CEH Practice Test 49 — 15 Questions

Question 1

A security analyst observes that a web application's login page responds with different HTTP status codes and response times for valid versus invalid usernames. This information leakage could be used to perform which type of authentication attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Username enumeration. Username enumeration occurs when an application reveals whether a username exists, often through differing error messages or response times. This information can be leveraged for brute force or password spraying attacks by focusing on valid usernames.

Answer

Credential stuffing

Answer

Password spraying

Answer

Brute force attack

Question 2

Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing capabilities. It actively sends forged ARP replies to poison the ARP cache of target hosts, allowing the attacker to intercept, modify, or drop traffic between them. This makes it the standard tool for ARP-based MITM attacks.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 3

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

Accepted Answer

Enforce HTTPS using TLS 1.2 or higher.. HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Answer

Implement password hashing with bcrypt on the server side.

Answer

Use digital signatures to sign the login request.

Answer

Encrypt the password field using AES-256 before sending via HTTP.

Question 4

Which of the following is the BEST defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are unique, unpredictable tokens that validate that requests originate from the legitimate site, effectively mitigating CSRF.

Answer

SameSite cookies

Answer

Input validation

Answer

Output encoding

Question 5

A penetration tester finds that a web application includes files based on user input without proper validation. The tester supplies 'http://attacker.com/malicious.txt' and the application includes its content. Which vulnerability is this?

Accepted Answer

Remote File Inclusion (RFI). Including a remote file from an attacker-controlled server is Remote File Inclusion (RFI).

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Server-Side Request Forgery (SSRF)

Question 6

During a web application penetration test, a tester discovers a file inclusion vulnerability. Which THREE of the following are potential impacts or exploitation scenarios? (Choose THREE.)

Accepted Answer

Disclosure of sensitive files like /etc/passwd. LFI can lead to remote code execution (via log poisoning), local file disclosure (e.g., /etc/passwd), and session hijacking (by including session files). Port scanning is not a direct impact of file inclusion.

Answer

Port scanning of internal network hosts

Answer

Denial of service by including large files

Question 7

A penetration tester is performing a check for HTTP response splitting. Which THREE of the following conditions must be present for this attack to succeed?

Accepted Answer

The application reflects user input in the HTTP response headers. HTTP response splitting requires that attacker input is reflected in the response headers (e.g., via CRLF injection). The application must not sanitize CRLF sequences. The attacker can then inject headers to separate the response into two HTTP responses, enabling cache poisoning or XSS.

Answer

The application reflects user input in the HTTP response body

Answer

The application uses HTTPS exclusively

Question 8

Which OWASP Top 10 (2021) category describes the vulnerability where an application allows an attacker to include a remote file from an external server, leading to code execution or data disclosure?

Accepted Answer

Injection (A03:2021). Injection (A03:2021) covers various injection flaws, including Remote File Inclusion (RFI). RFI is a type of injection where user input is used to include a remote file, leading to code execution.

Answer

Security Misconfiguration (A05:2021)

Answer

Broken Access Control (A01:2021)

Answer

Cryptographic Failures (A02:2021)

Question 9

Which THREE of the following are types of SQL injection attacks? (Choose 3)

Accepted Answer

Out-of-band SQLi (e.g., DNS or HTTP exfiltration). Out-of-band SQLi (option A) is correct because it uses a different channel (e.g., DNS or HTTP requests) to exfiltrate data when the attacker cannot receive direct responses from the database. This technique is effective when the database server can initiate outbound network connections, allowing data to be sent to an attacker-controlled server via DNS queries or HTTP requests.

Answer

Stored SQLi

Answer

Reflected SQLi

Question 10

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Accepted Answer

Proxy. Burp Proxy is the component that intercepts and allows modification of requests/responses in transit.

Answer

Intruder

Answer

Scanner

Answer

Repeater

Question 11

In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?

Accepted Answer

Server-Side Request Forgery (SSRF) targeting cloud metadata. SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.

Answer

XML External Entity (XXE) injection

Answer

Insecure Direct Object Reference (IDOR) on metadata

Answer

Cross-Site Request Forgery (CSRF) targeting cloud APIs

Question 12

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the server in the response without proper sanitization. The script executes once and is not stored, distinguishing it from stored XSS. DOM-based XSS would involve client-side JavaScript manipulation without server reflection.

Answer

Blind XSS

Answer

Stored (persistent) XSS

Answer

DOM-based XSS

Question 13

A web application is vulnerable to server-side request forgery (SSRF). An attacker sends a request that causes the server to make an internal HTTP request to http://169.254.169.254/latest/meta-data/. What is the attacker attempting to achieve?

Accepted Answer

Access the cloud instance metadata to obtain temporary credentials. 169.254.169.254 is the metadata IP address for cloud providers like AWS. The attacker is trying to retrieve instance metadata, which may contain credentials (e.g., IAM role credentials).

Answer

Exploit a command injection vulnerability in the web server

Answer

Perform a denial-of-service attack on the internal network

Answer

Perform a port scan on the internal network

Question 14

A web application allows users to upload profile images. An attacker uploads a file named 'image.php.png' with malicious PHP code, and the server executes it as PHP. Which type of vulnerability is this?

Accepted Answer

Unrestricted file upload. Unrestricted file upload vulnerabilities allow attackers to upload executable files if the server does not validate the file type or execute permissions.

Answer

Directory traversal

Answer

Command injection

Answer

SQL injection

Question 15

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., ARIN, RIPE) to retrieve domain registration details such as registrar, creation date, and name server records. This is passive because it relies on publicly available information without sending any packets to the target network or interacting with its live systems.

Answer

Running an Nmap version scan

Answer

Performing a ping sweep

Answer

Banner grabbing with Netcat