CEH Practice Test 40 — 15 Questions

Question 1

A penetration tester obtains a hash dump from a compromised Windows system and wants to crack LM and NTLM hashes quickly using precomputed tables. Which tool would be most efficient for this task?

Accepted Answer

Ophcrack. Ophcrack is the most efficient tool for quickly cracking LM and NTLM hashes using precomputed tables because it is specifically designed to leverage rainbow tables (precomputed hash chains) for these hash types. It can crack LM hashes almost instantly and NTLM hashes with high success rates when paired with the correct rainbow tables, making it ideal for fast offline password recovery from a hash dump.

Answer

Hashcat

Answer

John the Ripper

Answer

RainbowCrack

Question 2

Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?

Accepted Answer

Polymorphic virus. A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.

Answer

Trojan horse

Answer

Macro virus

Answer

Boot sector virus

Question 3

Which THREE of the following are characteristics of asymmetric encryption?

Accepted Answer

Supports digital signatures. Option B is correct because asymmetric encryption enables digital signatures: the sender signs with their private key and anyone can verify with the corresponding public key, providing authenticity and non-repudiation. Option C is correct because asymmetric cryptography allows key exchange without a prior shared secret, as seen in Diffie-Hellman or RSA-based key transport, where parties can establish a session key over an untrusted channel. Option D is correct because asymmetric encryption fundamentally uses a mathematically related key pair — a public key for encryption/verification and a private key for decryption/signing. Option A is incorrect because a single shared key describes symmetric encryption, not asymmetric. Option E is incorrect because asymmetric algorithms such as RSA are computationally much slower than symmetric ciphers like AES, which is why hybrid schemes are used in practice.

Answer

Uses a single shared key for both encryption and decryption

Answer

Typically faster than symmetric encryption

Question 4

After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?

Accepted Answer

Static analysis. The analyst is performing static analysis because they are examining the file without executing it. Running the 'strings' command extracts readable text from the binary, and uploading to VirusTotal checks the file's hash against known malware signatures — both are non-behavioral, non-runtime techniques. Static analysis focuses on file properties, code structure, and metadata without triggering the malware's execution.

Answer

Behavioral analysis

Answer

Code analysis

Answer

Dynamic analysis

Question 5

Which TWO of the following attacks can be prevented by properly validating and sanitizing user input? (Select 2)

Accepted Answer

SQL injection. Option B (SQL injection) is correct because SQL injection occurs when untrusted user input is concatenated into SQL queries, and validating/sanitizing that input (or using parameterized queries/prepared statements) prevents attackers from injecting malicious SQL syntax. Option E (Cross-Site Scripting, XSS) is correct because XSS arises when user-supplied data is rendered into HTML/JavaScript without proper output encoding or input sanitization, so validating and sanitizing input stops script payloads from executing in victims' browsers. Option A (CSRF) is not prevented by input validation alone; it requires anti-CSRF tokens, SameSite cookies, or origin/referer checks, since the attack abuses a victim's authenticated session rather than malformed input. Option C (MitM) is a network-layer interception problem mitigated by TLS, certificate pinning, and secure protocols, not by input validation. Option D (Clickjacking) is prevented by frame-busting headers such as X-Frame-Options or Content-Security-Policy frame-ancestors, not by sanitizing user input.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Man-in-the-Middle (MitM) attack

Answer

Clickjacking

Question 6

Which malware type is characterized by self-replication across networks without needing a host file?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across network connections without requiring a host file or user intervention. It exploits vulnerabilities in network protocols or services (e.g., SMB, RDP) to propagate autonomously, as seen with WannaCry's use of EternalBlue.

Answer

Trojan

Answer

Rootkit

Answer

Ransomware

Question 7

Which TWO tools are commonly used for ARP poisoning attacks?

