CEH Practice Test 46 — 15 Questions

Question 1

A security team detects unusual outbound traffic from a host that appears to be a reverse shell. Which of the following Nmap features would be MOST effective for identifying the service running on the listening port of the command-and-control server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service version detection using the -sV flag. The -sV flag instructs Nmap to perform service version detection by probing open ports and analyzing the responses to determine the exact application and version running on the listening port. In a reverse shell scenario, identifying the service (e.g., a specific SSH, HTTP, or custom listener) on the C2 server is critical for understanding the attack vector and planning remediation.

Answer

UDP scan using the -sU flag

Answer

Nmap Scripting Engine (NSE) with the http-enum script

Answer

OS fingerprinting using the -O flag

Question 2

An attacker is attempting to perform an Insecure Direct Object Reference (IDOR) attack on a web application. Which TWO conditions are necessary for this attack to succeed?

Accepted Answer

The application exposes direct references to internal objects (e.g., user IDs in URLs). IDOR exploits direct references to objects without proper authorization checks. The application must expose direct references (e.g., IDs in URLs) and fail to verify the user's permission to access the object.

Answer

The application uses indirect object references (e.g., random tokens)

Answer

The application has a CSRF vulnerability

Answer

The application implements strong access controls on every object

Question 3

An IoT device uses the MQTT protocol without TLS. An attacker on the same network subscribes to all topics and captures messages. What is the MOST significant security risk?

Accepted Answer

Loss of message confidentiality. Without TLS, MQTT traffic is sent in cleartext, allowing interception and reading of sensitive data.

Answer

Firmware corruption

Answer

Denial of service

Answer

Replay attacks

Question 4

A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)

Accepted Answer

Using Hashcat with a brute-force attack on GPU. Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.

Answer

Using RainbowCrack with precomputed rainbow tables for NTLM

Answer

Performing an online brute-force against the SAM database

Answer

Using Ophcrack with rainbow tables for NTLM

Question 5

Which THREE of the following are components of the CHPSET system hacking methodology?

Accepted Answer

Cracking passwords. Cracking passwords is a core phase in the CHPSET (Cracking, Hacking, Privilege escalation, System hacking, Erasing tracks, Tunneling) system hacking methodology. After gaining initial access, the attacker extracts password hashes (e.g., from SAM or LSASS) and uses tools like John the Ripper or Hashcat to crack them offline, enabling further access or lateral movement.

Answer

Port scanning

Answer

Vulnerability scanning

Question 6

Which of the following is an example of passive OS fingerprinting?

Accepted Answer

Analyzing TTL values from captured packets. Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.

Answer

Performing a TCP SYN scan

Answer

Nmap -O scan

Answer

Sending ICMP echo requests

Question 7

A penetration tester discovers a Linux server with the SUID bit set on the 'find' command. How could this be exploited for privilege escalation?

Accepted Answer

By running 'find / -exec /bin/sh \;' to spawn a root shell. When the SUID bit is set on the 'find' command, it executes with the privileges of the file owner (typically root). The '-exec' option allows arbitrary command execution. Running 'find / -exec /bin/sh \;' spawns a shell with root privileges, enabling full system compromise.

Answer

By using 'find' to delete log files

Answer

By using 'find' to search for files owned by root

Answer

By using 'find' to mount a remote share

Question 8

During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?

Accepted Answer

Perform banner grabbing on port 22 to identify the SSH version.. Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.

Answer

Perform SNMP enumeration to gather system information.

Answer

Attempt a DNS zone transfer from the server.

Answer

Enumerate NetBIOS names using `nbtstat`.

Question 9

A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP echo requests. The attacker sends ICMP echo request packets with a spoofed source IP (the victim's IP) to the network's broadcast address, causing every host on that network to reply to the victim, overwhelming it with ICMP echo replies. This amplification effect makes the attack highly effective, as a single request generates many responses.

Answer

UDP flood

Answer

SYN flood

Answer

Ping of Death

Question 10

A penetration tester is attempting to enumerate user accounts on a mail server. They connect to port 25 and issue the commands `VRFY root` and `EXPN support`. Which protocol is being targeted?

Accepted Answer

SMTP. The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Answer

LDAP

Answer

SMB

Answer

SNMP

Question 11

A security analyst identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are effective mitigation techniques for SSRF?

Accepted Answer

Disable unnecessary URL schemas (e.g., file://, dict://). Whitelisting allowed domains prevents requests to arbitrary targets. Disabling unused URL schemas (e.g., file://) reduces attack surface. Input validation alone is insufficient.

Answer

Use a blacklist to block private IP ranges

Answer

Increase the timeout for HTTP requests

Answer

Encode user input in base64 before passing to URL functions

Question 12

An analyst uses the following command to capture traffic: tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80. After generating traffic from a web server at 10.0.0.5, the analyst examines the pcap with Wireshark. What type of traffic will appear in the capture?

Accepted Answer

HTTP traffic to and from 10.0.0.5. The command `tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80` captures only packets that match both conditions: the IP address is 10.0.0.5 (source or destination) and the port is 80 (source or destination). Since port 80 is the default HTTP port, this filter captures HTTP traffic to and from the web server at 10.0.0.5. The `host` keyword includes both directions, so the capture is not limited to traffic originating from the server.

Answer

All HTTP traffic on the network

Answer

Only HTTP traffic originating from 10.0.0.5

Answer

All traffic from 10.0.0.5 on any port

Question 13

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

Accepted Answer

Backdoor Trojan. The outbound traffic on port 4444, a common port for the Metasploit Meterpreter reverse shell, combined with the 'strings' output showing 'cmd.exe /c' (a command shell invocation) and an IP address, indicates a backdoor Trojan. This malware type establishes a covert reverse connection to an attacker's command-and-control server, allowing remote shell access without a legitimate service on the target port.

Answer

Worm

Answer

Keylogger

Answer

Ransomware

Question 14

What can be inferred from the output?

Accepted Answer

The domain has two mail servers with different priority levels.. The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Answer

The command failed because the DNS server is unreachable.

Answer

The domain uses SPF records to prevent email spoofing.

Answer

The domain's web server IP address is 192.168.1.1.

Question 15

Drag and drop the steps to perform a SQL injection attack manually into the correct order.

Accepted Answer

Identify vulnerability, then test injection points, then find number of columns, then use UNION to combine results, then extract data. The correct sequence for manual SQL injection starts with identifying a vulnerable input (e.g., by observing error messages or behavior), then testing injection (e.g., adding a single quote), finding the number of columns using ORDER BY or UNION SELECT, using UNION to combine attacker-controlled queries, and finally extracting sensitive data. This order ensures each step builds on the previous one.

Answer

Test injection points, then identify vulnerability, then find number of columns, then use UNION, then extract data

Answer

Identify vulnerability, then find number of columns, then test injection points, then use UNION, then extract data

Answer

Test injection points, then find number of columns, then identify vulnerability, then use UNION, then extract data