CEH Practice Test 33 — 15 Questions

Question 1

Which of the following cryptographic hash functions is known to be vulnerable to collision attacks and should be avoided for security applications?

Accepted Answer

MD5. MD5 is known to be vulnerable to collision attacks, making it unsuitable for security applications like digital signatures.

Answer

RIPEMD-160

Answer

SHA-256

Answer

SHA-1

Question 2

An IoT device uses the MQTT protocol without TLS. An attacker on the same network captures messages and publishes a fake temperature reading. Which attack is being executed?

Accepted Answer

Man-in-the-middle attack. MQTT over plain TCP allows message interception and injection (man-in-the-middle) because no encryption or authentication is enforced.

Answer

Replay attack

Answer

Firmware reversing attack

Answer

Denial of service attack

Question 3

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.

Answer

Remote File Inclusion (RFI)

Answer

Command Injection

Answer

Directory Traversal

Question 4

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

Answer

Aircrack-ng

Answer

Nmap

Answer

Wireshark

Question 5

A web application uses XML to transmit data between client and server. A tester submits the following payload: ']>&xxe;'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Answer

SQL injection

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 6

A security analyst notices that a web application's search functionality returns database error messages in the response. The analyst suspects SQL injection. Which TWO techniques should the analyst use to confirm and exploit this vulnerability? (Choose TWO.)

Accepted Answer

Leverage error-based SQL injection with CONVERT() or double query. Union-based SQL injection uses UNION SELECT to retrieve data from other tables. Error-based SQL injection leverages database error messages to extract information. Both are common in-band techniques suitable when errors are displayed.

Answer

Use out-of-band SQL injection with DNS exfiltration

Answer

Use a time-based blind SQL injection with SLEEP() function

Answer

Implement parameterized queries in the application code

Question 7

During a penetration test, a tester captures the WPA2 4-way handshake with airodump-ng and then uses aircrack-ng with a wordlist. However, the PSK is not found. Which of the following is the MOST likely reason?

Accepted Answer

The wordlist does not contain the PSK. If the PSK is not in the wordlist, dictionary attacks will fail. Other steps (capture, cracking) were done correctly.

Answer

Aircrack-ng does not support WPA2 cracking

Answer

The handshake was not captured correctly

Answer

The network uses WPA3 instead of WPA2

Question 8

An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?

Accepted Answer

Set 'Options -Indexes' in the httpd.conf or .htaccess file. Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.

Answer

Set 'AllowOverride None'

Answer

Set 'ServerSignature Off'

Answer

Set 'DirectoryIndex disabled'

Question 9

A penetration tester discovers that a web application's login page does not enforce rate limiting and several usernames are known from a prior data breach. The tester wants to try a few common passwords across many accounts to avoid account lockouts. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying involves trying a small number of common passwords against many user accounts to avoid account lockout. This contrasts with credential stuffing (using many passwords per account) and brute force (many passwords per user).

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 10

A security team discovers that an attacker has been intercepting and modifying traffic between a client and server by impersonating both endpoints. Which type of cryptographic attack is this?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and server to intercept and modify traffic.

Answer

Replay attack

Answer

Downgrade attack

Answer

Birthday attack

Question 11

An attacker crafts a link that, when clicked by an authenticated user, performs an unintended action on a web application where the user is logged in, such as changing their email address. The application uses a session cookie for authentication but does not include any anti-forgery tokens in forms. Which attack is this?

Accepted Answer

Cross-Site Request Forgery (CSRF). The description matches Cross-Site Request Forgery (CSRF), where a malicious link triggers actions on a site where the victim is authenticated.

Answer

Cross-Site Scripting (XSS)

Answer

Clickjacking

Answer

Server-Side Request Forgery (SSRF)

Question 12

A penetration tester discovers that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is a potential impact of this vulnerability?

Accepted Answer

Access to cloud instance metadata. SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.

Answer

Cross-site scripting (XSS) in the browser

Answer

Remote code execution via command injection

Answer

SQL injection in the database

Question 13

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: ]>&xxe;. Which vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity that reads a local file, which is classic XXE (XML External Entity) injection.

Answer

Server-Side Request Forgery (SSRF)

Answer

XPath injection

Answer

SQL injection

Question 14

Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?

Accepted Answer

RDP brute-force attack. Multiple established RDP connections from different internal IPs suggest a brute-force or password-spraying attack against RDP. The established connections indicate successful authentication attempts.

Answer

SMB relay attack

Answer

DDoS attack

Answer

Man-in-the-middle attack

Question 15

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Accepted Answer

Trying a few common passwords against many accounts. Password spraying uses a few common passwords against many accounts to avoid account lockout.

Answer

Using a list of compromised credentials from a data breach

Answer

Trying many passwords for a single account

Answer

Using automated tools to bypass CAPTCHA