CEH Practice Exam 52 — 20 Questions

Question 1

Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)

Accepted Answer

It changes its code signature each time it replicates. A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.

Answer

It does not require a host file to spread

Answer

It only infects the master boot record

Answer

It attaches to email messages automatically

Question 2

A penetration tester runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The command uses the -sS flag for a TCP SYN scan (stealth scan), -sV for service version detection, and -O for OS fingerprinting, targeting only the four specified ports (22, 80, 443, 3389) across the 192.168.1.0/24 subnet. This combination performs a half-open TCP scan on those ports, probes open ports to identify service versions, and attempts to determine the operating system based on TCP/IP stack responses.

Answer

Perform a UDP scan on the four specified ports and identify running services

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Question 3

An attacker attempts to enumerate valid email users by connecting to an SMTP server and issuing the following commands: EHLO example.com, VRFY root, VRFY admin, VRFY user1. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY. The VRFY command is specifically designed to verify whether a mailbox exists on an SMTP server. By issuing VRFY followed by usernames (root, admin, user1), the attacker can enumerate valid email users based on the server's responses (e.g., 250 or 251 for valid, 550 for invalid). This is a classic SMTP user enumeration technique.

Answer

RCPT TO

Answer

MAIL FROM

Answer

EXPN

Question 4

A web application allows users to access files using parameters like 'file=report.pdf'. A tester changes the parameter to '../../etc/passwd' and retrieves the system password file. This is an example of which attack?

Accepted Answer

Directory traversal. Directory traversal attacks exploit insufficient input validation to access files outside the intended directory by using '../' sequences.

Answer

Local file inclusion (LFI)

Answer

Remote file inclusion (RFI)

Answer

Command injection

Question 5

An application is vulnerable to server-side request forgery (SSRF). An attacker exploits this to access internal services. Which of the following is a common indicator of SSRF?

Accepted Answer

The application includes a parameter like 'url=' that fetches remote resources. SSRF vulnerabilities often appear where the application fetches URLs based on user input, such as 'url=' parameters, allowing the attacker to make the server request internal resources.

Answer

The application uses user input in file inclusion functions like include()

Answer

The application reflects user input in HTTP headers

Answer

The application stores user input in a database without sanitization

Question 6

An analyst reviews the following HTTP response: HTTP/1.1 200 OK Set-Cookie: sessionid=abc123; SameSite=None; Secure ...

Welcome back!

. What possible vulnerability exists if the application does not use CSRF tokens?

Accepted Answer

Cross-site request forgery (CSRF). SameSite=None allows cross-site requests to include cookies, making CSRF possible if no CSRF tokens are used. SameSite=Lax or Strict would block some CSRF attacks.

Answer

Clickjacking

Answer

Cross-site scripting (XSS)

Answer

Session fixation

Question 7

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services

Question 8

A security team discovers that an attacker has been using steganography to exfiltrate data from the corporate network. The attacker hid data inside image files and uploaded them to a public image hosting site. Which of the following is the BEST method to detect this type of exfiltration?

Accepted Answer

Deploy a steganography detection tool that analyzes image pixel patterns for statistical anomalies. Steganography detection tools analyze statistical anomalies in pixel patterns (e.g., LSB embedding, DCT coefficient deviations) that are invisible to the human eye but detectable via algorithms like chi-square analysis or RS analysis. This directly identifies hidden payloads without relying on file hashes or headers, which steganography does not alter.

Answer

Compare file hashes of uploaded images to known-good baselines

Answer

Block all image uploads to external sites

Answer

Use network-based DLP to inspect image file headers for hidden data

Question 9

A security analyst is investigating a potential container escape in a Kubernetes cluster. Which THREE of the following are common indicators of a container escape?

Accepted Answer

A process running inside the container with CAP_SYS_ADMIN capability. Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

Answer

The container has a read-only root filesystem

Answer

The container is running as a non-root user

Question 10

Which TWO of the following are passive reconnaissance techniques? (Select 2)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.

Answer

Banner grabbing with Netcat

Answer

Running a TCP SYN scan with Nmap

Answer

Performing a ping sweep

Question 11

Which THREE of the following are common methods used to mitigate DDoS attacks? (Select 3)

Accepted Answer

Rate limiting. Rate limiting is a common mitigation technique that restricts the number of requests a server or network device will accept from a specific source within a given time window. By enforcing thresholds (e.g., packets per second), it prevents any single source from overwhelming the target, effectively reducing the impact of volumetric DDoS attacks.

