CEH Practice Test 5 — 10 Questions

Question 1

A penetration tester is performing reconnaissance and wants to identify email addresses associated with a target domain. Which tool is specifically designed for this purpose?

Accepted Answer

theHarvester. TheHarvester is specifically designed for passive reconnaissance to gather email addresses, subdomains, and other open-source intelligence (OSINT) from public sources like search engines, PGP key servers, and the SHODAN database. It directly queries these sources to extract email addresses associated with a target domain, making it the correct tool for this task.

Answer

Nmap

Answer

Shodan

Answer

Maltego

Question 2

A security analyst is investigating a compromised Linux system. The /var/log/auth.log file appears to be truncated, and the timestamps on several binaries in /bin/ have been modified. Which of the following tools or techniques is the attacker MOST likely using to cover tracks?

Accepted Answer

Rootkit. The attacker is most likely using a rootkit to cover tracks because rootkits are designed to hide malicious activity by intercepting system calls (e.g., via LD_PRELOAD or kernel modules) to hide processes, files, and network connections. The truncated auth.log and modified timestamps on binaries in /bin/ indicate the rootkit is actively tampering with system logs and file metadata to evade detection, which aligns with rootkit behavior rather than simpler tools.

Answer

Timestamp manipulation tool

Answer

Steganography

Answer

Log cleaner script

Question 3

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

Accepted Answer

Configure Nessus to use a 'safe' scan policy that disables disruptive plugins. Nessus 'safe' scan policies disable plugins known to cause service disruption, such as those performing denial-of-service tests or exploiting vulnerabilities that may crash services. By using a safe policy, the analyst avoids aggressive checks that can degrade server performance or cause unresponsiveness, which is a common risk during vulnerability scanning.

Answer

Increase the scan intensity to complete faster and reduce the load

Answer

Use a different scanner like OpenVAS which is less intrusive

Answer

Run the scan during peak hours to blend in with normal traffic

Question 4

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

Accepted Answer

dnsrecon -d example.com -t axfr. The `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Answer

dig example.com ANY

Answer

nslookup -type=ns example.com

Answer

theHarvester -d example.com -l 500 -b google

Question 5

A security analyst suspects an attacker has used a rainbow table to crack password hashes from a compromised system. Which password cracking technique involves precomputed hash chains?

Accepted Answer

Rainbow table attack. A rainbow table attack is the correct answer because it specifically uses precomputed hash chains to reverse cryptographic hash functions. Rainbow tables are a form of time-memory trade-off where chains of hashes are computed and stored, allowing an attacker to look up a hash and quickly find the original plaintext without recomputing all possible hashes. This technique is distinct from other methods because it relies on precomputation rather than real-time guessing or dictionary lookups.

Answer

Dictionary attack

Answer

Brute force attack

Answer

Hybrid attack

Question 6

Which of the following tools is specifically designed for high-speed port scanning across large address spaces?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.

Answer

Zenmap

Answer

hping3

Answer

Nmap

Question 7

During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 8

During a penetration test, the tester needs to identify the operating system of a remote host without sending any packets to it. Which technique should the tester use?

Accepted Answer

Passive OS fingerprinting using captured packets. Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.

Answer

Banner grabbing with Telnet

Answer

Querying Shodan for the target IP

Answer

Active OS fingerprinting with Nmap -O

Question 9

An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?

Accepted Answer

Session hijacking. The attacker is actively intercepting a TCP session, predicting sequence numbers, and injecting malicious packets, which is the definition of TCP session hijacking. This attack exploits the lack of authentication in TCP connections, where the attacker can take over an established session by correctly guessing or obtaining the next sequence number.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

Man-in-the-middle

Question 10

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process