CEH Practice Test 29 — 15 Questions

Question 1

A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anyone on the internet can read objects in the bucket if they know the object URL.. The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.

Answer

The data is encrypted at rest, so no exposure risk exists.

Answer

The bucket policy is misconfigured but only affects objects with server-side encryption.

Answer

Only authenticated AWS users can access the bucket, so the risk is limited.

Question 2

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Accepted Answer

-f (fragment packets). The -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Answer

-sT (TCP connect scan)

Answer

-sV (version detection)

Question 3

An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?

Accepted Answer

enum4linux 192.168.1.1. enum4linux is a tool specifically designed to enumerate SMB (Server Message Block) shares, users, and other information from Windows systems using the SMB protocol. The analyst detected SMB enumeration traffic, which is exactly what enum4linux generates by querying NetBIOS and SMB services (ports 139 and 445).

Answer

nmap -sT 192.168.1.1

Answer

snmpwalk -v 2c 192.168.1.1

Answer

ldapsearch -h 192.168.1.1

Question 4

Which THREE of the following are common techniques used in the 'Cracking passwords' phase of system hacking? (Select 3)

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

Answer

Keylogging

Answer

Social engineering

Question 5

During a penetration test, the tester runs `ldapsearch -x -H ldap://192.168.1.20 -b 'dc=domain,dc=com' '(objectclass=*)'`. The output reveals user objects with 'userPassword' attributes in clear text. Which type of enumeration is being performed, and what is the security implication?

Accepted Answer

LDAP enumeration; it indicates that the LDAP server stores passwords in plaintext, posing a credential theft risk. The `ldapsearch` command is used to query an LDAP directory service. The option `-x` specifies simple authentication, and the filter `(objectclass=*)` retrieves all entries. The output revealing `userPassword` attributes in clear text indicates that the LDAP server is storing passwords in plaintext, which is a severe security risk because an attacker can directly harvest credentials for lateral movement or privilege escalation.

Answer

NFS enumeration; it indicates that NFS shares are world-readable

Answer

SNMP enumeration; it indicates that the community string is weak

Answer

SMTP enumeration; it indicates that the mail server is misconfigured

Question 6

During a penetration test, you receive a list of password hashes from a Windows server. Which of the following tools would be BEST suited to perform a dictionary attack against these hashes?

Accepted Answer

John the Ripper. John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 7

A security analyst runs the following command: 'smbclient -L //192.168.1.50 -N'. What is the purpose of this command?

Accepted Answer

List available SMB shares on the remote host anonymously. The `smbclient -L` command lists the available SMB shares on a remote host. The `-N` flag suppresses the password prompt, effectively performing an anonymous (null session) enumeration of shares. This is a standard technique in the enumeration phase to discover accessible resources without authentication.

Answer

Connect to the remote host's SMB share with a null password

Answer

Perform a dictionary attack on SMB passwords

Answer

Enumerate users via SMB

Question 8

A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?

Accepted Answer

VRFY. The VRFY command is used in SMTP to verify whether a mailbox exists on the server. By issuing VRFY followed by a username, the server typically responds with a 250 code if the user exists or a 550 code if not, enabling user enumeration. This is a recognized technique in security assessments to discover valid email accounts.

Answer

DATA

Answer

MAIL FROM

Answer

HELO

Question 9

Which TWO tools are specifically designed for cloud security auditing and exploitation? (Choose two.)

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security-auditing tool that assesses the security posture of AWS, Azure, and GCP environments by checking for misconfigurations, excessive permissions, and compliance violations. Pacu is an AWS exploitation framework designed for offensive security testing, allowing penetration testers to enumerate resources, escalate privileges, and execute post-exploitation modules against cloud accounts. Both tools are purpose-built for cloud security auditing and exploitation, making them the correct choices.

Answer

Nessus

Answer

Aircrack-ng

Answer

Nmap

Question 10

A security analyst notices that an attacker has gained SYSTEM privileges on a Windows server after compromising a service running as LOCAL SYSTEM. The attacker then uses `whoami /priv` and finds the SeTcbPrivilege (Act as part of the operating system) is enabled. Which privilege escalation technique might the attacker use next?

Accepted Answer

Token impersonation. With SeTcbPrivilege enabled, the attacker can call the `CreateProcessAsUser` or `DuplicateTokenEx` API to impersonate any user token, including SYSTEM. This is a classic token impersonation attack, allowing the attacker to elevate from LOCAL SYSTEM to a higher-integrity context or move laterally by creating processes with arbitrary identities.

Answer

Sticky keys exploit

Answer

DLL injection

Answer

Pass-the-hash

Question 11

Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)

Accepted Answer

It uses spoofed source IP addresses. DNS amplification attacks rely on sending DNS queries with a spoofed source IP address that matches the victim's IP. The attacker sends small queries to open DNS resolvers, which then send large responses to the victim, overwhelming their bandwidth. This spoofing ensures the amplified traffic is directed at the victim, not the attacker.

Answer

It targets the victim's MAC address

Answer

It requires the attacker to be on the same subnet as the victim

Answer

It uses ICMP echo requests

Question 12

In the context of system hacking methodology (CHPSET), which phase involves removing evidence of the attacker's activities from logs and system files?

Accepted Answer

Erasing tracks. In the CEH system hacking methodology (CHPSET), the 'Erasing tracks' phase is specifically defined as the step where attackers remove evidence of their activities, such as clearing logs, modifying timestamps, or deleting system files. This ensures that intrusion detection systems or system administrators cannot trace the attack back to the source.

Answer

Spying

Answer

Privilege escalation

Answer

Cracking passwords

Question 13

Which TWO of the following Nmap scans are considered 'stealth' scans that do not complete a full TCP three-way handshake?

Accepted Answer

FIN scan (-sF). A FIN scan (-sF) sends a TCP packet with only the FIN flag set. According to RFC 793, if the port is closed, the target responds with an RST packet; if open, the packet is ignored. This avoids completing a full TCP three-way handshake, making it a stealth scan.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

ACK scan (-sA)

Question 14

Which TWO of the following are examples of privilege escalation on Linux? (Select 2)

Accepted Answer

SUID bit abuse. SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.

Answer

Pass-the-Hash

Answer

Token impersonation

Answer

DLL hijacking

Question 15

Which THREE of the following are indicators of a slowloris DDoS attack?

Accepted Answer

Normal traffic volume but connections remain open for a long time. B is correct because a Slowloris DDoS attack works by opening many connections to a target web server and keeping them open for as long as possible, sending partial HTTP requests to tie up server resources. This results in normal traffic volume but with connections that remain open for extended periods, preventing legitimate users from connecting.

Answer

ICMP echo replies from random IPs

Answer

High volume of UDP packets