CEH Practice Test 26 — 15 Questions

Question 1

A penetration tester uses the Social Engineering Toolkit (SET) to create a malicious USB drive that autoruns when inserted. Which social engineering technique is being employed?

Accepted Answer

Baiting. Baiting is the correct answer because the penetration tester is using a physical device (USB drive) to exploit human curiosity or greed, enticing the target to insert it into a system. The Social Engineering Toolkit (SET) can create an autorun.inf file that triggers a payload upon insertion, which is a classic baiting attack that relies on the victim's action to compromise the system.

Answer

Tailgating

Answer

Pretexting

Answer

Phishing

Question 2

You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?

Accepted Answer

Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.. The server allows file uploads with .phtml extension, which Apache processes as PHP due to its configuration. Uploading a PHP web shell with .phtml extension to the /uploads/ directory and accessing it directly allows command execution, escalating the attack. This bypasses the 403 Forbidden restriction on .php files while leveraging the existing upload functionality.

Answer

Use the PUT method to upload a malicious file directly to the web root.

Answer

Exploit the IIS WebDAV vulnerability to execute commands.

Answer

Attempt SQL injection in the login form to extract database credentials.

Question 3

An analyst executes 'nmap -sU -p 161,162 10.0.0.1'. What is the primary purpose of this scan?

Accepted Answer

Discover SNMP services running on the target. The `-sU` flag instructs Nmap to perform a UDP scan, and the `-p 161,162` targets the default SNMP ports (UDP 161 for SNMP queries, UDP 162 for SNMP traps). This combination is specifically designed to discover SNMP services running on the target host, as SNMP operates exclusively over UDP. Option C is correct because the command's primary purpose is to probe for SNMP services.

Answer

Detect TCP services on the target

Answer

Enumerate all open ports on the target

Answer

Perform a SYN flood attack

Question 4

During a forensic investigation, an analyst finds a suspicious file that changes its code signature each time it replicates. The file uses encryption and polymorphism to evade signature-based detection. Which type of virus is this?

Accepted Answer

Polymorphic virus. D is correct because a polymorphic virus is specifically designed to change its code signature each time it replicates, using encryption and mutation engines to evade signature-based detection. The description of altering the signature with each replication while maintaining the same core functionality is the defining characteristic of a polymorphic virus.

Answer

Macro virus

Answer

File infector virus

Answer

Boot sector virus

Question 5

A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?

Accepted Answer

Disable password authentication and use SSH key-based authentication.. Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.

Answer

Install fail2ban to automatically block IPs after failures.

Answer

Implement rate-limiting on SSH connections per IP.

Answer

Change the SSH port to a non-standard port.

Question 6

Which of the following is a type of malware that spreads by replicating itself across a network without requiring a host file?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself across a network by exploiting vulnerabilities or using network protocols (e.g., SMB, RDP, or email) without needing a host file. Unlike viruses, worms do not attach to existing programs; they self-propagate via network connections, often consuming bandwidth and creating backdoors.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 7

A security analyst wants to gather information about a target domain without directly interacting with its systems. Which technique would be MOST appropriate?

Accepted Answer

Query WHOIS databases for domain registration information. Querying WHOIS databases is a passive reconnaissance technique that retrieves publicly available domain registration information (e.g., registrar, creation/expiration dates, name servers, and administrative contacts) without sending any packets to the target's systems. This aligns with the goal of gathering information without direct interaction, as defined in the CEH footprinting phase.

Answer

Send ICMP echo requests to the target network

Answer

Run a vulnerability scan with Nessus

Answer

Perform a port scan using Nmap SYN scan

Question 8

Which of the following techniques is considered PASSIVE reconnaissance?

Accepted Answer

Performing a WHOIS lookup. WHOIS queries retrieve domain registration records from public databases like whois.iana.org or RDAP servers. Since the target server is never contacted directly — only public registries are queried — no packets are sent to the target's infrastructure, making it a purely passive reconnaissance technique.

Answer

Ping sweeping a subnet

Answer

Banner grabbing with Telnet

Answer

Running a SYN scan with Nmap

Question 9

Which password cracking method uses a precomputed table of hash chains to reverse password hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses precomputed tables of hash chains to reverse password hashes quickly. Instead of computing the hash for every possible password in real time, the attacker looks up the hash in the table to find the corresponding plaintext, drastically reducing the time needed for cracking.

Answer

Hybrid attack

Answer

Dictionary attack

Answer

Brute-force attack

Question 10

During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?

Accepted Answer

Email enumeration. Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.

Answer

DNS cache poisoning

Answer

Man-in-the-middle attack

Answer

Phishing attack

Question 11

A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?

Accepted Answer

Enable multi-factor authentication (MFA) for all users.. Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.

Answer

Enforce complex password policies.

Answer

Implement CAPTCHA on the login page.

Answer

Enable account lockout after 3 failed attempts.

Question 12

Drag and drop the steps to perform a successful social engineering attack in a penetration test into the correct order.

Accepted Answer

Research, Craft Pretext, Choose Channel, Execute, Document. In a social engineering penetration test, the correct sequence is Research (gather intelligence on the target), Craft Pretext (create a believable scenario), Choose Channel (select communication medium), Execute (deliver the attack), and Document (record findings). This order ensures the attack is tailored and effective, as each step builds on the previous one.

Answer

Choose Channel, Research, Craft Pretext, Execute, Document

Answer

Execute, Research, Craft Pretext, Choose Channel, Document

Answer

Research, Choose Channel, Craft Pretext, Execute, Document

Question 13

Which phase of the system hacking methodology (CHPSET) involves hiding files from the operating system using techniques such as rootkits or steganography?

Accepted Answer

Hiding files. The 'Hiding files' phase of the CHPSET (Cracking passwords, Hacking, Privilege escalation, Spying, Erasing tracks, Executing applications, Hiding files) methodology involves concealing malicious files from the operating system and security tools. Techniques such as rootkits (which hook system calls like NtQueryDirectoryFile to hide files from directory listings) and steganography (embedding data within innocent files like images or audio) are used to avoid detection. This phase directly follows 'Executing applications' and ensures the attacker's payload remains persistent and covert.

Answer

Cracking passwords

Answer

Erasing tracks

Answer

Executing applications

Question 14

A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?

Accepted Answer

Configure egress filtering on the firewall to block outbound connections to known malicious domains.. Egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.

Answer

Install a host-based firewall on the IoT device to restrict outbound traffic.

Answer

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Answer

Disable DNS resolution on the IoT device to prevent any external communication.

Question 15

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

Accepted Answer

The domain has two mail exchange servers. The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Answer

The DNS server is configured to block zone transfers

Answer

Mail is automatically forwarded to a backup server

Answer

The domain has an SPF record configured