CEH Practice Test 28 — 15 Questions

Question 1

An employee receives an email that appears to be from the CEO, requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ceo@cornpany.com instead of ceo@company.com). This is an example of which type of attack?

Accepted Answer

Spear phishing. Spear phishing targets a specific individual with a tailored message, often impersonating a trusted figure. Whaling targets high-profile individuals but is a subset of spear phishing. Pretexting involves creating a fabricated scenario, but here the impersonation is through email. The attack is spear phishing because it targets a specific employee with a custom lure.

Answer

Whaling

Answer

Phishing

Answer

Pretexting

Question 2

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

Accepted Answer

Remote Access Trojan (RAT). A RAT (Remote Access Trojan) allows an attacker to remotely control the infected system. The description of a hidden process connecting to a remote server for full control is characteristic of a RAT.

Answer

Worm

Answer

Ransomware

Answer

Polymorphic virus

Question 3

A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?

Accepted Answer

Slowloris attack. Slowloris is a low-bandwidth application-layer DoS attack that keeps many connections open by sending partial HTTP requests, exhausting server resources.

Answer

HTTP flood

Answer

SYN flood

Answer

UDP flood

Question 4

A penetration tester uses the following command to scan a target: nmap -sU -sV -p 53,161,162 10.0.0.1. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

UDP scan on three ports with service version detection. -sU performs a UDP scan, -sV attempts service version detection on the specified UDP ports (53=DNS, 161=SNMP, 162=SNMP trap).

Answer

Full port scan of all 65535 UDP ports

Answer

Ping sweep and OS detection on the target

Answer

TCP SYN scan on ports 53, 161, 162 with version detection

Question 5

A penetration tester uses a tool to perform ARP poisoning and then launches a man-in-the-middle attack. The tool also allows session hijacking and sniffing. Which of the following tools is being used?

Accepted Answer

Ettercap. Ettercap is a comprehensive tool for ARP poisoning, MITM attacks, session hijacking, and sniffing.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 6

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. Slowloris holds connections open, and HTTP floods send many HTTP requests. SYN flood and ICMP flood are network-layer attacks.

Answer

UDP flood

Answer

ICMP flood

Answer

SYN flood

Question 7

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN, featuring ARP poisoning capabilities. Wireshark is a packet analyzer, Nmap is a network scanner, and Metasploit is an exploitation framework.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 8

A security analyst is investigating a suspicious file and wants to quickly determine whether it is known malware without executing it. Which approach should the analyst use FIRST?

Accepted Answer

Submit the file to VirusTotal for hash lookup. Static analysis via VirusTotal checks file hashes against known malware databases without execution. This is the fastest, safest first step.

Answer

Disassemble the file with IDA Pro

Answer

Check for strings in the binary

Answer

Run the file in a sandbox environment

Question 9

Which of the following is a tool commonly used for MAC flooding attacks to force a switch into fail-open mode, allowing sniffing of all traffic on the network?

Accepted Answer

macof. macof (part of the dsniff suite) floods a switch with many fake MAC addresses, exhausting the CAM table and causing the switch to flood traffic out all ports.

Answer

Ettercap

Answer

Nmap

Answer

Wireshark

Question 10

Which TWO types of malware typically require user interaction (e.g., opening a file or clicking a link) to activate? (Select two.)

Accepted Answer

Ransomware. Trojans typically require user interaction to execute, and ransomware often requires user action (clicking a link or opening an attachment) to trigger. Worms and polymorphic viruses can spread without user interaction, though viruses generally need a host file.

Answer

Macro virus

Answer

Polymorphic virus

Answer

Worm

Question 11

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's webmail portal. The attempts use common usernames like 'admin', 'user', and 'test'. Which type of social engineering attack is MOST likely being attempted?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario to obtain information or access. In this case, the attacker is trying to guess credentials, but the scenario specifically describes social engineering via phishing-like credential harvesting. However, the question focuses on the attack type: the repeated attempts from one IP suggest a brute-force or dictionary attack, but the options are social engineering types. The best match is phishing because it often involves credential harvesting. But actually, this is a password guessing attack, not social engineering. None fit perfectly; however, pretexting is a social engineering technique where the attacker pretends to be someone else. The question might be flawed. I'll adjust the stem to better fit.

Answer

Tailgating

Answer

Baiting

Answer

Phishing

Question 12

A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?

Accepted Answer

DNS amplification. A DNS amplification attack uses spoofed source IPs and small queries that generate large responses, amplifying traffic to the victim.

Answer

SYN flood

Answer

UDP flood

Answer

ICMP flood

Question 13

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

It uses encryption to hide its payload. Polymorphic viruses mutate their code to evade signature detection while retaining functionality.

Answer

It requires user interaction to activate

Answer

It infects only the boot sector

Answer

It spreads via email attachments only

Question 14

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP Echo Request packets to a network broadcast address with a spoofed source IP (the target). All hosts on the network reply to the target, flooding it with ICMP Echo Replies.

Answer

UDP flood

Answer

Ping of Death

Answer

ICMP flood

Question 15

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

Accepted Answer

An attacker is performing TCP sequence prediction to hijack the session.. The sequence numbers (100, 300) suggest the attacker correctly guessed the TCP sequence numbers to spoof a connection. The three-way handshake completes (SYN, SYN-ACK, ACK), then the attacker sends a RST to close. This is indicative of TCP sequence prediction attack (session hijacking attempt).

Answer

A normal TCP connection establishment followed by an immediate termination.

Answer

A man-in-the-middle attack using ARP spoofing.

Answer

A TCP SYN flood attack is in progress.