CEH Practice Test 38 — 15 Questions

Question 1

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Accepted Answer

Intruder. Intruder is designed for automated customized attacks including brute-force, fuzzing, and credential stuffing.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 2

Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nmap scan

Answer

WHOIS lookup

Answer

Shodan search

Question 3

Which of the following is a primary defense against SQL injection attacks?

Accepted Answer

Prepared statements. Prepared statements with parameterized queries ensure user input is treated as data, not executable SQL code.

Answer

HTTPS encryption

Answer

Input blacklisting

Answer

Output encoding

Question 4

Which cloud security assessment tool is specifically designed to audit AWS environments for misconfigurations and provides a detailed report of findings?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations. It generates a comprehensive HTML report. Pacu is an exploitation framework, not an audit tool.

Answer

Pacu

Answer

Metasploit

Answer

Nmap

Question 5

Which of the following Burp Suite tools is used to automatically fuzz web application inputs and identify common vulnerabilities like SQL injection and XSS?

Accepted Answer

Intruder. Burp Intruder is a tool for automating customized attacks against web applications, including fuzzing for vulnerabilities.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 6

A web developer wants to mitigate CSRF attacks. Which of the following configurations for cookies is most effective when combined with CSRF tokens?

Accepted Answer

SameSite=Strict. SameSite=Strict prevents the browser from sending cookies for cross-site requests, which blocks CSRF attacks.

Answer

HttpOnly flag

Answer

Domain attribute

Answer

Secure flag

Question 7

Which cryptographic algorithm is vulnerable to a birthday attack on its hash output size of 128 bits, reducing the effective security to 64 bits against collision resistance?

Accepted Answer

MD5. MD5 produces 128-bit hashes. Birthday attack complexity for collision is 2^(n/2) = 2^64 for n=128. SHA-1 is 160-bit, SHA-256 is 256-bit, RC4 is a stream cipher not a hash.

Answer

SHA-256

Answer

SHA-1

Answer

RC4

Question 8

An attacker wants to perform a CSRF attack against a banking application. The application uses SameSite cookies set to 'Strict'. The attacker hosts a malicious page on their own domain. When the victim visits the malicious page, which of the following statements is TRUE regarding the CSRF attack?

Accepted Answer

The attack will fail because the browser will not include the session cookie with the cross-origin request.. SameSite=Strict prevents cookies from being sent on cross-site requests, effectively blocking CSRF attacks if the attacker cannot control the origin.

Answer

The attack will succeed because cookies are sent regardless of SameSite settings.

Answer

The attack will succeed because the attacker can bypass SameSite using GET requests.

Answer

The attack will fail because CSRF requires POST requests and the malicious page only uses GET.

Question 9

What is the primary purpose of the 4-way handshake in WPA/WPA2-Personal?

Accepted Answer

To establish encryption keys without transmitting the pre-shared key. The 4-way handshake confirms that both client and AP possess the pre-shared key (PSK) without exposing it, and generates temporal keys for encryption.

Answer

To authenticate the user with a username and password

Answer

To synchronize the beacon intervals between client and AP

Answer

To exchange digital certificates between client and AP

Question 10

Match each type of attack to its description.

Accepted Answer

Phishing: A broad term for social engineering attacks that use fraudulent emails or websites to trick individuals into revealing sensitive information.. The correct matches are Phishing with its broad definition, Spear Phishing with targeted definition, and Whaling with high-profile target definition. Common confusions: Vishing is voice-based, Smishing is SMS-based; also targeted phishing is spear phishing.

Answer

Vishing: A targeted form of phishing directed at a specific individual.

Answer

Smishing: Voice phishing using phone calls.

Question 11

A security engineer wants to ensure that a wireless network uses the most secure encryption available. Which of the following should be configured on the access point?

Accepted Answer

WPA3. WPA3 is the latest Wi-Fi security standard, providing stronger encryption (GCMP-256) and protection against dictionary attacks via SAE.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with AES

Question 12

Which TWO of the following are effective defenses against CSRF attacks? (Choose 2.)

Accepted Answer

Using anti-CSRF tokens that are validated on the server. CSRF tokens and SameSite cookies both prevent cross-site request forgery. Double Submit Cookie is also a method but not listed. Custom headers are not a standard defense; the primary ones are CSRF tokens and SameSite cookies.

Answer

Setting the Secure flag on cookies

Answer

Using input validation to block special characters

Answer

Enabling the HttpOnly flag on session cookies

Question 13

A penetration tester uses the following command to attack a WPS-enabled AP: 'reaver -i mon0 -b 00:11:22:33:44:55 -vv'. What is the primary goal of this attack?

Accepted Answer

Obtain the WPS PIN and subsequently the WPA2 PSK. Reaver is used to brute force the WPS PIN, recovering the PIN and ultimately the WPA2 PSK.

Answer

Perform a de-authentication attack on all clients

Answer

Capture a WPA2 4-way handshake for offline cracking

Answer

Scan for hidden SSIDs in the area

Question 14

A security engineer analyzes a cloud environment and finds that an S3 bucket named 'company-backups' is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. Which of the following is the MOST likely risk?

Accepted Answer

An attacker can read any object in the bucket without authentication. A bucket policy allowing anonymous GetObject makes all objects publicly readable, leading to data exposure.

Answer

An attacker can modify the bucket policy

Answer

An attacker can delete objects in the bucket

Answer

An attacker can enumerate all objects in the bucket

Question 15

An attacker uses Reaver against a Wi-Fi network. What vulnerability is the attacker primarily exploiting?

Accepted Answer

WPS PIN vulnerability. Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.

Answer

Weak WPA2 passphrase

Answer

Deauthentication attack

Answer

IV weakness in WEP