Accepted Answer

Cain & Abel. Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 8

Which TWO of the following are common defense measures against wireless de-authentication attacks? (Select 2)

Accepted Answer

Enabling 802.11w (Management Frame Protection). Option B is correct because 802.11w (Management Frame Protection, MFP) cryptographically protects unicast and broadcast management frames, including de-authentication and disassociation frames, so spoofed de-auth frames injected by an attacker are rejected by clients and APs. Option D is correct because WPA3 mandates Management Frame Protection (MFP) as part of its certification, meaning de-authentication frames are authenticated and forged de-auth attacks are mitigated by design, unlike WPA2 where MFP is optional. Option A is not a defense against de-authentication attacks, since changing the default SSID only obscures the network name and does not protect management frames. Option C is not effective because MAC addresses are transmitted in the clear and can be spoofed, and MAC filtering does nothing to stop forged de-auth frames. Option E is not a defense either, as hiding the SSID is trivially bypassed by monitoring client probe requests and does not authenticate management frames.

Answer

Changing the default SSID

Answer

Implementing MAC address filtering

Answer

Disabling SSID broadcast

Question 9

A network administrator notices an unusually high number of half-open TCP connections to the company's web server. The source IPs are spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to the target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, exhausting its connection queue and preventing legitimate connections. The description of half-open TCP connections with spoofed source IPs is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

UDP flood

Answer

ICMP flood

Question 10

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The log shows a GET request with a 'url' parameter pointing to 'http://169.254.169.254/latest/meta-data/', which is the AWS Instance Metadata Service (IMDS) endpoint. An attacker is attempting to trick the server into making an HTTP request to this internal address on their behalf, a classic Server-Side Request Forgery (SSRF) attack. By accessing the metadata service, the attacker could retrieve sensitive information such as IAM credentials, instance identity documents, or user data. The presence of the 'url' parameter strongly indicates the application is designed to fetch remote resources, and the attacker is abusing that functionality to reach internal-only services.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)

Question 11

A security team detects unusual outbound traffic from a host that appears to be a reverse shell. Which of the following Nmap features would be MOST effective for identifying the service running on the listening port of the command-and-control server?

Accepted Answer

Service version detection using the -sV flag. The -sV flag instructs Nmap to perform service version detection by probing open ports and analyzing the responses to determine the exact application and version running on the listening port. In a reverse shell scenario, identifying the service (e.g., a specific SSH, HTTP, or custom listener) on the C2 server is critical for understanding the attack vector and planning remediation.

Answer

UDP scan using the -sU flag

Answer

Nmap Scripting Engine (NSE) with the http-enum script

Answer

OS fingerprinting using the -O flag

Question 12

Which of the following commands would a penetration tester use to enumerate SMB shares on a target Windows machine from a Linux system?

Accepted Answer

smbclient -L // -N. The `smbclient -L // -N` command lists SMB shares on a target Windows machine without requiring a password (null session). This is a standard enumeration technique because SMB uses TCP port 445 and the `-L` flag queries the share list, while `-N` suppresses the password prompt, allowing anonymous access if the target permits null sessions.

Answer

ldapsearch -x -h <IP>

Answer

snmpwalk -v2c -c public <IP>

Answer

nbtstat -A <IP>

Question 13

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 14

An attacker sets up a fake access point with the same SSID as a legitimate corporate network. Clients connecting to this AP are prompted to enter their network credentials. Which type of attack is this?

Accepted Answer

Evil twin attack. An evil twin attack involves an attacker setting up a rogue access point that mimics a legitimate network's SSID (and often BSSID) to trick clients into connecting. Once connected, victims may be prompted for credentials via a captive portal or have their traffic intercepted. This is a classic wireless phishing and man-in-the-middle technique.

Answer

Replay attack

Answer

WPS PIN attack

Answer

De-authentication attack

Question 15

Which THREE of the following are components of the CHPSET system hacking methodology?

Accepted Answer

Cracking passwords. Cracking passwords is a core phase in the CHPSET (Cracking, Hacking, Privilege escalation, System hacking, Erasing tracks, Tunneling) system hacking methodology. After gaining initial access, the attacker extracts password hashes (e.g., from SAM or LSASS) and uses tools like John the Ripper or Hashcat to crack them offline, enabling further access or lateral movement.

Answer

Port scanning

Answer

Vulnerability scanning