CEH Practice Test 36 — 15 Questions

Question 1

A security team deployed a web application firewall (WAF) that blocks requests containing SQL keywords like 'SELECT', 'UNION', and 'DROP'. An attacker bypasses the WAF by encoding the payload in base64 and using a SQL injection tool that decodes it server-side. Which mitigation would be MOST effective against this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement prepared statements with parameterized queries. Prepared statements (parameterized queries) prevent SQL injection by separating query structure from data, regardless of encoding. WAF bypasses are mitigated by using proper coding practices.

Answer

Increase WAF sensitivity to block base64-encoded strings

Answer

Disable error messages to hide database errors

Answer

Use a more restrictive input validation regex

Question 2

A security analyst observes repeated de-authentication packets targeting clients on a corporate Wi-Fi network. What is the MOST likely goal of the attacker?

Accepted Answer

To capture the WPA2 4-way handshake for offline password cracking. De-authentication attacks force clients to reconnect, allowing the attacker to capture the 4-way handshake for offline cracking of the PSK.

Answer

To perform a denial-of-service attack and disrupt all wireless connectivity

Answer

To install malware on the client devices

Answer

To exploit a vulnerability in the RADIUS server

Question 3

A security analyst notices that a web application's SSL/TLS certificate is issued by a CA that is not trusted by modern browsers. Which type of attack could this enable?

Accepted Answer

Man-in-the-middle attack. Using a self-signed or untrusted CA certificate can allow an attacker to perform a man-in-the-middle attack by presenting their own certificate that the browser may accept with user warning.

Answer

Downgrade attack

Answer

Birthday attack

Answer

Replay attack

Question 4

A web application uses user input in the following PHP code: include($_GET['page'] . '.php');. An attacker submits the URL: http://example.com/index.php?page=../../../../etc/passwd%00. Which two vulnerabilities are being attempted?

Accepted Answer

LFI and null byte injection. The attacker is using '../' for directory traversal to access files outside the web root, and a null byte injection (%00) to truncate the '.php' extension. This targets LFI (local file inclusion) via directory traversal.

Answer

RFI and command injection

Answer

SQL injection and XSS

Answer

Directory traversal and IDOR

Question 5

A web application allows users to upload profile pictures. An attacker uploads a file named "profile.php" containing malicious PHP code. When the attacker visits the uploaded file's URL, the code executes. Which vulnerability is being exploited?

Accepted Answer

File upload vulnerability. The application fails to validate the file type or restrict execution, allowing a malicious PHP file to be uploaded and executed on the server, which is a classic file upload vulnerability leading to remote code execution.

Answer

Directory traversal

Answer

Command injection

Answer

Stored XSS

Question 6

In a cloud environment, which of the following is an example of a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker exploits a web application to send HTTP requests from the server to an internal metadata endpoint. SSRF occurs when an attacker tricks the server into making requests to internal resources, such as a cloud metadata service, to obtain credentials.

Answer

An attacker intercepts traffic between a load balancer and backend servers

Answer

An attacker uses a SQL injection to extract database contents

Answer

An attacker uploads a malicious file to an S3 bucket that executes code on the server

Question 7

A company wants to ensure that data in transit between its IoT devices and the cloud server is encrypted. Which protocol combination is BEST suited for this purpose?

Accepted Answer

MQTT with TLS. The best choice for encrypting data in transit between IoT devices and a cloud server is MQTT with TLS. MQTT is a lightweight, publish-subscribe protocol ideal for IoT, and TLS provides robust encryption. While CoAP with DTLS is also secure, it is typically used for constrained device-to-device communication, not as the primary protocol for cloud connectivity. HTTP with SSL is too heavy for many IoT devices, and MQTT without encryption lacks security. Therefore, MQTT with TLS is the optimal combination.

Answer

MQTT without encryption

Answer

HTTP with SSL

Answer

CoAP with DTLS

Question 8

During a web application test, a penetration tester intercepts a request using Burp Suite Proxy, modifies the 'Referer' header, and resends the request. The application processes the request despite the modified header. Which attack is the tester attempting to validate?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF (Cross-Site Request Forgery) attacks often rely on the Referer header for validation. By modifying it, the tester checks if the application validates the header. If the request is processed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 9

Match each footprinting technique to its description.

Accepted Answer

DNS interrogation: Extracting DNS records to discover network information. The correct matches are: DNS interrogation extracts DNS records, WHOIS lookup queries domain databases, Google hacking uses search operators, and social engineering manipulates people. Common confusions include swapping ping sweep (ICMP probing) with DNS interrogation or Google hacking.

Answer

Ping sweep: Using search operators to find sensitive information

Answer

DNS interrogation: Identifying live hosts by sending ICMP requests

Question 10

A security team is implementing measures to prevent cross-site request forgery (CSRF) attacks. Which of the following is the most effective mitigation technique?

Accepted Answer

Implementing CSRF tokens. CSRF tokens are unique, unpredictable values that must be included in state-changing requests, ensuring the request originated from the legitimate site.

Answer

Enabling SSL/TLS

Answer

Using HTTP GET for all form submissions

Answer

Using input validation

Question 11

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Accepted Answer

Stored XSS. The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Self-XSS

Question 12

Which of the following is the primary purpose of using a CSRF token in a web application?

Accepted Answer

Prevent cross-site request forgery. CSRF tokens are unique, unpredictable values embedded in forms or requests that validate the request originated from the legitimate application, preventing cross-site request forgery attacks.

Answer

Prevent session hijacking

Answer

Prevent XSS

Answer

Prevent SQL injection

Question 13

A security analyst runs the following command: 'wget http://example.com/bucket?list-type=2' and receives a listing of objects. Which cloud misconfiguration is this MOST likely exploiting?

Accepted Answer

Publicly accessible S3 bucket with list permissions enabled. An S3 bucket with public listing enabled allows anyone to list objects via HTTP GET requests.

Answer

SSRF vulnerability in the cloud application

Answer

Container escape vulnerability

Answer

Misconfigured IAM roles allowing privilege escalation

Question 14

Which of the following cryptographic hash functions is known to be vulnerable to collision attacks and should be avoided for security applications?

Accepted Answer

MD5. MD5 is known to be vulnerable to collision attacks, making it unsuitable for security applications like digital signatures.

Answer

RIPEMD-160

Answer

SHA-256

Answer

SHA-1

Question 15

An IoT device uses the MQTT protocol without TLS. An attacker on the same network captures messages and publishes a fake temperature reading. Which attack is being executed?

Accepted Answer

Man-in-the-middle attack. MQTT over plain TCP allows message interception and injection (man-in-the-middle) because no encryption or authentication is enforced.

Answer

Replay attack

Answer

Firmware reversing attack

Answer

Denial of service attack