CEH Practice Test 41 — 15 Questions

Question 1

A security analyst captures network traffic and sees the following: Client sends a SYN, server responds with SYN-ACK, then client sends ACK. Immediately after, the client sends an encrypted payload. This traffic is consistent with which phase of a WPA2 attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

De-authentication attack. The traffic shown is a TCP three-way handshake followed by encrypted application data. This is not a deauthentication attack (which uses spoofed 802.11 deauthentication frames) and not the WPA2 4-way handshake (which uses EAPOL-Key frames at Layer 2). Therefore, none of the listed options correctly identifies a WPA2 attack phase.

Answer

WPA2 4-way handshake exchange

Answer

WPS PIN exchange

Answer

WEP initialization vector capture

Question 2

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

Accepted Answer

Perform banner grabbing on port 22 to identify the SSH version.. Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.

Answer

Perform SNMP enumeration to gather system information.

Answer

Attempt a DNS zone transfer from the server.

Answer

Enumerate NetBIOS names using `nbtstat`.

Question 3

A penetration tester is attempting to enumerate user accounts on a mail server. They connect to port 25 and issue the commands `VRFY root` and `EXPN support`. Which protocol is being targeted?

Accepted Answer

SMTP. The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Answer

LDAP

Answer

SMB

Answer

SNMP

Question 4

An analyst uses the following command to capture traffic: tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80. After generating traffic from a web server at 10.0.0.5, the analyst examines the pcap with Wireshark. What type of traffic will appear in the capture?

Accepted Answer

HTTP traffic to and from 10.0.0.5. The command `tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80` captures only packets that match both conditions: the IP address is 10.0.0.5 (source or destination) and the port is 80 (source or destination). Since port 80 is the default HTTP port, this filter captures HTTP traffic to and from the web server at 10.0.0.5. The `host` keyword includes both directions, so the capture is not limited to traffic originating from the server.

Answer

All HTTP traffic on the network

Answer

Only HTTP traffic originating from 10.0.0.5

Answer

All traffic from 10.0.0.5 on any port

Question 5

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

Accepted Answer

Backdoor Trojan. The outbound traffic on port 4444, a common port for the Metasploit Meterpreter reverse shell, combined with the 'strings' output showing 'cmd.exe /c' (a command shell invocation) and an IP address, indicates a backdoor Trojan. This malware type establishes a covert reverse connection to an attacker's command-and-control server, allowing remote shell access without a legitimate service on the target port.

Answer

Worm

Answer

Keylogger

Answer

Ransomware

Question 6

What can be inferred from the output?

Accepted Answer

The domain has two mail servers with different priority levels.. The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Answer

The command failed because the DNS server is unreachable.

Answer

The domain uses SPF records to prevent email spoofing.

Answer

The domain's web server IP address is 192.168.1.1.

Question 7

Which TWO of the following are common attack vectors for IoT devices? (Select two)

Accepted Answer

Default credentials. Option B (Default credentials) is correct because IoT devices are frequently shipped with factory-set usernames and passwords (e.g., admin/admin, root/root) that users never change, making them trivially exploitable by botnets like Mirai. Option C (Insecure protocols such as plain MQTT) is correct because IoT devices often communicate over unencrypted protocols like MQTT on port 1883, CoAP, or HTTP, exposing credentials and telemetry to eavesdropping and man-in-the-middle attacks. Option A (SQL injection) is not a typical IoT attack vector since most IoT devices do not expose SQL databases or web forms backed by relational databases. Option D (Side-channel attacks) requires physical proximity and specialized equipment, making it far less common than credential and protocol weaknesses in IoT threat landscapes. Option E (ARP spoofing) is a general LAN-layer attack applicable to any networked host, not a vector specific to or characteristic of IoT devices.

Answer

SQL injection

Answer

Side-channel attacks

Answer

ARP spoofing

Question 8

Drag and drop the steps to perform a SQL injection attack manually into the correct order.

Accepted Answer

Identify vulnerability, then test injection points, then find number of columns, then use UNION to combine results, then extract data. The correct sequence for manual SQL injection starts with identifying a vulnerable input (e.g., by observing error messages or behavior), then testing injection (e.g., adding a single quote), finding the number of columns using ORDER BY or UNION SELECT, using UNION to combine attacker-controlled queries, and finally extracting sensitive data. This order ensures each step builds on the previous one.

