CEH Practice Test 34 — 15 Questions

Question 1

During a wireless penetration test, the tester runs `airodump-ng wlan0mon` and sees numerous beacon frames from a network. The tester then sends deauthentication packets using `aireplay-ng -0 5 -a <BSSID> wlan0mon`. What is the PRIMARY purpose of this deauthentication attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To force a client to reconnect and capture the WPA/WPA2 handshake. Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.

Answer

To crash the access point and cause a denial of service

Answer

To obtain the WPS PIN of the access point

Answer

To perform a rogue AP attack by spoofing the BSSID

Question 2

Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?

Accepted Answer

Intruder. Burp Intruder is designed for automated customized attacks, allowing you to send many requests with varying payloads to a single target endpoint.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 3

A security engineer observes that an internal web application uses XML to transmit data between systems. The engineer discovers that by sending a crafted XML payload, they can read sensitive files from the server's filesystem. Which attack is being performed?

Accepted Answer

XXE injection. XXE (XML External Entity) injection allows reading files via external entities in XML.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 4

A security analyst notices that the web application returns different response times when a valid username is submitted versus an invalid one during login. Which type of vulnerability is likely being exploited?

Accepted Answer

Time-based SQL injection. Time-based SQL injection involves injecting SQL code that causes the database to pause if a condition is true, allowing an attacker to infer information based on response times. The observed difference in response times for valid vs. invalid usernames is characteristic of this technique.

Answer

Reflected XSS

Answer

Blind boolean-based SQL injection

Answer

CSRF

Question 5

A security analyst observes an SSL/TLS handshake where the client and server negotiate TLS 1.0 instead of TLS 1.2, despite the server supporting TLS 1.2. Which attack BEST describes the manipulation of the handshake to force weaker encryption?

Accepted Answer

Downgrade attack. A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Birthday attack

Question 6

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Accepted Answer

Implement a whitelist of allowed domains and IP addresses for outbound requests. Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

Answer

Use input validation to block URLs containing '127.0.0.1' or 'localhost'

Answer

Implement CSRF tokens on all forms

Answer

Disable unnecessary HTTP methods on the web server

Question 7

Which tool is specifically designed to assess the security configuration of AWS, Azure, and GCP cloud environments by scanning for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for misconfigurations across AWS, Azure, and GCP. Pacu is an AWS exploitation framework; Aircrack-ng is for wireless; Reaver is for WPS.

Answer

Pacu

Answer

Reaver

Answer

Aircrack-ng

Question 8

A security analyst notices that a web application uses sequential numeric IDs for user accounts (e.g., /profile?id=1001). By changing the ID to 1002, the analyst can view another user's profile. Which vulnerability is present?

Accepted Answer

IDOR. This is an IDOR (Insecure Direct Object Reference) vulnerability, where direct access to objects is not properly restricted.

Answer

SQL injection

Answer

Directory traversal

Answer

CSRF

Question 9

After a security incident, logs show repeated login attempts from different IP addresses using a list of common passwords against a single username. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying uses a small set of common passwords against many accounts or, as in this case, against a single account from multiple IPs to avoid lockout.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 10

A security analyst notices that the web application returns different response times when querying user IDs. For example, a valid user ID returns the page in 2 seconds, while an invalid ID returns in 0.5 seconds. The analyst suspects a blind SQL injection vulnerability. Which SQL injection technique is MOST likely being used?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on causing a time delay (e.g., via SLEEP or WAITFOR DELAY) to infer the truth of conditions. The varying response times (2s vs 0.5s) indicate a time-based attack.

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 11

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 12

A security analyst observes that a server running an IoT device management platform is sending MQTT traffic to an unexpected IP address. The analyst also notes that the device's firmware contains hardcoded credentials. Which attack vector is MOST likely being exploited?

Accepted Answer

Insecure MQTT protocol exploitation via default credentials. The combination of hardcoded credentials and unexpected MQTT traffic suggests an attacker has used default credentials to compromise the device and is exfiltrating data via MQTT.

Answer

CoAP protocol attack

Answer

Firmware reversing attack

Answer

Container escape attack

Question 13

A penetration tester uses the tool 'Pacu' during an AWS security assessment. Which phase of testing is Pacu most commonly associated with?

Accepted Answer

Exploitation and post-exploitation. Pacu is an exploitation framework for AWS, used after initial access to escalate privileges, pivot, and maintain access. It is not typically used for initial reconnaissance (Nmap, ScoutSuite) or reporting.

Answer

Reporting and documentation

Answer

Vulnerability scanning

Answer

Reconnaissance

Question 14

An attacker intercepts a TLS-encrypted session and attempts to force the client and server to use a weaker cipher suite. Which type of attack is being performed?

Accepted Answer

Downgrade attack. A downgrade attack tricks the communicating parties into negotiating a less secure version of TLS or a weaker cipher suite, making it easier for the attacker to break the encryption.

Answer

Man-in-the-middle (MITM) attack

Answer

Birthday attack

Answer

Replay attack

Question 15

In an IoT environment, a researcher finds that the firmware of a smart lock can be extracted via UART and reversed to reveal hardcoded encryption keys. Which type of vulnerability is this?

Accepted Answer

Hardcoded backdoor credentials. Hardcoded keys in firmware are a classic example of a backdoor or hardcoded credential vulnerability, allowing attackers to decrypt traffic or authenticate without proper authorization.

Answer

Insecure firmware update mechanism

Answer

Insufficient entropy in random number generation

Answer

Use of deprecated cryptographic algorithm