CEH Practice Test 47 — 15 Questions

Question 1

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Accepted Answer

Using Google dorking to find exposed documents. Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Answer

Performing a ping sweep on the target network

Answer

Conducting a port scan with Nmap

Answer

Brute forcing subdomains via DNS queries

Question 2

An attacker sets up a fake access point with the same SSID as a legitimate corporate network. Clients connecting to this AP are prompted to enter their network credentials. Which type of attack is this?

Accepted Answer

Evil twin attack. The attack is an evil twin attack, where a rogue AP mimics a legitimate one to capture credentials or perform man-in-the-middle.

Answer

Replay attack

Answer

WPS PIN attack

Answer

De-authentication attack

Question 3

A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?

Accepted Answer

Sender's private key. Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).

Answer

Sender's public key

Answer

Recipient's private key

Answer

Recipient's public key

Question 4

A security analyst observes repeated attempts to validate user accounts via SMTP using VRFY commands from an external IP. What is the BEST immediate action to mitigate this reconnaissance?

Accepted Answer

Disable VRFY and EXPN commands in the SMTP server configuration. The VRFY command is an SMTP protocol feature (RFC 821) that allows a client to verify whether a specific email address exists on the server. Attackers use VRFY and EXPN to enumerate valid user accounts during the reconnaissance phase. Disabling these commands in the SMTP server configuration directly stops this enumeration technique without affecting legitimate mail delivery.

Answer

Upgrade to the latest version of the SMTP server

Answer

Enable SMTP authentication for all incoming connections

Answer

Block the external IP address at the firewall

Question 5

Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)

Accepted Answer

Spoofs the source IP address of the victim. In a DNS amplification DDoS attack, the attacker spoofs the source IP address of the victim in DNS queries sent to open resolvers. This causes the resolvers to send their large responses to the victim, not the attacker, thereby directing the amplified traffic at the target. Without IP spoofing, the attack would not be able to flood the victim with responses.

Answer

Exploits the TCP handshake process

Answer

Floods the target with small ICMP packets

Question 6

A security analyst notices that a web server is responding very slowly to legitimate requests. The server logs show many incomplete HTTP GET requests that never complete, each opened slowly over time from many different IP addresses. Which attack is most likely occurring?

Accepted Answer

Slowloris. Slowloris is a denial-of-service attack that works by opening multiple HTTP connections to a target web server and sending partial HTTP GET requests, never completing them. The server keeps these connections open waiting for the request to finish, eventually exhausting its connection pool and denying service to legitimate users. The key indicators are many incomplete GET requests from diverse IPs and slow server response, which match the scenario exactly.

Answer

Ping of Death

Answer

HTTP flood

Answer

SYN flood

Question 7

During a forensic investigation, an analyst retrieves a suspicious executable. Running 'strings' reveals no readable text, and VirusTotal shows zero detections. However, when executed in a sandbox, the binary connects to a remote IP and injects code into 'explorer.exe'. Which conclusion is MOST accurate?

Accepted Answer

The file is likely a packed trojan that evades signature-based detection. The absence of readable strings and zero VirusTotal detections strongly suggest the executable is packed or obfuscated, a common evasion technique used by trojans. The sandbox behavior—connecting to a remote IP and injecting code into explorer.exe—confirms malicious intent, specifically trojan-like remote access and process injection. This combination of static stealth and dynamic malicious activity indicates a packed trojan designed to bypass signature-based antivirus.

Answer

The file is a worm because it connects to a remote IP

Answer

The file is benign because static analysis found no indicators

Answer

The file is a false positive and the sandbox environment is compromised

Question 8

Which TWO of the following are examples of session hijacking attacks? (Select 2)

Accepted Answer

Cookie theft. Both cookie theft and TCP sequence prediction are session hijacking attacks. Cookie theft involves stealing a session identifier (e.g., via XSS or sniffing) to impersonate the victim's authenticated web session. TCP sequence prediction targets the transport layer: an attacker predicts the sequence numbers used in a TCP connection to inject forged packets and hijack the session, taking over an established TCP connection. These attacks directly take over an authenticated session, distinguishing them from other network attacks like ARP poisoning or DNS spoofing.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning

Question 9

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

Mutates its code to evade signature detection. A polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.

Answer

Remains constant in code to ensure replication

Answer

Spreads via network shares

Answer

Resides in the boot sector of a hard drive

Question 10

A penetration tester uses `smbclient -L //192.168.1.30 -N` and receives a list of shares including a hidden administrative share (C$) and a user share named "Backup". What is the most immediate security concern?

Accepted Answer

Null session enumeration is possible, allowing information gathering. The `-N` flag in the `smbclient` command suppresses password prompts, enabling a null session connection. The fact that the command successfully lists shares without authentication indicates that null session enumeration is permitted, which is a critical security flaw. This allows an attacker to gather sensitive information (share names, user lists, etc.) without any credentials, often serving as the first step in a targeted attack.

Answer

The Backup share may contain sensitive data

Answer

SMB signing is not enabled

Answer

The C$ share is a default administrative share

Question 11

An employee receives an SMS message that claims to be from the IT department, asking the employee to click a link to verify their email account. Which social engineering attack is this?

Accepted Answer

SMiShing. C is correct because SMiShing (SMS phishing) specifically uses SMS text messages as the attack vector to deliver a malicious link or request, exactly as described in the scenario. Unlike email-based phishing, SMiShing exploits the trust users place in text messages and often bypasses email security filters.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 12

A penetration tester uses a tool to perform ARP poisoning and then launches a man-in-the-middle attack. The tool also allows session hijacking and sniffing. Which of the following tools is being used?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LANs, featuring built-in ARP poisoning, session hijacking, and sniffing capabilities. It actively intercepts traffic by spoofing ARP replies to redirect packets through the attacker's machine, enabling real-time manipulation of sessions. This matches the question's description of a tool that performs ARP poisoning, MITM attacks, session hijacking, and sniffing.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 13

A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?

Accepted Answer

SYN scan (-sS). A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.

Answer

Ping sweep (-sn)

Answer

TCP Connect scan (-sT)

Answer

UDP scan (-sU)

Question 14

Which THREE of the following are common IoT attack vectors?

Accepted Answer

Default credentials. Default credentials, insecure protocols, and firmware reversing are common IoT attack vectors.

Answer

SQL injection

Answer

ARP spoofing

Question 15

A system administrator receives a phone call from someone claiming to be from IT support, asking for the administrator's password to 'fix a server issue'. This is an example of which social engineering attack?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker fabricates a scenario (pretext) to manipulate the target into divulging sensitive information. In this case, the attacker impersonates IT support and invokes a fake server issue to create urgency, directly requesting the administrator's password. This aligns with the CEH definition of pretexting as a confidence-building deception, not a technical exploit.

Answer

Vishing

Answer

Baiting

Answer

Phishing