CEH Practice Test 27 — 15 Questions

Question 1

During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk. The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

Answer

NFS enumeration; it indicates that NFS shares are world-readable

Answer

SNMP enumeration; it indicates that the community string is weak

Answer

SMTP enumeration; it indicates that the mail server is misconfigured

Question 2

During a penetration test, you receive a list of password hashes from a Windows server. Which of the following tools would be BEST suited to perform a dictionary attack against these hashes?

Accepted Answer

John the Ripper. John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 3

A security analyst runs the following command: 'smbclient -L //192.168.1.50 -N'. What is the purpose of this command?

Accepted Answer

List available SMB shares on the remote host anonymously. The `smbclient -L` command lists the available SMB shares on a remote host. The `-N` flag suppresses the password prompt, effectively performing an anonymous (null session) enumeration of shares. This is a standard technique in the enumeration phase to discover accessible resources without authentication.

Answer

Connect to the remote host's SMB share with a null password

Answer

Perform a dictionary attack on SMB passwords

Answer

Enumerate users via SMB

Question 4

A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?

Accepted Answer

VRFY. The VRFY command is used in SMTP to verify whether a mailbox exists on the server. By issuing VRFY followed by a username, the server typically responds with a 250 code if the user exists or a 550 code if not, enabling user enumeration. This is a recognized technique in security assessments to discover valid email accounts.

Answer

DATA

Answer

MAIL FROM

Answer

HELO

Question 5

Which TWO tools are specifically designed for cloud security auditing and exploitation? (Choose two.)

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security-auditing tool that assesses the security posture of AWS, Azure, and GCP environments by checking for misconfigurations, excessive permissions, and compliance violations. Pacu is an AWS exploitation framework designed for offensive security testing, allowing penetration testers to enumerate resources, escalate privileges, and execute post-exploitation modules against cloud accounts. Both tools are purpose-built for cloud security auditing and exploitation, making them the correct choices.

Answer

Nessus

Answer

Aircrack-ng

Answer

Nmap

Question 6

A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?

Accepted Answer

Token impersonation. With SeTcbPrivilege enabled, the attacker can call the `CreateProcessAsUser` or `DuplicateTokenEx` API to impersonate any user token, including SYSTEM. This is a classic token impersonation attack, allowing the attacker to elevate from LOCAL SYSTEM to a higher-integrity context or move laterally by creating processes with arbitrary identities.

Answer

Sticky keys exploit

Answer

DLL injection

Answer

Pass-the-hash

Question 7

Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)

Accepted Answer

It uses spoofed source IP addresses. DNS amplification attacks rely on sending DNS queries with a spoofed source IP address that matches the victim's IP. The attacker sends small queries to open DNS resolvers, which then send large responses to the victim, overwhelming their bandwidth. This spoofing ensures the amplified traffic is directed at the victim, not the attacker.

Answer

It targets the victim's MAC address

Answer

It requires the attacker to be on the same subnet as the victim

Answer

It uses ICMP echo requests

Question 8

In the context of system hacking methodology (CHPSET), which phase involves removing evidence of the attacker's activities from logs and system files?

Accepted Answer

Erasing tracks. In the CEH system hacking methodology (CHPSET), the 'Erasing tracks' phase is specifically defined as the step where attackers remove evidence of their activities, such as clearing logs, modifying timestamps, or deleting system files. This ensures that intrusion detection systems or system administrators cannot trace the attack back to the source.

Answer

Spying

Answer

Privilege escalation

Answer

Cracking passwords

Question 9

Which TWO of the following Nmap scans are considered 'stealth' scans that do not complete a full TCP three-way handshake?

Accepted Answer

FIN scan (-sF). A FIN scan (-sF) sends a TCP packet with only the FIN flag set. According to RFC 793, if the port is closed, the target responds with an RST packet; if open, the packet is ignored. This avoids completing a full TCP three-way handshake, making it a stealth scan.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

ACK scan (-sA)

Question 10

Which TWO of the following are cloud-specific security threats?

Accepted Answer

S3 bucket misconfiguration. Option D (S3 bucket misconfiguration) is a cloud-specific threat because it exploits the shared responsibility model in AWS, where an improperly configured bucket ACL or bucket policy can expose object storage publicly over the internet, a risk unique to cloud object storage services. Option E (SSRF in cloud) is cloud-specific because server-side request forgery can be used to reach the cloud instance metadata service (e.g., 169.254.169.254) and steal temporary IAM credentials from instance roles, an attack path that only exists in cloud environments. The unmarked options do not belong: SQL injection (A) is a generic web application vulnerability targeting database query construction, de-authentication attack (B) is a Wi-Fi layer 2 denial-of-service technique against 802.11 management frames, and ARP spoofing (C) is a LAN-based man-in-the-middle attack on IPv4-to-MAC resolution, none of which are specific to cloud platforms.

Answer

SQL injection

Answer

De-authentication attack

Answer

ARP spoofing

Question 11

Which TWO of the following are examples of privilege escalation on Linux? (Select 2)

Accepted Answer

SUID bit abuse. SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.

Answer

Pass-the-Hash

Answer

Token impersonation

Answer

DLL hijacking

Question 12

Which THREE of the following are indicators of a slowloris DDoS attack?

Accepted Answer

Normal traffic volume but connections remain open for a long time. B is correct because a Slowloris DDoS attack works by opening many connections to a target web server and keeping them open for as long as possible, sending partial HTTP requests to tie up server resources. This results in normal traffic volume but with connections that remain open for extended periods, preventing legitimate users from connecting.

Answer

ICMP echo replies from random IPs

Answer

High volume of UDP packets

Question 13

Which THREE of the following Nmap flags are commonly used for evasion techniques? (Select 3)

Accepted Answer

-f. The -f flag fragments the probe packets into smaller 8-byte fragments (or less, depending on the MTU). This helps evade simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragments before applying rules, as the fragmented headers may bypass signature-based detection.

Answer

-O

Answer

-sV

Question 14

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature on each infection.. A polymorphic virus mutates its code signature with each infection, using a mutation engine to generate new decryption routines or code patterns while preserving the core payload. This signature change evades signature-based detection by antivirus software, as the virus appears different in every infected file.

Answer

It spreads without user interaction.

Answer

It attaches to a host file and does not change.

Answer

It only infects the boot sector.

Question 15

Which tool is specifically designed to perform SNMP enumeration by walking the MIB tree using a known community string?

Accepted Answer

SNMPwalk. SNMPwalk is the correct tool because it is specifically designed to perform SNMP enumeration by walking the Management Information Base (MIB) tree using a known community string (e.g., 'public' or 'private'). It sends successive GETNEXT requests to retrieve all OID values from the SNMP agent, effectively dumping the entire MIB tree for reconnaissance.

Answer

enum4linux

Answer

nbtstat

Answer

smbclient