CEH Practice Test 28 — 15 Questions

Question 1

Which TWO of the following Nmap flags can be used to bypass firewall restrictions? (Select 2)

Accepted Answer

-f (fragment packets). The -f flag fragments packets into smaller 8-byte chunks, which can evade simple firewall rules that inspect packet headers for known signatures or block oversized packets. Option E is correct because the -D flag performs a decoy scan by spoofing multiple source IP addresses, making it difficult for a firewall to identify the true scanning host and block it.

Answer

-P0 (disable ping)

Answer

-T4 (aggressive timing)

Answer

-sS (SYN scan)

Question 2

During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?

Accepted Answer

MX record. An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.

Answer

CNAME record

Answer

A record

Answer

NS record

Question 3

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It changes its code signature each time it infects a new file. A polymorphic virus changes its decryption routine and code signature each time it infects a new file, making signature-based detection difficult. This mutation is achieved by using a polymorphic engine that generates varied decryption loops while preserving the malicious payload.

Answer

It spreads via email attachments

Answer

It remains dormant until a specific date or time

Answer

It can infect the Master Boot Record (MBR)

Question 4

Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)

Accepted Answer

-D. (-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.

Answer

-sV

Answer

-O

Answer

-sT

Question 5

A security team detects that an internal host is sending ARP replies claiming to have the IP address of the default gateway. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a dedicated man-in-the-middle (MITM) attack tool that includes built-in ARP poisoning functionality. It sends forged ARP replies to associate the attacker's MAC address with the default gateway's IP, redirecting traffic through the attacker's host. This matches the described behavior of claiming the gateway's IP address via ARP replies.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 6

A security analyst runs a vulnerability scan with Nessus and receives a report indicating that multiple hosts have the 'MS17-010' vulnerability. What is the MOST likely impact of this vulnerability if exploited?

Accepted Answer

Remote code execution on Windows systems. MS17-010 is a critical remote code execution vulnerability in the Microsoft Server Message Block (SMB) protocol. Exploitation allows an unauthenticated attacker to send specially crafted packets to an SMB server, enabling arbitrary code execution with system privileges. This is the same vulnerability leveraged by the EternalBlue exploit used in the WannaCry ransomware attacks.

Answer

SQL injection

Answer

Cross-site scripting

Answer

DNS cache poisoning

Question 7

After successfully exploiting a system, an attacker uses the command 'wevtutil cl system' on a Windows target. What is the MOST likely purpose of this command?

Accepted Answer

To clear the system event log. The command 'wevtutil cl system' is used to clear the System event log on a Windows system. After successfully exploiting a target, an attacker would use this command to erase traces of their activities, such as log entries generated by their tools or actions, thereby hindering forensic analysis. The 'cl' parameter stands for 'clear log', and 'system' specifies the System log.

Answer

To export event logs to a file

Answer

To disable Windows event logging

Answer

To create a new event log entry

Question 8

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Accepted Answer

Ettercap. Ettercap is a dedicated suite for man-in-the-middle attacks on LANs, with built-in support for ARP poisoning. It actively sends forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host, allowing interception of traffic between two hosts. This makes it the most direct and purpose-built tool for the task described.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 9

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Accepted Answer

Slow down the scan rate. Slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

Answer

Use random source ports

Answer

Use a decoy scan

Answer

Use fragmented packets

Question 10

Which of the following tools is specifically designed to enumerate SMB shares and user information from Windows systems using the SMB protocol?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate SMB shares, user lists, OS information, and other details from Windows systems by leveraging the SMB protocol (typically over TCP/445 or TCP/139). It automates queries using SMB RPC calls, such as those from the `samr` and `lsarpc` pipes, making it the correct choice for targeted SMB enumeration.

Answer

snmpwalk

Answer

nmap

Answer

hping3

Question 11

Drag and drop the steps to set up a VPN using IPsec in tunnel mode into the correct order.

Accepted Answer

Phase 1, then Phase 2, then traffic selectors, then apply policies, then test.. The correct sequence for setting up a VPN using IPsec in tunnel mode is: Phase 1 (IKE) to establish a secure channel, Phase 2 (IPsec) to negotiate security associations, then define traffic selectors (interesting traffic), apply the policies, and finally test the connection. This order ensures that the underlying secure infrastructure is built before defining and enforcing traffic rules, and that testing validates the entire setup.

Answer

Phase 2, then Phase 1, then traffic selectors, then apply policies, then test.

Answer

Phase 1, then traffic selectors, then Phase 2, then apply policies, then test.

Answer

Phase 1, then Phase 2, then apply policies, then traffic selectors, then test.

Question 12

During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?

Accepted Answer

Set the User-Agent to: . Using a simple script alert like is a standard proof-of-concept for reflected XSS. The exact payload may vary, but it must execute JavaScript. The simplest is an alert.

Answer

Set the User-Agent to: <img src=x onerror=alert(1)>

Answer

Set the User-Agent to: ' OR '1'='1

Answer

Set the User-Agent to: ../../../../etc/passwd

Question 13

Which type of malware is characterized by encrypting a victim's files and demanding a ransom payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files on the victim's system using strong encryption algorithms (e.g., AES-256 or RSA) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This matches the description exactly, distinguishing it from other malware types that do not perform file encryption for extortion.

Answer

Spyware

Answer

Adware

Answer

Keylogger

Question 14

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that uses a pair of keys (public and private) for encryption and digital signatures, making it an asymmetric algorithm. Unlike symmetric ciphers, RSA relies on the mathematical difficulty of factoring large prime numbers to secure communications.

Answer

3DES

Answer

SHA-256

Answer

AES

Question 15

A penetration tester uses a tool to spoof ARP replies, redirecting traffic through the tester's machine. The tester then captures credentials from the redirected traffic. Which tool is BEST suited for this task?

Accepted Answer

Ettercap. Ettercap is the best tool for ARP spoofing because it is specifically designed for man-in-the-middle (MITM) attacks on local networks. It actively sends forged ARP replies to poison the ARP cache of target hosts, redirecting traffic through the attacker's machine, and includes built-in packet capture and credential extraction features.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump