CEH Practice Test 31 — 15 Questions

Question 1

A security analyst notices that after a user connects to a corporate Wi-Fi network, all HTTP traffic is redirected to a fake login page that captures credentials. The analyst suspects a rogue access point. Which attack is most likely being used to force client connections to the rogue AP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

De-authentication attack followed by evil twin. De-authentication packets force clients to disconnect from the legitimate AP, after which they may automatically reconnect to a rogue AP with the same SSID. Evil twin is the fake AP, but the mechanism to disconnect clients is de-authentication.

Answer

Evil twin attack using a stronger signal

Answer

WPA2 dictionary attack on the handshake

Answer

WPS PIN brute-force attack

Question 2

Which tool is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where rainbow tables allow rapid reversal of hashes without brute-forcing each password individually. This makes it the correct choice for the scenario described.

Answer

John the Ripper

Answer

RainbowCrack

Answer

Hashcat

Question 3

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

It uses encryption to hide its payload. Polymorphic viruses use encryption to hide their payload from signature-based detection. Each time the virus replicates, it generates a new encryption key and a corresponding decryption routine, making the encrypted payload appear different while the underlying malicious code remains the same.

Answer

It requires user interaction to activate

Answer

It infects only the boot sector

Answer

It spreads via email attachments only

Question 4

During a web application penetration test, a tester uses Burp Suite's Repeater tool to manually manipulate a request and observe the response. After sending the same request multiple times, the application returns a 302 redirect pointing to a login page. What is the MOST likely cause?

Accepted Answer

The session token has expired and the user must re-authenticate. A 302 redirect to a login page typically indicates that the session has expired or the tester's session is no longer valid. The application is redirecting to enforce authentication.

Answer

The server is rate-limiting the requests

Answer

A cross-site request forgery (CSRF) token mismatch occurred

Answer

The server detected the use of a proxy and blocked the request

Question 5

Which of the following describes the difference between reflected and stored (persistent) cross-site scripting (XSS)?

Accepted Answer

Reflected XSS is non-persistent and requires user interaction, while stored XSS is persistent and can affect multiple users. Reflected XSS is injected via the current request (e.g., URL parameter) and the script reflects immediately in the response. Stored XSS is saved on the server (e.g., in a database) and executed when other users view the affected page.

Answer

Reflected XSS is a server-side vulnerability, while stored XSS is a client-side vulnerability

Answer

Reflected XSS only works with HTTP POST requests, while stored XSS works with GET requests

Answer

Reflected XSS is triggered by the server, while stored XSS is triggered by the client

Question 6

During a penetration test, a tester captures network traffic and notices a large number of ARP replies claiming that 192.168.1.1 is at MAC address 00:11:22:33:44:55, which is different from the legitimate gateway MAC. Which attack is likely in progress?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker is sending forged ARP replies that associate the legitimate gateway IP (192.168.1.1) with an attacker-controlled MAC address (00:11:22:33:44:55). This causes victim hosts to update their ARP cache with the false mapping, redirecting traffic intended for the gateway to the attacker's machine, enabling man-in-the-middle (MITM) attacks.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 7

A penetration tester is conducting DNS enumeration. Which TWO of the following tools are specifically designed for DNS enumeration? (Select two)

Accepted Answer

dnsrecon. dnsrecon is a dedicated DNS enumeration tool that performs multiple types of DNS queries (e.g., SRV, MX, SOA, zone transfer attempts) and supports brute-force subdomain discovery. It is specifically designed to gather DNS records and identify misconfigurations, making it a primary tool for DNS enumeration.

Answer

theHarvester

Answer

Nmap

Answer

Maltego

Question 8

Which THREE of the following are correct statements about DNS zone transfers?

Accepted Answer

A successful zone transfer reveals all DNS records for the domain. A successful DNS zone transfer (AXFR) returns the complete zone file, which contains all DNS records for the domain, including A, AAAA, MX, CNAME, NS, and TXT records. This is why it is a critical information-gathering step during reconnaissance.

Answer

Zone transfers are encrypted by default

Answer

Zone transfers use UDP port 53

Question 9

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Accepted Answer

CSRF token. The presence of a SameSite cookie set to Lax does not prevent CSRF for state-changing requests like password change if the attack uses a GET or POST from a top-level navigation. However, the primary missing mitigation is a CSRF token, which is a unique unpredictable value tied to the session and validated by the server.

Answer

SameSite=Strict

Answer

HTTPOnly flag

Answer

Secure flag

Question 10

Which TWO of the following are common tools used for SMB enumeration? (Select 2)

Accepted Answer

enum4linux. enum4linux is a wrapper tool that leverages SMB/CIFS operations (via smbclient, rpcclient, and net) to enumerate user lists, share listings, OS information, and password policies from Windows and Samba targets. It directly queries the SMB protocol (port 445/139) and is a standard tool for SMB enumeration in penetration testing.

Answer

ldapsearch

Answer

snmpwalk

Answer

nbtstat

Question 11

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It uses a decryption routine that varies. A polymorphic virus uses a decryption routine that varies with each infection, preventing signature-based detection. Option C is also correct because the changing decryption routine causes the virus's code signature to change each time it replicates, further evading signature matching.

Answer

It uses a constant signature across all infections

Answer

It can only infect boot sectors

Answer

It always remains in memory

Question 12

A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?

Accepted Answer

Dictionary attack on the 4-way handshake. The analyst captured the 4-way handshake and used a dictionary attack (wordlist) to recover the PSK. This is a dictionary attack, not brute force (which tries all combinations), rainbow table, or hash length extension (which is for hash-based MACs).

Answer

Hash length extension attack on the MIC

Answer

Rainbow table attack on the WPA2 handshake

Answer

Brute-force attack against the PSK

Question 13

A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing . When an admin views the feedback page, the script executes. Which type of XSS is this?

Accepted Answer

Stored XSS. Stored (persistent) XSS occurs when the payload is stored on the server and served to other users later.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 14

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization, typically via GET parameters.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 15

Which THREE of the following are examples of OSINT techniques? (Choose 3)

Accepted Answer

Shodan search. Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.

Answer

Nmap version detection

Answer

Nessus vulnerability scan