CEH Practice Test 47 — 15 Questions

Question 1

Which type of social engineering attack involves a malicious actor impersonating a legitimate organization in a voicemail message to trick the victim into revealing sensitive information?

Accepted Answer

Vishing. Vishing (voice phishing) is the correct answer because it specifically involves using voice communication—such as a phone call or voicemail—to impersonate a legitimate organization and trick the victim into revealing sensitive information like passwords or credit card numbers. Unlike other social engineering attacks, vishing exploits the trust associated with voice interactions and often uses caller ID spoofing to appear as a trusted entity.

Answer

SMiShing

Answer

Pharming

Answer

Baiting

Question 2

Which Google dork would a penetration tester use to find login pages of websites that have 'admin' in the URL?

Accepted Answer

inurl:"admin" inurl:"login". The Google dork `inurl:"admin" inurl:"login"` specifically searches for pages where both 'admin' and 'login' appear in the URL. This is a precise way to find login pages on administrative interfaces, as it targets URLs containing both terms, which is a common pattern for admin login portals.

Answer

site:admin login

Answer

filetype:pdf admin login

Answer

intitle:"login" inurl:admin

Question 3

Which of the following is a tool commonly used for MAC flooding attacks to force a switch into fail-open mode, allowing sniffing of all traffic on the network?

Accepted Answer

macof. macof is a tool specifically designed to perform MAC flooding attacks. It generates thousands of random MAC addresses, overwhelming the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode (hub mode), forwarding all frames out of all ports, which allows an attacker to sniff traffic that would normally be isolated.

Answer

Ettercap

Answer

Nmap

Answer

Wireshark

Question 4

During a vulnerability scan with Nessus, you find that port 445/TCP is open on a Windows server. Which of the following is the MOST likely associated risk?

Accepted Answer

Remote code execution via SMB vulnerabilities. Port 445/TCP is used by Microsoft SMB (Server Message Block) over a direct TCP connection, commonly known as SMB over TCP. SMB has historically been plagued by critical remote code execution vulnerabilities, most notably EternalBlue (MS17-010) exploited by WannaCry. Therefore, an open SMB port on a Windows server presents a high risk of remote code execution if unpatched.

Answer

SNMP community string brute-forcing

Answer

HTTP directory traversal

Answer

DNS cache poisoning

Question 5

During a penetration test, the tester wants to discover all subdomains of a target domain using an OSINT technique. Which tool is specifically designed for subdomain enumeration via search engines and public records?

Accepted Answer

theHarvester. theHarvester is specifically designed to perform OSINT-based subdomain enumeration by querying search engines (e.g., Google, Bing) and public data sources (e.g., PGP key servers, DNSDumpster). It collects email addresses, subdomains, IPs, and virtual hosts without direct interaction with the target's infrastructure, making it ideal for passive reconnaissance.

Answer

Maltego

Answer

Shodan

Answer

dnsrecon

Question 6

Which THREE of the following are password cracking techniques? (Select 3)

Accepted Answer

Dictionary attack. A dictionary attack is a password cracking technique where an attacker uses a precompiled list of likely passwords (a dictionary file) to attempt authentication against a target system. It relies on the fact that many users choose common words or phrases as passwords, making it effective against weak passwords but ineffective against strong, random ones.

Answer

Phishing

Answer

Steganography

Question 7

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Accepted Answer

SQLMap. SQLMap is a purpose-built open-source penetration testing tool that automates the detection and exploitation of SQL injection vulnerabilities and can enumerate and dump database contents. It supports a wide range of DBMS backends (MySQL, MSSQL, Oracle, PostgreSQL) and injection techniques (boolean-based, time-based, UNION, error-based). This makes it the correct answer for automating SQLi exploitation and data retrieval.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 8

An incident response team discovers a suspicious executable on a compromised workstation. They want to analyze the malware without executing it. Which of the following techniques would be MOST appropriate for this initial analysis?

