CEH Practice Test 33 — 15 Questions

Question 1

Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)

Accepted Answer

Hosting provider and country. Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.

Answer

Internal IP addresses of the servers

Answer

Employee email addresses

Question 2

Which asymmetric encryption algorithm is based on the algebraic structure of elliptic curves over finite fields and provides equivalent security to RSA with smaller key sizes?

Accepted Answer

Elliptic Curve Cryptography (ECC). ECC (Elliptic Curve Cryptography) offers strong security with smaller keys compared to RSA. Diffie-Hellman is a key exchange protocol, 3DES is symmetric, and SHA-256 is a hash function.

Answer

SHA-256

Answer

Diffie-Hellman (DH)

Answer

Triple DES (3DES)

Question 3

A penetration tester discovers that a web application includes the following code: 'include($_GET['page'] . '.php');' and the application is running on a Linux server. The tester attempts to exploit this by accessing 'index.php?page=../../etc/passwd'. What type of attack is this, and will it succeed?

Accepted Answer

Local File Inclusion (LFI); it will not succeed because the '.php' extension is appended. This is a Local File Inclusion (LFI) vulnerability. The appended '.php' extension prevents reading '/etc/passwd' because the file would be interpreted as '/etc/passwd.php', which does not exist.

Answer

Directory traversal; it will succeed because '../' bypasses restrictions

Answer

Remote File Inclusion (RFI); it will succeed because the parameter is not filtered

Answer

Command injection; it will succeed if the server interprets PHP code

Question 4

An application allows users to upload XML files for processing. A tester uploads the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which attack is being performed?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read a local file. The server's XML parser processes the entity and reflects the file content, confirming the vulnerability.

Answer

SQL injection

Answer

Cross-Site Scripting (XSS)

Answer

Server-Side Request Forgery (SSRF)

Question 5

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page?id=1' --batch --dbs. Which of the following best describes what this command will do?

Accepted Answer

Enumerate all database names in non-interactive mode. --dbs enumerates database names; --batch uses default options without interactive input.

Answer

Dump the entire contents of the current database

Answer

Perform a time-based blind SQL injection to extract data

Answer

Enumerate all tables in all databases

Question 6

Which of the following is the most effective defense against SQL injection attacks?

Accepted Answer

Parameterized queries. Parameterized queries (prepared statements) ensure user input is treated as data, not executable code, preventing SQL injection.

Answer

Escaping all user input

Answer

Input validation using blacklists

Answer

Stored procedures

Question 7

Which of the following attacks is characterized by an attacker placing a fake wireless access point with the same SSID as a legitimate network to capture client credentials?

Accepted Answer

Evil twin attack. An evil twin attack involves setting up a rogue access point that mimics a legitimate SSID to intercept traffic and capture credentials.

Answer

De-authentication attack

Answer

WPS PIN brute force attack

Answer

Replay attack

Question 8

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

Accepted Answer

WEP key recovery using aircrack-ng. WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

Answer

WPS PIN brute-force attack

Answer

Evil twin AP deployment

Answer

WPA handshake capture

Question 9

An attacker attempts to exploit a web application by sending a request that triggers the server to make an internal HTTP request to a sensitive internal service. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when an attacker can induce the server to make requests to internal resources.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 10

A security analyst discovers that a web application's search box reflects user input without proper sanitization. However, the attacker must trick a victim into clicking a crafted link containing the malicious script. This vulnerability is classified as which type?

Accepted Answer

Reflected XSS. Reflected XSS requires user interaction (clicking a link) to execute the script in the victim's browser. The payload is not stored on the server, distinguishing it from stored XSS. DOM-based XSS does not involve server reflection.

Answer

Blind XSS

Answer

Stored XSS

Answer

DOM-based XSS

Question 11

A security analyst discovers that a containerized application running in a cloud environment can access the host's file system by mounting /var/run/docker.sock inside the container. Which type of attack does this configuration enable?

Accepted Answer

Container escape to the host. Mounting the Docker socket inside a container allows the container to communicate with the Docker daemon on the host, potentially allowing the attacker to create new containers, escape the container, and execute commands on the host.

Answer

Server-Side Request Forgery (SSRF)

Answer

Privilege escalation within the container only

Answer

Denial-of-Service (DoS) attack against the container runtime

Question 12

A security analyst captures a WPA2 4-way handshake using airodump-ng. To crack the PSK, which tool would they MOST likely use next?

Accepted Answer

Aircrack-ng. The correct tool for cracking a WPA2 PSK from a captured handshake is aircrack-ng, which performs dictionary attacks against the handshake file.

Answer

Kismet

Answer

John the Ripper

Answer

Reaver

Question 13

Refer to the exhibit. A penetration tester observes that the DNS server returns both internal (10.0.0.0/8) and external (203.0.113.5) IP addresses for the same domain. What is this technique called?

Accepted Answer

Split DNS misconfiguration

Answer

DNS cache poisoning

Answer

DNS rebinding

Answer

DNS zone transfer

Question 14

An attacker sends an email that appears to come from the CEO of the company, requesting an urgent wire transfer to a specific account. This is an example of which social engineering attack?

Accepted Answer

Whaling. Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like the CEO or CFO. In this scenario, the attacker impersonates the CEO to trick an employee into authorizing a fraudulent wire transfer, which is the classic hallmark of whaling rather than generic phishing.

Answer

Spear phishing

Answer

Phishing

Answer

Pretexting

Question 15

An analyst captures the following output from a wireless adapter: `[00:1A:2B:3C:4D:5E] 54 Mbps WPA2 CCMP PSK`. The analyst suspects a malicious rogue AP is impersonating a legitimate network. Which of the following indicators would MOST strongly confirm a rogue AP?

Accepted Answer

The BSSID matches a known manufacturer, but the signal strength is unusually high. A rogue AP often has a higher signal strength than expected, especially if it's placed closer to users. Additionally, a mismatch between the BSSID and the known legitimate AP can indicate spoofing.

Answer

The channel number is different from the legitimate AP

Answer

The SSID is broadcasted with the same name as the corporate network

Answer

The encryption type is WPA2 with CCMP