Answer

MAC flooding

Answer

ARP poisoning

Question 12

A security analyst notices that a server is sending an unusually high number of SYN packets to multiple external hosts, but the connections are never completed. The server is most likely involved in which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target without completing the handshake (no final ACK). The server in this scenario is the attacker, generating these incomplete SYN connections to exhaust the target's resources, such as the SYN backlog queue, leading to denial of service.

Answer

Ping of Death

Answer

Smurf attack

Answer

UDP flood

Question 13

An analyst captures network traffic and sees a large number of packets with source IP 10.0.0.1, destination IP 192.168.1.1, TCP SYN flag set, with sequence numbers that appear incremental. The destination responds with SYN-ACK but the source never completes the handshake. Which attack is MOST likely occurring?

Accepted Answer

SYN flood. This behavior describes a classic SYN flood attack. The source (10.0.0.1) sends a high volume of TCP SYN packets with incremental sequence numbers to the target (192.168.1.1). The target responds with SYN-ACK packets, but the source never sends the final ACK to complete the three-way handshake. This leaves the target with half-open connections that exhaust its connection table, denying service to legitimate traffic.

Answer

ARP poisoning

Answer

ICMP flood

Answer

DNS amplification

Question 14

After gaining access to a system, an attacker modifies log files to remove evidence of their activities. This action is part of which phase of the system hacking methodology?

Accepted Answer

Erasing tracks. 'Erasing tracks,' because after gaining access, the attacker's goal is to cover their footprints by modifying or deleting log files, clearing event logs, or using tools like `wevtutil` or `clearev` to remove evidence of their activities. This phase ensures the system administrator cannot detect the intrusion or trace the attacker's actions.

Answer

Spying

Answer

Executing applications

Answer

Hiding files

Question 15

Which of the following is a symmetric encryption algorithm that uses a block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm that operates as a block cipher with a fixed block size of 128 bits and supports key sizes of 128, 192, or 256 bits. It was established by NIST in 2001 (FIPS 197) and is widely used in modern cryptographic systems, including wireless security (WPA2/WPA3) and TLS.

Answer

3DES

Answer

RC4

Answer

RSA

Question 16

A security analyst wants to gather information about a target domain using public records without directly interacting with the target's systems. Which technique is the analyst employing?

Accepted Answer

OSINT using WHOIS queries. OSINT (Open Source Intelligence) using WHOIS queries is a passive reconnaissance technique that gathers domain registration details from public WHOIS databases without interacting with the target's systems. This aligns with the requirement to use public records and avoid direct contact, making it the correct choice for footprinting.

Answer

Vulnerability scanning

Answer

Active reconnaissance

Answer

Social engineering

Question 17

A penetration tester needs to perform a brute-force attack on a web application login form. Which Burp Suite tool is specifically designed for automating parameterized attacks like password guessing?

Accepted Answer

Intruder. Burp Suite Intruder is specifically designed for automating parameterized attacks, such as brute-forcing login credentials, by allowing the tester to define payload positions and iterate through a list of values (e.g., passwords) against a target endpoint. Unlike other tools in Burp Suite, Intruder supports multiple attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) and can handle rate limiting and session handling, making it ideal for password guessing.

Answer

Repeater

Answer

Scanner

Answer

Proxy

Question 18

Which TWO of the following are examples of active reconnaissance techniques? (Select two)

Accepted Answer

Running an Nmap SYN scan against a target. An Nmap SYN scan (also known as a half-open scan) sends a TCP SYN packet to a target port and analyzes the response. If a SYN/ACK is received, the port is open; if an RST is received, the port is closed. This scan actively interacts with the target system by sending network traffic, making it an active reconnaissance technique.

Answer

Querying Shodan for open ports on a target

Answer

Searching for sensitive files using Google dorks

Answer

Performing a WHOIS lookup

Question 19

Which TWO of the following are symmetric encryption algorithms? (Select TWO.)

Accepted Answer

AES. AES and 3DES are both symmetric block ciphers. RSA and ECC are asymmetric algorithms, and SHA-256 is a hash function.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 20

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

Accepted Answer

SQL injection in SOAP service. The SOAP service returns multiple user records in response to a crafted request, indicating that the input is being interpolated into a database query without proper sanitization. This is classic SQL injection (SQLi) in a SOAP XML context, where an attacker can embed SQL payloads within XML elements (e.g., admin' OR '1'='1) to manipulate the backend SQL query and retrieve all records.

Answer

XML External Entity (XXE) injection

Answer

Cross-site scripting (XSS)

Answer

Command injection