CEH Practice Test 42 — 15 Questions

Question 1

Which TWO of the following are symmetric encryption algorithms? (Select 2)

Accepted Answer

3DES. AES and 3DES are symmetric algorithms; RSA and ECC are asymmetric; MD5 is a hash function.

Answer

ECC

Answer

RSA

Answer

MD5

Question 2

During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?

Accepted Answer

MAC flooding. MAC flooding. When a switch's MAC address table is full, it can no longer learn new MAC addresses and enters a fail-open state, flooding all incoming frames out every port except the ingress port. This allows the tester to capture traffic destined for other hosts on the same VLAN by placing their NIC in promiscuous mode and using Wireshark, effectively performing a MAC flooding attack to turn the switch into a hub-like device.

Answer

DNS spoofing

Answer

Session hijacking

Answer

ARP poisoning

Question 3

Which TWO of the following are asymmetric encryption algorithms? (Choose two.)

Accepted Answer

ECC. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. SHA-256 is a hash function.

Answer

3DES

Answer

SHA-256

Answer

AES

Question 4

During a penetration test, a tester runs enum4linux against a Windows server and receives the following output: 'S-1-5-21-3623811015-3361044348-30300820-500' and 'S-1-5-21-3623811015-3361044348-30300820-501'. Which TWO conclusions can be drawn from this output?

Accepted Answer

The Guest account SID was enumerated. The SID ending in -500 is the well-known RID for the built-in Administrator account, and the SID ending in -501 is the RID for the built-in Guest account. Enum4linux enumerates user SIDs from the SAM database via SMB null sessions, confirming that both the Administrator and Guest account SIDs were retrieved. Therefore, options B and C are correct.

Answer

The Guest account is enabled

Answer

The server is a domain controller

Answer

Password policy was retrieved

Question 5

During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?

Accepted Answer

Knowledge of the SNMP community string. SNMP enumeration relies on the SNMP community string, which acts as a password-like credential for read or read/write access to MIB data. Without the correct community string (defaults are often 'public' for read-only and 'private' for read-write), SNMPwalk cannot authenticate with the target agent and will fail to retrieve any OID values.

Answer

An open TCP port 161

Answer

The target must be running Linux

Answer

A valid username and password

Question 6

Which tool is specifically designed to automate social engineering attacks, such as phishing and credential harvesting?

Accepted Answer

SET. The Social Engineering Toolkit (SET) is an open-source Python-driven framework specifically designed to automate social engineering attacks, including phishing campaigns, credential harvesting via cloned websites, and spear-phishing payloads. It integrates with Metasploit for payload delivery but is distinct in its focus on manipulating human behavior rather than exploiting technical vulnerabilities.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 7

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area without presenting their own credentials. The attacker exploits the authorized person's trust or politeness to bypass access control systems such as badge readers or biometric locks. This technique relies on the human factor rather than technical vulnerabilities.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 8

An organization wants to mitigate the impact of a DDoS attack that uses large volumes of UDP traffic to exhaust bandwidth. Which of the following techniques would be MOST effective?

Accepted Answer

Deploying a scrubbing center. A scrubbing center is the most effective technique because it filters out malicious UDP traffic from legitimate traffic by analyzing packet characteristics, such as source IP reputation and payload patterns, before forwarding clean traffic to the target network. This approach preserves legitimate UDP services (e.g., DNS, VoIP) while absorbing volumetric attacks, unlike simpler methods that may block all UDP or fail to scale.

Answer

Rate limiting on all ports

Answer

Blocking all UDP traffic

Answer

Implementing SYN cookies

Question 9

Which THREE of the following are valid methods for DDoS mitigation?

Accepted Answer

Rate limiting. Rate limiting is a valid DDoS mitigation method because it restricts the number of requests a server accepts from a single source within a given time window, preventing resource exhaustion. By enforcing thresholds (e.g., via iptables or application-layer rate limiters), it reduces the impact of volumetric attacks like HTTP floods without blocking legitimate traffic entirely.

Answer

Increasing server timeout values

Answer

Disabling SYN cookies

Question 10

Which TWO of the following are techniques used in session hijacking? (Choose 2)

Accepted Answer

Cookie theft. Cookie theft is a session hijacking technique where an attacker captures a user's session cookie (e.g., via XSS, packet sniffing, or malware) and uses it to impersonate the user. Since HTTP is stateless, the server relies on the cookie to identify the session, so stealing it grants the attacker unauthorized access without needing credentials.

Answer

MAC flooding

Answer

ARP poisoning

Answer

DNS spoofing

Question 11

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Rate limiting. Rate limiting is effective because it restricts the number of requests a server will accept from a single IP address or session within a given time window, typically enforced via token bucket or leaky bucket algorithms. This prevents a single attacker or botnet node from overwhelming server resources, though it must be carefully tuned to avoid blocking legitimate users.

Answer

Blackholing all traffic to the target

Answer

IP spoofing

Question 12

Which TWO of the following are examples of application layer DDoS attacks? (Select two.)

Accepted Answer

Slowloris. Slowloris is an application layer DDoS attack that targets HTTP servers by opening multiple connections and sending partial HTTP requests, keeping them open as long as possible. It exploits the server's connection handling by sending incomplete headers, preventing the server from timing out the connection and exhausting its connection pool. This attack operates at Layer 7 and does not require high bandwidth, making it effective against web servers.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 13

A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)

Accepted Answer

Enable Zigbee security suite (AES-128 encryption) on all sensor devices.. Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.

Answer

Disable encryption on MQTT to reduce latency and improve performance.

Answer

Implement device authentication using pre-shared keys only for Zigbee devices.

Answer

Segment the IoT devices into a separate VLAN and restrict access with ACLs.

Question 14

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

Accepted Answer

Privilege escalation; gain root access. A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Answer

Information disclosure; read sensitive files

Answer

Denial of service; crash the system

Answer

Buffer overflow; execute arbitrary code

Question 15

Which TWO of the following techniques are considered passive reconnaissance? (Select exactly 2.)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks. This process does not send any packets directly to the target system; it relies on third-party servers, making it a passive reconnaissance technique.

Answer

Connecting to a web server to grab its banner

Answer

Sending ICMP echo requests to a target

Answer

Running a Nmap SYN scan