CEH Practice Test 29 — 15 Questions

Question 1

During a penetration test, you capture the following output: 'HTTP/1.1 200 OK ... Set-Cookie: sessionid=abc123; path=/'. You then send a request with a modified cookie value 'sessionid=abc124' and receive a valid session. Which type of vulnerability has been exploited?

Accepted Answer

Session hijacking via cookie prediction. Session hijacking via cookie theft/prediction. The attacker guessed or brute-forced a valid session ID (abc124) after seeing the pattern (abc123).

Answer

Cross-site scripting

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 2

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Rate limiting. Scrubbing centers filter malicious traffic, rate limiting reduces impact, and anycast distribution spreads traffic across multiple servers. Blackholing drops all traffic (including legitimate), and IP spoofing is an attack technique.

Answer

Blackholing all traffic to the target

Answer

IP spoofing

Question 3

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

Accepted Answer

Backdoor Trojan. Port 4444 is commonly associated with Metasploit's default reverse shell payload. The presence of 'cmd.exe /c' and an IP address indicates a backdoor that provides remote command execution, which is a Trojan backdoor or RAT.

Answer

Worm

Answer

Keylogger

Answer

Ransomware

Question 4

A security analyst detects a file named 'invoice.pdf.exe' in an email attachment. When the file is submitted to VirusTotal, multiple engines detect it as a Trojan. The analyst wants to perform dynamic analysis to observe its behavior. Which approach is BEST?

Accepted Answer

Execute the file in a sandboxed environment and monitor system calls. Dynamic analysis involves executing the malware in a controlled environment (sandbox) and monitoring its actions. Static analysis (strings, PEiD) examines the binary without execution. Submitting to VirusTotal is static, and disassembly is also static.

Answer

Disassemble the file using IDA Pro to understand its code

Answer

Run 'strings' on the file and analyze the output

Answer

Submit the file again to VirusTotal for a second opinion

Question 5

A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?

Accepted Answer

Implement rate limiting and connection timeout. Slowloris sends partial HTTP requests to keep connections open. Increasing the maximum number of connections per IP may help, but rate limiting and connection timeout are more effective. However, the most direct mitigation is to limit the time a connection can remain open while idle, i.e., increasing the request timeout or reducing the connection timeout. Among options, configuring a reverse proxy to limit concurrent connections is effective.

Answer

Use anycast routing

Answer

Increase the maximum number of simultaneous connections

Answer

Enable SYN cookies

Question 6

A security analyst is analyzing a suspicious file and runs the command 'strings malware.exe | grep -i http'. The output shows several URLs ending with '.exe'. What does this indicate?

Accepted Answer

The malware may download additional payloads from remote servers. Strings extracts readable text; finding URLs that point to executable files suggests the malware may download additional payloads from those URLs.

Answer

The malware has a keylogger component

Answer

The malware is a boot sector virus

Answer

The malware is a worm that spreads via email

Question 7

A penetration tester uses the Social Engineering Toolkit (SET) to create a malicious USB drive that autoruns when inserted. Which social engineering technique is being employed?

Accepted Answer

Baiting. Baiting involves leaving a physical device (e.g., USB drive) in a location where the victim will find and use it, often with enticing labels.

Answer

Tailgating

Answer

Pretexting

Answer

Phishing

Question 8

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files and demand ransom for the decryption key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 9

Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)

Accepted Answer

Spoofs the source IP address of the victim. DNS amplification uses open DNS resolvers, spoofs the victim's IP, and exploits small queries to generate large responses, thereby amplifying traffic.

Answer

Exploits the TCP handshake process

Answer

Floods the target with small ICMP packets

Question 10

During a penetration test, a security analyst runs the following command on a Linux system: ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//. What is the PRIMARY purpose of this command?

Accepted Answer

To perform a man-in-the-middle attack between the gateway and the target host. The command uses Ettercap with ARP poisoning (arp:remote) to perform a man-in-the-middle attack between the gateway (192.168.1.1) and a target host (192.168.1.100). This allows interception and modification of traffic.

Answer

To spoof the DNS responses to redirect the target to a malicious site

Answer

To sniff all traffic on the network by enabling promiscuous mode on the interface

Answer

To perform a denial-of-service attack by flooding the network with ARP replies

Question 11

A security analyst discovers a file named invoice.exe in an email attachment. Static analysis with PEiD indicates the file is packed with UPX. What is the BEST next step in analyzing this malware?

Accepted Answer

Unpack the file with UPX and then perform static analysis. UPX packers require unpacking to reveal the original code. Dynamic analysis in a sandbox can observe behavior after unpacking.

Answer

Execute the packed file on a production server

Answer

Submit the packed file directly to VirusTotal

Answer

Delete the file immediately

Question 12

A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing malware in a controlled environment to observe behavior.

Answer

Static analysis

Answer

Network analysis

Answer

Code analysis

Question 13

An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?

Accepted Answer

Implement DNSSEC. DNSSEC adds cryptographic signatures to DNS data, preventing spoofed responses.

Answer

Use IPsec

Answer

Use a firewall

Answer

Disable DNS recursion

Question 14

Which tool is specifically designed to create and manage phishing campaigns for security awareness testing?

Accepted Answer

SET. The Social Engineering Toolkit (SET) is a framework for social engineering attacks, including phishing.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 15

An analyst is analyzing a suspicious file using VirusTotal and observes that only 3 out of 60 antivirus engines detect it as malicious. The file has been submitted before but with no detections. What should the analyst conclude?

Accepted Answer

The file is likely malicious and requires further analysis. Low detection rate suggests the file may be a zero-day or heavily obfuscated. The fact that previous submission had no detections and now some detect indicates it might be a new variant or the file is not widely known. The best action is to treat as potentially malicious and perform dynamic analysis.

Answer

The file is a clean file with a rare hash

Answer

The file is safe because most engines don't detect it

Answer

The file is likely a false positive