CEH Practice Test 44 — 15 Questions

Question 1

Which TWO of the following are characteristics of a reflected Cross-Site Scripting (XSS) attack? (Select 2)

Accepted Answer

The attack is typically delivered through a crafted link. Reflected XSS requires user interaction (clicking a link) and does not persist on the server.

Answer

The script executes in the server-side context

Answer

The attack affects all users who visit the compromised page without any interaction

Answer

The malicious script is permanently stored on the server

Question 2

A pentester uses Burp Suite's Intruder to perform a brute-force attack on a login form. Which TWO of the following Intruder attack types would be appropriate for testing different payload combinations?

Accepted Answer

Pitchfork. For testing different payload combinations, you need multiple payload sets. Pitchfork uses multiple payload sets and pairs them position-by-position, testing different combinations where each set provides distinct values. Cluster bomb uses multiple payload sets and tests every possible combination across all positions, which is ideal for brute-force attacks on login forms. Sniper and Battering ram use a single payload set and are not appropriate for testing different combinations.

Answer

Sniper

Answer

Direct

Answer

Battering ram

Question 3

A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.

Answer

Vulnerability scanning

Answer

Social engineering

Answer

Active reconnaissance

Question 4

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Accepted Answer

Session hijacking via cross-site scripting (XSS). The absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Clickjacking

Question 5

During a web application test, an analyst intercepts a request containing a 'Referer' header that points to a different domain. The analyst modifies the request by removing the 'Referer' header and the action still executes successfully. Which type of attack is the analyst testing?

Accepted Answer

Cross-Site Request Forgery (CSRF). CSRF protection often relies on checking the Referer header; if it can be removed or spoofed, the application is vulnerable to CSRF.

Answer

Server-Side Request Forgery (SSRF)

Answer

Clickjacking

Answer

Cross-Site Scripting (XSS)

Question 6

An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?

Accepted Answer

Closed. When Nmap sends a TCP SYN packet to a port and receives a TCP RST packet in response, it indicates that the port is reachable but no service is listening on it. Per RFC 793, a RST is sent when a SYN arrives on a closed port, so Nmap classifies this port as 'closed'.

Answer

Filtered

Answer

Unfiltered

Answer

Open

Question 7

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Accepted Answer

Send SYN, then receive SYN-ACK, then send ACK. The TCP three-way handshake establishes a connection: SYN, SYN-ACK, ACK, then data transfer.

Answer

Send SYN-ACK, then send SYN, then send ACK

Answer

Send SYN, then send ACK, then send SYN-ACK

Answer

Send ACK, then send SYN, then send SYN-ACK

Question 8

Match each encryption algorithm to its type.

Accepted Answer

AES: Symmetric encryption. AES and 3DES are symmetric algorithms, while RSA and ECC are asymmetric. The distractors swap these types.

Answer

AES: Asymmetric encryption

Answer

RSA: Symmetric encryption

Question 9

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

Accepted Answer

The port is closed. When hping3 sends a SYN packet to a closed port, the target responds with an RST/ACK packet per TCP RFC 793. This indicates that the port is reachable but no service is listening on it, hence the immediate reset.

Answer

The port is open and listening

Answer

The port is filtered by a firewall

Answer

The port is in a TIME_WAIT state

Question 10

A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.. The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.

Answer

The target host has a host-based firewall that drops SYN packets but allows full connections.

Answer

The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.

Answer

Nmap's SYN scan requires root privileges, and the tester ran it without sudo.

Question 11

Which TWO of the following are examples of application-layer DDoS attacks? (Choose two.)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that works by opening multiple HTTP connections to a target web server and keeping them alive indefinitely by sending partial HTTP requests. This exhausts the server's connection pool, preventing legitimate users from connecting. It specifically targets the HTTP protocol at Layer 7, making it an application-layer attack.

Answer

UDP flood

Answer

SYN flood

Answer

Smurf attack

Question 12

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Accepted Answer

Static analysis using strings and PEiD. Static analysis using tools like strings and PEiD should be performed first to quickly inspect the file's metadata, embedded strings, and packer information without executing it. Since the digital signature validation fails despite claiming to be from Microsoft, static analysis can reveal anomalies such as unusual section names, suspicious imports, or packed code that indicate tampering. This non-execution approach is safe and efficient for initial triage, avoiding the risks of dynamic analysis or running the file.

Answer

Upload to VirusTotal

Answer

Dynamic analysis in a sandbox

Answer

Run the file on a production system to observe behavior

Question 13

A security analyst notices that the ARP cache on a workstation contains multiple entries for the same IP address with different MAC addresses. Which attack is likely occurring?

Accepted Answer

ARP poisoning. ARP poisoning (also called ARP spoofing) occurs when an attacker sends forged ARP replies to a network, associating their own MAC address with the IP address of a legitimate host (e.g., the default gateway). The workstation's ARP cache then stores multiple MAC addresses for the same IP, as the cache is updated with each fraudulent reply. This allows the attacker to intercept, modify, or block traffic intended for that IP, enabling man-in-the-middle attacks.

Answer

Session hijacking

Answer

DNS spoofing

Answer

MAC flooding

Question 14

Which TWO of the following correctly describe aspects of the shared responsibility model in cloud computing?

Accepted Answer

The customer is responsible for securing data stored in the cloud. In the shared responsibility model, the customer is responsible for security IN the cloud (e.g., data, application configurations, identity management) while the provider is responsible for security OF the cloud (e.g., physical security, network infrastructure). Option C is correct because customers must secure their stored data. Option E is correct because providers secure data center physical access. Option A is incorrect: the cloud provider does not manage customer encryption keys; that is the customer's responsibility. Option B is incorrect: in PaaS, the provider manages the network firewall; the customer manages application-level security only. Option D is incorrect: in IaaS, the customer patches the guest OS; the provider patches the hypervisor and physical infrastructure.

Answer

The cloud provider is responsible for managing customer application encryption keys

Answer

The customer is responsible for network firewall configuration in PaaS

Answer

The cloud provider is responsible for patching the guest operating system in IaaS

Question 15

Which TWO of the following are passive reconnaissance techniques?

Accepted Answer

Google hacking (dorking). Google hacking (dorking) is a passive reconnaissance technique because it involves using advanced search operators in Google to discover publicly indexed information about a target, such as exposed configuration files or login pages, without sending any packets directly to the target's systems. It relies entirely on the search engine's pre-existing index, making it undetectable and non-intrusive. Similarly, WHOIS lookup is a passive reconnaissance technique because it queries public WHOIS databases to retrieve domain registration information, such as registrant details, name servers, and expiration dates, without directly interacting with the target's own infrastructure. Both techniques align with the CEH definition of passive reconnaissance, where no direct interaction with the target occurs.

Answer

Ping sweep

Answer

Nmap SYN scan

Answer

Banner grabbing with Netcat