CEH Practice Test 43 — 15 Questions

Question 1

During an assessment, a tester discovers that the web application accepts XML input and returns the parsed data. The tester submits the following payload: <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>. The response contains the contents of /etc/passwd. This vulnerability is known as:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

XML External Entity (XXE) Injection. The payload defines an external entity that reads a local file, a classic XXE (XML External Entity) injection.

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

SQL injection

Question 2

A web application firewall (WAF) blocks requests containing ' UNION SELECT '. A penetration tester wants to bypass this restriction to perform a union-based SQL injection. Which of the following techniques is MOST likely to succeed?

Accepted Answer

Use inline comments: 'UN/**/ION/**/SE/**/LECT'. Using comments or alternative encoding can bypass WAF rules. Inline comments like '/**/' can break up keywords.

Answer

Use double URL encoding: '%25%35%35%25%34%65%25%34%39...'

Answer

Use hex encoding: '0x554e494f4e2053454c454354'

Answer

Use URL encoding: '%55%4e%49%4f%4e%20%53%45%4c%45%43%54'

Question 3

Which TWO of the following are characteristics of stored (persistent) XSS?

Accepted Answer

The malicious script is stored on the server (e.g., in a database). Stored XSS involves malicious script being permanently stored on the server (e.g., in a database) and executed whenever the stored content is accessed. It does not require a crafted link, and it can affect multiple users without direct interaction.

Answer

The attack requires the victim to click a crafted link

Answer

The payload is reflected immediately in the response

Answer

The attack only works if the victim is logged in

Question 4

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities?

Accepted Answer

SQLMap. SQLMap is a well-known open-source tool that automates the process of detecting and exploiting SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 5

Which of the following best describes the attack where an attacker uses a valid session token to impersonate a user without needing to authenticate?

Accepted Answer

Session hijacking. Session hijacking involves stealing or using a valid session token to impersonate a user, bypassing authentication.

Answer

Cross-site scripting

Answer

Phishing

Answer

Brute-force attack

Question 6

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when a server makes requests to internal resources based on user-supplied URLs.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Remote File Inclusion (RFI)

Question 7

During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 8

During a penetration test, an ethical hacker runs the following command: aireplay-ng -0 5 -a 00:11:22:33:44:55 -c 66:77:88:99:AA:BB wlan0mon. What is the immediate effect of this command?

Accepted Answer

It forces the client to disconnect and reconnect, capturing the WPA handshake. The -0 flag sends deauthentication packets to force a client to reconnect, enabling capture of the WPA handshake.

Answer

It performs a WEP injection attack to generate traffic

Answer

It cracks the pre-shared key using a dictionary

Answer

It initiates a brute force attack on the WPS PIN

Question 9

During a penetration test, a security analyst runs the following command on a Linux system: ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//. What is the PRIMARY purpose of this command?

Accepted Answer

To perform a man-in-the-middle attack between the gateway and the target host. The command `ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//` uses ARP poisoning in remote mode to intercept traffic between the gateway (192.168.1.1) and the target host (192.168.1.100). By sending forged ARP replies to both devices, the attacker's machine becomes a man-in-the-middle, allowing it to capture, modify, or relay packets between them. The `-M arp:remote` flag specifically enables ARP poisoning for a MITM attack, not for DNS spoofing, promiscuous mode, or flooding.

Answer

To spoof the DNS responses to redirect the target to a malicious site

Answer

To sniff all traffic on the network by enabling promiscuous mode on the interface

Answer

To perform a denial-of-service attack by flooding the network with ARP replies

Question 10

A security analyst is investigating a compromised Linux system and finds the following: - A binary with SUID bit set owned by root that is not a standard system binary - The file /etc/ld.so.preload contains a reference to a shared object in /tmp - The system logs show gaps of several minutes during peak hours. Which TWO techniques has the attacker MOST likely used to maintain access and evade detection?

Accepted Answer

SUID privilege escalation. The SUID bit set on a non-standard binary owned by root allows an attacker to execute that binary with root privileges, providing a persistent privilege escalation mechanism. The reference in /etc/ld.so.preload to a shared object in /tmp indicates an LD_PRELOAD rootkit, which forces the dynamic linker to load a malicious library before all others, enabling hooking of system calls to hide processes, files, or network connections.

Answer

Password cracking

Answer

Kernel module rootkit

Answer

Steganography

Question 11

A security analyst finds multiple failed login attempts in the system logs, followed by a successful login from an unusual IP address. The attacker then deleted the log entries for that session. Which step of the system hacking methodology (CHPSET) does the log deletion represent?

Accepted Answer

Erasing tracks. The log deletion represents the 'Erasing tracks' step in the CHPSET methodology. After gaining unauthorized access, attackers must cover their footprints by removing evidence of their activities, such as clearing system logs, modifying timestamps, or deleting audit trails. This ensures the intrusion remains undetected by system administrators or security monitoring tools.

Answer

Spying

Answer

Executing applications

Answer

Cracking passwords

Question 12

Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.

Answer

hping3

Answer

OpenVAS

Answer

Nmap

Question 13

You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?

Accepted Answer

DNS tunneling. The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS zone transfer

Question 14

Refer to the exhibit. A penetration tester runs the above Nmap scan. Which of the following statements is most accurate regarding the state of port 3389?

Accepted Answer

A firewall is likely blocking the scan probes to port 3389, preventing Nmap from determining whether the port is open.. The Nmap scan output shows port 3389 in a 'filtered' state, which means Nmap received no response or an ICMP unreachable error from the target. This typically indicates a firewall is blocking the probes, preventing Nmap from determining whether the port is actually open or closed. A filtered state does not confirm the port is open or closed, only that access is being obstructed.

Answer

Port 3389 is open and running a Remote Desktop service, but the service version could not be identified.

Answer

Port 3389 is closed and the target is ignoring the probe.

Answer

The target is likely a honeypot designed to simulate a Windows machine.

Question 15

During a penetration test, a tester uses the SMTP VRFY command against a mail server. The server responds with '252 Cannot VRFY user, but will accept message' for most usernames. Which action should the tester take to enumerate valid email addresses more effectively?

Accepted Answer

Use the EXPN command to expand mailing lists and verify addresses. The SMTP VRFY command is used to verify whether a specific user exists on the mail server. When the server responds with '252 Cannot VRFY user, but will accept message', it indicates that VRFY is disabled or restricted, but the server still supports the EXPN command. EXPN (Expand) reveals the actual members of a mailing list or alias, allowing the tester to enumerate valid email addresses indirectly by querying known or guessed list names.

Answer

Use the NetBIOS nbtstat command to query the mail server

Answer

Run a brute-force attack on the SMTP service using Hydra

Answer

Switch to SNMP enumeration to gather email addresses