CEH Practice Test 42 — 15 Questions

Question 1

Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)

Accepted Answer

Spoofs the source IP address of the victim. In a DNS amplification DDoS attack, the attacker spoofs the source IP address of the victim in DNS queries sent to open resolvers. This causes the resolvers to send their large responses to the victim, not the attacker, thereby directing the amplified traffic at the target. Without IP spoofing, the attack would not be able to flood the victim with responses.

Answer

Exploits the TCP handshake process

Answer

Floods the target with small ICMP packets

Question 2

During a forensic investigation, an analyst retrieves a suspicious executable. Running 'strings' reveals no readable text, and VirusTotal shows zero detections. However, when executed in a sandbox, the binary connects to a remote IP and injects code into 'explorer.exe'. Which conclusion is MOST accurate?

Accepted Answer

The file is likely a packed trojan that evades signature-based detection. The absence of readable strings and zero VirusTotal detections strongly suggest the executable is packed or obfuscated, a common evasion technique used by trojans. The sandbox behavior—connecting to a remote IP and injecting code into explorer.exe—confirms malicious intent, specifically trojan-like remote access and process injection. This combination of static stealth and dynamic malicious activity indicates a packed trojan designed to bypass signature-based antivirus.

Answer

The file is a worm because it connects to a remote IP

Answer

The file is benign because static analysis found no indicators

Answer

The file is a false positive and the sandbox environment is compromised

Question 3

Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.

Answer

Burp Suite

Answer

Metasploit

Answer

Nmap

Question 4

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

Mutates its code to evade signature detection. A polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.

Answer

Remains constant in code to ensure replication

Answer

Spreads via network shares

Answer

Resides in the boot sector of a hard drive

Question 5

A penetration tester uses `smbclient -L //192.168.1.30 -N` and receives a list of shares including a hidden administrative share (C$) and a user share named "Backup". What is the most immediate security concern?

Accepted Answer

Null session enumeration is possible, allowing information gathering. The `-N` flag in the `smbclient` command suppresses password prompts, enabling a null session connection. The fact that the command successfully lists shares without authentication indicates that null session enumeration is permitted, which is a critical security flaw. This allows an attacker to gather sensitive information (share names, user lists, etc.) without any credentials, often serving as the first step in a targeted attack.

Answer

The Backup share may contain sensitive data

Answer

SMB signing is not enabled

Answer

The C$ share is a default administrative share

Question 6

A security analyst is reviewing a web application log and sees the following request: GET /page?file=../../../etc/passwd HTTP/1.1. Which TWO vulnerabilities are most likely being attempted? (Select two)

Accepted Answer

Directory traversal. Option A (Directory traversal) is correct because the payload ../../../etc/passwd uses dot-dot-slash sequences to escape the web root and reference files outside the intended directory, which is the classic signature of a path traversal attack. Option D (Local file inclusion) is correct because the same traversal sequence is being passed to the file parameter to make the application include a local server-side file such as /etc/passwd, a hallmark of LFI attempts. Option B (RFI) is not indicated because the value references a local path rather than a remote URL or protocol such as http:// or ftp://. Option C (SQL injection) is not indicated because there are no SQL metacharacters, quotes, or query fragments in the payload. Option E (Command injection) is not indicated because no shell operators or system commands (e.g., ;, |, &&, whoami) appear in the request.

Answer

Remote file inclusion (RFI)

Answer

SQL injection

Answer

Command injection

Question 7

A penetration tester successfully gains access to a Linux server as a low-privilege user. The goal is to escalate to root. Which THREE methods could the tester use to achieve privilege escalation?

Accepted Answer

Exploit a vulnerable SUID binary to spawn a root shell. Option B is correct because a SUID binary executes with the file owner's privileges (typically root), so exploiting a vulnerable SUID program (e.g., via GTFOBins techniques or buffer overflow) can yield a root shell. Option C is correct because 'sudo -l' reveals the sudoers permissions for the current user, and misconfigurations such as NOPASSWD entries or allowed binaries like vim, find, or less can be abused to spawn a root shell. Option E is correct because a local kernel exploit matching the exact kernel version (verified with 'uname -r') can leverage a known vulnerability such as Dirty COW (CVE-2016-5195) or PwnKit to escalate to root. Option A is not a privilege escalation method by itself; 'find / -perm -4000' is only an enumeration step that identifies SUID binaries, which must then be exploited as in option B. Option D does not belong because /etc/shadow is normally readable only by root, so a low-privilege user cannot read the hashes; even if obtained, cracking them yields credentials rather than a direct escalation path.

