CEH Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?

Accepted Answer

Mail server addresses and priority. The nslookup command with the -type=MX query returns mail exchange (MX) records for the domain. The output shows mail server hostnames and their associated priority values (e.g., 10, 20), which indicate the order in which mail servers should be used. This directly reveals the mail server addresses and their priority, making option A correct.

Answer

Name server records

Answer

IP addresses of the web server

Answer

SPF records for email authentication

Question 2

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Accepted Answer

Set up listener on attacker machine, then victim connects back, then attacker gains shell access, then execute commands, then cleanup. In a reverse shell using Netcat, the correct sequence is: first, the attacker sets up a listener on a chosen port; second, the victim executes a command that connects back to the attacker's listener; third, the attacker gains a shell on the victim machine; fourth, the attacker executes commands; and finally, cleanup is performed to close the connection. This order ensures the listener is ready before the victim connects, and that the shell is operational before executing any commands or terminating the session.

Answer

Victim connects back first, then set up listener, then attacker gains shell access, then execute commands, then cleanup

Answer

Set up listener, then victim connects back, then cleanup, then attacker gains shell access, then execute commands

Answer

Set up listener, then attacker gains shell access, then victim connects back, then execute commands, then cleanup

Question 3

A security analyst is planning a reconnaissance activity that must remain undetected. Which TWO of the following techniques should they choose?

Accepted Answer

Gather information from public OSINT sources like Shodan and social media. OSINT sources like Shodan and social media provide publicly available information without interacting with the target's systems, keeping the reconnaissance passive and undetected. Option C is correct because passive reconnaissance via DNS records (e.g., using cached or third-party DNS databases) avoids querying the target's authoritative DNS servers, thus not generating logs or alerts on the target's infrastructure.

Answer

Engage in social engineering to extract network diagrams from employees

Answer

Use Nmap with default scripts to enumerate services

Answer

Perform a full TCP connect scan on all ports

Question 4

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Accepted Answer

Update Log4j to version 2.17.1 or later. CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

Answer

Remove the JndiLookup class from the Log4j jar

Answer

Disable JDBC appender in Log4j configuration

Answer

Block outbound traffic from the server to the internet

Question 5

A penetration tester uses the SMTP commands VRFY and EXPN on a mail server. What is the tester MOST likely trying to accomplish?

Accepted Answer

To enumerate valid email addresses and distribution lists. The VRFY command asks the mail server to verify whether a given email address exists, while EXPN requests the members of a mailing list or alias. By issuing these commands, the tester can enumerate valid user accounts and distribution lists on the server, which is a key step in building a target list for further attacks such as password guessing or phishing.

Answer

To extract email content from the server

Answer

To perform a mail relay attack

Answer

To test for open relay

Question 6

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

Accepted Answer

Cross-Site Scripting (XSS). The scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.

Answer

SQL Injection

Answer

Cross-Site Request Forgery (CSRF)

Answer

Command Injection

Question 7

Which SNMP community string is typically used for read-only access by default on many devices?

Accepted Answer

public. The default read-only community string in SNMPv1 and SNMPv2c is 'public'. This string acts as a password that allows an SNMP manager to query device MIB objects for monitoring purposes without making configuration changes. It is widely documented in RFC 1157 and is the standard default across most networking equipment.

Answer

snmp

Answer

private

Answer

admin

Question 8

Which TWO of the following are examples of hybrid password attacks? (Select 2 correct answers)

Accepted Answer

Using a dictionary file and appending random numbers to each word. A hybrid password attack combines a dictionary or wordlist with additional modifications, such as appending random numbers to each word. This approach leverages common password patterns where users often add digits to a base word to meet complexity requirements, making it more effective than a simple dictionary attack.

Answer

Using a wordlist to try every possible password in the list

Answer

Generating all possible character combinations up to a certain length

Answer

Cracking passwords using precomputed rainbow tables

Question 9

Which of the following is a method of hiding files on a system using steganography?

Accepted Answer

Embedding a secret message in an image file. Steganography is the practice of concealing a secret message within a non-secret file, such as an image, audio, or video file. By embedding data into the least significant bits (LSB) of pixel values in an image, the file appears unchanged to the casual observer, effectively hiding the secret message in plain sight.

Answer

Encrypting a file with AES

Answer

Renaming a file to a system filename

Answer

Using a rootkit to hide processes

Question 10

An employee receives a text message claiming to be from the company's IT department, stating that their account will be suspended unless they click a link to verify their credentials. Which type of social engineering attack is this?

Accepted Answer

SMiShing. SMiShing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) rather than email or voice. The message impersonates the IT department and uses a link to harvest credentials, which is the hallmark of SMiShing — phishing conducted via Short Message Service.

Answer

Vishing

Answer

Phishing

Answer

Baiting

Question 11

An attacker has compromised a Linux machine and wants to hide a rootkit by replacing system binaries with trojaned versions. Which technique is being used to maintain persistent access while evading detection?

Accepted Answer

Rootkit installation via binary replacement. Replacing system binaries (e.g., `ls`, `ps`, `netstat`) with trojaned versions is a classic rootkit technique. The rootkit intercepts system calls or filters output to hide its own processes, files, and network connections, allowing the attacker to maintain persistent access while evading detection by standard administrative tools.

Answer

Log manipulation

Answer

Token impersonation

Answer

Steganography

Question 12

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

Accepted Answer

The group cipher is TKIP, which is deprecated and vulnerable.. TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.

Answer

The pairwise cipher is CCMP, which is outdated.

Answer

The network uses WPA2-PSK, which is easily cracked.

Answer

The beacon frame reveals the BSSID, which is a security risk.

Question 13

Which TWO of the following are valid methods for enumerating users on a SMTP server? (Select 2)

Accepted Answer

EXPN. EXPN (Expand) and VRFY (Verify) are SMTP commands defined in RFC 821 that allow an attacker to enumerate valid email addresses and mailing list members on a mail server. EXPN reveals the members of a mailing list, while VRFY confirms whether a specific mailbox exists. Both commands are often disabled in production to prevent user enumeration.

Answer

MAIL FROM

Answer

RCPT TO

Answer

AUTH

Question 14

A penetration tester obtains a list of password hashes and uses RainbowCrack. Which statement BEST describes how RainbowCrack works?

Accepted Answer

It uses time-memory trade-off with precomputed hash chains. RainbowCrack implements a time-memory trade-off attack by precomputing hash chains for a given set of passwords and storing them in rainbow tables. When a password hash is provided, the tool looks up the hash in these tables to reverse it, avoiding the need to recompute hashes for every possible password. This makes it far faster than brute-force for cracking hashes, provided the password is covered by the precomputed chains.

Answer

It uses a dictionary attack with word mangling rules

Answer

It uses online password guessing against the target service

Answer

It uses a brute-force attack by trying all possible character combinations

Question 15

An analyst reviews a web server log and sees the following request: GET /search?q= HTTP/1.1. The response from the server includes the search term inside a

tag without any sanitization. Which type of XSS vulnerability does this indicate?

Accepted Answer

Reflected XSS. This is a typical reflected XSS because the malicious script is injected via a GET parameter and immediately reflected in the response without persistent storage.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Blind XSS