CEH Practice Test 35 — 15 Questions

Question 1

A security engineer analyzes a cloud environment and finds that an S3 bucket named 'company-backups' is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. Which of the following is the MOST likely risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An attacker can read any object in the bucket without authentication. A bucket policy allowing anonymous GetObject makes all objects publicly readable, leading to data exposure.

Answer

An attacker can modify the bucket policy

Answer

An attacker can delete objects in the bucket

Answer

An attacker can enumerate all objects in the bucket

Question 2

An attacker uses Reaver against a Wi-Fi network. What vulnerability is the attacker primarily exploiting?

Accepted Answer

WPS PIN vulnerability. Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.

Answer

Weak WPA2 passphrase

Answer

Deauthentication attack

Answer

IV weakness in WEP

Question 3

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Accepted Answer

To mitigate cross-site request forgery (CSRF) attacks. SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.

Answer

To enforce HTTPS for cookie transmission

Answer

To prevent the cookie from being accessed by JavaScript

Answer

To ensure the cookie is only sent over HTTP and not FTP

Question 4

Which of the following is a common defense against clickjacking attacks?

Accepted Answer

Content Security Policy (CSP) with 'frame-ancestors' directive. Clickjacking attacks trick users into clicking on a hidden or disguised element on a page that is embedded in a malicious frame. The Content Security Policy (CSP) directive 'frame-ancestors' is a modern and effective defense against clickjacking. It allows the server to specify which origins are permitted to embed the page in frames, providing granular control. For example, 'frame-ancestors none' blocks all embedding, while 'frame-ancestors self' allows same-origin framing only. This directive supersedes the older X-Frame-Options header, which only supports DENY or SAMEORIGIN and is less flexible. Therefore, CSP with 'frame-ancestors' is the correct choice among the given options.

Answer

CSRF tokens

Answer

SameSite cookies

Answer

Input validation

Question 5

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Setting SameSite cookies to Lax or Strict. CSRF tokens ensure the request originates from the legitimate site; SameSite cookies prevent the browser from sending cookies on cross-site requests.

Answer

Input validation

Answer

Using CAPTCHA

Answer

Using HTTPS only

Question 6

Which THREE of the following are common indicators of a Server-Side Request Forgery (SSRF) vulnerability? (Select 3)

Accepted Answer

The server returns data from internal services like http://localhost/ or http://192.168.x.x/. SSRF often involves requests to internal IPs or services, use of URL schemas like file://, and responses including internal data.

Answer

The application reflects user input in the page source without encoding

Answer

The server responds with a different delay when a URL is provided versus a non-URL input

Question 7

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 8

A web application tester encounters a parameter that is reflected in the response without sanitization. The tester suspects XSS. Which TWO types of XSS could be present in this scenario? (Choose TWO.)

Accepted Answer

DOM-based XSS. Reflected XSS occurs when the input is immediately reflected in the response. DOM-based XSS occurs when client-side JavaScript processes the input unsafely. Stored XSS requires data to be saved on the server, which is not indicated here.

Answer

Self-XSS

Answer

Stored (persistent) XSS

Answer

Blind XSS

Question 9

A penetration tester is assessing a web application and notices that the application reflects the User-Agent header in the response body without sanitization. What attack could be performed using this behavior?

Accepted Answer

Cross-Site Scripting (XSS). Reflecting unsanitized input in HTTP headers can lead to reflected XSS.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 10

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Answer

Union-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

Error-based SQL injection

Question 11

A security team discovers that an S3 bucket configured for static website hosting is exposing sensitive documents. The bucket policy allows public read access. Which AWS misconfiguration is MOST likely present?

Accepted Answer

The bucket policy allows s3:GetObject for all principals. Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.

Answer

The bucket versioning is disabled

Answer

The bucket is not using server-side encryption

Answer

The bucket ACL grants write access to authenticated users

Question 12

In the cloud shared responsibility model, which of the following is typically the responsibility of the customer when using AWS EC2 (IaaS)?

Accepted Answer

Configuring security groups and firewall rules. AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

Answer

Patching the hypervisor

Answer

Network infrastructure redundancy

Answer

Physical security of data centers

Question 13

Which THREE of the following are cryptanalysis attacks that target hash functions? (Choose three.)

Accepted Answer

Preimage attack. Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.

Answer

Man-in-the-middle attack

Answer

Dictionary attack

Question 14

Which of the following is a cryptographic attack that exploits collisions in hash functions?

Accepted Answer

Birthday attack. A birthday attack exploits the birthday paradox to find two different inputs that produce the same hash output (collision).

Answer

Dictionary attack

Answer

Downgrade attack

Answer

Replay attack

Question 15

Which TWO of the following are common tools used for web application security testing? (Choose 2)

Accepted Answer

Burp Suite. Burp Suite and OWASP ZAP are both widely used web application security testing tools.

Answer

Wireshark

Answer

Nessus

Answer

Metasploit