CEH Practice Questions 2 — 50 Questions

Question 1

A security analyst suspects an attacker has used a rainbow table to crack password hashes from a compromised system. Which password cracking technique involves precomputed hash chains?

Accepted Answer

Rainbow table attack. A rainbow table attack is the correct answer because it specifically uses precomputed hash chains to reverse cryptographic hash functions. Rainbow tables are a form of time-memory trade-off where chains of hashes are computed and stored, allowing an attacker to look up a hash and quickly find the original plaintext without recomputing all possible hashes. This technique is distinct from other methods because it relies on precomputation rather than real-time guessing or dictionary lookups.

Answer

Dictionary attack

Answer

Brute force attack

Answer

Hybrid attack

Question 2

Which of the following tools is specifically designed for high-speed port scanning across large address spaces?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed port scanning across large address spaces, capable of transmitting packets at rates exceeding 10 million packets per second. It achieves this by using asynchronous transmission and a custom TCP/IP stack, making it ideal for scanning the entire IPv4 internet or massive subnets in minutes, unlike general-purpose scanners that prioritize accuracy over raw speed.

Answer

Zenmap

Answer

hping3

Answer

Nmap

Question 3

During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 4

During a penetration test, the tester needs to identify the operating system of a remote host without sending any packets to it. Which technique should the tester use?

Accepted Answer

Passive OS fingerprinting using captured packets. Passive OS fingerprinting (Option B) is correct because it analyzes captured network traffic—such as TCP/IP packet headers, TTL values, window sizes, and DF flags—to infer the remote host's operating system without sending any packets. This technique relies on subtle differences in how various OS stacks implement RFC 793, making it ideal for stealthy reconnaissance where no direct contact with the target is permitted.

Answer

Banner grabbing with Telnet

Answer

Querying Shodan for the target IP

Answer

Active OS fingerprinting with Nmap -O

Question 5

An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?

Accepted Answer

Session hijacking. The attacker is actively intercepting a TCP session, predicting sequence numbers, and injecting malicious packets, which is the definition of TCP session hijacking. This attack exploits the lack of authentication in TCP connections, where the attacker can take over an established session by correctly guessing or obtaining the next sequence number.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

Man-in-the-middle

Question 6

An attacker attempts to log into a web application by trying many common passwords for a list of known usernames. Which type of authentication attack is this?

Accepted Answer

Password spraying. Password spraying involves using a few common passwords against many usernames to avoid account lockouts, as opposed to brute force (many passwords on one account) or credential stuffing (using known username/password pairs).

Answer

Dictionary attack

Answer

Credential stuffing

Answer

Brute force attack

Question 7

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process

Question 8

During a penetration test, you run the command: nmap -sU -p 161,162 --script=snmp-brute 192.168.1.100. Which of the following is the PRIMARY goal of this scan?

Accepted Answer

Discover SNMP community strings via brute-force. The command uses the `-sU` flag for a UDP scan and targets ports 161 and 162, which are the standard SNMP ports. The `--script=snmp-brute` script attempts to brute-force SNMP community strings (the equivalent of passwords for SNMPv1/v2c). Therefore, the primary goal is to discover valid community strings, which is option A.

Answer

Perform a ping sweep to discover live hosts

Answer

Identify open TCP ports and services on the target

Answer

Enumerate SNMP MIB tree values

Question 9

During a penetration test, the tester uses a tool that queries search engines with specific operators to find sensitive information such as login pages, exposed directories, and file types. Which tool or technique is being used?

Accepted Answer

Google dorking. Google dorking (also known as Google hacking) uses advanced search operators (e.g., intitle:, filetype:, inurl:) to uncover sensitive information indexed by search engines, such as login pages, exposed directories, and specific file types. This technique directly matches the description of querying search engines with operators to find hidden or sensitive data.

Answer

Shodan

Answer

theHarvester

Answer

DNS zone transfer

Question 10

During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?

Accepted Answer

-sn (ping sweep). The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.

Answer

-O (OS fingerprinting)

Answer

-sS (SYN scan)

Answer

-sV (version detection)

Question 11

A security analyst runs the command 'tcpdump -i eth0 -n host 10.0.0.5 and port 80' and sees many packets with the SYN flag set but no corresponding ACK. Which attack is likely occurring?

Accepted Answer

SYN flood. The command captures TCP packets on port 80 with the SYN flag set but no corresponding ACK, which indicates that the target is receiving SYN requests but never completing the three-way handshake. This is the hallmark of a SYN flood attack, where the attacker sends a high volume of SYN packets to exhaust the server's connection queue, preventing legitimate connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Ping of Death

Question 12

A security analyst notices a significant increase in outbound traffic from an internal server to multiple external IPs on port 443. The server is not a web server and should not be initiating such connections. Which type of malware is MOST likely causing this behavior?

