CEH Practice Test 45 — 15 Questions

Question 1

An attacker performs a downgrade attack on a TLS connection, forcing the client and server to negotiate a weaker cipher suite. This attack exploits which of the following?

Accepted Answer

The fallback mechanism in SSL/TLS implementations. Downgrade attacks (e.g., POODLE, FREAK, Logjam) exploit the SSL/TLS fallback mechanism, where a client and server negotiate down to an older, weaker protocol or cipher suite if the initial handshake fails. An attacker forces that fallback to a vulnerable option, then exploits the weakness.

Answer

A vulnerability in the TLS 1.3 handshake

Answer

A known weakness in the Diffie-Hellman key exchange

Answer

The ability to modify the ClientHello message

Question 2

Which of the following is a recommended countermeasure against WPA2 KRACK attacks?

Accepted Answer

Patch all clients and access points. KRACK (Key Reinstallation Attack) exploits the WPA2 4-way handshake by forcing nonce reuse, allowing an attacker to decrypt and potentially inject traffic. The definitive countermeasure is patching both clients and access points, because the vulnerability exists in the supplicant (client) and authenticator implementations, not in the WPA2 protocol itself. Vendors released patches that prevent key reinstallation, so updating firmware and OS on all devices is required.

Answer

Enable MAC filtering

Answer

Disable WPS

Answer

Switch to WEP encryption

Question 3

A web application allows users to view documents by specifying a filename in the URL, e.g., /getDocument?file=report.pdf. A tester changes the file parameter to '../../etc/passwd' and retrieves the system password file. Which vulnerability is being exploited?

Accepted Answer

Directory traversal. The tester manipulated the 'file' parameter with '../' sequences to escape the intended directory and read /etc/passwd, which is classic directory traversal (path traversal). The vulnerability arises because the application fails to sanitize user-supplied file paths, allowing access to files outside the web root.

Answer

Local File Inclusion (LFI)

Answer

Remote File Inclusion (RFI)

Answer

Command injection

Question 4

A penetration tester is using SQLMap to automate exploitation of a SQL injection vulnerability found in a login form. The tester wants to retrieve the names of all databases on the backend MySQL server. Which SQLMap flag should be used?

Accepted Answer

--dbs. The --dbs flag in SQLMap instructs the tool to enumerate all databases on the target DBMS. This is the standard first step after confirming an injection point, and it directly answers the tester's goal of retrieving database names. It works against MySQL, MSSQL, Oracle, PostgreSQL, and others.

Answer

--current-db

Answer

--schema

Answer

--tables

Question 5

Which of the following is a recommended defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Implementing CSRF tokens in forms. CSRF tokens are the canonical defense: the server issues a unique, unpredictable token tied to the user's session and requires it on state-changing requests. An attacker's forged request from a malicious site cannot read or guess the token due to same-origin policy, so the request is rejected. This directly defeats CSRF.

Answer

Enabling directory listing on the web server

Answer

Using a same-origin policy with CORS headers

Answer

Setting the HttpOnly flag on cookies

Question 6

Which cryptographic algorithm is classified as symmetric and uses a block cipher with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits, and it operates on 128-bit blocks. It is the standard symmetric encryption algorithm used worldwide and is the correct answer because it matches both criteria: symmetric and block cipher with those key sizes.

Answer

ECC

Answer

Diffie-Hellman

Answer

RSA

Question 7

In PKI, what is the primary role of a Certificate Authority (CA)?

Accepted Answer

To issue and digitally sign certificates. A Certificate Authority (CA) is the trusted entity in a PKI that issues digital certificates and digitally signs them with its private key, thereby binding a public key to an identity. The CA's signature allows relying parties to verify that the certificate is authentic and has not been tampered with. This is the foundational trust role of a CA.

Answer

To revoke user passwords

Answer

To generate random session keys

Answer

To encrypt data between client and server

Question 8

Which Burp Suite tool is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials or fuzzing parameters?

Accepted Answer

Intruder. Burp Intruder is specifically designed to automate customized attacks against web applications, such as brute-forcing login credentials, fuzzing parameters, and enumerating identifiers. It allows testers to configure payloads, attack types, and grep-match rules to analyze responses. This makes it the correct tool for automating repetitive attacks.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 9

A tester sends the following payload to a web application: %3Cscript%3Ealert('XSS')%3C/script%3E. The application echoes back the decoded payload in the response without sanitization. This behavior is typical of which type of vulnerability?

Accepted Answer

Reflected XSS. Reflected XSS occurs when an application immediately echoes user-supplied input in the response without proper sanitization. The payload is not stored on the server but reflected back to the user, executing in the victim's browser. The given payload is URL-encoded and decoded by the server, then echoed, which is typical of reflected XSS.

Answer

HTTP Response Splitting

Answer

DOM-based XSS

Answer

Stored XSS

Question 10

Which cloud security assessment tool is specifically designed to audit AWS environments against best practices and CIS benchmarks?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that natively supports AWS and evaluates configurations against CIS benchmarks and security best practices. It uses read-only API calls to enumerate resources and produces an HTML report highlighting misconfigurations such as public S3 buckets, overly permissive IAM policies, and unencrypted volumes. This makes it the correct answer for auditing AWS against CIS benchmarks.

Answer

Pacu

Answer

Nessus

Answer

Metasploit

Question 11

A security team has collected a hash file from a compromised Windows server that contains NTLM hashes. They want to crack the passwords as quickly as possible using a precomputed lookup table. Which tool and technique combination is BEST suited for this task?

Accepted Answer

Use RainbowCrack with precomputed rainbow tables. RainbowCrack is specifically designed for fast password cracking using precomputed rainbow tables, which are lookup tables that store hash chains for rapid reversal of hashes. Since the team already has NTLM hashes and wants the quickest method, RainbowCrack with precomputed tables avoids the computational overhead of real-time hashing, making it the best fit for this scenario.

Answer

Use John the Ripper in incremental mode

Answer

Use Hydra with a dictionary of common passwords

Answer

Use Hashcat with a rules-based attack

Question 12

Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)

Accepted Answer

It changes its code signature each time it replicates. A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.

Answer

It does not require a host file to spread

Answer

It only infects the master boot record

Answer

It attaches to email messages automatically

Question 13

A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The command uses the -sS flag for a TCP SYN scan (stealth scan), -sV for service version detection, and -O for OS fingerprinting, targeting only the four specified ports (22, 80, 443, 3389) across the 192.168.1.0/24 subnet. This combination performs a half-open TCP scan on those ports, probes open ports to identify service versions, and attempts to determine the operating system based on TCP/IP stack responses.

Answer

Perform a UDP scan on the four specified ports and identify running services

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Question 14

An attacker attempts to enumerate valid email users by connecting to an SMTP server and issuing the following commands: EHLO example.com, VRFY root, VRFY admin, VRFY user1. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY. The VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.

Answer

RCPT TO

Answer

MAIL FROM

Answer

EXPN

Question 15

A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?

Accepted Answer

Directory traversal. Directory traversal attacks exploit insufficient input validation to access files outside the intended directory by using '../' sequences.

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Answer

Command injection