CEH Practice Test 32 — 15 Questions

Question 1

A penetration tester finds that a web application allows uploading a file with the name '../../var/www/html/shell.php'. The file is successfully written to the server. Which combination of vulnerabilities does this exploit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Directory traversal and unrestricted file upload. Directory traversal allows moving up directories, and unrestricted file upload allows writing a PHP shell, leading to remote code execution.

Answer

Cross-Site Scripting (XSS) and CSRF

Answer

Local File Inclusion (LFI) and Remote File Inclusion (RFI)

Answer

SQL injection and command injection

Question 2

During an IoT assessment, a tester examines a smart thermostat that uses the MQTT protocol. The tester finds that the device connects to a broker without any authentication. Which of the following attacks is MOST likely to succeed?

Accepted Answer

Publishing arbitrary messages to control the device and subscribing to data topics. Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.

Answer

Firmware extraction via UART

Answer

Reversing the firmware to find hardcoded credentials

Answer

Performing a dictionary attack on the Wi-Fi PSK

Question 3

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they most likely use next to attempt to crack the PSK using a wordlist?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP/WPA keys from captured packets, including WPA2 handshakes using a dictionary attack.

Answer

John the Ripper

Answer

ScoutSuite

Answer

Reaver

Question 4

A security team deployed a web application firewall (WAF) that blocks requests containing SQL keywords like 'SELECT', 'UNION', and 'DROP'. An attacker bypasses the WAF by encoding the payload in base64 and using a SQL injection tool that decodes it server-side. Which mitigation would be MOST effective against this?

Accepted Answer

Implement prepared statements with parameterized queries. Prepared statements (parameterized queries) prevent SQL injection by separating query structure from data, regardless of encoding. WAF bypasses are mitigated by using proper coding practices.

Answer

Increase WAF sensitivity to block base64-encoded strings

Answer

Disable error messages to hide database errors

Answer

Use a more restrictive input validation regex

Question 5

A security analyst observes repeated de-authentication packets targeting clients on a corporate Wi-Fi network. What is the MOST likely goal of the attacker?

Accepted Answer

To capture the WPA2 4-way handshake for offline password cracking. De-authentication attacks force clients to reconnect, allowing the attacker to capture the 4-way handshake for offline cracking of the PSK.

Answer

To perform a denial-of-service attack and disrupt all wireless connectivity

Answer

To install malware on the client devices

Answer

To exploit a vulnerability in the RADIUS server

Question 6

A security analyst notices that a web application's SSL/TLS certificate is issued by a CA that is not trusted by modern browsers. Which type of attack could this enable?

Accepted Answer

Man-in-the-middle attack. Using a self-signed or untrusted CA certificate can allow an attacker to perform a man-in-the-middle attack by presenting their own certificate that the browser may accept with user warning.

Answer

Downgrade attack

Answer

Birthday attack

Answer

Replay attack

Question 7

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Accepted Answer

File upload vulnerability. The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

Answer

Directory traversal

Answer

Command injection

Answer

Stored XSS

Question 8

In a cloud environment, which of the following is an example of a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker exploits a web application to send HTTP requests from the server to an internal metadata endpoint. SSRF occurs when an attacker tricks the server into making requests to internal resources, such as a cloud metadata service, to obtain credentials.

Answer

An attacker intercepts traffic between a load balancer and backend servers

Answer

An attacker uses a SQL injection to extract database contents

Answer

An attacker uploads a malicious file to an S3 bucket that executes code on the server

Question 9

A company wants to ensure that data in transit between its IoT devices and the cloud server is encrypted. Which protocol combination is BEST suited for this purpose?

Accepted Answer

MQTT with TLS. The best choice for encrypting data in transit between IoT devices and a cloud server is MQTT with TLS. MQTT is a lightweight, publish-subscribe protocol ideal for IoT, and TLS provides robust encryption. While CoAP with DTLS is also secure, it is typically used for constrained device-to-device communication, not as the primary protocol for cloud connectivity. HTTP with SSL is too heavy for many IoT devices, and MQTT without encryption lacks security. Therefore, MQTT with TLS is the optimal combination.

Answer

MQTT without encryption

Answer

HTTP with SSL

Answer

CoAP with DTLS

Question 10

During a web application test, a penetration tester intercepts a request using Burp Suite Proxy, modifies the 'Referer' header, and resends the request. The application processes the request despite the modified header. Which attack is the tester attempting to validate?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF (Cross-Site Request Forgery) attacks often rely on the Referer header for validation. By modifying it, the tester checks if the application validates the header. If the request is processed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 11

Match each footprinting technique to its description.

Accepted Answer

DNS interrogation: Extracting DNS records to discover network information. The correct matches are: DNS interrogation extracts DNS records, WHOIS lookup queries domain databases, Google hacking uses search operators, and social engineering manipulates people. Common confusions include swapping ping sweep (ICMP probing) with DNS interrogation or Google hacking.

Answer

Ping sweep: Using search operators to find sensitive information

Answer

DNS interrogation: Identifying live hosts by sending ICMP requests

Question 12

A security team is implementing measures to prevent cross-site request forgery (CSRF) attacks. Which of the following is the most effective mitigation technique?

Accepted Answer

Implementing CSRF tokens. CSRF tokens are unique, unpredictable values that must be included in state-changing requests, ensuring the request originated from the legitimate site.

Answer

Enabling SSL/TLS

Answer

Using HTTP GET for all form submissions

Answer

Using input validation

Question 13

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Accepted Answer

Stored XSS. The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Self-XSS

Question 14

Which of the following is the primary purpose of using a CSRF token in a web application?

Accepted Answer

Prevent cross-site request forgery. CSRF tokens are unique, unpredictable values embedded in forms or requests that validate the request originated from the legitimate application, preventing cross-site request forgery attacks.

Answer

Prevent session hijacking

Answer

Prevent XSS

Answer

Prevent SQL injection

Question 15

A security analyst runs the following command: 'wget http://example.com/bucket?list-type=2' and receives a listing of objects. Which cloud misconfiguration is this MOST likely exploiting?

Accepted Answer

Publicly accessible S3 bucket with list permissions enabled. An S3 bucket with public listing enabled allows anyone to list objects via HTTP GET requests.

Answer

SSRF vulnerability in the cloud application

Answer

Container escape vulnerability

Answer

Misconfigured IAM roles allowing privilege escalation