CEH Practice Test 48 — 15 Questions

Question 1

During a social engineering engagement, an attacker calls an employee pretending to be from IT support and asks for their password to perform a system update. Which social engineering technique is being employed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pretexting. Pretexting is the correct answer because the attacker fabricates a scenario (pretext) by impersonating IT support to create a false sense of authority and urgency, thereby manipulating the employee into revealing their password. This technique relies on a fabricated story rather than a technical exploit, distinguishing it from other social engineering methods.

Answer

Phishing

Answer

Quid pro quo

Answer

Vishing

Question 2

A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)

Accepted Answer

WHOIS lookup. WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.

Answer

Telnet banner grab

Answer

Ping sweep

Answer

Nmap SYN scan

Question 3

Which tool is specifically designed to create fake login pages for phishing campaigns and can be integrated with Metasploit?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed to automate social engineering attacks, including the creation of fake login pages (credential harvesting) for phishing campaigns. It includes a built-in 'Website Attack Vectors' module that can clone legitimate sites and capture submitted credentials, and it offers direct integration with Metasploit to deliver payloads or establish reverse shells upon credential submission.

Answer

Nmap

Answer

Wireshark

Answer

Ettercap

Question 4

An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?

Accepted Answer

Slowloris. Slowloris is a low-and-slow application-layer DoS attack that opens multiple HTTP connections to the target server and keeps them alive by sending partial HTTP GET requests with random parameters, never completing the request. This exhausts the server's connection pool, preventing legitimate users from connecting, while each request takes a long time due to the server waiting for the final headers.

Answer

UDP flood

Answer

SYN flood

Answer

HTTP flood

Question 5

During a vulnerability assessment, a security analyst receives an alert from the IDS that a scan with fragmented packets and spoofed source IPs is targeting the internal network. Which Nmap command MOST likely caused this alert?

Accepted Answer

nmap -f -D 10.0.0.1,10.0.0.2 192.168.1.1. The `-f` flag fragments the packets into smaller IP fragments, and the `-D` flag performs a decoy scan by spoofing source IPs. This combination causes the IDS to detect fragmented packets with spoofed source addresses, matching the alert description.

Answer

nmap -sS -O 192.168.1.1

Answer

nmap -sV -p 80 192.168.1.1

Answer

nmap -sU 192.168.1.1

Question 6

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 7

Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. HTTP flood is a Layer 7 DDoS attack because it targets the application layer by sending seemingly legitimate HTTP GET or POST requests to overwhelm a web server's resources. Unlike network-layer attacks, HTTP flood exploits the server's ability to process requests, often mimicking normal user behavior to bypass basic rate limiting. Slowloris is also a Layer 7 attack that works by opening multiple HTTP connections and keeping them open with partial requests, exhausting the server's connection pool without completing the handshake.

Answer

Smurf attack

Answer

SYN flood

Answer

UDP flood

Question 8

Which THREE of the following are types of SQL injection attacks? (Select 3)

Accepted Answer

Blind SQL injection (boolean-based, time-based). Blind SQL injection (C) is a recognized SQLi type where the attacker gets no direct data in the response and instead infers information via boolean true/false queries or time delays (e.g., WAITFOR DELAY, SLEEP). In-band SQL injection (D) is the classic SQLi category where results are returned through the same channel used to inject, typically via error-based or UNION-based techniques. Out-of-band SQL injection (E) is also a valid SQLi type that uses a different channel (e.g., DNS or HTTP requests via xp_dirtree or UTL_HTTP) to exfiltrate data when in-band and blind methods are not viable. The other options do not belong: DOM-based SQL injection (A) is not a SQLi category (DOM-based is a type of XSS), and stored SQL injection (B) is not a standard SQLi classification (stored XSS is a distinct vulnerability).

Answer

DOM-based SQL injection

Answer

Stored SQL injection

Question 9

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

Accepted Answer

The CRL published by the online issuing CA. The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.

Answer

The CRL published by the certificate authority that signed the issuing CA's certificate

Answer

The CRL published by the intermediate CA, if any

Answer

The CRL published by the offline root CA

Question 10

Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing capabilities. It actively sends forged ARP replies to poison the ARP cache of target hosts, allowing the attacker to intercept, modify, or drop traffic between them. This makes it the standard tool for ARP-based MITM attacks.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 11

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Accepted Answer

Remote File Inclusion (RFI). The scenario describes a web application that includes files based on user input without proper validation, and the tester supplies a remote URL (http://attacker.com/malicious.txt) which the application then includes. This is the definition of Remote File Inclusion (RFI), where an attacker can include a file from a remote server, often leading to remote code execution. RFI is possible when the application uses user-supplied input in file inclusion functions (e.g., include, require in PHP) and allows remote URLs. The key indicator is the inclusion of a file from an external domain, which is RFI.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 12

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they use to perform a dictionary attack on the captured handshake to recover the PSK?

Accepted Answer

aircrack-ng. Aircrack-ng, which is the standard tool for cracking WPA2 PSK from a captured handshake using a dictionary file.

Answer

Reaver

Answer

Hydra

Answer

John the Ripper

Question 13

A penetration tester uses a tool to intercept and modify HTTP/HTTPS requests in real-time between the browser and the web application. Which tool is being used?

Accepted Answer

Burp Suite Proxy. Burp Suite Proxy is the industry-standard tool for intercepting, inspecting, and modifying HTTP/HTTPS traffic between a browser and a web application in real time. It acts as a man-in-the-middle proxy with a CA certificate installed in the browser to decrypt TLS, enabling request/response tampering during penetration tests.

Answer

SQLMap

Answer

Nmap

Answer

Metasploit

Question 14

A web server running IIS 8.5 is found to have WebDAV enabled with write permissions. Which attack is MOST likely to be successful against this configuration?

Accepted Answer

File upload leading to remote code execution. WebDAV (Web Distributed Authoring and Versioning) is an extension to HTTP that allows clients to author and modify content on a web server. When enabled with write permissions on IIS 8.5, it permits HTTP methods like PUT, which can be used to upload files directly to the server. If the server also allows execution of uploaded files (e.g., .asp or .aspx), an attacker can upload a malicious script and execute arbitrary code, achieving remote code execution. This is the most direct and likely attack given the configuration.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL injection

Answer

Directory traversal

Question 15

Which of the following is a primary purpose of the SameSite cookie attribute in mitigating CSRF attacks?

Accepted Answer

To prevent the cookie from being sent in cross-origin requests, mitigating CSRF. The SameSite cookie attribute controls whether a browser includes a cookie in requests that originate from a different site than the one that set the cookie. By setting SameSite=Strict or SameSite=Lax, the browser withholds the cookie on cross-site requests, which breaks the CSRF attack model where a malicious site causes the victim's browser to send an authenticated request to a trusted site. This directly prevents the attacker from riding the user's session cookie.

Answer

To limit the cookie to a specific path

Answer

To encrypt the cookie value

Answer

To restrict the cookie to HTTPS connections only (Secure flag)