CEH Practice Test 38 — 15 Questions

Question 1

An analyst is analyzing a suspicious file using VirusTotal and observes that only 3 out of 60 antivirus engines detect it as malicious. The file has been submitted before but with no detections. What should the analyst conclude?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file is likely malicious and requires further analysis. A detection rate of 3 out of 60 (5%) is extremely low, but the fact that the file was previously submitted with zero detections and now has three detections indicates that the antivirus engines have updated their signatures to identify it. This pattern is consistent with a new or polymorphic malware strain that initially evaded detection but is now being recognized by a few engines. A low detection rate does not guarantee safety; it often signals a targeted or zero-day threat that requires further analysis through sandboxing or dynamic analysis.

Answer

The file is a clean file with a rare hash

Answer

The file is safe because most engines don't detect it

Answer

The file is likely a false positive

Question 2

During a penetration test, a security analyst runs the following command on a Linux system: ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//. What is the PRIMARY purpose of this command?

Accepted Answer

To perform a man-in-the-middle attack between the gateway and the target host. The command `ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//` uses ARP poisoning in remote mode to intercept traffic between the gateway (192.168.1.1) and the target host (192.168.1.100). By sending forged ARP replies to both devices, the attacker's machine becomes a man-in-the-middle, allowing it to capture, modify, or relay packets between them. The `-M arp:remote` flag specifically enables ARP poisoning for a MITM attack, not for DNS spoofing, promiscuous mode, or flooding.

Answer

To spoof the DNS responses to redirect the target to a malicious site

Answer

To sniff all traffic on the network by enabling promiscuous mode on the interface

Answer

To perform a denial-of-service attack by flooding the network with ARP replies

Question 3

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Accepted Answer

Erasing tracks. The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Answer

Spying

Answer

Executing applications

Answer

Cracking passwords

Question 4

A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?

Accepted Answer

Username enumeration. When a login endpoint returns distinguishable responses (different status codes, messages, or timing) for valid versus invalid usernames, an attacker can systematically probe the endpoint to build a list of valid accounts. This behavior is the defining characteristic of username enumeration. It is a reconnaissance technique that precedes brute-force or credential-stuffing attacks.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 5

You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?

Accepted Answer

DNS tunneling. The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS zone transfer

Question 6

Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?

Accepted Answer

A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.. The Nmap scan output shows port 3389 in a 'filtered' state, which means Nmap received no response or an ICMP unreachable error from the target. This typically indicates a firewall is blocking the probes, preventing Nmap from determining whether the port is actually open or closed. A filtered state does not confirm the port is open or closed, only that access is being obstructed.

Answer

Port 3389 is open and running a Remote Desktop service, but the service version could not be identified.

Answer

Port 3389 is closed and the target is ignoring the probe.

Answer

The target is likely a honeypot designed to simulate a Windows machine.

Question 7

Which TWO of the following are characteristics of a reflected Cross-Site Scripting (XSS) attack? (Select 2)

Accepted Answer

The attack is typically delivered through a crafted link. Reflected XSS requires user interaction (clicking a link) and does not persist on the server.

Answer

The script executes in the server-side context

Answer

The attack affects all users who visit the compromised page without any interaction

Answer

The malicious script is permanently stored on the server

Question 8

A security analyst observes a web application returning database error messages containing table names and column names in the HTTP response. Which type of SQL injection is MOST likely being exploited?

Accepted Answer

Error-based SQL injection. Error-based SQL injection is correct because the attacker deliberately causes the database to throw errors that are reflected in the HTTP response, revealing schema details like table and column names. This technique relies on verbose error messages from the DBMS (e.g., MySQL, MSSQL) to extract information directly. Unlike blind or out-of-band methods, error-based injection provides immediate feedback in the application's output.

Answer

Blind SQL injection (boolean-based)

Answer

Union-based SQL injection

Answer

Out-of-band SQL injection

Question 9

An analyst notices that a web application's login page returns a generic 'Invalid credentials' message regardless of whether the username is valid. This is an example of which security control?

Accepted Answer

Generic error messages. The login page returns a generic 'Invalid credentials' message regardless of whether the username is valid. This is a deliberate security control known as generic error messages, which prevents username enumeration by not revealing whether an account exists. By using the same message for both invalid usernames and incorrect passwords, attackers cannot easily determine valid usernames, thus reducing the attack surface for brute-force or credential-stuffing attacks.

Answer

Anti-CSRF token

Answer

Account lockout policy

Answer

Rate limiting

Question 10

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Accepted Answer

Session hijacking via cross-site scripting (XSS). The absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Clickjacking

Question 11

During a penetration test, you capture the following 4-way handshake using airodump-ng. Which tool would you use to attempt a dictionary attack to recover the WPA2 passphrase?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for performing dictionary attacks against captured WPA2 handshakes. It takes the 4-way handshake (captured in a .cap file) and a wordlist, and attempts to derive the pre-shared key (PSK) by trying each passphrase, computing the PMK, and verifying the MIC. It is specifically designed for this purpose.

Answer

Reaver

Answer

Kismet

Answer

John the Ripper

Question 12

During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Clickjacking

Answer

Cross-Site Scripting (XSS)

Question 13

An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?

Accepted Answer

Closed. When Nmap sends a TCP SYN packet to a port and receives a TCP RST packet in response, it indicates that the port is reachable but no service is listening on it. Per RFC 793, a RST is sent when a SYN arrives on a closed port, so Nmap classifies this port as 'closed'.

Answer

Filtered

Answer

Unfiltered

Answer

Open

Question 14

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Accepted Answer

Send SYN, then receive SYN-ACK, then send ACK. The TCP three-way handshake establishes a connection: SYN, SYN-ACK, ACK, then data transfer.

Answer

Send SYN-ACK, then send SYN, then send ACK

Answer

Send SYN, then send ACK, then send SYN-ACK

Answer

Send ACK, then send SYN, then send SYN-ACK

Question 15

Match each encryption algorithm to its type.

Accepted Answer

AES: Symmetric encryption. AES and 3DES are symmetric algorithms, while RSA and ECC are asymmetric. The distractors swap these types.

Answer

AES: Asymmetric encryption

Answer

RSA: Symmetric encryption