CEH Practice Test 36 — 15 Questions

Question 1

In the shared responsibility model for cloud computing, which of the following is typically the customer's responsibility?

Accepted Answer

Configuration of IAM roles and permissions. The customer is responsible for security IN the cloud, including configuring IAM policies, encryption, and access controls.

Answer

Physical security of data centers

Answer

Hypervisor security

Answer

Network infrastructure security

Question 2

During a penetration test, a tester finds a web application that reflects user input in the page without sanitization. Which TWO types of XSS are potentially exploitable in this scenario?

Accepted Answer

DOM-based XSS. Reflected XSS occurs when input is immediately returned in the response. DOM-based XSS occurs when client-side scripts process input unsafely. Stored XSS requires persistence on the server, which is not indicated.

Answer

Blind XSS

Answer

Self-XSS

Answer

Stored (persistent) XSS

Question 3

Which THREE of the following are common indicators of an SQL injection attack? (Choose 3.)

Accepted Answer

Unexpected rows or columns in query results. SQL injection attacks commonly cause unexpected rows or columns in query results due to manipulated queries, unusually slow database responses from resource-intensive operations like UNION or subqueries, and database error messages that reveal syntax or structure to the attacker. Frequent 302 redirects and many failed connection attempts are not typical or specific indicators of SQL injection.

Answer

Frequent 302 redirects to login pages

Answer

Multiple failed connection attempts in server logs

Question 4

A security engineer is reviewing web server logs and finds the following request: GET /files/../../../etc/passwd HTTP/1.1. Which THREE attacks could be associated with this request? (Choose THREE.)

Accepted Answer

Directory traversal. The request uses path traversal to access /etc/passwd (directory traversal/LFI). It can be used for file disclosure, and if the file is included in a script, it could be LFI. Command injection is not related.

Answer

SQL injection

Answer

Command injection

Question 5

Refer to the exhibit. A penetration tester runs hashcat to crack NTLM hashes. Which hash mode (-m) would be correct for NTLM?

Accepted Answer

1000. NTLM hash mode is 1000. The exhibit shows -m 1000, which is correct for NTLM.

Answer

1100

Answer

3000

Answer

5500

Question 6

Which THREE of the following are effective mitigation techniques against Cross-Site Scripting (XSS) attacks?

Accepted Answer

Output encoding. Input validation ensures malicious characters are rejected. Output encoding converts special characters to safe HTML entities. Content Security Policy (CSP) restricts script sources. Disabling JavaScript is not practical. Using HTTPS protects data in transit but not against XSS.

Answer

Disabling JavaScript in the client browser

Answer

Using HTTPS for all communications

Question 7

Which of the following is a hashing algorithm that produces a 160-bit (20-byte) hash value?

Accepted Answer

SHA-1. SHA-1 produces a 160-bit hash. MD5 produces 128 bits, SHA-256 produces 256 bits, and SHA-512 produces 512 bits.

Answer

MD5

Answer

SHA-256

Answer

SHA-512

Question 8

Which of the following tools is specifically designed for auditing cloud environments (AWS, Azure, GCP) for security misconfigurations?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for common misconfigurations.

Answer

John the Ripper

Answer

Aircrack-ng

Answer

Reaver

Question 9

Which TWO of the following are common attack vectors against IoT devices? (Select TWO.)

Accepted Answer

Default credentials left unchanged. IoT devices often have default credentials that are not changed, and they use insecure protocols like MQTT without encryption. These are common entry points for attackers.

Answer

Regular firmware updates

Answer

Use of strong encryption protocols

Answer

Use of certificate-based authentication

Question 10

Which of the following is an example of passive OS fingerprinting?

Accepted Answer

Analyzing TTL values from captured packets. Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.

Answer

Performing a TCP SYN scan

Answer

Nmap -O scan

Answer

Sending ICMP echo requests

Question 11

Match each vulnerability assessment tool to its function.

Accepted Answer

Nmap: Network port scanning and service detection. Correct matches: Nmap for network scanning, Nessus for vulnerability assessment, Metasploit for exploitation. Common confusions involve swapping scanning and vulnerability roles.

Answer

Nmap: Vulnerability scanning and risk assessment

Answer

Nessus: Network port scanning and service detection

Answer

OpenVAS: Packet capture and analysis

Question 12

Match each wireless attack to its description.

Accepted Answer

Evil Twin: A rogue access point that mimics a legitimate one to capture credentials. Correct matches: Evil Twin (A), Rogue AP (C), War Driving (F) are correctly paired. WEP Cracking (D is swapped with War Driving; B and E are misidentified).

Answer

War Driving: Exploiting weaknesses in WEP encryption to gain access

Answer

WEP Cracking: Driving around to detect wireless networks and gather information

Answer

Evil Twin: An unauthorized access point installed on a network without permission

Question 13

Match each CEH phase to its key activity.

Accepted Answer

Reconnaissance: Passive information gathering. The five phases of ethical hacking (as per EC-Council) are Reconnaissance, Scanning & Enumeration, Gaining Access, Maintaining Access, and Clearing Tracks. In this set, options A-D correctly match phases to their key activities, while options E and F are distractors with swapped definitions.

Answer

Reconnaissance: Active scanning of target network

Answer

Clearing Tracks: Gaining initial access

Question 14

Match each security tool to its primary purpose.

Accepted Answer

Nmap: Network discovery and security scanning. The correct matches are: Nmap for network scanning, Wireshark for packet analysis, Metasploit for exploitation, and Burp Suite for web app testing. Common confusions arise from swapping definitions between tools with overlapping functionalities.

Answer

Nmap: Exploit development and execution framework

Answer

Metasploit: Network packet capture and analysis

Question 15

During a penetration test, a tester runs enum4linux against a Windows server and receives the following output: 'S-1-5-21-3623811015-3361044348-30300820-500' and 'S-1-5-21-3623811015-3361044348-30300820-501'. Which TWO conclusions can be drawn from this output?

Accepted Answer

The Guest account SID was enumerated. The SID ending in -500 is the well-known RID for the built-in Administrator account, and the SID ending in -501 is the RID for the built-in Guest account. Enum4linux enumerates user SIDs from the SAM database via SMB null sessions, confirming that both the Administrator and Guest account SIDs were retrieved. Therefore, options B and C are correct.

Answer

The Guest account is enabled

Answer

The server is a domain controller

Answer

Password policy was retrieved