CEH Practice Test 50 — 15 Questions

Question 1

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Accepted Answer

Command injection. The 'cmd' parameter in a CGI script is a common indicator of command injection, where the attacker tries to execute system commands.

Answer

Local File Inclusion (LFI)

Answer

SQL injection

Answer

Directory traversal

Question 2

What is the PRIMARY purpose of performing a DNS zone transfer?

Accepted Answer

To obtain all DNS records for a domain from an authoritative server. DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

Answer

To cache DNS queries locally

Answer

To resolve IP addresses to hostnames

Answer

To verify the DNS server's response time

Question 3

An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?

Accepted Answer

AXFR. B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.

Answer

NS records

Answer

MX records

Answer

SOA records

Question 4

You are a security consultant hired by a mid-sized company with 500 employees. The company has a central office with a lobby, reception, and two secure areas: the server room (requires keycard and PIN) and the executive floor (requires keycard only). Recently, employees have reported seeing unfamiliar people in restricted areas. Security logs show keycard access for the server room only during business hours, but no anomalies. However, the executive floor logs show multiple entries by a single employee, John from Sales, at odd hours. John claims he was working late. The company has a policy that all employees must wear ID badges visibly. You observe that employees often hold doors open for colleagues, and the receptionist does not verify visitor badges. Which of the following actions should you recommend FIRST to address the most likely attack vector?

Accepted Answer

Implement mantraps and enforce a policy of one person per keycard entry. The most likely attack vector is tailgating (piggybacking), where unauthorized individuals gain physical access by following an authorized employee through a secured door without using their own credentials. Option C directly addresses this by implementing mantraps (a small room with two interlocking doors that only allows one person to pass at a time) and enforcing a strict one-person-per-keycard-entry policy, which physically prevents tailgating. This is the first and most effective control because it mitigates the root cause—social engineering exploiting human courtesy—rather than focusing on symptoms like John's after-hours access or adding surveillance that doesn't prevent the act.

Answer

Investigate John's activities and consider disciplinary action

Answer

Upgrade keycard readers to biometric scanners

Answer

Install additional CCTV cameras in hallways

Question 5

During a penetration test, the tester wants to discover all subdomains of a target domain using an OSINT technique. Which tool is specifically designed for subdomain enumeration via search engines and public records?

Accepted Answer

theHarvester. theHarvester is specifically designed to perform OSINT-based subdomain enumeration by querying search engines (e.g., Google, Bing) and public data sources (e.g., PGP key servers, DNSDumpster). It collects email addresses, subdomains, IPs, and virtual hosts without direct interaction with the target's infrastructure, making it ideal for passive reconnaissance.

Answer

Maltego

Answer

Shodan

Answer

dnsrecon

Question 6

A penetration tester is assessing the security of a cloud application and discovers that it is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are potential impacts of this vulnerability?

Accepted Answer

Access to cloud instance metadata (e.g., AWS IMDS). SSRF can allow access to internal services (like metadata endpoints) and potentially lead to remote code execution if internal services are compromised.

Answer

Ability to perform a man-in-the-middle attack on the user's browser

Answer

Direct modification of DNS records

Answer

Direct access to the database without authentication

Question 7

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Directory Traversal

Question 8

A penetration tester runs `nmap -sI 192.168.1.10 -p 80 10.0.0.1` and receives output indicating port 80 is open. The scan uses a zombie host. Which type of scan is this?

Accepted Answer

Idle scan. The `-sI` flag in Nmap specifies an idle scan, which uses a zombie host (192.168.1.10) to probe the target (10.0.0.1). By observing changes in the zombie's IP ID sequence, the attacker can infer whether a port on the target is open or closed without revealing their own IP address. The output indicating port 80 is open confirms the scan type as an idle scan.

Answer

SYN scan

Answer

Decoy scan

Answer

Fragmentation scan

Question 9

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Accepted Answer

SYN scan. C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

Answer

TCP connect scan

Answer

UDP scan

Answer

FIN scan

Question 10

Which THREE of the following are methods attackers use to cover their tracks after compromising a system?

Accepted Answer

Modifying file timestamps. Modifying file timestamps (A) is a common anti-forensic technique used to hide the evidence of file creation, modification, or access. Attackers use tools like `touch` on Linux or `SetFileTime` on Windows to alter the MAC (Modify, Access, Change) timestamps, making malicious files appear as legitimate system files. This prevents forensic investigators from identifying when the compromise occurred or which files were altered.

Answer

Performing a dictionary attack

Answer

Running a vulnerability scanner

Question 11

A penetration tester is enumerating an SMTP server on port 25. They issue the command `VRFY root` and receive a 250 response, then `VRFY admin` also returns 250. What does this indicate about the SMTP server?

Accepted Answer

Both root and admin are valid email accounts on the server. The VRFY command is used to verify whether a specific user exists on an SMTP server. A 250 response code indicates that the user is valid and the mailbox exists. Since both `root` and `admin` returned 250, this confirms that both are valid email accounts on the server, making option A correct.

Answer

The SMTP server supports password authentication

Answer

The command failed due to syntax errors

Answer

The SMTP server has disabled user verification

Question 12

An organization deploys a fleet of IoT cameras that communicate with a central server over the internet. The cameras use HTTP to send video streams. What is the most critical security improvement to protect the video data in transit?

Accepted Answer

Implement TLS/SSL encryption for all camera communications.. The most critical security improvement is to implement TLS/SSL encryption (HTTPS) for all camera communications. HTTP transmits video data in plaintext, allowing any attacker on the network path to capture and view the video stream. TLS/SSL provides encryption, integrity, and authentication, directly protecting the confidentiality of the video data in transit.

Answer

Require strong passwords on the camera web interface.

Answer

Use a site-to-site VPN between the cameras and the server.

Answer

Use certificate pinning to prevent man-in-the-middle attacks.

Question 13

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Accepted Answer

Restrict access to the Engineering web server to only the Engineering VLAN.. The Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

Answer

Implement a password policy requiring complex passwords for all users.

Answer

Enable two-factor authentication on the web server.

Answer

Apply the latest security patches to the web server.

Question 14

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern every time it infects a new file or system.. A polymorphic virus is designed to evade signature-based detection by mutating its code—typically using an encryption engine and a mutation engine—so that each infection generates a functionally identical but byte-wise different payload. This constant change in the virus's signature pattern prevents antivirus software from recognizing it through static file hashes or fixed byte sequences.

Answer

It spreads through network shares without requiring user interaction.

Answer

It remains dormant until a specific date or time.

Answer

It infects the master boot record of a hard drive.

Question 15

An organization experiences a DDoS attack where the attacker sends many incomplete HTTP requests that keep connections open, exhausting the server's connection pool. Which attack technique is being used?

Accepted Answer

Slowloris. Slowloris is a DDoS attack that works by opening multiple connections to the target server and sending partial HTTP requests, never completing them. The server keeps these connections open waiting for the rest of the request, eventually exhausting the connection pool and denying service to legitimate users. This matches the description of incomplete HTTP requests keeping connections open.

Answer

UDP flood

Answer

HTTP flood

Answer

SYN flood