Accepted Answer

Using the 'strings' command to extract embedded text. The 'strings' command extracts human-readable text from a binary file without executing it, making it ideal for static analysis. This technique can reveal indicators such as IP addresses, domain names, file paths, registry keys, or embedded commands that help classify the malware's purpose and capabilities without triggering its payload.

Answer

Capturing network traffic with Wireshark during execution

Answer

Monitoring process behavior with Process Monitor

Answer

Running the executable in a sandboxed environment

Question 9

During an internal penetration test, an analyst uses `enum4linux -a 10.0.0.5` and retrieves a list of local users, including an account named 'sqlsvc'. The analyst then attempts to crack the password using a dictionary attack. Which password cracking tool would be most efficient for this task?

Accepted Answer

John the Ripper. John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.

Answer

RainbowCrack

Answer

SNMPwalk

Answer

Ophcrack

Question 10

A user receives an email claiming to be from their bank, asking them to click a link and verify their account credentials. The email contains spelling errors and the link points to a suspicious domain. What type of social engineering attack is this?

Accepted Answer

Phishing. This scenario describes a mass, unsolicited email with generic content and a suspicious link, which is the classic definition of phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information, such as credentials, by impersonating a trusted entity. The presence of spelling errors and a suspicious domain are common indicators of a phishing attempt, not a targeted attack.

Answer

Vishing

Answer

Whaling

Answer

Spear phishing

Question 11

An attacker uses 'rpcclient -U '' -N 192.168.1.10' followed by 'enumdomusers' and 'enumdomgroups'. What type of enumeration is being performed, and which protocol does it rely on?

Accepted Answer

SMB/RPC enumeration over port 445. The `rpcclient` tool with the `-U '' -N` flags performs a null session connection to a Windows system over the SMB protocol. The subsequent `enumdomusers` and `enumdomgroups` commands enumerate domain users and groups via MS-RPC (Remote Procedure Call) functions, which are transported over SMB. By default, modern Windows systems use SMB over port 445, making option B the correct choice.

Answer

LDAP enumeration over port 389

Answer

NetBIOS enumeration over port 139

Answer

SNMP enumeration over port 161

Question 12

During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?

Accepted Answer

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.. In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.

Answer

Decrypt the traffic using the captured handshake to get the credentials.

Answer

WPS PIN brute-force to recover the PSK.

Answer

PMKID attack to crack the pre-shared key.

Question 13

A security analyst issues the command `dnsenum example.com` and receives a list of subdomains, mail servers, and name servers. What information is revealed by the presence of multiple MX records?

Accepted Answer

The domain uses multiple mail servers for load balancing and failover. Multiple MX records in a DNS zone file indicate that the domain is configured with more than one mail exchange server. This setup provides redundancy and load balancing for email delivery, as defined in RFC 5321. The `dnsenum` tool enumerates these records from the DNS server, revealing the domain's email infrastructure design.

Answer

The domain has been compromised

Answer

The domain uses a single mail server with multiple aliases

Answer

The domain is participating in a DDoS attack

Question 14

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

Accepted Answer

theHarvester. theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

Answer

Nmap

Answer

Netcat

Answer

Wireshark

Question 15

A security analyst runs `ldapsearch -x -h 10.0.0.3 -b "dc=company,dc=com"` and receives a large number of entries including user objects. What type of information is being collected?

Accepted Answer

Active Directory users and attributes. The `ldapsearch` command with the `-x` flag (simple authentication) and `-b` base DN `"dc=company,dc=com"` performs an LDAP query against the specified server (10.0.0.3). LDAP is the protocol used to query and retrieve directory services, and in a Windows environment, Active Directory exposes user objects, groups, and their attributes via LDAP. Therefore, the output contains Active Directory users and their associated attributes, making D correct.

Answer

SMB share listings

Answer

SNMP MIB values

Answer

NetBIOS names and MAC addresses