CEH Practice Exam 51 — 20 Questions

Question 1

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remote Access Trojan (RAT). The behavior described—downloading a file that, when executed, creates a hidden process that connects to a remote server and provides full remote control—is the classic definition of a Remote Access Trojan (RAT). A RAT is a type of malware that allows an attacker to remotely control the victim's system, often using a command-and-control (C2) channel over protocols like TCP or HTTP. The hidden process and outbound connection to a remote server are key indicators of a RAT, distinguishing it from other malware types that do not provide interactive remote control.

Answer

Worm

Answer

Ransomware

Answer

Polymorphic virus

Question 2

A web server is configured with WebDAV and allows PUT requests. An attacker uploads a .asp file and accesses it to execute code. Which tool or method is most directly associated with exploiting this misconfiguration?

Accepted Answer

File upload vulnerability. WebDAV with PUT enabled allows attackers to upload arbitrary files, including web shells, leading to remote code execution.

Answer

SQL injection

Answer

Directory brute forcing

Answer

Cross-site scripting (XSS)

Question 3

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Answer

Command injection

Answer

Remote File Inclusion (RFI)

Answer

Directory traversal

Question 4

An IoT device uses MQTT protocol with default credentials 'admin/admin' and no TLS encryption. An attacker on the same network captures MQTT packets and extracts sensor data. Which two vulnerabilities are being exploited? (Choose the best combination)

Accepted Answer

Default credentials and cleartext communication. The use of default credentials and lack of encryption (no TLS) are the vulnerabilities. MQTT itself is not insecure when properly configured; the issues are weak authentication and cleartext communication.

Answer

Buffer overflow and command injection

Answer

Insecure firmware and hardcoded backdoor

Answer

Weak encryption and replay attack

Question 5

A penetration tester finds that a web application accepts XML input and returns the parsed data in the response. The tester submits the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which vulnerability is being exploited?

Accepted Answer

XXE injection. The payload defines an external entity (XXE) that reads a local file, indicating an XML External Entity (XXE) injection vulnerability.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 6

A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: . When an admin views the public page, the script executes. Which type of attack occurred?

Accepted Answer

Stored XSS. The script is stored on the server (feedback) and executed when the admin views the page. This is persistent (stored) XSS.

Answer

Reflected XSS

Answer

Cross-site request forgery (CSRF)

Answer

DOM-based XSS

Question 7

During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?

Accepted Answer

Directory traversal. The use of '../' sequences to traverse directories and access files outside the web root is classic directory traversal.

Answer

Remote File Inclusion (RFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

Local File Inclusion (LFI)

Question 8

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Accepted Answer

Custom request headers (e.g., X-Requested-With). CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.

Answer

Input validation

Answer

Output encoding

Question 9

An IoT device uses the MQTT protocol without TLS. A security tester connects to the broker and subscribes to all topics using '#'. What is the tester MOST likely able to accomplish?

Accepted Answer

Eavesdrop on all MQTT communications. MQTT without encryption allows anyone to subscribe to topics. Subscribing to '#' captures all messages, leading to interception of sensitive data. This is a passive eavesdropping attack, not active manipulation like replay or injection.

Answer

Perform a denial of service on the broker

Answer

Inject malicious control commands

Answer

Replay previously captured messages

Question 10

A penetration tester executes the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. Which attack is being performed?

Accepted Answer

WPS PIN brute-force attack. Reaver is a tool used for brute-forcing WPS PINs to recover the WPA/WPA2 pre-shared key. The command specifies the interface and BSSID, indicating a WPS attack.

Answer

WEP IV attack

Answer

Evil twin attack

Answer

De-authentication attack

Question 11

An attacker uses the following URL pattern to access files: http://example.com/../../etc/passwd. Which attack is being attempted?

Accepted Answer

Directory traversal. The URL pattern http://example.com/../../etc/passwd uses directory traversal (also known as path traversal) to navigate outside the web root and access the /etc/passwd file on a Linux system. The ../ sequences move up the directory tree, attempting to read a sensitive system file. This is a classic directory traversal attack.

Answer

Command injection

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Question 12

Which THREE of the following are valid methods to prevent a downgrade attack on TLS? (Select 3)

Accepted Answer

Disable TLS 1.0 and 1.1 on the server. Disabling older TLS versions, enforcing TLS 1.2+, and using TLS_FALLBACK_SCSV prevent downgrade; disabling cipher suites does not prevent downgrade directly; using self-signed certificates increases risk.

