CEH Practice Test 46 — 15 Questions

Question 1

An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?

Accepted Answer

The application includes a parameter like 'url=' that fetches remote resources. SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.

Answer

The application uses user input in file inclusion functions like include()

Answer

The application reflects user input in HTTP headers

Answer

The application stores user input in a database without sanitization

Question 2

An analyst reviews the following HTTP response: HTTP/1.1 200 OK Set-Cookie: sessionid=abc123; SameSite=None; Secure ...

Welcome back!

. What possible vulnerability exists if the application does not use CSRF tokens?

Accepted Answer

Cross-site request forgery (CSRF). SameSite=None allows cross-site requests to include cookies, making CSRF possible if no CSRF tokens are used. SameSite=Lax or Strict would block some CSRF attacks.

Answer

Clickjacking

Answer

Cross-site scripting (XSS)

Answer

Session fixation

Question 3

Which THREE of the following are common methods used to mitigate DDoS attacks? (Select 3)

Accepted Answer

Rate limiting. Rate limiting (B) is correct because it caps the number of requests or packets a client or service can send per unit time, so volumetric floods and application-layer floods are throttled before they exhaust server or bandwidth resources. Scrubbing centers (C) are correct because they divert incoming traffic to specialized cleaning facilities that filter out malicious DDoS packets via signature, anomaly, and behavioral analysis and forward only legitimate traffic to the origin. Anycast network distribution (E) is correct because advertising the same IP prefix from many geographically dispersed points of presence spreads attack traffic across the provider's global edge, absorbing and dispersing volumetric floods while bringing legitimate users to the nearest node. MAC flooding (A) is not a mitigation but a Layer 2 switch attack that overflows the CAM table to force hub-like flooding, and ARP poisoning (D) is a Layer 2 man-in-the-middle attack that forges ARP replies to associate an attacker's MAC with a victim's IP, so neither belongs among DDoS mitigation methods.

Answer

MAC flooding

Answer

ARP poisoning

Question 4

A security team discovers that an attacker has been using steganography to exfiltrate data from the corporate network. The attacker hid data inside image files and uploaded them to a public image hosting site. Which of the following is the BEST method to detect this type of exfiltration?

Accepted Answer

Deploy a steganography detection tool that analyzes image pixel patterns for statistical anomalies. Steganography detection tools analyze statistical anomalies in pixel patterns (e.g., LSB embedding, DCT coefficient deviations) that are invisible to the human eye but detectable via algorithms like chi-square analysis or RS analysis. This directly identifies hidden payloads without relying on file hashes or headers, which steganography does not alter.

Answer

Compare file hashes of uploaded images to known-good baselines

Answer

Block all image uploads to external sites

Answer

Use network-based DLP to inspect image file headers for hidden data

Question 5

Which THREE of the following are types of SQL injection attacks? (Choose 3)

Accepted Answer

Out-of-band SQLi (e.g., DNS or HTTP exfiltration). Option A is correct because out-of-band SQLi is a recognized SQL injection category in which the attacker uses a separate channel such as DNS or HTTP requests to exfiltrate data when the database server cannot return results directly through the application response. Option C is correct because in-band SQLi is the classic SQL injection type where results are returned in the same communication channel, typically via error-based or UNION-based techniques that leverage database error messages or UNION SELECT statements. Option D is correct because blind (inferential) SQLi is a standard SQL injection category where no data is directly returned; instead, attackers infer information using boolean-based true/false responses or time-based delays such as WAITFOR DELAY or SLEEP. Option B is not a recognized SQLi type; 'stored' describes stored XSS, not SQL injection, even though stored procedures can be involved in SQLi. Option E is also not a SQLi category; 'reflected' describes reflected XSS, where malicious script is echoed back by the application rather than injected into SQL queries.

Answer

Stored SQLi

Answer

Reflected SQLi

Question 6

A security analyst is investigating a potential container escape in a Kubernetes cluster. Which THREE of the following are common indicators of a container escape?