Accepted Answer

A backdoor Trojan. A backdoor Trojan is designed to give an attacker remote control over an infected system, often using outbound connections on common ports like 443 (HTTPS) to blend in with normal traffic. Since the server is not a web server and should not be initiating outbound HTTPS connections, this anomalous behavior strongly indicates a backdoor Trojan is exfiltrating data or receiving commands via encrypted channels.

Answer

A boot sector virus

Answer

A fileless virus

Answer

A worm

Question 13

A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?

Accepted Answer

NetBIOS names and their associated service types. The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.

Answer

SMB share lists and open sessions

Answer

DNS records for the host and domain

Answer

ARP cache entries for the subnet

Question 14

A penetration tester uses the following Google dork: intitle:"index of" "backup" site:example.com. What is the MOST likely goal of this search?

Accepted Answer

Locate open directories that might contain sensitive files. The Google dork `intitle:"index of" "backup" site:example.com` targets web servers that have directory listing enabled (indicated by the page title containing 'index of') and that contain a folder or file named 'backup'. This is a classic reconnaissance technique to find open directories where backup files (e.g., database dumps, configuration files) may be inadvertently exposed, potentially containing sensitive data such as credentials or proprietary information.

Answer

Discover email addresses associated with the domain

Answer

Find login pages of the target domain

Answer

Identify subdomains of example.com

Question 15

A security analyst is asked to perform a fast scan of a large network (e.g., /16 subnet) to identify live hosts. Which tool is MOST suitable for this task due to its high speed?

Accepted Answer

Masscan. Masscan is the most suitable tool for this task because it is designed specifically for high-speed scanning of large address spaces, such as a /16 subnet (65,536 hosts). It uses asynchronous transmission and can send packets at rates exceeding 10 million packets per second, making it significantly faster than Nmap for raw host discovery across massive ranges.

Answer

hping3

Answer

Nmap

Answer

Wireshark

Question 16

During a security assessment, you find a Linux binary with the SUID bit set and owned by root. You execute it and obtain a root shell. This is an example of which privilege escalation technique?

Accepted Answer

SUID abuse. The SUID (Set User ID) bit on a binary owned by root allows it to execute with root privileges regardless of the user running it. When you execute such a binary and it spawns a shell, that shell inherits the elevated privileges, effectively granting you a root shell. This is a classic example of SUID abuse, a common privilege escalation technique on Linux systems.

Answer

DLL hijacking

Answer

Kernel exploit

Answer

Token impersonation

Question 17

You are the security lead for a multinational corporation that uses a hybrid cloud architecture with AWS and on-premises data centers. The company recently deployed a fleet of IoT sensors in a remote factory to monitor equipment. These sensors communicate via MQTT to an AWS IoT Core endpoint, which forwards data to an S3 bucket and a DynamoDB table. The factory network is isolated but has a site-to-site VPN to the corporate HQ. Over the past week, the S3 bucket has experienced an unusual number of PUT requests from an IP address that resolves to a known malicious host. The DynamoDB table shows write spikes at odd hours. The MQTT broker logs indicate that some sensors are publishing data with invalid client IDs. Meanwhile, the VPN logs show no anomalies. You need to identify the likely attack vector and recommend a course of action. Which of the following is the BEST course of action?

Accepted Answer

Implement client certificate authentication on AWS IoT Core and revoke any unregistered client IDs.. The attack exploits weak authentication on MQTT connections to AWS IoT Core. By implementing client certificate authentication, you ensure only registered devices with valid X.509 certificates can publish data, directly blocking the malicious PUT requests and write spikes. Revoking unregistered client IDs eliminates the invalid client IDs observed in the MQTT broker logs, closing the primary attack vector without disrupting legitimate sensor traffic.

Answer

Disable the site-to-site VPN and require all traffic to go through a bastion host.

Answer

Move the S3 bucket and DynamoDB table to the on-premises data center to reduce cloud exposure.

Answer

Replace all IoT sensors with new ones that have firmware-level encryption.

Question 18

A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning and DNS spoofing. It can intercept DNS requests and forge fake responses to redirect victims to a malicious IP, making it the correct tool for DNS spoofing.

Answer

Nmap

Answer

Wireshark

Answer

tcpdump

Question 19

Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?

Accepted Answer

-sS. The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.

Answer

-sT

Answer

-sU

Answer

-sA

Question 20

During a penetration test, you run `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.10` and receive responses '252 2.5.2 User <username>' for some users and '550 5.1.1 User unknown' for others. What does this indicate?

Accepted Answer

The SMTP server is revealing valid usernames via the VRFY command. The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.

Answer

The SMTP server is using EXPN instead of VRFY

Answer

The SMTP server is vulnerable to command injection

Answer

The SMTP server is properly configured to prevent enumeration