CEH Practice Test 46 — 15 Questions

Question 1

During a penetration test, you find a web application that includes files using a parameter like /index.php?page=about. When you change the parameter to /etc/passwd, the application returns the contents of the password file. Which vulnerability is present?

Accepted Answer

Local File Inclusion (LFI). Local File Inclusion (LFI) allows an attacker to include local files on the server through path traversal or direct inclusion.

Answer

Remote File Inclusion (RFI)

Answer

Command Injection

Answer

Directory Traversal

Question 2

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA is an asymmetric algorithm using a public/private key pair. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 3

A web application uses XML to transfer data. An attacker submits the following payload: ']>&xxe;'. What vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read local files.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Question 4

A penetration tester is testing an IIS web server and wants to exploit a WebDAV misconfiguration to upload a web shell. Which HTTP method should the tester check to determine if WebDAV is enabled and allows file uploads?

Accepted Answer

OPTIONS. The OPTIONS method queries the server for supported HTTP methods. If WebDAV is enabled, the response will include methods like PUT, DELETE, PROPFIND, etc. PUT is used for upload, but OPTIONS first confirms availability.

Answer

MOVE

Answer

PUT

Answer

PROPFIND

Question 5

During a security assessment, a tester discovers an endpoint that reflects the 'User-Agent' header in the response without sanitization. The tester wants to confirm a reflected XSS vulnerability. Which of the following payloads would be MOST effective to demonstrate the issue in a single request?

Accepted Answer

Set the User-Agent to: . Using a simple script alert like is a standard proof-of-concept for reflected XSS. The exact payload may vary, but it must execute JavaScript. The simplest is an alert.

Answer

Set the User-Agent to: <img src=x onerror=alert(1)>

Answer

Set the User-Agent to: ' OR '1'='1

Answer

Set the User-Agent to: ../../../../etc/passwd

Question 6

A security analyst notices that a web application returns different HTTP responses for valid and invalid usernames during login. Which attack is this behavior most likely facilitating?

Accepted Answer

Username enumeration. The difference in responses (e.g., 'User not found' vs 'Invalid password') allows an attacker to enumerate valid usernames, which is a common first step in credential stuffing or brute-force attacks.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 7

An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?

Accepted Answer

The application includes a parameter like 'url=' that fetches remote resources. SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.

Answer

The application uses user input in file inclusion functions like include()

Answer

The application reflects user input in HTTP headers

Answer

The application stores user input in a database without sanitization

Question 8

A security analyst notices that a web application returns different error messages for valid and invalid usernames during login. Which type of attack is this application MOST vulnerable to?

Accepted Answer

Username enumeration. The different error messages allow an attacker to enumerate valid usernames, which is a common precursor to brute-force or credential-stuffing attacks.

Answer

Directory traversal

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 9

During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?

Accepted Answer

Directory traversal. The use of '../' sequences to traverse directories and access files outside the web root is classic directory traversal.

Answer

Remote File Inclusion (RFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

Local File Inclusion (LFI)

Question 10

A security team discovers that their web application is vulnerable to a Server-Side Request Forgery (SSRF) attack. Which of the following is the MOST effective mitigation technique to prevent SSRF?

Accepted Answer

Implement a whitelist of allowed domains and IP addresses for outbound requests. Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

Answer

Use input validation to block URLs containing '127.0.0.1' or 'localhost'

Answer

Implement CSRF tokens on all forms

Answer

Disable unnecessary HTTP methods on the web server

Question 11

During a web application penetration test, a tester uses Burp Suite's Repeater tool to manually manipulate a request and observe the response. After sending the same request multiple times, the application returns a 302 redirect pointing to a login page. What is the MOST likely cause?

Accepted Answer

The session token has expired and the user must re-authenticate. A 302 redirect to a login page typically indicates that the session has expired or the tester's session is no longer valid. The application is redirecting to enforce authentication.

Answer

The server is rate-limiting the requests

Answer

A cross-site request forgery (CSRF) token mismatch occurred

Answer

The server detected the use of a proxy and blocked the request

Question 12

A penetration tester uses a tool to intercept and modify HTTP/HTTPS requests in real-time between the browser and the web application. Which tool is being used?

Accepted Answer

Burp Suite Proxy. Burp Suite's Proxy module allows interception and modification of HTTP/HTTPS traffic. Repeater is for resending requests, Intruder for automated attacks, Scanner for vulnerability scanning.

Answer

SQLMap

Answer

Nmap

Answer

Metasploit

Question 13

An application uses the SameSite cookie attribute. Which TWO of the following are valid values for this attribute and their purposes? (Select two)

Accepted Answer

Lax - Cookie is sent for top-level navigations with safe methods. SameSite can be set to 'Lax' (default) which allows cookies for top-level navigations, or 'Strict' which prevents cookies on cross-site requests. 'None' requires Secure flag but is used for cross-site.

Answer

None - Cookie is sent on all cross-site requests

Answer

Secure - Cookie is sent only over HTTPS

Answer

HttpOnly - Cookie is inaccessible to JavaScript

Question 14

A security team wants to test their web application for vulnerabilities. Which Burp Suite tool is BEST suited for automating attacks like brute-force or fuzzing?

Accepted Answer

Intruder. Intruder is designed for automated customized attacks including brute-force, fuzzing, and credential stuffing.

Answer

Proxy

Answer

Repeater

Answer

Scanner

Question 15

A web application takes a URL from user input and fetches the content to display on the page. An attacker submits a URL pointing to an internal service like http://localhost:8080/admin. The server retrieves the internal resource and returns it. What is this attack?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) occurs when a server makes requests to internal resources based on user-supplied URLs.

Answer

Cross-Site Scripting (XSS)

Answer

Directory Traversal

Answer

Remote File Inclusion (RFI)