CEH Practice Test 44 — 15 Questions

Question 1

Which of the following best describes the difference between active and passive reconnaissance?

Accepted Answer

Active reconnaissance involves direct interaction with the target, whereas passive reconnaissance does not. Active reconnaissance involves direct interaction with the target system, such as sending packets, probes, or connection requests (e.g., using Nmap scans, ping sweeps, or banner grabbing) that can be logged or detected by the target. Passive reconnaissance, in contrast, gathers information without engaging the target directly, relying on publicly available sources (e.g., WHOIS lookups, DNS records, social media, or search engines) and does not generate traffic that reaches the target's network. This distinction is fundamental in the CEH methodology because active techniques carry a higher risk of alerting the target, while passive techniques are stealthier and often used first to avoid detection.

Answer

Active reconnaissance is legal, while passive reconnaissance is not

Answer

Passive reconnaissance uses tools like Nmap, while active reconnaissance uses Google dorks

Answer

Passive reconnaissance is used only during the exploitation phase

Question 2

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Accepted Answer

Restrict access to the Engineering web server to only the Engineering VLAN.. The Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

Answer

Implement a password policy requiring complex passwords for all users.

Answer

Enable two-factor authentication on the web server.

Answer

Apply the latest security patches to the web server.

Question 3

A security analyst runs `snmpwalk -v2c -c public 192.168.1.1` and receives extensive output about the device's configuration. Which of the following is the MOST effective countermeasure against this enumeration?

Accepted Answer

Change the default community string and restrict SNMP access to specific IPs. The most effective countermeasure against SNMP enumeration via a default community string is to change the default 'public' (or 'private') string to a strong, non-guessable value and restrict SNMP access to trusted management IPs using an access control list (ACL). This prevents unauthorized querying of the MIB tree while still allowing legitimate SNMP monitoring.

Answer

Disable SNMP entirely

Answer

Use SNMPv3 with encryption

Answer

Block ICMP echo requests

Question 4

Which of the following is a symptom of a successful command injection attack?

Accepted Answer

The output of the 'id' command appears in the response. In a successful command injection attack, the attacker injects operating system commands into a vulnerable input field, and the web application passes them to a shell for execution. If the application returns the command output in the HTTP response, seeing the result of the 'id' command (e.g., 'uid=33(www-data) gid=33(www-data) groups=33(www-data)') is a definitive symptom that the injection succeeded and the server executed the attacker's command.

Answer

The server returns a 404 error

Answer

The HTTP response header contains 'Server: Apache'

Answer

The page loads slower than usual

Question 5

A security analyst runs the command `nbtstat -A 192.168.1.105` on a Windows machine. What information is the analyst most likely trying to gather?

Accepted Answer

The NetBIOS name table and MAC address of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.

Answer

The LDAP directory structure of the domain

Answer

The SNMP community strings of the target

Answer

The SMB shares available on the remote host

Question 6

Which of the following describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker forces the web server to make HTTP requests to arbitrary destinations, potentially accessing internal resources.. SSRF occurs when an attacker manipulates a server-side application into making HTTP requests to attacker-chosen destinations. Because the request originates from the server, it can reach internal-only resources (metadata endpoints, internal APIs, databases) that the attacker cannot access directly.

Answer

An attacker tricks a user into clicking a link that executes unwanted actions on a web application where the user is authenticated.

Answer

An attacker injects malicious scripts into a web page that executes in other users' browsers.

Answer

An attacker manipulates input to execute system commands on the server.

Question 7

During a security assessment, an analyst runs 'enum4linux -a 10.0.0.5' and obtains a list of users, shares, and OS information. What protocol is enum4linux primarily using to gather this information?

Accepted Answer

SMB/CIFS. enum4linux is a wrapper around tools from the Samba suite, primarily using the SMB/CIFS protocol to query Windows systems for information such as user lists, shares, and OS details. It leverages SMB's remote IPC mechanisms (e.g., via \pipe\lsarpc or \pipe\samr) to enumerate these data points, making D the correct answer.

Answer

NetBIOS

Answer

SNMP

Answer

LDAP

Question 8

Which of the following tools is specifically used to enumerate SMB shares and retrieve file listings from Windows systems?

