CEH Practice Test 40 — 15 Questions

Question 1

A security analyst observes a sudden increase in network traffic from many external IPs targeting the company's web server with multiple HTTP GET requests to the same page (/index.php?page=home). The requests appear legitimate but are coming at a very high rate. Which TWO types of attack is the analyst most likely witnessing?

Accepted Answer

Application-layer (Layer 7) attack. HTTP flood is an application-layer DDoS sending many seemingly legitimate requests. Distributed means many sources. Volumetric floods use high bandwidth, and SYN flood uses TCP handshake.

Answer

Smurf attack

Answer

Volumetric attack

Answer

SYN flood attack

Question 2

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Using SameSite cookies. CSRF tokens and SameSite cookies are standard defenses. The other options do not prevent CSRF: input validation does not; anti-CSRF tokens are synonymous; referer header validation is weak.

Answer

Input validation

Answer

Using anti-CSRF tokens

Answer

Using HTTPOnly cookies

Question 3

Which of the following is a symptom of a successful command injection attack?

Accepted Answer

The output of the 'id' command appears in the response. Command injection allows execution of system commands; using 'id' is a common test to confirm.

Answer

The server returns a 404 error

Answer

The HTTP response header contains 'Server: Apache'

Answer

The page loads slower than usual

Question 4

Which of the following tools is commonly used to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a widely used open-source tool that automates the process of detecting and exploiting SQL injection flaws in web applications.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 5

Which of the following is the primary purpose of using a CSRF token in a web application?

Accepted Answer

Prevent cross-site request forgery. CSRF tokens are unique, unpredictable values embedded in forms or requests that validate the request originated from the legitimate application, preventing cross-site request forgery attacks.

Answer

Prevent session hijacking

Answer

Prevent XSS

Answer

Prevent SQL injection

Question 6

A security analyst wants to check if a web application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following actions would be most effective?

Accepted Answer

Send a request with a URL parameter pointing to an internal IP address. Crafting a request that makes the server fetch an internal IP address (like 127.0.0.1) and observing if the response includes data from that internal resource is a good test for SSRF.

Answer

Submit a base64-encoded payload in a cookie

Answer

Use SQLMap with a time-based payload

Answer

Modify the Host header to point to localhost

Question 7

A security analyst observes that after a user submits a comment on a blog, the comment is displayed immediately on the page without sanitization. Another user visits the page and the comment's JavaScript executes in their browser. Which type of XSS attack is this?

Accepted Answer

Stored XSS. The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Self-XSS

Question 8

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: ]>&xxe;. The response contains the contents of /etc/passwd. This vulnerability is known as:

Accepted Answer

XML External Entity (XXE) Injection. The payload defines an external entity that reads a local file, a classic XXE (XML External Entity) injection.

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 9

Which Burp Suite tool is specifically designed to automate customized attacks on web applications, such as brute-forcing login forms or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is the tool for automating customized attacks like brute-forcing and fuzzing.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 10

Which Burp Suite tool is most appropriate for modifying and re-sending a single HTTP request multiple times with different payloads to test for SQL injection?

Accepted Answer

Intruder. Burp Intruder is designed for automated customized attacks, allowing you to send many requests with varying payloads to a single target endpoint.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 11

A web application uses XML to transmit data between client and server. A tester submits the following payload: ']>&xxe;'. The application returns the content of the /etc/passwd file in the response. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection, where an external entity is used to read a local file and return its contents.

Answer

SQL injection

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 12

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Accepted Answer

Use inline comments: 'UN/**/ION/**/SE/**/LECT'. Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

Answer

Use double URL encoding: '%25%35%35%25%34%65%25%34%39...'

Answer

Use hex encoding: '0x554e494f4e2053454c454354'

Answer

Use URL encoding: '%55%4e%49%4f%4e%20%53%45%4c%45%43%54'

Question 13

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Accepted Answer

CSRF token. The presence of a SameSite cookie set to Lax does not prevent CSRF for state-changing requests like password change if the attack uses a GET or POST from a top-level navigation. However, the primary missing mitigation is a CSRF token, which is a unique unpredictable value tied to the session and validated by the server.

Answer

SameSite=Strict

Answer

HTTPOnly flag

Answer

Secure flag

Question 14

A web application uses user input in the following PHP code: include($_GET['page'] . '.php');. An attacker submits the URL: http://example.com/index.php?page=../../../../etc/passwd%00. Which two vulnerabilities are being attempted?

Accepted Answer

LFI and null byte injection. The attacker is using '../' for directory traversal to access files outside the web root, and a null byte injection (%00) to truncate the '.php' extension. This targets LFI (local file inclusion) via directory traversal.

Answer

RFI and command injection

Answer

SQL injection and XSS

Answer

Directory traversal and IDOR

Question 15

A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?

Accepted Answer

Time-based. Boolean-based, time-based, and out-of-band are all types of blind SQL injection. Error-based and union-based are in-band techniques, not blind.

Answer

Error-based

Answer

Union-based