Accepted Answer

A process running inside the container with CAP_SYS_ADMIN capability. Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

Answer

The container has a read-only root filesystem

Answer

The container is running as a non-root user

Question 7

A web application tester uses the following Burp Suite feature to automatically send multiple requests with different payloads to test for common vulnerabilities. Which feature is being used?

Accepted Answer

Intruder. Burp Intruder is designed to automate sending large numbers of requests with varying payloads, making it the tool for fuzzing, brute force, and injection testing. It lets testers define payload positions and payload sets, then iterates through them automatically. This matches the scenario of sending multiple requests with different payloads to test for vulnerabilities.

Answer

Repeater

Answer

Proxy

Answer

Scanner

Question 8

After gaining access to a system, an attacker modifies log files to remove evidence of their activities. This action is part of which phase of the system hacking methodology?

Accepted Answer

Erasing tracks. 'Erasing tracks,' because after gaining access, the attacker's goal is to cover their footprints by modifying or deleting log files, clearing event logs, or using tools like `wevtutil` or `clearev` to remove evidence of their activities. This phase ensures the system administrator cannot detect the intrusion or trace the attacker's actions.

Answer

Spying

Answer

Executing applications

Answer

Hiding files

Question 9

Which of the following is a symmetric encryption algorithm that uses a block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm that operates as a block cipher with a fixed block size of 128 bits and supports key sizes of 128, 192, or 256 bits. It was established by NIST in 2001 (FIPS 197) and is widely used in modern cryptographic systems, including wireless security (WPA2/WPA3) and TLS.

Answer

3DES

Answer

RC4

Answer

RSA

Question 10

A security analyst wants to gather information about a target domain using public records without directly interacting with the target's systems. Which technique is the analyst employing?

Accepted Answer

OSINT using WHOIS queries. OSINT (Open Source Intelligence) using WHOIS queries is a passive reconnaissance technique that gathers domain registration details from public WHOIS databases without interacting with the target's systems. This aligns with the requirement to use public records and avoid direct contact, making it the correct choice for footprinting.

Answer

Vulnerability scanning

Answer

Active reconnaissance

Answer

Social engineering

Question 11

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 12

Which TWO of the following are examples of active reconnaissance techniques? (Select two)

Accepted Answer

Running an Nmap SYN scan against a target. An Nmap SYN scan (also known as a half-open scan) sends a TCP SYN packet to a target port and analyzes the response. If a SYN/ACK is received, the port is open; if an RST is received, the port is closed. This scan actively interacts with the target system by sending network traffic, making it an active reconnaissance technique.

Answer

Querying Shodan for open ports on a target

Answer

Searching for sensitive files using Google dorks

Answer

Performing a WHOIS lookup

Question 13

Which TWO of the following are password cracking techniques? (Select 2)

Accepted Answer

Rainbow table attack. A rainbow table attack (B) is a password cracking technique that uses precomputed hash chains to reverse cryptographic hash functions and recover plaintext passwords quickly, trading computation time for storage space. A dictionary attack (E) is also a password cracking technique that systematically tries words from a predefined wordlist, often with mutations, against a password hash or login to guess the correct password. The other options are not password cracking techniques: SQL injection (A) is a web application injection attack that manipulates database queries, phishing (C) is a social engineering attack that tricks users into revealing credentials, and ARP spoofing (D) is a network attack that poisons ARP caches to intercept traffic.

Answer

SQL injection

Answer

Phishing

Answer

ARP spoofing

Question 14

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

Accepted Answer

SQL injection in SOAP service. The SOAP service returns multiple user records in response to a crafted request, indicating that the input is being interpolated into a database query without proper sanitization. This is classic SQL injection (SQLi) in a SOAP XML context, where an attacker can embed SQL payloads within XML elements (e.g., admin' OR '1'='1) to manipulate the backend SQL query and retrieve all records.

Answer

XML External Entity (XXE) injection

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 15

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

Accepted Answer

Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.. The symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

Answer

Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.

Answer

Increase the number of application servers to handle the load.

Answer

Run a SQL injection scanner on the application.