Accepted Answer

smbclient. smbclient is a tool from the Samba suite specifically designed to interact with SMB/CIFS shares. It allows an attacker to enumerate available shares on a Windows target and retrieve file listings by connecting to the SMB service (port 445 or 139) using commands like 'smbclient -L //target' or by mounting a share and listing its contents.

Answer

ldapsearch

Answer

snmpwalk

Answer

nmap

Question 9

A security analyst runs the command `nbtstat -A 192.168.1.50` in a Windows environment. What information is the analyst attempting to retrieve?

Accepted Answer

NetBIOS names and services of the remote system. The `nbtstat -A` command queries the NetBIOS name table of a remote system by its IP address. NetBIOS over TCP/IP (NBT) maintains a table of names and services (e.g., workstation, server, messenger) that the remote host has registered. This is a classic enumeration technique to discover shares, logged-in users, and other NetBIOS resources.

Answer

The current routing table on the host

Answer

Active network connections and listening ports

Answer

DNS records for the host

Question 10

Which THREE of the following are techniques used in session hijacking? (Select three.)

Accepted Answer

ARP poisoning. ARP poisoning (A) is correct because an attacker poisons the victim's ARP cache to map the gateway's IP to the attacker's MAC address, enabling a man-in-the-middle position where the attacker can capture or reuse the victim's session ID. TCP sequence prediction (C) is correct because hijacking a TCP session requires guessing the next expected sequence and acknowledgment numbers so the attacker can inject packets that the server accepts as belonging to the legitimate session. Cookie theft (D) is correct because session cookies often carry the session identifier, and stealing them (via XSS, sniffing, or malware) lets the attacker replay the cookie and impersonate the authenticated user. DNS amplification (B) is not a session hijacking technique; it is a reflection/amplification DoS attack that abuses open DNS resolvers to flood a target with large responses. MAC flooding (E) is a Layer 2 switch attack that overflows the CAM table to force the switch into hub-like flooding, which can aid sniffing but is not itself a session hijacking technique.

Answer

DNS amplification

Answer

MAC flooding

Question 11

Which tool is specifically designed to create and manage phishing campaigns for security awareness testing?

Accepted Answer

SET. The Social-Engineer Toolkit (SET) is an open-source Python-driven framework specifically designed for social engineering attacks, including the creation and management of phishing campaigns. It automates the generation of malicious emails, credential harvesting pages, and payload delivery, making it the standard tool for security awareness testing in CEH contexts.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 12

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

Accepted Answer

VirusTotal. VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.

Answer

Nmap

Answer

John the Ripper

Answer

Wireshark

Question 13

Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?

Accepted Answer

A firewall or ACL is blocking the port.. A 'filtered' port state in Nmap means the probe was sent but no response was received, and the most common cause is a firewall, ACL, or packet-filtering device silently dropping the packets. Unlike 'closed' (RST returned) or 'open' (SYN-ACK returned), 'filtered' indicates active blocking. This is the textbook interpretation of Nmap's filtered state.

Answer

The SSH service is interfering with the scan.

Answer

The target host is offline.

Answer

The web server is not running.

Question 14

During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?

Accepted Answer

dnsenum. Options A (dnsenum) and C (dnsrecon) are both specialized DNS enumeration tools that can attempt a full zone transfer (AXFR query) to retrieve all DNS records for a domain. dnsenum automates zone transfer attempts against multiple nameservers, while dnsrecon includes similar functionality. Although tools like dig and nslookup can also perform manual zone transfers, the question specifically asks for tools designed for enumeration, making dnsenum and dnsrecon the correct choices.

Answer

dig

Answer

theHarvester

Answer

nslookup

Question 15

A penetration tester wants to perform DNS zone transfer enumeration. Which TWO of the following tools can be used for this purpose? (Select exactly 2.)

Accepted Answer

dnsrecon. Dnsrecon is a dedicated DNS enumeration tool that supports zone transfer requests (AXFR queries) to retrieve all DNS records from a nameserver if it is misconfigured to allow transfers from any host. It can also perform other DNS reconnaissance tasks such as SRV record enumeration and subdomain brute-forcing, making it a direct choice for zone transfer enumeration.

Answer

Shodan

Answer

Maltego

Answer

theHarvester