CEH Practice Test 39 — 15 Questions

Question 1

A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?

Accepted Answer

To mitigate cross-site request forgery (CSRF) attacks. SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.

Answer

To enforce HTTPS for cookie transmission

Answer

To prevent the cookie from being accessed by JavaScript

Answer

To ensure the cookie is only sent over HTTP and not FTP

Question 2

Which of the following is a common defense against clickjacking attacks?

Accepted Answer

Content Security Policy (CSP) with 'frame-ancestors' directive. Clickjacking attacks trick users into clicking on a hidden or disguised element on a page that is embedded in a malicious frame. The Content Security Policy (CSP) directive 'frame-ancestors' is a modern and effective defense against clickjacking. It allows the server to specify which origins are permitted to embed the page in frames, providing granular control. For example, 'frame-ancestors none' blocks all embedding, while 'frame-ancestors self' allows same-origin framing only. This directive supersedes the older X-Frame-Options header, which only supports DENY or SAMEORIGIN and is less flexible. Therefore, CSP with 'frame-ancestors' is the correct choice among the given options.

Answer

CSRF tokens

Answer

SameSite cookies

Answer

Input validation

Question 3

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Setting SameSite cookies to Lax or Strict. CSRF tokens ensure the request originates from the legitimate site; SameSite cookies prevent the browser from sending cookies on cross-site requests.

Answer

Input validation

Answer

Using CAPTCHA

Answer

Using HTTPS only

Question 4

Which THREE of the following are common indicators of a Server-Side Request Forgery (SSRF) vulnerability? (Select 3)

Accepted Answer

The server returns data from internal services like http://localhost/ or http://192.168.x.x/. SSRF often involves requests to internal IPs or services, use of URL schemas like file://, and responses including internal data.

Answer

The application reflects user input in the page source without encoding

Answer

The server responds with a different delay when a URL is provided versus a non-URL input

Question 5

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 6

A web application tester encounters a parameter that is reflected in the response without sanitization. The tester suspects XSS. Which TWO types of XSS could be present in this scenario? (Choose TWO.)

Accepted Answer

DOM-based XSS. Reflected XSS occurs when the input is immediately reflected in the response. DOM-based XSS occurs when client-side JavaScript processes the input unsafely. Stored XSS requires data to be saved on the server, which is not indicated here.

Answer

Self-XSS

Answer

Stored (persistent) XSS

Answer

Blind XSS

Question 7

A penetration tester is assessing a web application and notices that the application reflects the User-Agent header in the response body without sanitization. What attack could be performed using this behavior?

Accepted Answer

Cross-Site Scripting (XSS). Reflecting unsanitized input in HTTP headers can lead to reflected XSS.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 8

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Answer

Union-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

Error-based SQL injection

Question 9

A security team discovers that an S3 bucket configured for static website hosting is exposing sensitive documents. The bucket policy allows public read access. Which AWS misconfiguration is MOST likely present?

Accepted Answer

The bucket policy allows s3:GetObject for all principals. Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.

Answer

The bucket versioning is disabled

Answer

The bucket is not using server-side encryption

Answer

The bucket ACL grants write access to authenticated users

Question 10

In the cloud shared responsibility model, which of the following is typically the responsibility of the customer when using AWS EC2 (IaaS)?

Accepted Answer

Configuring security groups and firewall rules. AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

Answer

Patching the hypervisor

Answer

Network infrastructure redundancy

Answer

Physical security of data centers

Question 11

Which THREE of the following are cryptanalysis attacks that target hash functions? (Choose three.)

Accepted Answer

Preimage attack. Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.

Answer

Man-in-the-middle attack

Answer

Dictionary attack

Question 12

Which of the following is a cryptographic attack that exploits collisions in hash functions?

Accepted Answer

Birthday attack. A birthday attack exploits the birthday paradox to find two different inputs that produce the same hash output (collision).

Answer

Dictionary attack

Answer

Downgrade attack

Answer

Replay attack

Question 13

Which TWO of the following are common tools used for web application security testing? (Choose 2)

Accepted Answer

Burp Suite. Burp Suite and OWASP ZAP are both widely used web application security testing tools.

Answer

Wireshark

Answer

Nessus

Answer

Metasploit

Question 14

In the shared responsibility model for cloud computing, which of the following is typically the customer's responsibility?

Accepted Answer

Configuration of IAM roles and permissions. The customer is responsible for security IN the cloud, including configuring IAM policies, encryption, and access controls.

Answer

Physical security of data centers

Answer

Hypervisor security

Answer

Network infrastructure security

Question 15

During a penetration test, a tester finds a web application that reflects user input in the page without sanitization. Which TWO types of XSS are potentially exploitable in this scenario?

Accepted Answer

DOM-based XSS. Reflected XSS occurs when input is immediately returned in the response. DOM-based XSS occurs when client-side scripts process input unsafely. Stored XSS requires persistence on the server, which is not indicated.

Answer

Blind XSS

Answer

Self-XSS

Answer

Stored (persistent) XSS