CEH Practice Test 32 — 15 Questions

Question 1

During a web application penetration test, a tester submits a comment containing '<script>alert("XSS")</script>' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stored (persistent) XSS. Stored (persistent) XSS occurs when the injected script is permanently stored on the server (e.g., in a database) and executed for every user who accesses that content.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 2

Which THREE of the following are common techniques used during the footprinting phase? (Choose three.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a footprinting technique that queries domain registration databases (e.g., whois.arin.net) to obtain registrant contact details, name servers, and registration dates. Google hacking (also known as Google dorking) uses advanced search operators to uncover sensitive information indexed by search engines, such as exposed configuration files or login pages. DNS zone transfer (AXFR) is a footprinting technique that, if misconfigured, allows an attacker to retrieve a complete list of DNS records for a domain, revealing internal hostnames and network structure. All three are passive or semi-passive information-gathering methods performed without directly engaging the target's systems.

Answer

Exploitation

Answer

Port scanning

Question 3

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references (e.g., database keys) and fails to enforce proper access controls, allowing users to manipulate them to access unauthorized data.

Answer

SQL injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Request Forgery (CSRF)

Question 4

Which THREE of the following are best practices for securing IoT devices in a home automation network?

Accepted Answer

Segment IoT devices on a separate VLAN or subnet.. Segmenting IoT devices on a separate VLAN or subnet (Option B) is a best practice because it isolates potentially insecure IoT devices from the main trusted network. If an IoT device is compromised, the attacker cannot easily pivot to other devices on the primary LAN. This leverages Layer 2 or Layer 3 segmentation to enforce network access controls, reducing the attack surface in a home automation environment.

Answer

Enable Universal Plug and Play (UPnP) for easy integration.

Answer

Ensure all devices are connected directly to the internet for remote access.

Question 5

During a penetration test, a tester uses SQLMap with the following command: 'sqlmap -u "http://target.com/page?id=1" --os-shell'. The target is a Linux server running MySQL. Which SQL injection technique will SQLMap likely attempt to use to achieve an OS shell?

Accepted Answer

In-band (file write via INTO OUTFILE). SQLMap's --os-shell option typically uses the 'INTO OUTFILE' clause to write a backdoor webshell onto the server, requiring file write privileges. This is an in-band technique.

Answer

Error-based injection

Answer

Blind boolean-based injection

Answer

Union-based injection

Question 6

Which THREE of the following Nmap options can be used to evade detection by IDS/IPS? (Select three)

Accepted Answer

-f (fragment packets). The -f flag fragments the crafted packets into smaller pieces, typically 8-byte fragments, which can bypass simple IDS/IPS signatures that expect full unfragmented packets. This technique exploits the fact that many intrusion detection systems struggle to reassemble fragmented packets in real time, allowing the scan to evade detection.

Answer

-sV (version detection)

Answer

-O (OS detection)

Question 7

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection vulnerabilities. Burp Suite is a web proxy and scanner, Nikto is a web server scanner, and Metasploit is a penetration testing framework with broader capabilities.

Answer

Burp Suite

Answer

Nikto

Answer

Metasploit

Question 8

Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?

Accepted Answer

A firewall or ACL is blocking the port.

Answer

The SSH service is interfering with the scan.

Answer

The target host is offline.

Answer

The web server is not running.

Question 9

An analyst observes the following log entry on a web server: GET /../../etc/passwd HTTP/1.1 200. Which type of attack is indicated?

Accepted Answer

Directory traversal. The log shows a request attempting to traverse directories using '../' to access a sensitive system file (/etc/passwd), which is directory traversal.

Answer

SSRF

Answer

LFI

Answer

Command injection

Question 10

An IoT device uses MQTT protocol with default credentials 'admin/admin' and no TLS encryption. An attacker on the same network captures MQTT packets and extracts sensor data. Which two vulnerabilities are being exploited? (Choose the best combination)

Accepted Answer

Default credentials and cleartext communication. The use of default credentials and lack of encryption (no TLS) are the vulnerabilities. MQTT itself is not insecure when properly configured; the issues are weak authentication and cleartext communication.

Answer

Buffer overflow and command injection

Answer

Insecure firmware and hardcoded backdoor

Answer

Weak encryption and replay attack

Question 11

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Accepted Answer

Directory traversal. Directory traversal (path traversal) uses ../ sequences to access files outside the web root.

Answer

Command injection

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Question 12

A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). This is a classic indicator of an Insecure Direct Object Reference (IDOR) vulnerability, where an attacker can enumerate valid IDs by observing differences in responses.

Answer

Stored Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Question 13

A web application allows users to submit feedback that is stored in a database and displayed to other users without proper sanitization. A tester inputs '' and it executes when other users view the feedback. Which type of XSS is this?

Accepted Answer

Stored XSS. The payload is stored in the database and executed when other users load the page, which is stored (persistent) XSS.

Answer

Self-XSS

Answer

DOM-based XSS

Answer

Reflected XSS

Question 14

A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP spoofing attack. An evil twin attack involves a rogue AP impersonating a legitimate one, but it does not typically cause ARP packets with varied IPs. ARP spoofing involves an attacker sending forged ARP replies to associate their MAC with another IP, causing traffic to be misdirected. The described behavior matches ARP spoofing, where the attacker's MAC appears with multiple IPs.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

Evil twin attack

Question 15

A web application allows users to upload profile pictures. The application uses the filename provided by the user to save the file on the server. An attacker uploads a file named 'malicious.php%00.png' and the server saves it as 'malicious.php'. Which vulnerability is being exploited?

Accepted Answer

Null byte injection. This is a null byte injection attack, where the %00 (null byte) terminates the string, bypassing extension checks to upload a PHP file.

Answer

Directory traversal

Answer

Command injection

Answer

Cross-Site Scripting (XSS)