CEH Practice Exam 52 — 20 Questions

Question 1

A security team uses ScoutSuite to assess their AWS environment. The tool reports that an S3 bucket policy allows access from any IP address. What is the MOST likely misconfiguration?

Accepted Answer

The bucket policy uses 'Principal': '*' and 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}}. ScoutSuite identifies overly permissive bucket policies; allowing access from any IP (0.0.0.0/0) is a common misconfiguration.

Answer

The bucket has versioning enabled

Answer

The bucket ACL grants 'FullControl' to 'AuthenticatedUsers' group

Answer

The bucket is encrypted with SSE-S3

Question 2

A cloud security engineer notices that an S3 bucket named 'company-backup' is configured to allow 's3:GetObject' access to 'Principal: *'. Which attack is this misconfiguration MOST likely to enable?

Accepted Answer

Unauthorized data access and exfiltration. When an S3 bucket allows GetObject access to any principal (public), anyone can list and download objects, leading to data exposure. This is a classic unauthorized data access scenario, not privileged escalation or DoS.

Answer

Denial of service by deleting objects

Answer

SSRF attack to internal metadata

Answer

Privilege escalation via IAM role

Question 3

During a penetration test, a security analyst captures network traffic and observes a series of ARP replies without corresponding ARP requests. An internal host's IP address is suddenly associated with two different MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP poisoning. D is correct because ARP poisoning (also known as ARP spoofing) involves sending forged ARP replies to associate a target IP address with an attacker's MAC address, allowing man-in-the-middle attacks. The observation of unsolicited ARP replies (gratuitous ARPs) that map one IP to two different MAC addresses is the classic signature of an ongoing ARP poisoning attack.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 4

During a cloud security audit, a tool reports that an AWS IAM role has a policy allowing 'ec2:RunInstances' with a condition 'aws:SourceIp': '0.0.0.0/0'. What is the most immediate risk?

Accepted Answer

An attacker can launch expensive EC2 instances from any IP. The condition allows all IP addresses (0.0.0.0/0) to launch EC2 instances, meaning any user who can assume this role can create instances from anywhere, potentially for cryptocurrency mining or other malicious purposes.

Answer

An attacker can delete all EC2 instances

Answer

An attacker can modify VPC security groups

Answer

An attacker can read data from any S3 bucket

Question 5

An IoT device uses MQTT for communication. An attacker intercepts MQTT packets and observes that the publish messages are not encrypted and contain plaintext sensor data. Which of the following is the BEST recommendation to secure MQTT traffic?

Accepted Answer

Use MQTT over TLS. MQTT itself does not provide encryption; using TLS (MQTT over TLS) encrypts the entire communication channel, protecting data in transit.

Answer

Base64-encode the payload

Answer

Switch to CoAP protocol

Answer

Implement a VPN on the device

Question 6

A security analyst notices that users receive emails from a known vendor requesting urgent payment to a new bank account. The email domain is misspelled (e.g., vvendorfake.com). Which type of social engineering is this?

Accepted Answer

Spear phishing. This is spear phishing because the attack is specifically targeted at users of a known vendor, using a misspelled domain (vvendorfake.com) to impersonate that vendor. Unlike generic phishing, spear phishing involves personalized context (e.g., referencing a known vendor and urgent payment) to increase credibility. The misspelled domain exploits users' trust in the legitimate vendor's name, making it a targeted social engineering technique.

Answer

Whaling

Answer

Phishing

Answer

Vishing

Question 7

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

Accepted Answer

The customer is responsible for configuring access controls and permissions. Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

Answer

AWS is responsible for physical security of data centers

Answer

The customer is responsible for patching the S3 service

Answer

AWS is responsible for network infrastructure; the customer for data classification

Question 8

A web application allows users to upload profile pictures. The application uses the filename provided by the user to save the file on the server. An attacker uploads a file named 'malicious.php%00.png' and the server saves it as 'malicious.php'. Which vulnerability is being exploited?

Accepted Answer

Null byte injection. Null byte injection exploits the fact that in some programming languages (like C or older PHP versions), a null byte (%00) terminates a string. The application saves the file using the user-supplied filename, but when it processes 'malicious.php%00.png', the null byte causes the string to be truncated to 'malicious.php', allowing the attacker to upload a PHP file that can be executed.

Answer

Directory traversal

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 9

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. A 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 10

An attacker sends a request to a web server with the following header: X-Forwarded-For: 127.0.0.1. The server processes the request as if it came from localhost and grants administrative access. This is an example of:

Accepted Answer

Server-Side Request Forgery (SSRF). The scenario describes spoofing the X-Forwarded-For header to bypass IP-based access controls. This is not SSRF; SSRF involves the server making outbound requests to internal resources based on user input. None of the listed options correctly identifies this attack.

Answer

HTTP request smuggling

Answer

IDOR (Insecure Direct Object Reference)

Answer

Clickjacking

Question 11

You are a security analyst for a financial institution. The company has deployed a network of 500 Windows 10 workstations and 50 servers running Windows Server 2019. All systems are protected by a next-generation firewall and an endpoint detection and response (EDR) solution. Recently, several employees reported that their workstations are running slowly and exhibiting unusual pop-up messages demanding a ransom note in Bitcoin. The EDR alerts show that a file named 'invoice.docm' was downloaded from an email attachment and executed on multiple workstations. The EDR also indicates that the file dropped a PowerShell script that connected to an external IP address and downloaded additional payloads. After the initial infection, the EDR detected that the ransomware binary 'encryptor.exe' was executed, which began encrypting files. However, the encryption process was stopped by the EDR before all files were encrypted. The incident response team needs to determine the source of the infection and prevent future occurrences. Which of the following is the most effective first step to identify the initial infection vector?

