CEH Practice Test 34 — 15 Questions

Question 1

A penetration tester uses SQLMap with the option '--technique=T --dbms=MySQL --level=5 --risk=3' against a login form. The tool returns results after a delay of several seconds per request. Which SQL injection technique is being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Time-based blind SQL injection. The 'T' in --technique stands for Time-based blind SQL injection. The delay indicates time-based injection where the database sleeps to cause a response delay.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Question 2

During a penetration test, a tester uses the following payload in a search field: . The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Self-XSS

Question 3

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Accepted Answer

Intruder. Intruder is designed for automated customized attacks including brute-force, fuzzing, and credential stuffing.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 4

Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nmap scan

Answer

WHOIS lookup

Answer

Shodan search

Question 5

Which of the following is a primary defense against SQL injection attacks?

Accepted Answer

Prepared statements. Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.

Answer

HTTPS encryption

Answer

Input blacklisting

Answer

Output encoding

Question 6

Which cloud security assessment tool is specifically designed to audit AWS environments for misconfigurations and provides a detailed report of findings?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations. It generates a comprehensive HTML report. Pacu is an exploitation framework, not an audit tool.

Answer

Pacu

Answer

Metasploit

Answer

Nmap

Question 7

Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?

Accepted Answer

Intruder. Burp Intruder is a tool for automating customized attacks against web applications, including fuzzing for vulnerabilities.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 8

A web developer wants to mitigate CSRF attacks. Which of the following configurations for cookies is most effective when combined with CSRF tokens?

Accepted Answer

SameSite=Strict. SameSite=Strict prevents the browser from sending cookies for cross-site requests, which blocks CSRF attacks.

Answer

HttpOnly flag

Answer

Domain attribute

Answer

Secure flag

Question 9

Which cryptographic algorithm is vulnerable to a birthday attack on its hash output size of 128 bits, reducing the effective security to 64 bits against collision resistance?

Accepted Answer

MD5. MD5 produces 128-bit hashes. Birthday attack complexity for collision is 2^(n/2) = 2^64 for n=128. SHA-1 is 160-bit, SHA-256 is 256-bit, RC4 is a stream cipher not a hash.

Answer

SHA-256

Answer

SHA-1

Answer

RC4

Question 10

An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?

Accepted Answer

The attack will fail because the browser will not include the session cookie with the cross-origin request.. SameSite=Strict prevents cookies from being sent on cross-site requests, effectively blocking CSRF attacks if the attacker cannot control the origin.

Answer

The attack will succeed because cookies are sent regardless of SameSite settings.

Answer

The attack will succeed because the attacker can bypass SameSite using GET requests.

Answer

The attack will fail because CSRF requires POST requests and the malicious page only uses GET.

Question 11

What is the primary purpose of the 4-way handshake in WPA/WPA2-Personal?

Accepted Answer

To establish encryption keys without transmitting the pre-shared key. The 4-way handshake confirms that both client and AP possess the pre-shared key (PSK) without exposing it, and generates temporal keys for encryption.

Answer

To authenticate the user with a username and password

Answer

To synchronize the beacon intervals between client and AP

Answer

To exchange digital certificates between client and AP

Question 12

Match each type of attack to its description.

Accepted Answer

Phishing: A broad term for social engineering attacks that use fraudulent emails or websites to trick individuals into revealing sensitive information.. The correct matches are Phishing with its broad definition, Spear Phishing with targeted definition, and Whaling with high-profile target definition. Common confusions: Vishing is voice-based, Smishing is SMS-based; also targeted phishing is spear phishing.

Answer

Vishing: A targeted form of phishing directed at a specific individual.

Answer

Smishing: Voice phishing using phone calls.

Question 13

A security engineer wants to ensure that a wireless network uses the most secure encryption available. Which of the following should be configured on the access point?

Accepted Answer

WPA3. WPA3 is the latest Wi-Fi security standard, providing stronger encryption (GCMP-256) and protection against dictionary attacks via SAE.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with AES

Question 14

Which TWO of the following are effective defenses against CSRF attacks? (Choose 2.)

Accepted Answer

Using anti-CSRF tokens that are validated on the server. CSRF tokens and SameSite cookies both prevent cross-site request forgery. Double Submit Cookie is also a method but not listed. Custom headers are not a standard defense; the primary ones are CSRF tokens and SameSite cookies.

Answer

Setting the Secure flag on cookies

Answer

Using input validation to block special characters

Answer

Enabling the HttpOnly flag on session cookies

Question 15

A penetration tester uses the following command to attack a WPS-enabled AP: 'reaver -i mon0 -b 00:11:22:33:44:55 -vv'. What is the primary goal of this attack?

Accepted Answer

Obtain the WPS PIN and subsequently the WPA2 PSK. Reaver is used to brute force the WPS PIN, recovering the PIN and ultimately the WPA2 PSK.

Answer

Perform a de-authentication attack on all clients

Answer

Capture a WPA2 4-way handshake for offline cracking

Answer

Scan for hidden SSIDs in the area