CEH Practice Test 39 — 15 Questions

Question 1

A penetration tester is tasked with performing privilege escalation on a Windows system. Which THREE of the following methods are commonly used for Windows privilege escalation? (Select 3)

Accepted Answer

Token impersonation (e.g., SeImpersonatePrivilege). Token impersonation (B) is a classic Windows privilege escalation technique: if a service account holds SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege), tools like JuicyPotato, RoguePotato, or PrintSpoofer can impersonate a SYSTEM token to gain elevated privileges. Exploiting unquoted service paths (C) works because Windows resolves unquoted paths containing spaces by trying each possible executable name in order, so a low-privileged user who can write to an earlier directory in the path can plant a malicious binary that runs as the service account (often SYSTEM). Exploiting weak service permissions (E) is also valid on Windows, since misconfigured service DACLs allowing SERVICE_CHANGE_CONFIG or WRITE_DAC let an attacker reconfigure the service binary path or replace its executable to run code as the service's privileged account. SUID bit abuse (A) is a Linux/Unix mechanism and does not exist on Windows filesystems, and pass-the-hash (D), while a Windows credential-reuse attack, is a lateral movement/authentication technique rather than a local privilege escalation method, so neither belongs here.

Answer

SUID bit abuse

Answer

Pass-the-hash attack

Question 2

A security auditor runs SNMPwalk against a network device using the default community string 'public' and obtains extensive system information. Which THREE of the following are effective countermeasures to prevent unauthorized SNMP enumeration?

Accepted Answer

Implement an access control list (ACL) limiting SNMP access to management hosts. Option B is correct because an ACL restricting SNMP access to specific management host IP addresses prevents unauthorized hosts from querying the SNMP agent, blocking enumeration from untrusted sources. Option D is correct because changing the default 'public' community string to a complex, non-guessable value removes the trivially known credential that allowed the auditor's SNMPwalk to succeed. Option E is correct because SNMPv3 with authentication (authNoPriv/authPriv) and encryption (priv) eliminates cleartext community-string authentication and provides cryptographic verification of users, preventing unauthorized enumeration. Option A, while it would stop SNMP enumeration, is not an effective general countermeasure since it disables legitimate management/monitoring functionality rather than securing it. Option C is incorrect because 'private' is itself a well-known default community string and using it for read-only access still leaves the device vulnerable to trivial enumeration.

Answer

Disable SNMP entirely on all devices

Answer

Set the community string to 'private' for read-only access

Question 3

A security team is investigating a compromised Linux server. They suspect the attacker used privilege escalation via SUID binaries. Which THREE techniques should the team check as potential attack vectors? (Choose THREE.)

Accepted Answer

Injecting a malicious shared library via LD_PRELOAD into a SUID binary. Option A is correct because LD_PRELOAD can be abused to inject a malicious shared library into a SUID binary, causing the library's code to run with the binary's elevated privileges (though modern loaders ignore LD_PRELOAD for SUID binaries unless the binary is misconfigured or the library path is otherwise trusted). Option C is correct because SUID shell scripts are inherently dangerous: the shell may honor user-controlled environment variables such as PATH, IFS, or command names, letting an attacker execute arbitrary commands with the script's effective UID. Option E is correct because legitimate SUID binaries like nmap (with --interactive) or find (via -exec) can be abused to spawn a shell or run commands as root, a classic GTFOBins privilege-escalation vector. Option B is incorrect because SeDebugPrivilege and token impersonation are Windows access-token concepts, not Linux SUID mechanisms. Option D is incorrect because a DDoS attack targets availability and does not escalate privileges on the compromised Linux host.

Answer

Using token impersonation with SeDebugPrivilege

Answer

Performing a DDoS attack on the server

Question 4

Which TWO of the following are examples of social engineering attacks? (Select two)

Accepted Answer

Pretexting. Pretexting (B) is a social engineering attack because the attacker fabricates a believable scenario or false identity (a 'pretext') to manipulate a human target into divulging information or performing an action, exploiting trust rather than technical flaws. Vishing (E) is also social engineering, as it uses voice communication—typically a phone call or VoIP—to impersonate a trusted party and trick the victim into revealing credentials, payment data, or other sensitive information. The remaining options are technical attacks, not social engineering: pharming (A) redirects users to fraudulent websites via DNS poisoning or host file modification, SYN flood (C) is a network-layer denial-of-service attack abusing the TCP three-way handshake, and brute force (D) is a cryptographic or authentication attack that systematically tries keys or passwords.

Answer

Pharming

Answer

SYN flood

Answer

Brute force attack

Question 5

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Accepted Answer

Static analysis using strings and PEiD. Static analysis using tools like strings and PEiD should be performed first to quickly inspect the file's metadata, embedded strings, and packer information without executing it. Since the digital signature validation fails despite claiming to be from Microsoft, static analysis can reveal anomalies such as unusual section names, suspicious imports, or packed code that indicate tampering. This non-execution approach is safe and efficient for initial triage, avoiding the risks of dynamic analysis or running the file.

Answer

Upload to VirusTotal

Answer

Dynamic analysis in a sandbox

Answer

Run the file on a production system to observe behavior

Question 6

Which TWO of the following correctly describe aspects of the shared responsibility model in cloud computing?