Answer

Use self-signed certificates to avoid CA trust issues

Answer

Disable all cipher suites except those using RC4

Question 13

During a cloud penetration test, you discover an S3 bucket that allows listing objects. You find a file named 'config.json' that contains an IAM access key and secret key. Which of the following is the BEST next step?

Accepted Answer

Use the keys to call sts:GetCallerIdentity and then enumerate permissions via IAM. The correct action is to use the discovered credentials to enumerate permissions via the AWS CLI, as they may grant further access.

Answer

Delete the bucket to prevent further data exposure

Answer

Download all objects from the bucket and exfiltrate them

Answer

Immediately rotate the keys in the AWS console

Question 14

A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?

Accepted Answer

Server-Side Request Forgery (SSRF). SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.

Answer

SQL injection

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 15

A web application allows users to submit feedback that is stored in a database and displayed to other users without proper sanitization. A tester inputs '' and it executes when other users view the feedback. Which type of XSS is this?

Accepted Answer

Stored XSS. Stored XSS occurs when malicious script is persisted on the server — typically in a database — and later served to other users who view the affected page. In this scenario the payload is saved via the feedback form and executes in the browsers of users who view the feedback, which is the defining characteristic of stored (persistent) XSS.

Answer

Self-XSS

Answer

DOM-based XSS

Answer

Reflected XSS

Question 16

Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?

Accepted Answer

File virus. A file virus (also known as a file infector) is a type of malware that replicates by inserting its code into executable files (e.g., .exe, .com, .dll). It requires human action to spread, such as opening an infected email attachment or running an infected program, because the virus code is only activated when the host executable is executed.

Answer

Worm

Answer

Ransomware

Answer

Trojan

Question 17

Which THREE of the following are effective countermeasures against evil twin attacks in wireless networks? (Select THREE.)

Accepted Answer

Implementing client-side certificate validation for network authentication. Evil twin attacks involve a rogue AP impersonating a legitimate one. Countermeasures include using WPA3-Enterprise with 802.1X for mutual authentication, implementing client-side certificate validation, and using VPNs to encrypt traffic even over rogue APs.

Answer

Enabling MAC address filtering on the AP

Answer

Disabling SSID broadcast on the legitimate AP

Question 18

A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). The different page sizes for valid versus invalid user IDs indicate an Insecure Direct Object Reference (IDOR) vulnerability, where the application exposes internal object references (like user IDs) without proper authorization checks. An attacker can manipulate the parameter to access other users' data, and the varying response size reveals whether the ID exists, enabling enumeration. This is a classic IDOR exploitation pattern.

Answer

Stored Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Question 19

During a cloud penetration test, a tester discovers an AWS S3 bucket that allows public 's3:PutObject' access. The tester uploads a file containing JavaScript that steals cookies. Which type of attack is this an example of?

Accepted Answer

Cross-Site Scripting (XSS) via uploaded file. Uploading malicious content to an S3 bucket with public write access enables storage of attacker-controlled files. When users access these files, a client-side attack (like XSS) can occur. This is a classic example of a storage-based attack via misconfigured S3 bucket.

Answer

Server-Side Request Forgery (SSRF)

Answer

Insecure Direct Object Reference (IDOR)

Answer

S3 bucket privilege escalation

Question 20

An organization is experiencing repeated DDoS attacks that consume all available bandwidth. Which mitigation technique is MOST effective for handling such volumetric attacks?

Accepted Answer

Scrubbing centers. Scrubbing centers (Option D) are the most effective mitigation for volumetric DDoS attacks because they use specialized hardware and software to filter malicious traffic from legitimate traffic before it reaches the target network. Unlike simpler methods, scrubbing centers can handle massive bandwidth floods by redirecting traffic through high-capacity filtering nodes that inspect packets, drop attack traffic based on signatures or behavioral analysis, and forward only clean traffic. This approach is specifically designed for volumetric attacks that saturate bandwidth, as it offloads the filtering burden from the target's own infrastructure.

Answer

Blackholing all traffic to the target IP

Answer

Anycast network distribution

Answer

Rate limiting on the firewall