CEH Practice Test 31 — 15 Questions

Question 1

A penetration tester uses the tool 'Pacu' during an AWS security assessment. Which phase of testing is Pacu most commonly associated with?

Accepted Answer

Exploitation and post-exploitation. Pacu is an exploitation framework for AWS, used after initial access to escalate privileges, pivot, and maintain access. It is not typically used for initial reconnaissance (Nmap, ScoutSuite) or reporting.

Answer

Reporting and documentation

Answer

Vulnerability scanning

Answer

Reconnaissance

Question 2

An attacker intercepts a TLS-encrypted session and attempts to force the client and server to use a weaker cipher suite. Which type of attack is being performed?

Accepted Answer

Downgrade attack. A downgrade attack tricks the communicating parties into negotiating a less secure version of TLS or a weaker cipher suite, making it easier for the attacker to break the encryption.

Answer

Man-in-the-middle (MITM) attack

Answer

Birthday attack

Answer

Replay attack

Question 3

In an IoT environment, a researcher finds that the firmware of a smart lock can be extracted via UART and reversed to reveal hardcoded encryption keys. Which type of vulnerability is this?

Accepted Answer

Hardcoded backdoor credentials. Hardcoded keys in firmware are a classic example of a backdoor or hardcoded credential vulnerability, allowing attackers to decrypt traffic or authenticate without proper authorization.

Answer

Insecure firmware update mechanism

Answer

Insufficient entropy in random number generation

Answer

Use of deprecated cryptographic algorithm

Question 4

Which THREE of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

Accepted Answer

Using the file:// protocol to read local files. SSRF (Server-Side Request Forgery) can be exploited by making the server fetch internal resources. Common techniques include using the file:// protocol to read local files (e.g., /etc/passwd), accessing internal services via localhost (e.g., http://127.0.0.1/admin), and targeting cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). Options B, C, and E are all valid SSRF techniques.

Answer

Injecting SQL commands into input fields

Answer

Sending a payload that includes

Question 5

During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?

Accepted Answer

Sensitive files may be exposed to unauthorized users. Directory listing exposes file names that may reveal sensitive information (e.g., backup files, config files). Attackers can then attempt to access these files directly, potentially leading to data disclosure.

Answer

The server is running an outdated version of Apache

Answer

The server is vulnerable to cross-site scripting (XSS) attacks

Answer

An attacker can upload malicious files to the directory

Question 6

A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?

Accepted Answer

Username enumeration. The different error messages allow an attacker to enumerate valid usernames, which is a common precursor to brute-force or credential-stuffing attacks.

Answer

Directory traversal

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 7

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Answer

RC4

Answer

3DES

Answer

RSA

Question 8

A security analyst wants to check if a web application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions would be most effective?

Accepted Answer

Send a request with a URL parameter pointing to an internal IP address. Crafting a request that makes the server fetch an internal IP address (like 127.0.0.1) and observing if the response includes data from that internal resource is a good test for SSRF.

Answer

Submit a base64-encoded payload in a cookie

Answer

Use SQLMap with a time-based payload

Answer

Modify the Host header to point to localhost

Question 9

A security team is evaluating wireless security for a corporate network. They want to implement the strongest current encryption standard for Wi-Fi. Which of the following should they choose?

Accepted Answer

WPA3 with SAE. WPA3 is the latest Wi-Fi security standard, offering stronger encryption with SAE (Simultaneous Authentication of Equals) and replacing WPA2.

Answer

WEP with 128-bit key

Answer

WPA2 with CCMP

Answer

802.1X with EAP-TLS

Question 10

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Accepted Answer

Exploitation. Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Answer

Reconnaissance

Answer

Reporting

Answer

Scanning and enumeration

Question 11

Which of the following is the PRIMARY reason that MD5 is no longer recommended for use in digital signatures?

Accepted Answer

MD5 is vulnerable to collision attacks. MD5 is vulnerable to collision attacks, where two different inputs produce the same hash. This undermines the integrity and non-repudiation properties required for digital signatures.

Answer

MD5 is a symmetric algorithm, not a hash function

Answer

MD5 is computationally too slow for large data

Answer

MD5 produces a 128-bit hash, which is too short for modern security

Question 12

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 13

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

Accepted Answer

Aircrack-ng. The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Answer

Wireshark

Answer

Kismet

Answer

Reaver

Question 14

While analyzing web server logs, an analyst finds the following entry: GET /../../../../etc/passwd HTTP/1.1 with a 200 OK response. Which vulnerability is indicated, and what is the MOST likely impact?

Accepted Answer

Directory traversal; reading sensitive files. The path contains '../' sequences indicating directory traversal. A 200 response suggests the attacker successfully read the /etc/passwd file, leading to disclosure of system user accounts. This can aid further attacks like password cracking.

Answer

Command injection; remote shell access

Answer

SQL injection; data exfiltration

Answer

Remote File Inclusion (RFI); arbitrary code execution

Question 15

An attacker gains access to a cloud environment and attempts to move laterally by assuming an IAM role with higher privileges. Which cloud attack vector is the attacker exploiting?

Accepted Answer

IAM misuse. IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

Answer

SSRF attack

Answer

S3 bucket misconfiguration

Answer

Container escape