CEH Practice Test 48 — 15 Questions

Question 1

Which DDoS attack type exploits a small query to a vulnerable service that generates a large response directed at the victim?

Accepted Answer

Amplification attack. An amplification attack is correct because it exploits a small query (e.g., a DNS lookup with a spoofed source IP) sent to a vulnerable service like an open DNS resolver or NTP server, which then generates a large response (e.g., 50-100x the query size) directed at the victim. This leverages the protocol's amplification factor and the lack of source IP validation, overwhelming the victim's bandwidth. The attack is a type of reflection attack, where the intermediary service unwittingly amplifies traffic toward the target.

Answer

HTTP flood

Answer

SYN flood

Answer

ICMP flood

Question 2

A network administrator notices that the ARP cache on several workstations contains entries mapping the default gateway IP to an unknown MAC address. Users report intermittent connectivity issues. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs, including ARP cache poisoning. By sending forged ARP replies, it maps the default gateway IP to an attacker-controlled MAC address, causing traffic to be intercepted and resulting in intermittent connectivity. This directly matches the symptoms described.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 3

Which of the following techniques involves sending crafted packets to a target to elicit responses that reveal the operating system?

Accepted Answer

Active OS fingerprinting. Active OS fingerprinting involves sending crafted packets (e.g., TCP SYN, FIN, or ICMP probes) to a target and analyzing the responses to deduce the operating system. Unlike passive methods, it actively interacts with the target, leveraging subtle differences in how various OSes implement TCP/IP stack behaviors (e.g., initial TTL values, window sizes, or TCP option ordering). This technique is commonly used by tools like Nmap with its `-O` flag.

Answer

Passive OS fingerprinting

Answer

Banner grabbing

Answer

DNS enumeration

Question 4

During a password cracking session, a pentester uses a wordlist combined with rules to generate variations of each word. This approach is called a hybrid attack. Which tool, when used with a rule file, can perform such an attack?

Accepted Answer

Hashcat. Hashcat is a powerful password recovery tool that supports hybrid attacks by combining a wordlist with rule-based mutations. When used with a rule file (e.g., best64.rule), Hashcat applies transformations like prefixing, suffixing, or character substitution to each word, enabling efficient generation of password variations. This directly matches the hybrid attack described in the question.

Answer

RainbowCrack

Answer

Ophcrack

Answer

Hydra

Question 5

Which of the following tools is specifically designed to automate the exploitation of SQL injection vulnerabilities and retrieve data from databases?

Accepted Answer

SQLMap. SQLMap is an open-source tool that automates detection and exploitation of SQL injection flaws.

Answer

Metasploit

Answer

Nmap

Answer

Burp Suite

Question 6

Which HTTP method is commonly used by WebDAV to upload files to a web server, and if misconfigured, could allow an attacker to upload malicious scripts?

Accepted Answer

PUT. The PUT method allows uploading resources to the server, and if enabled without proper controls, can be exploited to upload malicious files.

Answer

DELETE

Answer

GET

Answer

POST

Question 7

Which THREE of the following are techniques used in session hijacking? (Select three.)

Accepted Answer

ARP poisoning. ARP poisoning is correct because it allows an attacker on the same local network to associate their MAC address with the IP address of a legitimate host (e.g., the default gateway). This redirects traffic through the attacker's machine, enabling them to intercept and hijack active sessions by capturing or modifying packets in transit, a classic man-in-the-middle (MITM) technique used in session hijacking.

Answer

DNS amplification

Answer

MAC flooding

Question 8

A web server running IIS 8.5 is found to have WebDAV enabled with write permissions. Which attack is MOST likely to be successful against this configuration?

Accepted Answer

File upload leading to remote code execution. WebDAV with write permissions allows attackers to upload files (e.g., web shells) to the server, leading to remote code execution.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL injection

Answer

Directory traversal

Question 9

Which of the following is a primary purpose of the SameSite cookie attribute in mitigating CSRF attacks?

Accepted Answer

To prevent the cookie from being sent in cross-origin requests, mitigating CSRF. SameSite cookie attribute (Strict, Lax, or None) controls when cookies are sent in cross-site requests. Setting SameSite to Lax or Strict prevents the browser from sending cookies on cross-site POST requests, thus mitigating CSRF.

Answer

To limit the cookie to a specific path

Answer

To encrypt the cookie value

Answer

To restrict the cookie to HTTPS connections only (Secure flag)

Question 10

A web application uses XML to transfer data. An attacker submits the following payload: ']>&xxe;'. What vulnerability is being exploited?

Accepted Answer

XML External Entity (XXE) injection. This is an XML External Entity (XXE) injection attack, where an external entity is defined to read local files.

Answer

Directory traversal

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Question 11

Which of the following best describes the difference between active and passive reconnaissance?

Accepted Answer

Active reconnaissance involves direct interaction with the target, whereas passive reconnaissance does not. Active reconnaissance involves direct interaction with the target system, such as sending packets, probes, or connection requests (e.g., using Nmap scans, ping sweeps, or banner grabbing) that can be logged or detected by the target. Passive reconnaissance, in contrast, gathers information without engaging the target directly, relying on publicly available sources (e.g., WHOIS lookups, DNS records, social media, or search engines) and does not generate traffic that reaches the target's network. This distinction is fundamental in the CEH methodology because active techniques carry a higher risk of alerting the target, while passive techniques are stealthier and often used first to avoid detection.

Answer

Active reconnaissance is legal, while passive reconnaissance is not

Answer

Passive reconnaissance uses tools like Nmap, while active reconnaissance uses Google dorks

Answer

Passive reconnaissance is used only during the exploitation phase

Question 12

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page.php?id=1' --batch --dbs. Which database enumeration technique is SQLMap using by default?

Accepted Answer

In-band SQL injection. Without specifying a technique, SQLMap defaults to using in-band (UNION) and error-based techniques, which are all in-band.

Answer

Out-of-band SQL injection

Answer

Blind SQL injection

Answer

Time-based SQL injection

Question 13

A penetration tester is testing an IIS web server and wants to exploit a WebDAV misconfiguration to upload a web shell. Which HTTP method should the tester check to determine if WebDAV is enabled and allows file uploads?

Accepted Answer

OPTIONS. The OPTIONS method queries the server for supported HTTP methods. If WebDAV is enabled, the response will include methods like PUT, DELETE, PROPFIND, etc. PUT is used for upload, but OPTIONS first confirms availability.

Answer

MOVE

Answer

PUT

Answer

PROPFIND

Question 14

During a web application assessment, a tester intercepts a request and modifies the 'Referer' header. The application then performs a state-changing action without requiring a token. Which vulnerability is most likely present?

Accepted Answer

Cross-site request forgery (CSRF). Cross-Site Request Forgery (CSRF) attacks rely on the application not verifying the origin of the request; a missing CSRF token and lack of Referer validation make the application vulnerable.

Answer

Cross-site scripting (XSS)

Answer

Server-side request forgery (SSRF)

Answer

Clickjacking

Question 15

A penetration tester discovers that a web application's search functionality reflects user input directly in the page source without sanitization. The tester crafts a URL like http://example.com/search?q= and the script executes. This is an example of which type of XSS?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response, without being stored, and the example shows the payload in the URL parameter.

Answer

Stored (persistent) XSS

Answer

Blind XSS

Answer

DOM-based XSS