CEH Practice Exam 51 — 20 Questions

Question 1

A security analyst runs `snmpwalk -v2c -c public 192.168.1.1` and receives extensive output about the device's configuration. Which of the following is the MOST effective countermeasure against this enumeration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the default community string and restrict SNMP access to specific IPs. The most effective countermeasure against SNMP enumeration via a default community string is to change the default 'public' (or 'private') string to a strong, non-guessable value and restrict SNMP access to trusted management IPs using an access control list (ACL). This prevents unauthorized querying of the MIB tree while still allowing legitimate SNMP monitoring.

Answer

Disable SNMP entirely

Answer

Use SNMPv3 with encryption

Answer

Block ICMP echo requests

Question 2

Which of the following is a symptom of a successful command injection attack?

Accepted Answer

The output of the 'id' command appears in the response. In a successful command injection attack, the attacker injects operating system commands into a vulnerable input field, and the web application passes them to a shell for execution. If the application returns the command output in the HTTP response, seeing the result of the 'id' command (e.g., 'uid=33(www-data) gid=33(www-data) groups=33(www-data)') is a definitive symptom that the injection succeeded and the server executed the attacker's command.

Answer

The server returns a 404 error

Answer

The HTTP response header contains 'Server: Apache'

Answer

The page loads slower than usual

Question 3

A security analyst runs the command `nbtstat -A 192.168.1.105` on a Windows machine. What information is the analyst most likely trying to gather?

Accepted Answer

The NetBIOS name table and MAC address of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against the specified IP address using the NetBIOS over TCP/IP (NBT) protocol. It returns the remote host's NetBIOS name table, which includes registered names and services, along with the MAC address of the network adapter. This is a standard enumeration technique to identify the hostname, logged-in user, and other NetBIOS-related information.

Answer

The LDAP directory structure of the domain

Answer

The SNMP community strings of the target

Answer

The SMB shares available on the remote host

Question 4

During a security assessment, an analyst runs 'enum4linux -a 10.0.0.5' and obtains a list of users, shares, and OS information. What protocol is enum4linux primarily using to gather this information?

Accepted Answer

SMB/CIFS. enum4linux is a wrapper around tools from the Samba suite, primarily using the SMB/CIFS protocol to query Windows systems for information such as user lists, shares, and OS details. It leverages SMB's remote IPC mechanisms (e.g., via \pipe\lsarpc or \pipe\samr) to enumerate these data points, making D the correct answer.

Answer

NetBIOS

Answer

SNMP

Answer

LDAP

Question 5

Which of the following tools is specifically used to enumerate SMB shares and retrieve file listings from Windows systems?

Accepted Answer

smbclient. smbclient is a tool from the Samba suite specifically designed to interact with SMB/CIFS shares. It allows an attacker to enumerate available shares on a Windows target and retrieve file listings by connecting to the SMB service (port 445 or 139) using commands like 'smbclient -L //target' or by mounting a share and listing its contents.

Answer

ldapsearch

Answer

snmpwalk

Answer

nmap

Question 6

A security analyst runs the command `nbtstat -A 192.168.1.50` in a Windows environment. What information is the analyst attempting to retrieve?

Accepted Answer

NetBIOS names and services of the remote system. The `nbtstat -A` command queries the NetBIOS name table of a remote system by its IP address. NetBIOS over TCP/IP (NBT) maintains a table of names and services (e.g., workstation, server, messenger) that the remote host has registered. This is a classic enumeration technique to discover shares, logged-in users, and other NetBIOS resources.

Answer

The current routing table on the host

Answer

Active network connections and listening ports

Answer

DNS records for the host

Question 7

Which tool is specifically designed to create and manage phishing campaigns for security awareness testing?

Accepted Answer

SET. The Social-Engineer Toolkit (SET) is an open-source Python-driven framework specifically designed for social engineering attacks, including the creation and management of phishing campaigns. It automates the generation of malicious emails, credential harvesting pages, and payload delivery, making it the standard tool for security awareness testing in CEH contexts.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 8

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

Accepted Answer

VirusTotal. VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.

Answer

Nmap

Answer

John the Ripper

Answer

Wireshark

Question 9

During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?

Accepted Answer

dnsenum. Options A (dnsenum) and C (dnsrecon) are both specialized DNS enumeration tools that can attempt a full zone transfer (AXFR query) to retrieve all DNS records for a domain. dnsenum automates zone transfer attempts against multiple nameservers, while dnsrecon includes similar functionality. Although tools like dig and nslookup can also perform manual zone transfers, the question specifically asks for tools designed for enumeration, making dnsenum and dnsrecon the correct choices.

Answer

dig

Answer

theHarvester

Answer

nslookup

Question 10

A penetration tester wants to perform DNS zone transfer enumeration. Which TWO of the following tools can be used for this purpose? (Select exactly 2.)

Accepted Answer

dnsrecon. Dnsrecon is a dedicated DNS enumeration tool that supports zone transfer requests (AXFR queries) to retrieve all DNS records from a nameserver if it is misconfigured to allow transfers from any host. It can also perform other DNS reconnaissance tasks such as SRV record enumeration and subdomain brute-forcing, making it a direct choice for zone transfer enumeration.