Answer

Test injection points, then identify vulnerability, then find number of columns, then use UNION, then extract data

Answer

Identify vulnerability, then find number of columns, then test injection points, then use UNION, then extract data

Answer

Test injection points, then find number of columns, then identify vulnerability, then use UNION, then extract data

Question 9

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Accepted Answer

Using Google dorking to find exposed documents. Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Answer

Performing a ping sweep on the target network

Answer

Conducting a port scan with Nmap

Answer

Brute forcing subdomains via DNS queries

Question 10

Which THREE of the following are techniques used in static malware analysis? (Select 3)

Accepted Answer

Inspecting file metadata and properties. Inspecting file metadata and properties (Option A) is a static analysis technique because it examines the file's embedded information—such as author, creation date, file version, and digital signatures—without executing the binary. This metadata can reveal the origin, compilation timestamp, or whether the file is signed by a known legitimate publisher, helping to identify suspicious characteristics before runtime.

Answer

Capturing network traffic in a sandbox

Answer

Monitoring registry changes during execution

Question 11

Which THREE of the following are common attack vectors against IoT devices? (Choose three.)

Accepted Answer

Firmware reversing. Firmware reversing (A) is a common IoT attack vector because IoT firmware is frequently extracted from flash or update images and analyzed to uncover hardcoded keys, backdoors, and exploitable services. Default credentials (D) are a leading IoT weakness since many devices ship with well-known usernames/passwords like admin/admin or root/root that are rarely changed, enabling trivial unauthorized access. Insecure protocols (E) such as MQTT and CoAP are common vectors because they often lack encryption or authentication by default, allowing eavesdropping, spoofing, and message injection on IoT networks. Container escape (B) targets containerized workloads and orchestration platforms, not typical constrained IoT endpoints, and SQL injection (C) targets web application database queries, which is not a characteristic IoT-specific attack vector.

Answer

Container escape

Answer

SQL injection

Question 12

A web application is vulnerable to XML External Entity (XXE) injection. Which THREE of the following are potential impacts of successfully exploiting an XXE vulnerability?

Accepted Answer

Arbitrary file read on the server. Option B (Arbitrary file read on the server) is correct because XXE payloads can define an external entity whose SYSTEM identifier points to a local file (e.g., <!ENTITY xxe SYSTEM "file:///etc/passwd">), causing the parser to embed the file's contents in the response. Option C (Denial of Service) is correct because entities can be nested or recursively referenced (the 'billion laughs' attack) or point to large/blocking resources, exhausting parser memory or CPU and rendering the service unavailable. Option D (Server-Side Request Forgery) is correct because an external entity with an HTTP/FTP SYSTEM URL forces the vulnerable server to make outbound requests to internal or external hosts, enabling SSRF and potential access to internal services or cloud metadata endpoints. Option A (SQL injection) is not a direct XXE impact — XXE abuses the XML parser, not a database query interface, so any SQLi would be a separate vulnerability. Option E (Remote code execution via command injection) is not a standard XXE consequence; XXE does not invoke OS commands, and RCE typically requires additional flaws such as insecure deserialization or PHP expect:// wrappers in specific misconfigurations.

Answer

SQL injection

Answer

Remote code execution via command injection

Question 13

Which THREE of the following are effective DDoS mitigation techniques? (Choose 3)

Accepted Answer

Scrubbing centers. Scrubbing centers are effective DDoS mitigation because they act as a centralized traffic-cleaning facility. When an attack is detected, malicious traffic is diverted to the scrubbing center, where it is filtered using signature-based, anomaly-based, and rate-based techniques, allowing only legitimate traffic to pass through to the target network. This offloads the attack burden from the victim's infrastructure.

Answer

MAC address filtering

Answer

Disabling DHCP

Question 14

A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?

Accepted Answer

Sender's private key. Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).

Answer

Sender's public key

Answer

Recipient's private key

Answer

Recipient's public key

Question 15

During a penetration test, you run the tool 'macof' against a switch. After a few seconds, the switch starts flooding frames out all ports. Which attack have you successfully executed, and what is the primary goal of this technique?

Accepted Answer

MAC flooding; to cause a switch to fail-open and act like a hub for sniffing. The 'macof' tool is specifically designed to perform MAC flooding attacks by generating frames with random source MAC addresses. This overwhelms the switch's Content Addressable Memory (CAM) table, causing it to fail-open and flood all incoming frames out every port, effectively making it behave like a hub. This allows the attacker to sniff network traffic that would normally be isolated to specific switch ports.

Answer

VLAN hopping; to gain access to a different VLAN

Answer

STP manipulation; to create a loop and cause a DoS

Answer

ARP poisoning; to intercept traffic between two hosts