CEH Practice Test 30 — 15 Questions

Question 1

Which THREE of the following Nmap flags are commonly used for evasion techniques? (Select 3)

Accepted Answer

-f. The -f flag fragments the probe packets into smaller 8-byte fragments (or less, depending on the MTU). This helps evade simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragments before applying rules, as the fragmented headers may bypass signature-based detection.

Answer

-O

Answer

-sV

Question 2

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature on each infection.. A polymorphic virus mutates its code signature with each infection, using a mutation engine to generate new decryption routines or code patterns while preserving the core payload. This signature change evades signature-based detection by antivirus software, as the virus appears different in every infected file.

Answer

It spreads without user interaction.

Answer

It attaches to a host file and does not change.

Answer

It only infects the boot sector.

Question 3

Which tool is specifically designed to perform SNMP enumeration by walking the MIB tree using a known community string?

Accepted Answer

SNMPwalk. SNMPwalk is the correct tool because it is specifically designed to perform SNMP enumeration by walking the Management Information Base (MIB) tree using a known community string (e.g., 'public' or 'private'). It sends successive GETNEXT requests to retrieve all OID values from the SNMP agent, effectively dumping the entire MIB tree for reconnaissance.

Answer

enum4linux

Answer

nbtstat

Answer

smbclient

Question 4

A penetration tester wants to enumerate user accounts on a Linux system running SMTP service. Which commands are commonly used for this purpose?

Accepted Answer

VRFY, EXPN, RCPT TO. The VRFY command verifies whether a user mailbox exists on the SMTP server, EXPN expands a mailing list or alias to reveal individual member addresses, and RCPT TO specifies the recipient for a mail message and can be used to validate addresses during the SMTP conversation. These three commands are the standard SMTP enumeration techniques for discovering valid user accounts on a Linux system running an SMTP service.

Answer

USER, PASS, QUIT

Answer

AUTH LOGIN, STARTTLS, EHLO

Answer

HELO, MAIL FROM, DATA

Question 5

Which enumeration technique would be MOST effective for gathering usernames from an SMTP server that supports the VRFY command?

Accepted Answer

SMTP VRFY enumeration. The VRFY command is an SMTP protocol command (RFC 821) that allows a client to verify whether a specific mailbox exists on the server. Since the question explicitly states the SMTP server supports VRFY, sending VRFY requests with common usernames or using a wordlist directly enumerates valid usernames, making SMTP VRFY enumeration the most effective technique.

Answer

SNMP enumeration using SNMPwalk

Answer

NetBIOS enumeration using nbtstat

Answer

LDAP anonymous queries

Question 6

Which type of password cracking attack uses a precomputed table of hash chains to reverse hashes quickly?

Accepted Answer

Rainbow table attack. A rainbow table attack is correct because it uses a precomputed table of hash chains to reverse hashes quickly. Rainbow tables reduce the time needed for cracking by storing chains of hash values that allow for efficient lookup, trading off storage space for computational speed. This technique is specifically designed to reverse cryptographic hash functions like LM, NTLM, or MD5 without performing brute-force or dictionary lookups for each attempt.

Answer

Dictionary attack

Answer

Brute-force attack

Answer

Hybrid attack

Question 7

Which of the following malware types is characterized by self-replication without requiring a host file or program, and spreading across networks automatically?

Accepted Answer

Worm. A worm is a standalone malware type that self-replicates and spreads across networks automatically without needing a host file or program. It exploits network vulnerabilities or uses social engineering to propagate, often consuming bandwidth and system resources.

Answer

Trojan horse

Answer

Virus

Answer

Ransomware

Question 8

A security analyst runs `nbtstat -A 192.168.1.10` and receives a response with the computer name, logged-in user, and domain. Which protocol is being queried?

Accepted Answer

NetBIOS. The `nbtstat -A` command performs a NetBIOS name service query (NBNS) against the target IP address using UDP port 137. It retrieves the NetBIOS name table, which includes the computer name, logged-in user, and domain membership, directly from the NetBIOS over TCP/IP (NetBT) protocol stack.