Accepted Answer

The customer is responsible for securing data stored in the cloud. In the shared responsibility model, the customer is responsible for security IN the cloud (e.g., data, application configurations, identity management) while the provider is responsible for security OF the cloud (e.g., physical security, network infrastructure). Option C is correct because customers must secure their stored data. Option E is correct because providers secure data center physical access. Option A is incorrect: the cloud provider does not manage customer encryption keys; that is the customer's responsibility. Option B is incorrect: in PaaS, the provider manages the network firewall; the customer manages application-level security only. Option D is incorrect: in IaaS, the customer patches the guest OS; the provider patches the hypervisor and physical infrastructure.

Answer

The cloud provider is responsible for managing customer application encryption keys

Answer

The customer is responsible for network firewall configuration in PaaS

Answer

The cloud provider is responsible for patching the guest operating system in IaaS

Question 7

Which TWO of the following are characteristics of symmetric encryption? (Select two)

Accepted Answer

Uses a single shared key for encryption and decryption. Option A is correct because symmetric encryption is defined by the use of one single shared secret key that both encrypts and decrypts the data, unlike asymmetric algorithms that use a key pair. Option B is correct because symmetric ciphers such as AES and 3DES perform far fewer computationally expensive operations than asymmetric algorithms like RSA or ECC, making them significantly faster and better suited for bulk data encryption. Option C is incorrect because it reverses the actual performance relationship; symmetric encryption is faster, not slower, than asymmetric encryption. Option D is incorrect because non-repudiation requires a private key known only to one party, which is a property of asymmetric cryptography, not shared-key symmetric encryption. Option E is incorrect because a public/private key pair describes asymmetric encryption, whereas symmetric encryption relies on a single shared key.

Answer

Slower than asymmetric encryption

Answer

Provides non-repudiation

Answer

Uses a pair of public and private keys

Question 8

Which tool would an ethical hacker use to automatically generate a malicious USB drive that, when plugged in, executes a payload and connects back to the attacker?

Accepted Answer

USB Rubber Ducky. The USB Rubber Ducky is a keystroke injection tool that appears as a keyboard to the host computer. When plugged in, it automatically types a pre-programmed payload at high speed, which can download and execute a reverse shell or other malware, establishing a connection back to the attacker. This makes it the correct choice for automatically generating a malicious USB drive that executes a payload upon insertion.

Answer

Wireshark

Answer

Ettercap

Answer

Metasploit

Question 9

A security analyst receives an alert about a workstation repeatedly sending large volumes of ICMP echo request packets to a broadcast address. Which type of attack is this indicative of?

Accepted Answer

Smurf attack. A Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets sent to a network broadcast address. The source IP is spoofed to be the victim's address, causing all hosts on the broadcast network to reply to the victim, overwhelming it with ICMP echo replies. This matches the alert description of large volumes of ICMP echo requests to a broadcast address.

Answer

Ping of Death

Answer

SYN flood

Answer

Slowloris

Question 10

A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?

Accepted Answer

SNMP enumeration. The question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

Answer

SMB enumeration

Answer

LDAP enumeration

Answer

SMTP enumeration

Question 11

Which tool is specifically designed to enumerate SMB shares and user accounts on a Windows target by leveraging the SMB protocol?

Accepted Answer

Enum4linux. Enum4linux is a tool specifically designed to enumerate SMB shares and user accounts on Windows targets by leveraging the SMB protocol. It uses the SMB/CIFS protocol to query services like the SAMR (Security Account Manager Remote) and LSARPC (Local Security Authority Remote Procedure Call) interfaces to extract user lists, share listings, and OS information. This makes it the correct choice for targeted SMB enumeration.

Answer

Wireshark

Answer

Nmap

Answer

Hydra

Question 12

A user reports that their computer is infected with ransomware. Which of the following is the BEST immediate action for the security team to take?

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the best immediate action because it isolates the ransomware, preventing it from spreading laterally to other systems via SMB, RDP, or mapped drives. This containment step stops the encryption of additional network shares and halts any command-and-control (C2) communication the ransomware might be using to exfiltrate data or receive encryption keys.

Answer

Pay the ransom to regain access

Answer

Run a full antivirus scan

Answer

Restore the system from a recent backup

Question 13

Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?

Accepted Answer

CVE-2021-41773 (Apache Path Traversal). The exhibit shows Apache HTTP Server on port 80, which is vulnerable to CVE-2021-41773, a path traversal and file disclosure flaw in Apache HTTP Server 2.4.49. This vulnerability allows an attacker to use a specially crafted URL to traverse directories outside the document root, potentially reading sensitive files like /etc/passwd or executing arbitrary code if CGI scripts are enabled. The presence of Apache on port 80 directly aligns with this vulnerability, making it the most likely to be successfully exploited.

Answer

CVE-2017-5638 (Struts2 RCE)

Answer

CVE-2014-0160 (Heartbleed)

Answer

CVE-2020-1472 (Zerologon)

Question 14

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Accepted Answer

Installing a rootkit to hide files and processes. Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.

Answer

Escalating privileges to SYSTEM

Answer

Disabling antivirus software

Question 15

A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)

Accepted Answer

enum4linux. enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.

Answer

John the Ripper

Answer

SNMPwalk

Answer

Nmap