CEH Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. A penetration tester observes that the DNS server returns both internal (10.0.0.0/8) and external (203.0.113.5) IP addresses for the same domain. What is this technique called?

Accepted Answer

Split DNS misconfiguration

Answer

DNS cache poisoning

Answer

DNS rebinding

Answer

DNS zone transfer

Question 2

An attacker sends an email that appears to come from the CEO of the company, requesting an urgent wire transfer to a specific account. This is an example of which social engineering attack?

Accepted Answer

Whaling. Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like the CEO or CFO. In this scenario, the attacker impersonates the CEO to trick an employee into authorizing a fraudulent wire transfer, which is the classic hallmark of whaling rather than generic phishing.

Answer

Spear phishing

Answer

Phishing

Answer

Pretexting

Question 3

An analyst captures the following output from a wireless adapter: `[00:1A:2B:3C:4D:5E] 54 Mbps WPA2 CCMP PSK`. The analyst suspects a malicious rogue AP is impersonating a legitimate network. Which of the following indicators would MOST strongly confirm a rogue AP?

Accepted Answer

The BSSID matches a known manufacturer, but the signal strength is unusually high. A rogue AP often has a higher signal strength than expected, especially if it's placed closer to users. Additionally, a mismatch between the BSSID and the known legitimate AP can indicate spoofing.

Answer

The channel number is different from the legitimate AP

Answer

The SSID is broadcasted with the same name as the corporate network

Answer

The encryption type is WPA2 with CCMP

Question 4

During a wireless penetration test, the tester runs `airodump-ng wlan0mon` and sees numerous beacon frames from a network. The tester then sends deauthentication packets using `aireplay-ng -0 5 -a <BSSID> wlan0mon`. What is the PRIMARY purpose of this deauthentication attack?

Accepted Answer

To force a client to reconnect and capture the WPA/WPA2 handshake. Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.

Answer

To crash the access point and cause a denial of service

Answer

To obtain the WPS PIN of the access point

Answer

To perform a rogue AP attack by spoofing the BSSID

Question 5

Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?

Accepted Answer

Intruder. Burp Intruder is designed for automated customized attacks, allowing you to send many requests with varying payloads to a single target endpoint.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 6

A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?

Accepted Answer

XXE injection. XXE (XML External Entity) injection allows reading files via external entities in XML.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 7

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Accepted Answer

Time-based SQL injection. Time-based SQL injection involves injecting SQL code that causes the database to pause if a condition is true, allowing an attacker to infer information based on response times. The observed difference in response times for valid vs. invalid usernames is characteristic of this technique.

Answer

Reflected XSS

Answer

Blind boolean-based SQL injection

Answer

CSRF

Question 8

A security analyst observes an SSL/TLS handshake where the client and server negotiate TLS 1.0 instead of TLS 1.2, despite the server supporting TLS 1.2. Which attack BEST describes the manipulation of the handshake to force weaker encryption?

Accepted Answer

Downgrade attack. A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Birthday attack

Question 9

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Accepted Answer

Implement a whitelist of allowed domains and IP addresses for outbound requests. Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

Answer

Use input validation to block URLs containing '127.0.0.1' or 'localhost'

Answer

Implement CSRF tokens on all forms

Answer

Disable unnecessary HTTP methods on the web server

Question 10

Which tool is specifically designed to assess the security configuration of AWS, Azure, and GCP cloud environments by scanning for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for misconfigurations across AWS, Azure, and GCP. Pacu is an AWS exploitation framework; Aircrack-ng is for wireless; Reaver is for WPS.

Answer

Pacu

Answer

Reaver

Answer

Aircrack-ng

Question 11

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Accepted Answer

IDOR. This is an IDOR (Insecure Direct Object Reference) vulnerability, where direct access to objects is not properly restricted.

Answer

SQL injection

Answer

Directory traversal

Answer

CSRF

Question 12

After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying uses a small set of common passwords against many accounts or, as in this case, against a single account from multiple IPs to avoid lockout.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 13

A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on causing a time delay (e.g., via SLEEP or WAITFOR DELAY) to infer the truth of conditions. The varying response times (2s vs 0.5s) indicate a time-based attack.

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 14

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 15

A security analyst observes that a server running an IoT device management platform is sending MQTT traffic to an unexpected IP address. The analyst also notes that the device's firmware contains hardcoded credentials. Which attack vector is MOST likely being exploited?

Accepted Answer

Insecure MQTT protocol exploitation via default credentials. The combination of hardcoded credentials and unexpected MQTT traffic suggests an attacker has used default credentials to compromise the device and is exfiltrating data via MQTT.

Answer

CoAP protocol attack

Answer

Firmware reversing attack

Answer

Container escape attack