CEH Practice Test 45 — 15 Questions

Question 1

Which tool would an ethical hacker use to automatically generate a malicious USB drive that, when plugged in, executes a payload and connects back to the attacker?

Accepted Answer

USB Rubber Ducky. The USB Rubber Ducky is a keystroke injection tool that appears as a keyboard to the host computer. When plugged in, it automatically types a pre-programmed payload at high speed, which can download and execute a reverse shell or other malware, establishing a connection back to the attacker. This makes it the correct choice for automatically generating a malicious USB drive that executes a payload upon insertion.

Answer

Wireshark

Answer

Ettercap

Answer

Metasploit

Question 2

A security analyst receives an alert about a workstation repeatedly sending large volumes of ICMP echo request packets to a broadcast address. Which type of attack is this indicative of?

Accepted Answer

Smurf attack. A Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets sent to a network broadcast address. The source IP is spoofed to be the victim's address, causing all hosts on the broadcast network to reply to the victim, overwhelming it with ICMP echo replies. This matches the alert description of large volumes of ICMP echo requests to a broadcast address.

Answer

Ping of Death

Answer

SYN flood

Answer

Slowloris

Question 3

A penetration tester discovers a service running on UDP port 161 with a default community string 'public'. They use `snmpwalk -v2c -c public 192.168.1.10` and retrieve extensive system information. Which enumeration technique is being performed?

Accepted Answer

SNMP enumeration. The question describes using SNMP (Simple Network Management Protocol) over UDP port 161 with the default community string 'public' and the `snmpwalk` command to retrieve system information. This is a classic SNMP enumeration technique, where an attacker queries MIB (Management Information Base) data to extract details like running processes, user accounts, and network configurations.

Answer

SMB enumeration

Answer

LDAP enumeration

Answer

SMTP enumeration

Question 4

Which tool is specifically designed to enumerate SMB shares and user accounts on a Windows target by leveraging the SMB protocol?

Accepted Answer

Enum4linux. Enum4linux is a tool specifically designed to enumerate SMB shares and user accounts on Windows targets by leveraging the SMB protocol. It uses the SMB/CIFS protocol to query services like the SAMR (Security Account Manager Remote) and LSARPC (Local Security Authority Remote Procedure Call) interfaces to extract user lists, share listings, and OS information. This makes it the correct choice for targeted SMB enumeration.

Answer

Wireshark

Answer

Nmap

Answer

Hydra

Question 5

A user reports that their computer is infected with ransomware. Which of the following is the BEST immediate action for the security team to take?

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the best immediate action because it isolates the ransomware, preventing it from spreading laterally to other systems via SMB, RDP, or mapped drives. This containment step stops the encryption of additional network shares and halts any command-and-control (C2) communication the ransomware might be using to exfiltrate data or receive encryption keys.

Answer

Pay the ransom to regain access

Answer

Run a full antivirus scan

Answer

Restore the system from a recent backup

Question 6

Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?

Accepted Answer

CVE-2021-41773 (Apache Path Traversal). The exhibit shows Apache HTTP Server on port 80, which is vulnerable to CVE-2021-41773, a path traversal and file disclosure flaw in Apache HTTP Server 2.4.49. This vulnerability allows an attacker to use a specially crafted URL to traverse directories outside the document root, potentially reading sensitive files like /etc/passwd or executing arbitrary code if CGI scripts are enabled. The presence of Apache on port 80 directly aligns with this vulnerability, making it the most likely to be successfully exploited.

Answer

CVE-2017-5638 (Struts2 RCE)

Answer

CVE-2014-0160 (Heartbleed)

Answer

CVE-2020-1472 (Zerologon)

Question 7

Which THREE of the following are methods for covering tracks after compromising a system? (Select 3)

Accepted Answer

Installing a rootkit to hide files and processes. Installing a rootkit is a classic method for covering tracks because it operates at the kernel or user level to intercept system calls (e.g., NtQuerySystemInformation on Windows) and hide malicious files, processes, registry keys, and network connections from standard enumeration tools like Task Manager or netstat. This prevents the victim from detecting the compromise during routine monitoring.

Answer

Escalating privileges to SYSTEM

Answer

Disabling antivirus software

Question 8

A penetration tester is enumerating services on a target Windows server. Which TWO tools are specifically designed for SMB enumeration? (Select two.)

Accepted Answer

enum4linux. enum4linux (D) is a Perl script that wraps Samba tools like smbclient, rpcclient, and net to enumerate SMB shares, users, and OS information from Windows systems. smbclient (E) is a native Samba client that allows direct interaction with SMB shares, including listing, connecting, and transferring files. Both are purpose-built for SMB enumeration.

Answer

John the Ripper

Answer

SNMPwalk

Answer

Nmap

Question 9

A penetration tester obtains a hash dump from a compromised Windows system and wants to crack LM and NTLM hashes quickly using precomputed tables. Which tool would be most efficient for this task?

Accepted Answer

Ophcrack. Ophcrack is the most efficient tool for quickly cracking LM and NTLM hashes using precomputed tables because it is specifically designed to leverage rainbow tables (precomputed hash chains) for these hash types. It can crack LM hashes almost instantly and NTLM hashes with high success rates when paired with the correct rainbow tables, making it ideal for fast offline password recovery from a hash dump.

Answer

Hashcat

Answer

John the Ripper

Answer

RainbowCrack

Question 10

Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?

Accepted Answer

Polymorphic virus. A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.

Answer

Trojan horse

Answer

Macro virus

Answer

Boot sector virus

Question 11

A security analyst receives an email that appears to be from the CEO, urgently requesting a wire transfer. The email address is slightly misspelled (ceo@cornpany.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted social engineering attack where the attacker customizes the message for a specific individual or organization, often using a spoofed or lookalike domain. In this scenario, the email is directed at a security analyst, impersonates the CEO, and uses a slightly misspelled domain (ceo@cornpany.com) to deceive the recipient, which is a classic spear phishing technique because it targets a specific role within the company.

Answer

Vishing

Answer

Whaling

Answer

Phishing

Question 12

After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?

Accepted Answer

Static analysis. The analyst is performing static analysis because they are examining the file without executing it. Running the 'strings' command extracts readable text from the binary, and uploading to VirusTotal checks the file's hash against known malware signatures — both are non-behavioral, non-runtime techniques. Static analysis focuses on file properties, code structure, and metadata without triggering the malware's execution.

Answer

Behavioral analysis

Answer

Code analysis

Answer

Dynamic analysis

Question 13

Which malware type is characterized by self-replication across networks without needing a host file?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across network connections without requiring a host file or user intervention. It exploits vulnerabilities in network protocols or services (e.g., SMB, RDP) to propagate autonomously, as seen with WannaCry's use of EternalBlue.

Answer

Trojan

Answer

Rootkit

Answer

Ransomware

Question 14

Which TWO tools are commonly used for ARP poisoning attacks?

Accepted Answer

Cain & Abel. Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 15

A network administrator notices an unusually high number of half-open TCP connections to the company's web server. The source IPs are spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to the target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, exhausting its connection queue and preventing legitimate connections. The description of half-open TCP connections with spoofed source IPs is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

UDP flood

Answer

ICMP flood