CEH Practice Test 29 — 15 Questions

Question 1

Which THREE of the following are common techniques used during the footprinting phase? (Choose three.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a footprinting technique that queries domain registration databases (e.g., whois.arin.net) to obtain registrant contact details, name servers, and registration dates. Google hacking (also known as Google dorking) uses advanced search operators to uncover sensitive information indexed by search engines, such as exposed configuration files or login pages. DNS zone transfer (AXFR) is a footprinting technique that, if misconfigured, allows an attacker to retrieve a complete list of DNS records for a domain, revealing internal hostnames and network structure. All three are passive or semi-passive information-gathering methods performed without directly engaging the target's systems.

Answer

Exploitation

Answer

Port scanning

Question 2

Which THREE of the following are best practices for securing IoT devices in a home automation network?

Accepted Answer

Segment IoT devices on a separate VLAN or subnet.. Segmenting IoT devices on a separate VLAN or subnet (Option B) is a best practice because it isolates potentially insecure IoT devices from the main trusted network. If an IoT device is compromised, the attacker cannot easily pivot to other devices on the primary LAN. This leverages Layer 2 or Layer 3 segmentation to enforce network access controls, reducing the attack surface in a home automation environment.

Answer

Enable Universal Plug and Play (UPnP) for easy integration.

Answer

Ensure all devices are connected directly to the internet for remote access.

Question 3

Which THREE of the following Nmap options can be used to evade detection by IDS/IPS? (Select three)

Accepted Answer

-f (fragment packets). The -f flag fragments the crafted packets into smaller pieces, typically 8-byte fragments, which can bypass simple IDS/IPS signatures that expect full unfragmented packets. This technique exploits the fact that many intrusion detection systems struggle to reassemble fragmented packets in real time, allowing the scan to evade detection.

Answer

-sV (version detection)

Answer

-O (OS detection)

Question 4

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Accepted Answer

Hosting provider and country. Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Answer

Internal IP addresses of the servers

Answer

Employee email addresses

Question 5

Which asymmetric encryption algorithm is based on the algebraic structure of elliptic curves over finite fields and provides equivalent security to RSA with smaller key sizes?

Accepted Answer

Elliptic Curve Cryptography (ECC). ECC (Elliptic Curve Cryptography) offers strong security with smaller keys compared to RSA. Diffie-Hellman is a key exchange protocol, 3DES is symmetric, and SHA-256 is a hash function.

Answer

SHA-256

Answer

Diffie-Hellman (DH)

Answer

Triple DES (3DES)

Question 6

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Accepted Answer

Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended. This is a Local File Inclusion (LFI) vulnerability. The appended '.php' extension prevents reading '/etc/passwd' because the file would be interpreted as '/etc/passwd.php', which does not exist.

Answer

Directory traversal; it will succeed because '../' bypasses restrictions

Answer

Remote File Inclusion (RFI); it will succeed because the parameter is not filtered

Answer

Command injection; it will succeed if the server interprets PHP code

Question 7

An application allows users to upload XML files for processing. A tester uploads the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which attack is being performed?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.

Answer

SQL injection

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Question 8

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page?id=1' --batch --dbs. Which of the following best describes what this command will do?

Accepted Answer

Enumerate all database names in non-interactive mode. --dbs enumerates database names; --batch uses default options without interactive input.

Answer

Dump the entire contents of the current database

Answer

Perform a time-based blind SQL injection to extract data

Answer

Enumerate all tables in all databases

Question 9

Which of the following is the most effective defense against SQL injection attacks?

Accepted Answer

Parameterized queries. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.

Answer

Escaping all user input

Answer

Input validation using blacklists

Answer

Stored procedures

Question 10

Which of the following attacks is characterized by an attacker placing a fake wireless access point with the same SSID as a legitimate network to capture client credentials?

Accepted Answer

Evil twin attack. An evil twin attack involves setting up a rogue access point that mimics a legitimate SSID to intercept traffic and capture credentials.

Answer

De-authentication attack

Answer

WPS PIN brute force attack

Answer

Replay attack

Question 11

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

Accepted Answer

WEP key recovery using aircrack-ng. WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

Answer

WPS PIN brute-force attack

Answer

Evil twin AP deployment

Answer

WPA handshake capture

Question 12

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 13

A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?

Accepted Answer

Reflected XSS. Reflected XSS requires user interaction (clicking a link) to execute the script in the victim's browser. The payload is not stored on the server, distinguishing it from stored XSS. DOM-based XSS does not involve server reflection.

Answer

Blind XSS

Answer

Stored XSS

Answer

DOM-based XSS

Question 14

A security analyst discovers that a containerized application running in a cloud environment can access the host's file system by mounting /var/run/docker.sock inside the container. Which type of attack does this configuration enable?

Accepted Answer

Container escape to the host. Mounting the Docker socket inside a container allows the container to communicate with the Docker daemon on the host, potentially allowing the attacker to create new containers, escape the container, and execute commands on the host.

Answer

Server-Side Request Forgery (SSRF)

Answer

Privilege escalation within the container only

Answer

Denial-of-Service (DoS) attack against the container runtime

Question 15

A security analyst captures a WPA2 4-way handshake using airodump-ng. To crack the PSK, which tool would they MOST likely use next?

Accepted Answer

Aircrack-ng. The correct tool for cracking a WPA2 PSK from a captured handshake is aircrack-ng, which performs dictionary attacks against the handshake file.

Answer

Kismet

Answer

John the Ripper

Answer

Reaver