CEH Practice Test 35 — 15 Questions

Question 1

An analyst captures network traffic and sees a large number of packets with source IP 10.0.0.1, destination IP 192.168.1.1, TCP SYN flag set, with sequence numbers that appear incremental. The destination responds with SYN-ACK but the source never completes the handshake. Which attack is MOST likely occurring?

Accepted Answer

SYN flood. In a TCP SYN flood, the attacker sends many SYN packets with spoofed IPs (or non-responsive IPs) and never completes the handshake, exhausting server resources.

Answer

ARP poisoning

Answer

ICMP flood

Answer

DNS amplification

Question 2

A penetration tester runs the following command: `macof -i eth0 -s 192.168.1.100 -d 10.0.0.1`. Which attack is being performed?

Accepted Answer

MAC flooding. Macof is a tool used for MAC flooding, which fills the switch's CAM table with fake MAC addresses, causing it to fail open and broadcast traffic to all ports.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

DHCP starvation

Question 3

A security analyst receives an email that appears to be from the CEO, urgently requesting a wire transfer. The email address is slightly misspelled (ceo@cornpany.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or organization, often using personalized information to appear legitimate. This email targets the analyst specifically and uses a spoofed domain, making it spear phishing, not generic phishing or whaling (which targets high-level executives, though the CEO is impersonated, the recipient is the analyst).

Answer

Vishing

Answer

Whaling

Answer

Phishing

Question 4

Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?

Accepted Answer

File virus. A file virus infects executable files and spreads when the infected file is executed. Worms spread without human action; Trojans disguise as legitimate software; ransomware encrypts files.

Answer

Worm

Answer

Ransomware

Answer

Trojan

Question 5

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It uses a decryption routine that varies. A polymorphic virus changes its code signature (using encryption/decryption) each time it replicates to evade signature-based detection, while retaining its functionality.

Answer

It uses a constant signature across all infections

Answer

It can only infect boot sectors

Answer

It always remains in memory

Question 6

During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain information or action.

Answer

Phishing

Answer

Vishing

Answer

Quid pro quo

Question 7

A security analyst captures network traffic and sees a sequence of ARP replies with the same IP address mapping to different MAC addresses within a short period. Which attack is indicated?

Accepted Answer

ARP poisoning. ARP poisoning involves sending spoofed ARP replies to associate an IP with multiple MACs, enabling MITM.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

MAC flooding

Question 8

A security analyst uses a tool to capture packets in promiscuous mode on a network segment. The analyst notices that only traffic to and from the analyst's machine is captured, not all traffic on the segment. What is the most likely reason?

Accepted Answer

The network is using a switch instead of a hub. A switch only forwards traffic to the port where the destination MAC resides; promiscuous mode only affects the local NIC, not switch behavior.

Answer

The switch is preventing sniffing due to port security

Answer

The analyst is not using the correct filter in Wireshark

Answer

The network interface is not in promiscuous mode

Question 9

An organization receives an email that appears to be from the CEO, urgently requesting that the recipient wire funds to a new vendor. The email contains the CEO's name and title but the sender address is slightly misspelled. Which type of social engineering attack is this?

Accepted Answer

Whaling. Whaling targets senior executives (like the CEO) with personalized phishing emails, often involving financial fraud.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 10

Which TWO of the following are examples of session hijacking attacks? (Select 2)

Accepted Answer

Cookie theft. TCP sequence prediction and cookie theft are methods to hijack a session.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning

Question 11

During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?

Accepted Answer

Ettercap. Ettercap is a well-known tool for ARP poisoning (spoofing) to perform man-in-the-middle attacks. It is specifically designed for this purpose.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 12

A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?

Accepted Answer

DNS amplification. A DNS amplification attack uses open DNS resolvers to send large responses to a spoofed victim IP, amplifying traffic. The characteristics include UDP, port 53, spoofed source, and many sources (amplifiers).

Answer

UDP flood

Answer

SYN flood

Answer

ICMP flood

Question 13

A malware analyst wants to examine a suspicious executable without executing it. The goal is to extract strings, view the PE header, and check for known signatures. Which approach is the analyst using?

Accepted Answer

Static analysis. Static analysis involves examining the file without executing it. Techniques include string extraction, PE header analysis, and signature-based checks (e.g., VirusTotal).

Answer

Dynamic analysis

Answer

Heuristic analysis

Answer

Reverse engineering

Question 14

A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?

Accepted Answer

Ettercap. Ettercap includes a DNS spoofing plugin that allows the attacker to redirect DNS requests to arbitrary IP addresses.

Answer

Nmap

Answer

Wireshark

Answer

tcpdump

Question 15

An employee receives a text message claiming to be from the company's IT department, stating that their account will be suspended unless they click a link to verify their credentials. Which type of social engineering attack is this?

Accepted Answer

SMiShing. SMiShing (SMS phishing) is a phishing attack conducted via SMS text messages. The message uses urgency to trick the recipient into revealing credentials.

Answer

Vishing

Answer

Phishing

Answer

Baiting