Answer

Shodan

Answer

Maltego

Answer

theHarvester

Question 11

Which THREE of the following are techniques used in static malware analysis? (Select 3)

Accepted Answer

Inspecting file metadata and properties. Inspecting file metadata and properties (Option A) is a static analysis technique because it examines the file's embedded information—such as author, creation date, file version, and digital signatures—without executing the binary. This metadata can reveal the origin, compilation timestamp, or whether the file is signed by a known legitimate publisher, helping to identify suspicious characteristics before runtime.

Answer

Capturing network traffic in a sandbox

Answer

Monitoring registry changes during execution

Question 12

Which TWO of the following are examples of active reconnaissance? (Select 2)

Accepted Answer

Conducting an Nmap SYN scan on the target network. An Nmap SYN scan sends raw SYN packets to target ports and analyzes the responses (SYN-ACK for open, RST for closed). This actively probes the target network, generating traffic that can be detected by intrusion detection systems, which is the defining characteristic of active reconnaissance.

Answer

Performing a WHOIS lookup

Answer

Analyzing public social media profiles for employee information

Answer

Running a Google dork search for sensitive files

Question 13

Which THREE of the following are effective DDoS mitigation techniques? (Choose 3)

Accepted Answer

Scrubbing centers. Scrubbing centers are effective DDoS mitigation because they act as a centralized traffic-cleaning facility. When an attack is detected, malicious traffic is diverted to the scrubbing center, where it is filtered using signature-based, anomaly-based, and rate-based techniques, allowing only legitimate traffic to pass through to the target network. This offloads the attack burden from the victim's infrastructure.

Answer

MAC address filtering

Answer

Disabling DHCP

Question 14

You are a penetration tester hired to perform a security assessment for a medium-sized e-commerce company, "ShopSmart". The company hosts its website on a shared hosting environment and uses a third-party payment gateway. Your goal is to gather as much information as possible without triggering any alarms. During the initial footprinting, you discover that the company's domain "shopsmart.com" was registered five years ago and the WHOIS record shows the registrant's name, address, phone number, and email. The email address is "admin@shopsmart.com". You also find a job posting on LinkedIn that mentions they are looking for a "Senior PHP Developer with experience in Laravel and MySQL". Additionally, by using the Wayback Machine, you find an old version of the site that includes a comment in the HTML source: "". You attempt to access /dev/test.php but receive a 404 error. What should you do NEXT to maximize information gain while remaining passive?

Accepted Answer

Use Google dorking with site:shopsmart.com and filetype:php to find cached or indexed pages. Google dorking with `site:shopsmart.com filetype:php` is a passive reconnaissance technique that leverages cached or indexed pages in Google’s search engine. This can reveal the old `/dev/test.php` page or other PHP files that may still be accessible via cached content, even if the live server returns a 404. It maximizes information gain without sending any direct traffic to the target, thus avoiding alarms.

Answer

Run a whois lookup on the IP address of the shared host

Answer

Try common file extensions for the debug page: test.asp, test.aspx, test.jsp

Answer

Perform a DNS brute force to find subdomains

Question 15

A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?

Accepted Answer

DNS amplification. This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to multiple DNS servers, which then send large responses to the victim, overwhelming its DNS port (53). The key indicators are the use of UDP, port 53, spoofed source IP of the target, and the amplification effect where a small query generates a much larger response.

Answer

UDP flood

Answer

SYN flood

Answer

ICMP flood

Question 16

Which TWO of the following are examples of social engineering attacks? (Select two)

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker creates a fabricated scenario (pretext) to trick a target into divulging sensitive information or performing an action. It relies on impersonation and psychological manipulation rather than technical exploitation, making it a classic example of human-based social engineering.

Answer

Pharming

Answer

SYN flood

Answer

Brute force attack

Question 17

An attacker gains physical access to a restricted area by following an authorized employee through a secured door without swiping a badge. This technique is known as:

Accepted Answer

Tailgating. Tailgating is a social engineering attack where an unauthorized person physically follows an authorized employee through a secured entry point (e.g., a badge-protected door) without presenting their own credentials. This exploits the human tendency to hold the door for others, bypassing electronic access control systems (e.g., RFID badge readers) that would otherwise deny entry. The CEH exam defines this as a physical breach of perimeter security, distinct from digital or verbal manipulation.

Answer

Pretexting

Answer

Quid pro quo

Answer

Baiting

Question 18

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

Accepted Answer

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker. Outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

Answer

The server is performing a DNS lookup to resolve the malicious IP address

Answer

The web application is sending log data to a SIEM system for analysis

Answer

The vulnerability scan caused a false positive and triggered a legitimate backup process

Question 19

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files on the victim's system using a symmetric encryption algorithm (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This distinguishes it from other malware types that do not perform file encryption for extortion.

Answer

Spyware

Answer

Adware

Answer

Keylogger

Question 20

A security team has collected a hash file from a compromised Windows server that contains NTLM hashes. They want to crack the passwords as quickly as possible using a precomputed lookup table. Which tool and technique combination is BEST suited for this task?

Accepted Answer

Use RainbowCrack with precomputed rainbow tables. RainbowCrack is specifically designed for fast password cracking using precomputed rainbow tables, which are lookup tables that store hash chains for rapid reversal of hashes. Since the team already has NTLM hashes and wants the quickest method, RainbowCrack with precomputed tables avoids the computational overhead of real-time hashing, making it the best fit for this scenario.

Answer

Use John the Ripper in incremental mode

Answer

Use Hydra with a dictionary of common passwords

Answer

Use Hashcat with a rules-based attack