Accepted Answer

Reimage all affected workstations to remove the ransomware and then review email logs for the original phishing email.. The question asks for the most effective first step to identify the initial infection vector, and the only identification-oriented action among the choices is reviewing email logs to trace the original phishing email. The scenario already indicates that invoice.docm was delivered by email, so email logs and mail gateway/EDR telemetry are the proper forensic sources to identify sender, recipients, and delivery scope. Although option A includes reimaging, that is a remediation action and should not be performed before evidence collection; however, the key identification step is the email log review. Option C is preventive hardening and does not identify how the current infection started. Option B is containment, and option D is overly broad prevention that breaks legitimate automation.

Answer

Block the external IP address at the firewall to prevent further communication with the C2 server.

Answer

Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.

Answer

Disable PowerShell across all workstations via Group Policy to prevent script execution.

Question 12

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

Answer

Pharming

Answer

Spear phishing

Answer

Vishing

Question 13

Which TWO of the following techniques are considered passive reconnaissance? (Select exactly 2.)

Accepted Answer

Performing a WHOIS lookup. A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks. This process does not send any packets directly to the target system; it relies on third-party servers, making it a passive reconnaissance technique.

Answer

Connecting to a web server to grab its banner

Answer

Sending ICMP echo requests to a target

Answer

Running a Nmap SYN scan

Question 14

Which of the following is the BEST defense against brute-force attacks on a login form?

Accepted Answer

Account lockout after 5 failed attempts. Account lockout after a small number of failed attempts (D) is the most direct and effective defense against brute-force attacks on a login form: it stops the attack at the source by disabling the targeted account after repeated failures, regardless of source IP. Rate limiting (A) is a useful complementary control, but it can be bypassed by distributing attempts across many IPs and does not stop slow, low-rate brute-force attempts. CAPTCHA (B) can be bypassed by automated solvers, and complex password policies (C) do not prevent repeated attempts. Therefore the BEST answer is D.

Answer

Rate limiting on the login endpoint

Answer

CAPTCHA

Answer

Complex password policy

Question 15

In the context of privilege escalation on Windows, what is token impersonation, and which tool is commonly used to exploit it?

Accepted Answer

A technique to assume another user's security context; Incognito. Token impersonation is a privilege escalation technique where an attacker assumes the security context (including privileges and identity) of another user by duplicating or manipulating an existing access token. The Incognito tool is specifically designed to enumerate available tokens on a Windows system and impersonate them, allowing an attacker to escalate privileges to that of a higher-privileged user (e.g., SYSTEM). This is a core technique in post-exploitation after gaining initial access.

Answer

A technique to dump hashes; Hashcat

Answer

A technique to steal session cookies; Mimikatz

Answer

A technique to bypass UAC; Metasploit

Question 16

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. HTTP flood (B) is correct because it operates at the application layer (Layer 7), overwhelming a web server with seemingly legitimate HTTP GET or POST requests that consume server resources and bandwidth. Slowloris (C) is also correct because it is a Layer 7 attack that opens many partial HTTP connections and sends incomplete headers, keeping sockets open and exhausting the web server's connection pool without needing high bandwidth. UDP flood (A) is incorrect because it is a volumetric transport-layer (Layer 4) attack that sends large numbers of UDP packets to random ports. ICMP flood (D) is incorrect because it is a network-layer (Layer 3) attack using ICMP echo requests. SYN flood (E) is incorrect because it exploits the TCP handshake at the transport layer (Layer 4) by sending many SYN packets without completing the connection.

Answer

UDP flood

Answer

ICMP flood

Answer

SYN flood

Question 17

A security analyst is investigating a suspicious file and wants to quickly determine whether it is known malware without executing it. Which approach should the analyst use FIRST?

Accepted Answer

Submit the file to VirusTotal for hash lookup. Submitting the file's hash to VirusTotal is the fastest and safest first step to determine if the file is known malware. VirusTotal aggregates results from over 70 antivirus engines and threat intelligence feeds, allowing the analyst to check the file's reputation without any risk of execution or analysis overhead. This approach leverages existing threat intelligence to instantly identify known malicious samples, which is the most efficient initial triage step.

Answer

Disassemble the file with IDA Pro

Answer

Check for strings in the binary

Answer

Run the file in a sandbox environment

Question 18

A security analyst detects a file named 'invoice.pdf.exe' in an email attachment. When the file is submitted to VirusTotal, multiple engines detect it as a Trojan. The analyst wants to perform dynamic analysis to observe its behavior. Which approach is BEST?

Accepted Answer

Execute the file in a sandboxed environment and monitor system calls. Dynamic analysis involves executing malware in a controlled, isolated environment (sandbox) to observe its runtime behavior, such as file system changes, registry modifications, network connections, and process injections. Option C directly enables this by running the Trojan and monitoring system calls, which is the best approach to understand its actual impact and propagation methods.

Answer

Disassemble the file using IDA Pro to understand its code

Answer

Run 'strings' on the file and analyze the output

Answer

Submit the file again to VirusTotal for a second opinion

Question 19

During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?

Accepted Answer

SUID/GUID abuse. SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.

Answer

Pass-the-hash

Answer

Token impersonation

Answer

Kerberoasting

Question 20

An organization experiences a DDoS attack where the attacker sends many incomplete HTTP requests that keep connections open, exhausting the server's connection pool. Which attack technique is being used?

Accepted Answer

Slowloris. Slowloris is a DDoS attack that works by opening multiple connections to the target server and sending partial HTTP requests, never completing them. The server keeps these connections open waiting for the rest of the request, eventually exhausting the connection pool and denying service to legitimate users. This matches the description of incomplete HTTP requests keeping connections open.

Answer

UDP flood

Answer

HTTP flood

Answer

SYN flood