CEH Practice Test 44 — 15 Questions

Question 1

During a penetration test, the tester finds that the Apache server is configured with directory listing enabled on the /uploads directory. The tester navigates to http://example.com/uploads/ and sees a list of files. Which of the following is the MOST immediate security concern?

Accepted Answer

Sensitive files may be exposed to unauthorized users. Directory listing exposes file names that may reveal sensitive information (e.g., backup files, config files). Attackers can then attempt to access these files directly, potentially leading to data disclosure.

Answer

The server is running an outdated version of Apache

Answer

The server is vulnerable to cross-site scripting (XSS) attacks

Answer

An attacker can upload malicious files to the directory

Question 2

Which TWO of the following are valid techniques used in password spraying attacks? (Choose 2.)

Accepted Answer

Using a list of common passwords (e.g., 'Password123', 'Welcome1') against a large set of usernames. Password spraying uses a few common passwords against many accounts to avoid lockouts. Credential stuffing uses known username/password pairs from breaches. Dictionary attack uses a list of words. Brute force tries many passwords on one account. Keylogging is passive.

Answer

Using previously compromised username/password pairs from a breach

Answer

Capturing keystrokes to obtain a user's password

Answer

Trying every possible password from a dictionary against a single username

Question 3

Which of the following is a hashing algorithm that produces a 160-bit (20-byte) hash value?

Accepted Answer

SHA-1. SHA-1 produces a 160-bit hash. MD5 produces 128 bits, SHA-256 produces 256 bits, and SHA-512 produces 512 bits.

Answer

MD5

Answer

SHA-256

Answer

SHA-512

Question 4

A web application uses a URL parameter to fetch a file from the server, e.g., 'download.php?file=report.pdf'. An attacker changes the parameter to '../../etc/passwd' and retrieves the password file. This attack is known as:

Accepted Answer

Directory traversal. Directory traversal (also known as path traversal) allows an attacker to access files outside the intended directory by using '../' sequences.

Answer

Command injection

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 5

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Accepted Answer

Command injection. The 'cmd' parameter in a CGI script is a common indicator of command injection, where the attacker tries to execute system commands.

Answer

Local File Inclusion (LFI)

Answer

SQL injection

Answer

Directory traversal

Question 6

Which THREE of the following are effective mitigations against brute force attacks on web application login forms? (Select 3)

Accepted Answer

Account lockout after failed attempts. Account lockout, rate limiting, and CAPTCHA all hinder automated brute force attempts. Strong password policies help but are not a direct mitigation against brute force rate.

Answer

Enforcing strong password policies

Answer

Using HTTP basic authentication

Question 7

Which of the following is a primary purpose of the SameSite cookie attribute in mitigating CSRF attacks?

Accepted Answer

To prevent the cookie from being sent in cross-origin requests, mitigating CSRF. SameSite cookie attribute (Strict, Lax, or None) controls when cookies are sent in cross-site requests. Setting SameSite to Lax or Strict prevents the browser from sending cookies on cross-site POST requests, thus mitigating CSRF.

Answer

To limit the cookie to a specific path

Answer

To encrypt the cookie value

Answer

To restrict the cookie to HTTPS connections only (Secure flag)

Question 8

Which of the following describes the difference between reflected and stored (persistent) cross-site scripting (XSS)?

Accepted Answer

Reflected XSS is non-persistent and requires user interaction, while stored XSS is persistent and can affect multiple users. Reflected XSS is injected via the current request (e.g., URL parameter) and the script reflects immediately in the response. Stored XSS is saved on the server (e.g., in a database) and executed when other users view the affected page.

Answer

Reflected XSS is a server-side vulnerability, while stored XSS is a client-side vulnerability

Answer

Reflected XSS only works with HTTP POST requests, while stored XSS works with GET requests

Answer

Reflected XSS is triggered by the server, while stored XSS is triggered by the client

Question 9

Which of the following best describes the attack where an attacker uses a valid session token to impersonate a user without needing to authenticate?

Accepted Answer

Session hijacking. Session hijacking involves stealing or using a valid session token to impersonate a user, bypassing authentication.

Answer

Cross-site scripting

Answer

Phishing

Answer

Brute-force attack

Question 10

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Accepted Answer

Custom request headers (e.g., X-Requested-With). CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.

Answer

Input validation

Answer

Output encoding

Question 11

A penetration tester attempts a SQL injection on a login form and receives no error messages, but notices a delay in the server response when injecting ' OR SLEEP(5)--. Which type of SQL injection is this?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection relies on inducing a time delay to infer the truth of a condition, as no error or data is returned.

Answer

Union-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

Error-based SQL injection

Question 12

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. CSRF tokens are unique per request and validated server-side. SameSite cookies restrict cookie sending to same-site requests.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 13

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Accepted Answer

Reflected XSS. Reflected XSS occurs when the application immediately returns the user input in the response; here, the User-Agent header is reflected.

Answer

HTTP header injection

Answer

DOM-based XSS

Answer

Stored XSS

Question 14

Which TWO of the following are types of SQL injection? (Select 2)

Accepted Answer

Union-based. In-band SQL injection includes union-based and error-based. Blind SQL injection includes boolean-based and time-based. Out-of-band is another type.

Answer

Stored

Answer

DOM-based

Answer

Reflected

Question 15

A penetration tester is using SQLMap to automate exploitation of a SQL injection vulnerability found in a login form. The tester wants to retrieve the names of all databases on the backend MySQL server. Which SQLMap flag should be used?

Accepted Answer

--dbs. The --dbs flag in SQLMap enumerates all databases on the database server.

Answer

--current-db

Answer

--schema

Answer

--tables