CEH Practice Test 43 — 15 Questions

Question 1

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.

Answer

Running an Nmap version scan

Answer

Performing a ping sweep

Answer

Banner grabbing with Netcat

Question 2

Which tool is commonly used to perform DNS spoofing on a local network by intercepting DNS requests and replying with forged responses?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on a local network. It can perform DNS spoofing by intercepting DNS requests (typically over UDP port 53) and replying with forged responses before the legitimate DNS server can respond, redirecting victims to malicious IP addresses.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 3

What is the PRIMARY purpose of performing a DNS zone transfer?

Accepted Answer

To obtain all DNS records for a domain from an authoritative server. DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

Answer

To cache DNS queries locally

Answer

To resolve IP addresses to hostnames

Answer

To verify the DNS server's response time

Question 4

You are a security consultant hired by a mid-sized company with 500 employees. The company has a central office with a lobby, reception, and two secure areas: the server room (requires keycard and PIN) and the executive floor (requires keycard only). Recently, employees have reported seeing unfamiliar people in restricted areas. Security logs show keycard access for the server room only during business hours, but no anomalies. However, the executive floor logs show multiple entries by a single employee, John from Sales, at odd hours. John claims he was working late. The company has a policy that all employees must wear ID badges visibly. You observe that employees often hold doors open for colleagues, and the receptionist does not verify visitor badges. Which of the following actions should you recommend FIRST to address the most likely attack vector?

Accepted Answer

Implement mantraps and enforce a policy of one person per keycard entry. The most likely attack vector is tailgating (piggybacking), where unauthorized individuals gain physical access by following an authorized employee through a secured door without using their own credentials. Option C directly addresses this by implementing mantraps (a small room with two interlocking doors that only allows one person to pass at a time) and enforcing a strict one-person-per-keycard-entry policy, which physically prevents tailgating. This is the first and most effective control because it mitigates the root cause—social engineering exploiting human courtesy—rather than focusing on symptoms like John's after-hours access or adding surveillance that doesn't prevent the act.

Answer

Investigate John's activities and consider disciplinary action

Answer

Upgrade keycard readers to biometric scanners

Answer

Install additional CCTV cameras in hallways

Question 5

A penetration tester identifies a web page that reflects user input in the response without proper encoding. The input is submitted via a GET parameter. Which type of cross-site scripting (XSS) is MOST likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the web server in the response without proper encoding or validation. Since the input is submitted via a GET parameter and reflected in the response, this is the classic pattern of reflected XSS.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 6

During a web application penetration test, a tester submits a comment containing '' and the script executes for all users who view the comment. Which type of cross-site scripting (XSS) vulnerability is present?

Accepted Answer

Stored (persistent) XSS. Stored (persistent) XSS occurs when malicious script is permanently saved on the target server (e.g., in a database, comment field, or message board) and served to every user who subsequently views that page. Because the payload executes for all viewers without any crafted URL or user interaction beyond visiting the page, it is the most dangerous XSS variant. The scenario describes exactly this: the comment is persisted and the script runs for all users who view it.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 7

A penetration tester intercepts the following request using Burp Suite: POST /change_password HTTP/1.1 Host: example.com Cookie: sessionid=abc123; SameSite=Lax Content-Type: application/x-www-form-urlencoded new_password=Hacker123 The tester successfully crafts a CSRF attack by embedding a hidden form in a malicious page. Which mitigation is most likely missing?

Accepted Answer

CSRF token. The request shows a session cookie with SameSite=Lax but no anti-CSRF token, and the tester successfully forged a cross-site POST. A CSRF token is the standard defense that binds the request to the user's session and cannot be predicted by an attacker, so its absence is the missing mitigation.

Answer

SameSite=Strict

Answer

HTTPOnly flag

Answer

Secure flag

Question 8

A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?

Accepted Answer

Dictionary attack on the 4-way handshake. Running aircrack-ng with a wordlist against a captured WPA2 4-way handshake is a dictionary attack: aircrack-ng computes the PMK/PTK for each candidate passphrase and compares the resulting MIC to the captured handshake. When it reports 'KEY FOUND!', it has matched a passphrase from the wordlist. This is the classic WPA2 PSK cracking workflow.