Answer

SNMP

Answer

LDAP

Answer

SMTP

Question 9

An attacker modifies system logs to remove entries related to their activities. Which technique is being used to cover tracks?

Accepted Answer

Log manipulation. Log manipulation is the correct answer because it directly involves altering or deleting log entries to hide evidence of unauthorized activities. Attackers often use this technique to remove traces of their actions from system logs, such as event logs in Windows or syslog files in Linux, thereby covering their tracks and avoiding detection.

Answer

Token impersonation

Answer

Steganography

Answer

Rootkit installation

Question 10

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Accepted Answer

Implement client authentication and enable TLS encryption. MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 11

Which of the following Nmap scan types is MOST effective for evading a stateful firewall that only allows established connections? (Select one)

Accepted Answer

Idle scan (-sI). An idle scan (-sI) is effective against a stateful firewall that only allows established connections because it spoofs the source IP of a zombie host that already has an established session with the target. The firewall sees the packets as belonging to that existing session and allows them. A TCP SYN scan (-sS) sends unsolicited SYN packets that are not part of any existing session, so the stateful firewall would block them because it only permits traffic for established connections.

Answer

TCP SYN scan (-sS)

Answer

TCP connect scan (-sT)

Answer

Ping sweep (-sn)

Answer

UDP scan (-sU)

Question 12

During a penetration test, you run the tool 'macof' against a switch. After a few seconds, the switch starts flooding frames out all ports. Which attack have you successfully executed, and what is the primary goal of this technique?

Accepted Answer

MAC flooding; to cause a switch to fail-open and act like a hub for sniffing. The 'macof' tool is specifically designed to perform MAC flooding attacks by generating frames with random source MAC addresses. This overwhelms the switch's Content Addressable Memory (CAM) table, causing it to fail-open and flood all incoming frames out every port, effectively making it behave like a hub. This allows the attacker to sniff network traffic that would normally be isolated to specific switch ports.

Answer

VLAN hopping; to gain access to a different VLAN

Answer

STP manipulation; to create a loop and cause a DoS

Answer

ARP poisoning; to intercept traffic between two hosts

Question 13

A security analyst observes a sudden increase in network traffic from many external IPs targeting the company's web server with multiple HTTP GET requests to the same page (/index.php?page=home). The requests appear legitimate but are coming at a very high rate. Which TWO types of attack is the analyst most likely witnessing?

Accepted Answer

Application-layer (Layer 7) attack. The attack targets the application layer (Layer 7) by sending numerous HTTP GET requests to a specific page (/index.php?page=home). This type of attack aims to exhaust server resources like CPU, memory, or database connections, as each request appears legitimate but collectively overwhelms the web server's ability to process them. It is a classic example of an HTTP flood, which is a Layer 7 attack.

Answer

Smurf attack

Answer

Volumetric attack

Answer

SYN flood attack

Question 14

A security analyst notices that after submitting a form on a web application, the URL changes to include the user's ID parameter, e.g., 'user?id=123'. The analyst modifies the ID in the URL and accesses another user's profile without authorization. Which type of vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). This is an Insecure Direct Object Reference (IDOR) vulnerability, where the application exposes internal object references (like user IDs) without proper access control checks.

Answer

Reflected Cross-Site Scripting (XSS)

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 15

Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?

Accepted Answer

A script is permanently stored on the server and executed when users view a page. Stored (persistent) XSS occurs when malicious script is permanently stored on the server (e.g., in a database, comment field, or forum post) and is served to every user who views the affected page. The script executes in the victim's browser without requiring any additional interaction, as it is part of the page's HTML response from the server.

Answer

A script executes in the victim's browser without any server interaction

Answer

A script is executed when a user submits a form with malicious input

Answer

A script executes only after clicking a manipulated URL