CEH Practice Test 2 — 30 Questions

Question 1

During a penetration test, you are tasked with performing footprinting on a target organization. You have identified the target's IP range 192.168.1.0/24. Which of the following techniques would provide the most comprehensive information about the target's network topology and potential entry points?

Accepted Answer

Use traceroute to map the network path and identify intermediate routers and firewalls.. Traceroute (using ICMP, UDP, or TCP probes with incrementing TTL values) reveals the Layer 3 path from the tester to the target, identifying each hop (router, firewall, or other gateway) along the route. This directly maps the network topology and can expose intermediate security devices, ACLs, and potential choke points, which is the most comprehensive technique for understanding the target's network layout and entry points from the given options.

Answer

Conduct social engineering to gather information from employees about internal network structure.

Answer

Perform a WHOIS lookup to obtain domain registration details including administrative contacts.

Answer

Perform DNS enumeration to find all subdomains and associated IP addresses.

Question 2

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. Option B is correct because when a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 3

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.. The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.

Answer

The target host has a host-based firewall that drops SYN packets but allows full connections.

Answer

The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.

Answer

Nmap's SYN scan requires root privileges, and the tester ran it without sudo.

Question 4

What can be inferred from the output?

Accepted Answer

The domain has two mail servers with different priority levels.. The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Answer

The command failed because the DNS server is unreachable.

Answer

The domain uses SPF records to prevent email spoofing.

Answer

The domain's web server IP address is 192.168.1.1.

Question 5

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Accepted Answer

Update Log4j to version 2.17.1 or later. Option A is correct because CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

Answer

Remove the JndiLookup class from the Log4j jar

Answer

Disable JDBC appender in Log4j configuration

Answer

Block outbound traffic from the server to the internet

Question 6

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 7

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Accepted Answer

Session hijacking via cross-site scripting (XSS). Option C is correct because the absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Clickjacking

Question 8

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 9

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. It is computationally intensive but guaranteed to succeed given enough time, making it a fundamental method in password auditing and recovery.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 10

Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?

Accepted Answer

A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.. The Nmap scan output shows port 3389 in a 'filtered' state, which means Nmap received no response or an ICMP unreachable error from the target. This typically indicates a firewall is blocking the probes, preventing Nmap from determining whether the port is actually open or closed. A filtered state does not confirm the port is open or closed, only that access is being obstructed.

Answer

Port 3389 is open and running a Remote Desktop service, but the service version could not be identified.

Answer

Port 3389 is closed and the target is ignoring the probe.

Answer

The target is likely a honeypot designed to simulate a Windows machine.

Question 11

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

Accepted Answer

Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.. Option B is correct because the symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

Answer

Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.

Answer

Increase the number of application servers to handle the load.

Answer

Run a SQL injection scanner on the application.

Question 12

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Accepted Answer

The file is authentic and has not been tampered with.. Option C is correct because the SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Answer

The file has been tampered with because the hash is from a different file.

Answer

The SHA256 hash is not reliable; the analyst should use MD5 instead.

Answer

The file is malicious because the hash is too long.

Question 13

During a penetration test, an ethical hacker captures a WPA2 handshake and successfully cracks the PSK. Which additional action must be taken to decrypt previously captured traffic?

Accepted Answer

Compute the Pairwise Master Key Identifier (PMKID) from the PSK and AP MAC.. Option A is correct because after cracking the WPA2 Pre-Shared Key (PSK), the Pairwise Master Key (PMK) is derived from the PSK, SSID, and hashing iterations (PBKDF2). To decrypt previously captured traffic, you need the Pairwise Transient Key (PTK), which is computed from the PMK, the client nonce (SNonce), the AP nonce (ANonce), and both MAC addresses. However, the nonces are exchanged during the 4-way handshake and are present in the captured handshake; the missing piece is the PMKID, which is derived from the PMK, AP MAC, and STA MAC. Computing the PMKID from the cracked PSK and AP MAC allows tools like aircrack-ng to verify the correct PMK and then derive the PTK to decrypt the traffic.

Answer

Capture the nonce values from the access point.

Answer

Use the PSK directly to compute the Michael Integrity Check (MIC).

Answer

Obtain the Group Temporal Key (GTK) from the access point.

Question 14

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

Accepted Answer

Enforce HTTPS using TLS 1.2 or higher.. HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Answer

Implement password hashing with bcrypt on the server side.

Answer

Use digital signatures to sign the login request.

Answer

Encrypt the password field using AES-256 before sending via HTTP.

Question 15

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Accepted Answer

Parameter tampering. Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer

Directory traversal

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 16

A cloud security engineer wants to ensure that only authorized users can access an S3 bucket containing sensitive data. Which AWS service should be used to enforce fine-grained access control?

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

AWS CloudFront

Question 17

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Accepted Answer

Query string parameters. SQL injection attacks commonly target query string parameters because user input in URLs is often directly concatenated into SQL queries without proper sanitization. A WAF configured to inspect and filter query string parameters can block malicious SQL payloads before they reach the database server, as these parameters are the most frequent vector for such attacks.

Answer

Request body (POST data)

Answer

Cookie headers

Answer

User-Agent header

Question 18

During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?

Accepted Answer

The DNS server can be used for denial of service. Option D is correct because a DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.

Answer

Unauthorized zone transfers are possible

Answer

The DNS server can be used for denial of service (amplification)

Answer

The DNS cache can be poisoned easily

Question 19

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

Accepted Answer

Restrict recursive queries to trusted sources. Option B is correct because restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning.

Answer

Use a single DNS server for all queries

Answer

Disable DNS caching

Question 20

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. Option B is correct because a 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered