CEH Practice Test 34 — 15 Questions

Question 1

During a penetration test, an analyst uses a tool that sends forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This technique allows the attacker to intercept traffic. Which tool is commonly used for this purpose?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 2

A security analyst runs the command 'tcpdump -i eth0 -n host 10.0.0.5 and port 80' and sees many packets with the SYN flag set but no corresponding ACK. Which attack is likely occurring?

Accepted Answer

SYN flood. The TCP three-way handshake involves SYN, SYN-ACK, ACK. Seeing only SYN packets without ACK responses indicates a SYN flood attack, where the attacker sends many SYN packets without completing the handshake to exhaust server resources.

Answer

ICMP flood

Answer

UDP flood

Answer

Ping of Death

Question 3

A security analyst notices that the ARP cache on a workstation contains multiple entries for the same IP address with different MAC addresses. Which attack is likely occurring?

Accepted Answer

ARP poisoning. Multiple MAC addresses for one IP in the ARP cache is a sign of ARP spoofing/poisoning, where an attacker sends forged ARP replies to associate their MAC with the victim's IP.

Answer

Session hijacking

Answer

DNS spoofing

Answer

MAC flooding

Question 4

Which TWO of the following are effective mitigation techniques against DDoS attacks? (Select two)

Accepted Answer

Rate limiting. Rate limiting limits traffic per source, and scrubbing centers filter malicious traffic. Anycast distributes traffic, and blackholing drops traffic, but rate limiting and scrubbing are direct mitigations.

Answer

Port knocking

Answer

ARP poisoning

Answer

MAC filtering

Question 5

A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?

Accepted Answer

A DNS tunneling tool used for data exfiltration. A DNS tunneling tool uses DNS queries to exfiltrate data, which would cause an increase in UDP port 53 traffic. The other options are less likely to generate such traffic.

Answer

A worm that spreads via email attachments

Answer

A polymorphic virus

Answer

A keylogger that sends captured keystrokes via HTTP

Question 6

After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?

Accepted Answer

Static analysis. Static analysis involves examining the malware without executing it, using techniques like strings extraction and hash lookup on services like VirusTotal. Dynamic analysis would require executing the file in a sandbox.

Answer

Behavioral analysis

Answer

Code analysis

Answer

Dynamic analysis

Question 7

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

Accepted Answer

Tailgating. Tailgating is when an unauthorized person follows an authorized individual into a restricted area without consent. It is a physical security breach.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 8

An employee receives an SMS message that claims to be from the IT department, asking the employee to click a link to verify their email account. Which social engineering attack is this?

Accepted Answer

SMiShing. SMiShing is phishing via SMS text messages.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 9

A security analyst notices a significant increase in outbound traffic from an internal server to multiple external IPs on port 443. The server is not a web server and should not be initiating such connections. Which type of malware is MOST likely causing this behavior?

Accepted Answer

A backdoor Trojan. A backdoor Trojan allows an attacker to remotely control the infected system. The outbound connections are likely command-and-control traffic over HTTPS to hide from network monitoring.

Answer

A boot sector virus

Answer

A fileless virus

Answer

A worm

Question 10

A security administrator notices that the network switch is broadcasting traffic to all ports as if it were a hub. The switch logs show a sudden flood of packets with random MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. MAC flooding attacks send many frames with different source MAC addresses, overflowing the switch's CAM table. The switch then fails to learn MAC addresses and broadcasts frames to all ports.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 11

During a forensic investigation, an analyst finds a suspicious file that changes its code signature each time it replicates. The file uses encryption and polymorphism to evade signature-based detection. Which type of virus is this?

Accepted Answer

Polymorphic virus. A polymorphic virus mutates its code (often using encryption) while preserving its functionality, producing different signatures with each infection.

Answer

Macro virus

Answer

File infector virus

Answer

Boot sector virus

Question 12

Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. Slowloris keeps many connections open by sending partial HTTP requests, and HTTP flood sends a high volume of legitimate-looking HTTP requests. Both target the application layer.

Answer

Smurf attack

Answer

SYN flood

Answer

UDP flood

Question 13

An attacker sends an email that appears to come from the CEO, requesting that the recipient urgently transfer funds to a specified account. Which type of social engineering attack is this?

Accepted Answer

Whaling. Whaling targets high-profile individuals like executives. Spear phishing targets specific individuals, but whaling is specifically aimed at whales (big fish). The email from the CEO targeting an employee would be spear phishing, but the term 'whaling' is used when the target is a high-level executive. However, the email is from the CEO, so the attacker is impersonating a whale. Actually, whaling is when the target is a whale. Here the target is not necessarily a whale. The best answer is 'Spear phishing' because it's targeted. But the question says 'appears to come from the CEO' – that's impersonation. 'Pretexting' involves fabricating a scenario. 'Phishing' is generic. 'Spear phishing' is targeted. I'll go with 'Spear phishing' as the most accurate. I'll correct scenario: An attacker sends an email to a CFO appearing to be from the CEO. That's whaling. Let me adjust the stem to make it clear: 'An attacker sends an email to the company CFO that appears to come from the CEO, requesting an urgent wire transfer. Which type of social engineering attack is this?' Then the answer is 'Whaling'.

Answer

Spear phishing

Answer

Baiting

Answer

Phishing

Question 14

An organization experiences a DDoS attack where the attacker sends many incomplete HTTP requests that keep connections open, exhausting the server's connection pool. Which attack technique is being used?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep many connections open, eventually exhausting the server's resources.

Answer

UDP flood

Answer

HTTP flood

Answer

SYN flood

Question 15

A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP echo requests to the network broadcast address with the victim's spoofed source IP, causing all hosts to reply to the victim, amplifying traffic.

Answer

UDP flood

Answer

SYN flood

Answer

Ping of Death