CEH Practice Test 37 — 15 Questions

Question 1

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.

Answer

Remote File Inclusion (RFI)

Answer

Command Injection

Answer

Directory Traversal

Question 2

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

Answer

Aircrack-ng

Answer

Nmap

Answer

Wireshark

Question 3

A web application uses XML to transmit data between client and server. A tester submits the following payload: ']>&xxe;'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Answer

SQL injection

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 4

A security analyst notices that a web application's search functionality returns database error messages in the response. The analyst suspects SQL injection. Which TWO techniques should the analyst use to confirm and exploit this vulnerability? (Choose TWO.)

Accepted Answer

Leverage error-based SQL injection with CONVERT() or double query. Union-based SQL injection uses UNION SELECT to retrieve data from other tables. Error-based SQL injection leverages database error messages to extract information. Both are common in-band techniques suitable when errors are displayed.

Answer

Use out-of-band SQL injection with DNS exfiltration

Answer

Use a time-based blind SQL injection with SLEEP() function

Answer

Implement parameterized queries in the application code

Question 5

During a penetration test, a tester captures the WPA2 4-way handshake with airodump-ng and then uses aircrack-ng with a wordlist. However, the PSK is not found. Which of the following is the MOST likely reason?

Accepted Answer

The wordlist does not contain the PSK. If the PSK is not in the wordlist, dictionary attacks will fail. Other steps (capture, cracking) were done correctly.

Answer

Aircrack-ng does not support WPA2 cracking

Answer

The handshake was not captured correctly

Answer

The network uses WPA3 instead of WPA2

Question 6

An organization wants to prevent directory listing on its Apache web server. Which of the following configuration changes would achieve this?

Accepted Answer

Set 'Options -Indexes' in the httpd.conf or .htaccess file. Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.

Answer

Set 'AllowOverride None'

Answer

Set 'ServerSignature Off'

Answer

Set 'DirectoryIndex disabled'

Question 7

A penetration tester discovers that a web application's login page does not enforce rate limiting and several usernames are known from a prior data breach. The tester wants to try a few common passwords across many accounts to avoid account lockouts. Which attack technique is being used?

Accepted Answer

Password spraying. Password spraying involves trying a small number of common passwords against many user accounts to avoid account lockout. This contrasts with credential stuffing (using many passwords per account) and brute force (many passwords per user).

Answer

Credential stuffing

Answer

Brute force attack

Answer

Dictionary attack

Question 8

A security team discovers that an attacker has been intercepting and modifying traffic between a client and server by impersonating both endpoints. Which type of cryptographic attack is this?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and server to intercept and modify traffic.

Answer

Replay attack

Answer

Downgrade attack

Answer

Birthday attack

Question 9

An attacker crafts a link that, when clicked by an authenticated user, performs an unintended action on a web application where the user is logged in, such as changing their email address. The application uses a session cookie for authentication but does not include any anti-forgery tokens in forms. Which attack is this?

Accepted Answer

Cross-Site Request Forgery (CSRF). The description matches Cross-Site Request Forgery (CSRF), where a malicious link triggers actions on a site where the victim is authenticated.

Answer

Cross-Site Scripting (XSS)

Answer

Clickjacking

Answer

Server-Side Request Forgery (SSRF)

Question 10

A penetration tester discovers that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is a potential impact of this vulnerability?

Accepted Answer

Access to cloud instance metadata. SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.

Answer

Cross-site scripting (XSS) in the browser

Answer

Remote code execution via command injection

Answer

SQL injection in the database

Question 11

A web application uses an XML parser to process user-supplied XML documents. An attacker submits the following payload: ]>&xxe;. Which vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. The payload defines an external entity that reads a local file, which is classic XXE (XML External Entity) injection.

Answer

Server-Side Request Forgery (SSRF)

Answer

XPath injection

Answer

SQL injection

Question 12

Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?

Accepted Answer

RDP brute-force attack. Multiple established RDP connections from different internal IPs suggest a brute-force or password-spraying attack against RDP. The established connections indicate successful authentication attempts.

Answer

SMB relay attack

Answer

DDoS attack

Answer

Man-in-the-middle attack

Question 13

An attacker performs a password spraying attack against a web application. Which of the following BEST describes this technique?

Accepted Answer

Trying a few common passwords against many accounts. Password spraying uses a few common passwords against many accounts to avoid account lockout.

Answer

Using a list of compromised credentials from a data breach

Answer

Trying many passwords for a single account

Answer

Using automated tools to bypass CAPTCHA

Question 14

A penetration tester uses SQLMap with the option '--technique=T --dbms=MySQL --level=5 --risk=3' against a login form. The tool returns results after a delay of several seconds per request. Which SQL injection technique is being used?

Accepted Answer

Time-based blind SQL injection. The 'T' in --technique stands for Time-based blind SQL injection. The delay indicates time-based injection where the database sleeps to cause a response delay.

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Question 15

During a penetration test, a tester uses the following payload in a search field: . The payload is reflected in the response without sanitization. However, the tester notices that the attack only works when the payload is submitted via a POST request, not GET. Which type of XSS is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the payload is reflected immediately in the response. The fact that it works via POST but not GET does not change the classification; it is still reflected XSS because the payload is not stored on the server. Some reflected XSS may be triggered only via POST parameters.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Self-XSS