CEH Practice Test 36 — 15 Questions

Question 1

A security analyst receives an email from what appears to be the company's CEO requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ce0@company.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Whaling. Whaling specifically targets high-profile individuals like executives. The spoofed email address and urgent request for a wire transfer are classic indicators of a whaling attack.

Answer

Vishing

Answer

Phishing

Answer

Spear phishing

Question 2

During a ransomware incident response, a forensic analyst recovers a suspicious file that appears to be a PE executable. The analyst wants to quickly check if the file is known malware without executing it. Which of the following is the BEST first step?

Accepted Answer

Submit the file hash to VirusTotal. VirusTotal aggregates many antivirus engines and provides a quick reputation check. Submitting the file hash (or the file itself) is non-invasive and immediately reveals known malicious indicators.

Answer

Disassemble the file using IDA Pro

Answer

Perform static analysis using PEiD to identify compiler and packer

Answer

Run the file in a sandbox and observe its behavior

Question 3

An analyst runs the following command: `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap`. What is the primary purpose of this command?

Accepted Answer

To capture only HTTP traffic from a specific source IP and save it to a file. The command captures packets from source IP 192.168.1.10 with destination port 80 (HTTP) and writes them to a file for later analysis.

Answer

To perform a man-in-the-middle attack on HTTP traffic

Answer

To capture all traffic on eth0 and display it in real-time

Answer

To analyze the payload of HTTP packets in real-time

Question 4

Which TWO of the following are types of malware analysis? (Select two.)

Accepted Answer

Static analysis. Static analysis examines the file without executing it (e.g., examining strings, headers). Dynamic analysis executes the malware in a controlled environment (sandbox) to observe behavior.

Answer

Memory analysis

Answer

Signature analysis

Answer

Heuristic analysis

Question 5

A security analyst notices that users receive emails from a known vendor requesting urgent payment to a new bank account. The email domain is misspelled (e.g., vvendorfake.com). Which type of social engineering is this?

Accepted Answer

Spear phishing. Spear phishing targets specific individuals or organizations with personalized content. The misspelled domain and urgency are classic spear phishing indicators.

Answer

Whaling

Answer

Phishing

Answer

Vishing

Question 6

An attacker gains physical access to a restricted area by following an authorized employee through a secured door without swiping a badge. This technique is known as:

Accepted Answer

Tailgating. Tailgating (or piggybacking) is when an unauthorized person follows an authorized person into a restricted area without proper authentication.

Answer

Pretexting

Answer

Quid pro quo

Answer

Baiting

Question 7

An attacker uses the Social Engineering Toolkit (SET) to clone a legitimate website and send a malicious link to employees. When an employee clicks the link, they are prompted to enter their credentials. Which attack is this?

Accepted Answer

Phishing. Phishing involves sending fraudulent communications that appear to come from a reputable source, often via email, to steal credentials. SET is commonly used for phishing campaigns.

Answer

SMiShing

Answer

Spear phishing

Answer

Vishing

Question 8

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

Accepted Answer

Polymorphic virus. Polymorphic viruses change their code signature (using mutation engines) each replication to avoid detection.

Answer

Boot sector virus

Answer

Macro virus

Answer

Worm

Question 9

A system administrator receives a phone call from someone claiming to be from IT support, asking for the administrator's password to 'fix a server issue'. This is an example of which social engineering attack?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain sensitive information, such as a password. The caller pretends to be IT support to trick the victim.

Answer

Vishing

Answer

Baiting

Answer

Phishing

Question 10

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

Accepted Answer

UDP flood. A UDP flood is a volumetric attack that sends many UDP packets to random ports, overwhelming the target's ability to process them.

Answer

ICMP flood

Answer

SYN flood

Answer

Smurf attack

Question 11

Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?

Accepted Answer

Wireshark. Wireshark is the standard tool for capturing and analyzing network packets in pcap format.

Answer

Ettercap

Answer

tcpdump

Answer

Nmap

Question 12

A security analyst reviews a sandbox report for a suspicious executable. The report shows that the executable modified the Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to add a new entry pointing to itself. This action is characteristic of which type of malware?

Accepted Answer

Backdoor Trojan. A backdoor Trojan often persists by adding itself to startup registry keys to maintain access. The other options are incorrect: logic bombs activate under specific conditions, adware displays ads, and ransomware typically demands payment.

Answer

Logic bomb

Answer

Ransomware

Answer

Adware

Question 13

An attacker sends an email that appears to come from the CEO of the company, requesting an urgent wire transfer to a specific account. This is an example of which social engineering attack?

Accepted Answer

Whaling. Whaling targets high-profile individuals like CEOs with personalized phishing emails. Spear phishing also targets specific individuals but not necessarily executives.

Answer

Spear phishing

Answer

Phishing

Answer

Pretexting

Question 14

A network administrator notices unusual traffic patterns: the internal DNS server is receiving large DNS queries with the source IP spoofed to appear as the internal DNS server itself. The queries appear to be amplification requests. Which TWO characteristics describe this attack?

Accepted Answer

It relies on open DNS resolvers to amplify traffic. DNS amplification uses spoofed source IP and open resolvers to amplify traffic. The large response overwhelms the victim. It is a type of DDoS, not a protocol attack like SYN flood.

Answer

It is a protocol-specific attack targeting TCP SYN packets

Answer

It exploits the ARP protocol to redirect traffic

Answer

It requires the attacker to be on the same subnet as the victim

Question 15

An organization wants to mitigate the impact of a DDoS attack by distributing incoming traffic across multiple servers in different geographic locations. Which technique is BEST suited?

Accepted Answer

Anycast. Anycast routing allows traffic to be directed to the nearest or best-performing server among multiple locations, helping absorb DDoS traffic.

Answer

Scrubbing center

Answer

Rate limiting

Answer

Load balancing