CEH Practice Test 37 — 15 Questions

Question 1

During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?

Accepted Answer

Knowledge of the SNMP community string. SNMP enumeration relies on the SNMP community string, which acts as a password-like credential for read or read/write access to MIB data. Without the correct community string (defaults are often 'public' for read-only and 'private' for read-write), SNMPwalk cannot authenticate with the target agent and will fail to retrieve any OID values.

Answer

An open TCP port 161

Answer

The target must be running Linux

Answer

A valid username and password

Question 2

An organization wants to mitigate the impact of a DDoS attack that uses large volumes of UDP traffic to exhaust bandwidth. Which of the following techniques would be MOST effective?

Accepted Answer

Deploying a scrubbing center. A scrubbing center is the most effective technique because it filters out malicious UDP traffic from legitimate traffic by analyzing packet characteristics, such as source IP reputation and payload patterns, before forwarding clean traffic to the target network. This approach preserves legitimate UDP services (e.g., DNS, VoIP) while absorbing volumetric attacks, unlike simpler methods that may block all UDP or fail to scale.

Answer

Rate limiting on all ports

Answer

Blocking all UDP traffic

Answer

Implementing SYN cookies

Question 3

Which THREE of the following are valid methods for DDoS mitigation?

Accepted Answer

Rate limiting. Rate limiting is a valid DDoS mitigation method because it restricts the number of requests a server accepts from a single source within a given time window, preventing resource exhaustion. By enforcing thresholds (e.g., via iptables or application-layer rate limiters), it reduces the impact of volumetric attacks like HTTP floods without blocking legitimate traffic entirely.

Answer

Increasing server timeout values

Answer

Disabling SYN cookies

Question 4

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

Answer

UDP flood

Answer

ARP spoofing

Answer

ICMP flood

Question 5

A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)

Accepted Answer

Enable Zigbee security suite (AES-128 encryption) on all sensor devices.. Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.

Answer

Disable encryption on MQTT to reduce latency and improve performance.

Answer

Implement device authentication using pre-shared keys only for Zigbee devices.

Answer

Segment the IoT devices into a separate VLAN and restrict access with ACLs.

Question 6

Which TWO of the following are examples of application-layer DDoS attacks? (Choose two.)

Accepted Answer

Slowloris. Slowloris (B) is an application-layer DDoS attack because it opens many partial HTTP connections to a web server and keeps them alive by sending incomplete headers, exhausting the server's connection pool at Layer 7. HTTP flood (C) is also an application-layer attack because it overwhelms a web application with seemingly legitimate HTTP GET or POST requests, consuming server and application resources. By contrast, UDP flood (A) is a volumetric transport/network-layer attack that saturates bandwidth with UDP packets, SYN flood (D) exploits the TCP three-way handshake at the transport layer by leaving half-open connections, and Smurf attack (E) is an ICMP-based network-layer amplification attack using broadcast addresses.

Answer

UDP flood

Answer

SYN flood

Answer

Smurf attack

Question 7

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

Accepted Answer

Privilege escalation; gain root access. A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Answer

Information disclosure; read sensitive files

Answer

Denial of service; crash the system

Answer

Buffer overflow; execute arbitrary code

Question 8

A penetration tester uses a tool to perform a MAC flooding attack. What is the intended result of this attack?

Accepted Answer

Read all network traffic by turning the switch into a hub. A MAC flooding attack exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively turning it into a hub. This allows the attacker to capture network traffic that would normally be isolated to a specific port.

Answer

Modify the MAC address of the attacker's NIC

Answer

Cause a denial of service on the switch

Answer

Poison the ARP cache of the target hosts

Question 9

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: ]>&xxe;. The response contains the contents of /etc/passwd. This vulnerability is known as:

Accepted Answer

XML External Entity (XXE) Injection. The payload defines an external entity that reads a local file, a classic XXE (XML External Entity) injection.

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 10

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Accepted Answer

Use inline comments: 'UN/**/ION/**/SE/**/LECT'. Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

Answer

Use double URL encoding: '%25%35%35%25%34%65%25%34%39...'

Answer

Use hex encoding: '0x554e494f4e2053454c454354'

Answer

Use URL encoding: '%55%4e%49%4f%4e%20%53%45%4c%45%43%54'

Question 11

Which TWO of the following are characteristics of stored (persistent) XSS?

Accepted Answer

The malicious script is stored on the server (e.g., in a database). Stored XSS involves malicious script being permanently stored on the server (e.g., in a database) and executed whenever the stored content is accessed. It does not require a crafted link, and it can affect multiple users without direct interaction.

Answer

The attack requires the victim to click a crafted link

Answer

The payload is reflected immediately in the response

Answer

The attack only works if the victim is logged in

Question 12

Which of the following best describes the attack where an attacker uses a valid session token to impersonate a user without needing to authenticate?

Accepted Answer

Session hijacking. Session hijacking involves stealing or using a valid session token to impersonate a user, bypassing authentication.

Answer

Cross-site scripting

Answer

Phishing

Answer

Brute-force attack

Question 13

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when a server makes requests to internal resources based on user-supplied URLs.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Remote File Inclusion (RFI)

Question 14

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 15

During a penetration test, an ethical hacker runs the following command: aireplay-ng -0 5 -a 00:11:22:33:44:55 -c 66:77:88:99:AA:BB wlan0mon. What is the immediate effect of this command?

Accepted Answer

It forces the client to disconnect and reconnect, capturing the WPA handshake. The -0 flag sends deauthentication packets to force a client to reconnect, enabling capture of the WPA handshake.

Answer

It performs a WEP injection attack to generate traffic

Answer

It cracks the pre-shared key using a dictionary

Answer

It initiates a brute force attack on the WPS PIN