Answer

Enumerate SUID binaries with 'find / -perm -4000'

Answer

Check /etc/shadow for weak password hashes

Question 8

An employee receives an SMS message that claims to be from the IT department, asking the employee to click a link to verify their email account. Which social engineering attack is this?

Accepted Answer

SMiShing. C is correct because SMiShing (SMS phishing) specifically uses SMS text messages as the attack vector to deliver a malicious link or request, exactly as described in the scenario. Unlike email-based phishing, SMiShing exploits the trust users place in text messages and often bypasses email security filters.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 9

Which THREE of the following are common IoT attack vectors?

Accepted Answer

Default credentials. Default credentials, insecure protocols, and firmware reversing are common IoT attack vectors.

Answer

SQL injection

Answer

ARP spoofing

Question 10

A system administrator receives a phone call from someone claiming to be from IT support, asking for the administrator's password to 'fix a server issue'. This is an example of which social engineering attack?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker fabricates a scenario (pretext) to manipulate the target into divulging sensitive information. In this case, the attacker impersonates IT support and invokes a fake server issue to create urgency, directly requesting the administrator's password. This aligns with the CEH definition of pretexting as a confidence-building deception, not a technical exploit.

Answer

Vishing

Answer

Baiting

Answer

Phishing

Question 11

Which DDoS attack type exploits a small query to a vulnerable service that generates a large response directed at the victim?

Accepted Answer

Amplification attack. An amplification attack is correct because it exploits a small query (e.g., a DNS lookup with a spoofed source IP) sent to a vulnerable service like an open DNS resolver or NTP server, which then generates a large response (e.g., 50-100x the query size) directed at the victim. This leverages the protocol's amplification factor and the lack of source IP validation, overwhelming the victim's bandwidth. The attack is a type of reflection attack, where the intermediary service unwittingly amplifies traffic toward the target.

Answer

HTTP flood

Answer

SYN flood

Answer

ICMP flood

Question 12

Which of the following techniques involves sending crafted packets to a target to elicit responses that reveal the operating system?

Accepted Answer

Active OS fingerprinting. Active OS fingerprinting involves sending crafted packets (e.g., TCP SYN, FIN, or ICMP probes) to a target and analyzing the responses to deduce the operating system. Unlike passive methods, it actively interacts with the target, leveraging subtle differences in how various OSes implement TCP/IP stack behaviors (e.g., initial TTL values, window sizes, or TCP option ordering). This technique is commonly used by tools like Nmap with its `-O` flag.

Answer

Passive OS fingerprinting

Answer

Banner grabbing

Answer

DNS enumeration

Question 13

During a password cracking session, a pentester uses a wordlist combined with rules to generate variations of each word. This approach is called a hybrid attack. Which tool, when used with a rule file, can perform such an attack?

Accepted Answer

Hashcat. Hashcat is a powerful password recovery tool that supports hybrid attacks by combining a wordlist with rule-based mutations. When used with a rule file (e.g., best64.rule), Hashcat applies transformations like prefixing, suffixing, or character substitution to each word, enabling efficient generation of password variations. This directly matches the hybrid attack described in the question.

Answer

RainbowCrack

Answer

Ophcrack

Answer

Hydra

Question 14

Which THREE of the following are components of PKI (Public Key Infrastructure)?

Accepted Answer

Certificate Authority (CA). A Certificate Authority (CA) is a core PKI component because it issues, signs, and revokes digital certificates, binding a public key to an identity. A private key and public key pair is essential to PKI since asymmetric cryptography underpins key exchange, digital signatures, and certificate ownership. Digital certificates are also fundamental PKI components, as they are the signed X.509 structures that convey a subject's public key and identity, validated through the CA's trust chain. WPA3 is a Wi-Fi security certification/protocol standard, not a PKI component, and a RADIUS server is an AAA (authentication, authorization, accounting) server often used for network access control, not a defining element of PKI itself.

Answer

WPA3

Answer

RADIUS server

Question 15

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

Accepted Answer

Enforce HTTPS using TLS 1.2 or higher.. HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Answer

Implement password hashing with bcrypt on the server side.

Answer

Use digital signatures to sign the login request.

Answer

Encrypt the password field using AES-256 before sending via HTTP.