CEH Practice Test 35 — 15 Questions

Question 1

Which THREE of the following are valid methods to exploit or test for Server-Side Request Forgery (SSRF)?

Accepted Answer

Using the file:// protocol to read local files. SSRF (Server-Side Request Forgery) can be exploited by making the server fetch internal resources. Common techniques include using the file:// protocol to read local files (e.g., /etc/passwd), accessing internal services via localhost (e.g., http://127.0.0.1/admin), and targeting cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). Options B, C, and E are all valid SSRF techniques.

Answer

Injecting SQL commands into input fields

Answer

Sending a payload that includes

Question 2

During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?

Accepted Answer

Sensitive files may be exposed to unauthorized users. Directory listing exposes file names that may reveal sensitive information (e.g., backup files, config files). Attackers can then attempt to access these files directly, potentially leading to data disclosure.

Answer

The server is running an outdated version of Apache

Answer

The server is vulnerable to cross-site scripting (XSS) attacks

Answer

An attacker can upload malicious files to the directory

Question 3

A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?

Accepted Answer

Username enumeration. The different error messages allow an attacker to enumerate valid usernames, which is a common precursor to brute-force or credential-stuffing attacks.

Answer

Directory traversal

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 4

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Answer

RC4

Answer

3DES

Answer

RSA

Question 5

A security analyst wants to check if a web application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions would be most effective?

Accepted Answer

Send a request with a URL parameter pointing to an internal IP address. Crafting a request that makes the server fetch an internal IP address (like 127.0.0.1) and observing if the response includes data from that internal resource is a good test for SSRF.

Answer

Submit a base64-encoded payload in a cookie

Answer

Use SQLMap with a time-based payload

Answer

Modify the Host header to point to localhost

Question 6

A security team is evaluating wireless security for a corporate network. They want to implement the strongest current encryption standard for Wi-Fi. Which of the following should they choose?

Accepted Answer

WPA3 with SAE. WPA3 is the latest Wi-Fi security standard, offering stronger encryption with SAE (Simultaneous Authentication of Equals) and replacing WPA2.

Answer

WEP with 128-bit key

Answer

WPA2 with CCMP

Answer

802.1X with EAP-TLS

Question 7

A penetration tester uses Burp Suite Repeater to manually modify and resend HTTP requests to a web server. In which phase of the testing methodology is this tool most commonly employed?

Accepted Answer

Exploitation. Burp Suite Repeater is used to manually craft and reissue requests, typically during the exploitation phase after identifying potential vulnerabilities. It allows testing parameter manipulation, injection payloads, and observing responses.

Answer

Reconnaissance

Answer

Reporting

Answer

Scanning and enumeration

Question 8

Which of the following is the PRIMARY reason that MD5 is no longer recommended for use in digital signatures?

Accepted Answer

MD5 is vulnerable to collision attacks. MD5 is vulnerable to collision attacks, where two different inputs produce the same hash. This undermines the integrity and non-repudiation properties required for digital signatures.

Answer

MD5 is a symmetric algorithm, not a hash function

Answer

MD5 is computationally too slow for large data

Answer

MD5 produces a 128-bit hash, which is too short for modern security

Question 9

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 10

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

Accepted Answer

Aircrack-ng. The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Answer

Wireshark

Answer

Kismet

Answer

Reaver

Question 11

While analyzing web server logs, an analyst finds the following entry: GET /../../../../etc/passwd HTTP/1.1 with a 200 OK response. Which vulnerability is indicated, and what is the MOST likely impact?

Accepted Answer

Directory traversal; reading sensitive files. The path contains '../' sequences indicating directory traversal. A 200 response suggests the attacker successfully read the /etc/passwd file, leading to disclosure of system user accounts. This can aid further attacks like password cracking.

Answer

Command injection; remote shell access

Answer

SQL injection; data exfiltration

Answer

Remote File Inclusion (RFI); arbitrary code execution

Question 12

An attacker gains access to a cloud environment and attempts to move laterally by assuming an IAM role with higher privileges. Which cloud attack vector is the attacker exploiting?

Accepted Answer

IAM misuse. IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

Answer

SSRF attack

Answer

S3 bucket misconfiguration

Answer

Container escape

Question 13

A penetration tester finds that a web application allows uploading a file with the name '../../var/www/html/shell.php'. The file is successfully written to the server. Which combination of vulnerabilities does this exploit?

Accepted Answer

Directory traversal and unrestricted file upload. Directory traversal allows moving up directories, and unrestricted file upload allows writing a PHP shell, leading to remote code execution.

Answer

Cross-Site Scripting (XSS) and CSRF

Answer

Local File Inclusion (LFI) and Remote File Inclusion (RFI)

Answer

SQL injection and command injection

Question 14

During an IoT assessment, a tester examines a smart thermostat that uses the MQTT protocol. The tester finds that the device connects to a broker without any authentication. Which of the following attacks is MOST likely to succeed?

Accepted Answer

Publishing arbitrary messages to control the device and subscribing to data topics. Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.

Answer

Firmware extraction via UART

Answer

Reversing the firmware to find hardcoded credentials

Answer

Performing a dictionary attack on the Wi-Fi PSK

Question 15

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they most likely use next to attempt to crack the PSK using a wordlist?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP/WPA keys from captured packets, including WPA2 handshakes using a dictionary attack.

Answer

John the Ripper

Answer

ScoutSuite

Answer

Reaver