CEH Practice Test 26 — 15 Questions

Question 1

During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?

Accepted Answer

MX record. An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.

Answer

CNAME record

Answer

A record

Answer

NS record

Question 2

Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)

Accepted Answer

-D. (-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.

Answer

-sV

Answer

-O

Answer

-sT

Question 3

A security team detects that an internal host is sending ARP replies claiming to have the IP address of the default gateway. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a dedicated man-in-the-middle (MITM) attack tool that includes built-in ARP poisoning functionality. It sends forged ARP replies to associate the attacker's MAC address with the default gateway's IP, redirecting traffic through the attacker's host. This matches the described behavior of claiming the gateway's IP address via ARP replies.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 4

A security analyst runs a vulnerability scan with Nessus and receives a report indicating that multiple hosts have the 'MS17-010' vulnerability. What is the MOST likely impact of this vulnerability if exploited?

Accepted Answer

Remote code execution on Windows systems. MS17-010 is a critical remote code execution vulnerability in the Microsoft Server Message Block (SMB) protocol. Exploitation allows an unauthenticated attacker to send specially crafted packets to an SMB server, enabling arbitrary code execution with system privileges. This is the same vulnerability leveraged by the EternalBlue exploit used in the WannaCry ransomware attacks.

Answer

SQL injection

Answer

Cross-site scripting

Answer

DNS cache poisoning

Question 5

After successfully exploiting a system, an attacker uses the command 'wevtutil cl system' on a Windows target. What is the MOST likely purpose of this command?

Accepted Answer

To clear the system event log. The command 'wevtutil cl system' is used to clear the System event log on a Windows system. After successfully exploiting a target, an attacker would use this command to erase traces of their activities, such as log entries generated by their tools or actions, thereby hindering forensic analysis. The 'cl' parameter stands for 'clear log', and 'system' specifies the System log.

Answer

To export event logs to a file

Answer

To disable Windows event logging

Answer

To create a new event log entry

Question 6

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Accepted Answer

Ettercap. Ettercap is a dedicated suite for man-in-the-middle attacks on LANs, with built-in support for ARP poisoning. It actively sends forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host, allowing interception of traffic between two hosts. This makes it the most direct and purpose-built tool for the task described.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 7

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Accepted Answer

Slow down the scan rate. Slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

Answer

Use random source ports

Answer

Use a decoy scan

Answer

Use fragmented packets

Question 8

Which of the following tools is specifically designed to enumerate SMB shares and user information from Windows systems using the SMB protocol?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.

Answer

snmpwalk

Answer

nmap

Answer

hping3

Question 9

Drag and drop the steps to set up a VPN using IPsec in tunnel mode into the correct order.

Accepted Answer

Phase 1, then Phase 2, then traffic selectors, then apply policies, then test.. The correct sequence for setting up a VPN using IPsec in tunnel mode is: Phase 1 (IKE) to establish a secure channel, Phase 2 (IPsec) to negotiate security associations, then define traffic selectors (interesting traffic), apply the policies, and finally test the connection. This order ensures that the underlying secure infrastructure is built before defining and enforcing traffic rules, and that testing validates the entire setup.

Answer

Phase 2, then Phase 1, then traffic selectors, then apply policies, then test.

Answer

Phase 1, then traffic selectors, then Phase 2, then apply policies, then test.

Answer

Phase 1, then Phase 2, then apply policies, then traffic selectors, then test.

Question 10

Which type of malware is characterized by encrypting a victim's files and demanding a ransom payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files on the victim's system using strong encryption algorithms (e.g., AES-256 or RSA) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This matches the description exactly, distinguishing it from other malware types that do not perform file encryption for extortion.

Answer

Spyware

Answer

Adware

Answer

Keylogger

Question 11

A penetration tester uses a tool to spoof ARP replies, redirecting traffic through the tester's machine. The tester then captures credentials from the redirected traffic. Which tool is BEST suited for this task?

Accepted Answer

Ettercap. Ettercap is the best tool for ARP spoofing because it is specifically designed for man-in-the-middle (MITM) attacks on local networks. It actively sends forged ARP replies to poison the ARP cache of target hosts, redirecting traffic through the attacker's machine, and includes built-in packet capture and credential extraction features.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 12

A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?

Accepted Answer

Anyone on the internet can read objects in the bucket if they know the object URL.. The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.

Answer

The data is encrypted at rest, so no exposure risk exists.

Answer

The bucket policy is misconfigured but only affects objects with server-side encryption.

Answer

Only authenticated AWS users can access the bucket, so the risk is limited.

Question 13

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Accepted Answer

-f (fragment packets). The -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Answer

-sT (TCP connect scan)

Answer

-sV (version detection)

Question 14

An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?

Accepted Answer

enum4linux 192.168.1.1. enum4linux is a tool specifically designed to enumerate SMB (Server Message Block) shares, users, and other information from Windows systems using the SMB protocol. The analyst detected SMB enumeration traffic, which is exactly what enum4linux generates by querying NetBIOS and SMB services (ports 139 and 445).

Answer

nmap -sT 192.168.1.1

Answer

snmpwalk -v 2c 192.168.1.1

Answer

ldapsearch -h 192.168.1.1

Question 15

Which THREE of the following are common techniques used in the 'Cracking passwords' phase of system hacking? (Select 3)

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

Answer

Keylogging

Answer

Social engineering