Answer

Hash length extension attack on the MIC

Answer

Rainbow table attack on the WPA2 handshake

Answer

Brute-force attack against the PSK

Question 9

Which of the following describes the difference between reflected and stored (persistent) cross-site scripting (XSS)?

Accepted Answer

Reflected XSS is non-persistent and requires user interaction, while stored XSS is persistent and can affect multiple users. Reflected XSS is non-persistent: the malicious script is embedded in a request (often a URL parameter) and immediately reflected back in the response, requiring the victim to click a crafted link. Stored XSS is persistent: the payload is saved on the server (e.g., in a database, comment field, or forum post) and served to every user who views the affected page, affecting multiple victims without individual interaction.

Answer

Reflected XSS is a server-side vulnerability, while stored XSS is a client-side vulnerability

Answer

Reflected XSS only works with HTTP POST requests, while stored XSS works with GET requests

Answer

Reflected XSS is triggered by the server, while stored XSS is triggered by the client

Question 10

Which TWO of the following are types of malware that specifically aim to demand payment from victims?

Accepted Answer

Scareware. Scareware is a type of malware that displays fake security alerts or warnings to trick users into believing their system is infected, then demands payment to remove the nonexistent threat. Ransomware encrypts the victim's files or locks the system and demands a ransom payment for decryption or restoration. Both specifically aim to extort money from victims.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 11

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Directory Traversal

Question 12

A penetration tester runs `nmap -sI 192.168.1.10 -p 80 10.0.0.1` and receives output indicating port 80 is open. The scan uses a zombie host. Which type of scan is this?

Accepted Answer

Idle scan. The `-sI` flag in Nmap specifies an idle scan, which uses a zombie host (192.168.1.10) to probe the target (10.0.0.1). By observing changes in the zombie's IP ID sequence, the attacker can infer whether a port on the target is open or closed without revealing their own IP address. The output indicating port 80 is open confirms the scan type as an idle scan.

Answer

SYN scan

Answer

Decoy scan

Answer

Fragmentation scan

Question 13

Which THREE of the following are methods attackers use to cover their tracks after compromising a system?

Accepted Answer

Modifying file timestamps. Modifying file timestamps (A) is a common anti-forensic technique used to hide the evidence of file creation, modification, or access. Attackers use tools like `touch` on Linux or `SetFileTime` on Windows to alter the MAC (Modify, Access, Change) timestamps, making malicious files appear as legitimate system files. This prevents forensic investigators from identifying when the compromise occurred or which files were altered.

Answer

Performing a dictionary attack

Answer

Running a vulnerability scanner

Question 14

A penetration tester is enumerating an SMTP server on port 25. They issue the command `VRFY root` and receive a 250 response, then `VRFY admin` also returns 250. What does this indicate about the SMTP server?

Accepted Answer

Both root and admin are valid email accounts on the server. The VRFY command is used to verify whether a specific user exists on an SMTP server. A 250 response code indicates that the user is valid and the mailbox exists. Since both `root` and `admin` returned 250, this confirms that both are valid email accounts on the server, making option A correct.

Answer

The SMTP server supports password authentication

Answer

The command failed due to syntax errors

Answer

The SMTP server has disabled user verification

Question 15

An organization deploys a fleet of IoT cameras that communicate with a central server over the internet. The cameras use HTTP to send video streams. What is the most critical security improvement to protect the video data in transit?

Accepted Answer

Implement TLS/SSL encryption for all camera communications.. The most critical security improvement is to implement TLS/SSL encryption (HTTPS) for all camera communications. HTTP transmits video data in plaintext, allowing any attacker on the network path to capture and view the video stream. TLS/SSL provides encryption, integrity, and authentication, directly protecting the confidentiality of the video data in transit.

Answer

Require strong passwords on the camera web interface.

Answer

Use a site-to-site VPN between the cameras and the server.

Answer

Use certificate pinning to prevent man-in-the-middle attacks.