for weak password hashes

Question 3

A penetration tester obtains a hash dump from a compromised Windows system and wants to crack LM and NTLM hashes quickly using precomputed tables. Which tool would be most efficient for this task?

Accepted Answer

Ophcrack. Option A is correct. Ophcrack is specifically designed to crack LM and NTLM hashes using rainbow tables. John the Ripper and Hashcat are also good but Ophcrack is optimized for Windows hashes and precomputed tables.

Answer

Hashcat

Answer

John the Ripper

Answer

RainbowCrack

Question 4

You are a security analyst for a financial institution. The company has deployed a network of 500 Windows 10 workstations and 50 servers running Windows Server 2019. All systems are protected by a next-generation firewall and an endpoint detection and response (EDR) solution. Recently, several employees reported that their workstations are running slowly and exhibiting unusual pop-up messages demanding a ransom note in Bitcoin. The EDR alerts show that a file named 'invoice.docm' was downloaded from an email attachment and executed on multiple workstations. The EDR also indicates that the file dropped a PowerShell script that connected to an external IP address and downloaded additional payloads. After the initial infection, the EDR detected that the ransomware binary 'encryptor.exe' was executed, which began encrypting files. However, the encryption process was stopped by the EDR before all files were encrypted. The incident response team needs to determine the source of the infection and prevent future occurrences. Which of the following is the most effective first step to identify the initial infection vector?

Accepted Answer

Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.. Option C is correct because enabling macro security settings in Microsoft Office and enforcing them via Group Policy directly addresses the initial infection vector: the 'invoice.docm' file, which is a macro-enabled document. Macros are the most common mechanism for delivering initial payloads in phishing attacks, and blocking them from running without explicit consent prevents the PowerShell script from being executed, stopping the attack chain at its source.

Answer

Reimage all affected workstations to remove the ransomware and then review email logs for the original phishing email.

Answer

Block the external IP address at the firewall to prevent further communication with the C2 server.

Answer

Disable PowerShell across all workstations via Group Policy to prevent script execution.

Question 5

You are a security consultant hired by a mid-sized company with 500 employees. The company has a central office with a lobby, reception, and two secure areas: the server room (requires keycard and PIN) and the executive floor (requires keycard only). Recently, employees have reported seeing unfamiliar people in restricted areas. Security logs show keycard access for the server room only during business hours, but no anomalies. However, the executive floor logs show multiple entries by a single employee, John from Sales, at odd hours. John claims he was working late. The company has a policy that all employees must wear ID badges visibly. You observe that employees often hold doors open for colleagues, and the receptionist does not verify visitor badges. Which of the following actions should you recommend FIRST to address the most likely attack vector?

Accepted Answer

Implement mantraps and enforce a policy of one person per keycard entry. The most likely attack vector is tailgating (piggybacking), where unauthorized individuals gain physical access by following an authorized employee through a secured door without using their own credentials. Option C directly addresses this by implementing mantraps (a small room with two interlocking doors that only allows one person to pass at a time) and enforcing a strict one-person-per-keycard-entry policy, which physically prevents tailgating. This is the first and most effective control because it mitigates the root cause—social engineering exploiting human courtesy—rather than focusing on symptoms like John's after-hours access or adding surveillance that doesn't prevent the act.

Answer

Investigate John's activities and consider disciplinary action

Answer

Upgrade keycard readers to biometric scanners

Answer

Install additional CCTV cameras in hallways

Question 6

Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?

Accepted Answer

Polymorphic virus. Polymorphic malware changes its code (but retains functionality) to avoid detection by signature-based antivirus.

Answer

Trojan horse

Answer

Macro virus

Answer

Boot sector virus

Question 7

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain information. Here the attacker pretends to be IT support to trick the user into revealing their password.

Answer

Phishing

Answer

Baiting

Answer

Vishing

Question 8

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature on each infection.. Polymorphic viruses change their code signature each time they replicate, making detection difficult. They often use encryption to hide malicious code.

Answer

It spreads without user interaction.

Answer

It attaches to a host file and does not change.

Answer

It only infects the boot sector.

Question 9

An analyst uses the following command to capture traffic: tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80. After generating traffic from a web server at 10.0.0.5, the analyst examines the pcap with Wireshark. What type of traffic will appear in the capture?

Accepted Answer

HTTP traffic to and from 10.0.0.5. The filter 'host 10.0.0.5 and port 80' captures traffic to/from the host on port 80 only. It does not specify direction, so both inbound and outbound HTTP traffic (TCP port 80) from that host is captured.

Answer

All HTTP traffic on the network

Answer

Only HTTP traffic originating from 10.0.0.5

Answer

All traffic from 10.0.0.5 on any port

Question 10

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Accepted Answer

Static analysis using strings and PEiD. Static analysis (e.g., examining strings, digital signatures, PE headers) is the first step because it is safe and can quickly identify suspicious indicators without executing the file.

Answer

Upload to VirusTotal

Answer

Dynamic analysis in a sandbox

Answer

Run the file on a production system to observe behavior

Question 11

Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)

Accepted Answer

It uses spoofed source IP addresses. DNS amplification uses open resolvers and spoofed source IPs to send small queries that yield large responses, amplifying traffic.

Answer

It targets the victim's MAC address

Answer

It requires the attacker to be on the same subnet as the victim

Answer

It uses ICMP echo requests

Question 12

A penetration tester is performing a session hijacking attack. After capturing packets, the tester successfully predicts the TCP sequence numbers and injects packets to take over the session. Which type of attack is this?

Accepted Answer

TCP session hijacking. TCP sequence prediction is a classic method for session hijacking, where the attacker guesses the sequence numbers to spoof the server's IP and inject packets. ARP poisoning and MAC flooding are local network attacks, and cookie theft is application-level.

Answer

MAC flooding

Answer

Cookie theft

Answer

ARP poisoning

Question 13

Which THREE of the following are techniques used in static malware analysis? (Select 3)

Accepted Answer

Inspecting file metadata and properties. Static analysis examines the binary without execution. Inspecting file metadata, searching for suspicious strings, and analyzing the file's structure (e.g., using PEiD) are static techniques. Monitoring registry changes and network connections require execution (dynamic analysis).

Answer

Capturing network traffic in a sandbox

Answer

Monitoring registry changes during execution

Question 14

An organization's security team observes a surge in outgoing DNS queries to external servers from a single internal host, with each query returning unusually large responses (e.g., 4000 bytes). The host is not configured as a DNS resolver. Which attack is MOST likely occurring?

Accepted Answer

DNS amplification DDoS attack. DNS amplification attack uses small queries to generate large responses, overwhelming the victim. The large response sizes and unusual outgoing queries from a single host indicate the host is being used as an amplifier in a DDoS attack.

Answer

DNS cache poisoning

Answer

DNS zone transfer

Answer

DNS tunneling

Question 15

A company's security team wants to deploy a DDoS mitigation technique that distributes incoming traffic across multiple servers in different geographic locations, making it harder for an attacker to overwhelm a single target. Which technique BEST fits this description?

Accepted Answer

Anycast network. Anycast routing allows multiple servers to share the same IP address; traffic flows to the nearest server, distributing the load and absorbing DDoS attacks.

Answer

Rate limiting

Answer

Load balancer

Answer

Scrubbing center