CEH Practice Exam 53 — 20 Questions

Question 1

A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?

Accepted Answer

Server-Side Request Forgery (SSRF). SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.

Answer

SQL injection

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 2

An IoT device uses MQTT protocol with default credentials 'admin/admin' and no TLS encryption. An attacker on the same network captures MQTT packets and extracts sensor data. Which two vulnerabilities are being exploited? (Choose the best combination)

Accepted Answer

Default credentials and cleartext communication. The use of default credentials and lack of encryption (no TLS) are the vulnerabilities. MQTT itself is not insecure when properly configured; the issues are weak authentication and cleartext communication.

Answer

Buffer overflow and command injection

Answer

Insecure firmware and hardcoded backdoor

Answer

Weak encryption and replay attack

Question 3

Which THREE of the following are common attack vectors against IoT devices?

Accepted Answer

Insecure protocols (e.g., MQTT, CoAP without encryption). Default credentials, insecure protocols (e.g., MQTT without TLS), and firmware reversing (to find hardcoded secrets) are common IoT attack vectors. TLS stripping is a network attack, and container escape is a cloud/container attack.

Answer

Container escape

Answer

TLS stripping attack

Question 4

In PKI, what is the primary role of a Certificate Authority (CA)?

Accepted Answer

To issue and digitally sign certificates. A CA issues and signs digital certificates, validating the identity of certificate requestors.

Answer

To revoke user passwords

Answer

To generate random session keys

Answer

To encrypt data between client and server

Question 5

Which of the following attacks is characterized by an attacker placing a fake wireless access point with the same SSID as a legitimate network to capture client credentials?

Accepted Answer

Evil twin attack. An evil twin attack involves setting up a rogue access point that mimics a legitimate SSID to intercept traffic and capture credentials.

Answer

De-authentication attack

Answer

WPS PIN brute force attack

Answer

Replay attack

Question 6

A security analyst is investigating a potential container escape in a Kubernetes cluster. Which THREE of the following are common indicators of a container escape?

Accepted Answer

A process running inside the container with CAP_SYS_ADMIN capability. Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

Answer

The container has a read-only root filesystem

Answer

The container is running as a non-root user

Question 7

An IoT device uses the MQTT protocol without TLS. An attacker on the same network captures messages and publishes a fake temperature reading. Which attack is being executed?

Accepted Answer

Man-in-the-middle attack. MQTT over plain TCP allows message interception and injection (man-in-the-middle) because no encryption or authentication is enforced.

Answer

Replay attack

Answer

Firmware reversing attack

Answer

Denial of service attack

Question 8

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Accepted Answer

Implement client authentication and enable TLS encryption. MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 9

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

Answer

Aircrack-ng

Answer

Nmap

Answer

Wireshark

Question 10

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

Accepted Answer

Aircrack-ng. The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Answer

Wireshark

Answer

Kismet

Answer

Reaver

Question 11

An attacker gains access to a cloud environment and attempts to move laterally by assuming an IAM role with higher privileges. Which cloud attack vector is the attacker exploiting?

Accepted Answer

IAM misuse. IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

Answer

SSRF attack

Answer

S3 bucket misconfiguration

Answer

Container escape

Question 12

During a cloud penetration test, a tester discovers an AWS S3 bucket that allows public 's3:PutObject' access. The tester uploads a file containing JavaScript that steals cookies. Which type of attack is this an example of?

Accepted Answer

Cross-Site Scripting (XSS) via uploaded file. Uploading malicious content to an S3 bucket with public write access enables storage of attacker-controlled files. When users access these files, a client-side attack (like XSS) can occur. This is a classic example of a storage-based attack via misconfigured S3 bucket.

Answer

Server-Side Request Forgery (SSRF)

Answer

Insecure Direct Object Reference (IDOR)

Answer

S3 bucket privilege escalation

Question 13

Which wireless security standard introduced in 2018 uses Simultaneous Authentication of Equals (SAE) to replace the pre-shared key exchange in WPA2, providing forward secrecy and resistance to offline dictionary attacks?

Accepted Answer

WPA3. WPA3 uses SAE (Dragonfly handshake) to provide forward secrecy and protect against offline dictionary attacks. WPA2 used PSK which is vulnerable to dictionary attacks. WEP and 802.1X are older or different.

Answer

802.1X/EAP

Answer

WEP

Answer

WPA2

Question 14

What is the primary purpose of the 4-way handshake in WPA/WPA2-Personal?

Accepted Answer

To establish encryption keys without transmitting the pre-shared key. The 4-way handshake confirms that both client and AP possess the pre-shared key (PSK) without exposing it, and generates temporal keys for encryption.

Answer

To authenticate the user with a username and password

Answer

To synchronize the beacon intervals between client and AP

Answer

To exchange digital certificates between client and AP

Question 15

In the cloud shared responsibility model, which of the following is typically the responsibility of the customer when using AWS EC2 (IaaS)?

Accepted Answer

Configuring security groups and firewall rules. AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

Answer

Patching the hypervisor

Answer

Network infrastructure redundancy

Answer

Physical security of data centers

Question 16

Which cloud security assessment tool is specifically designed to audit AWS environments against best practices and CIS benchmarks?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations.

Answer

Pacu

Answer

Nessus

Answer

Metasploit

Question 17

Which cryptographic algorithm is vulnerable to a birthday attack on its hash output size of 128 bits, reducing the effective security to 64 bits against collision resistance?

Accepted Answer

MD5. MD5 produces 128-bit hashes. Birthday attack complexity for collision is 2^(n/2) = 2^64 for n=128. SHA-1 is 160-bit, SHA-256 is 256-bit, RC4 is a stream cipher not a hash.

Answer

SHA-256

Answer

SHA-1

Answer

RC4

Question 18

A penetration tester uses the following command to attack a WPS-enabled AP: 'reaver -i mon0 -b 00:11:22:33:44:55 -vv'. What is the primary goal of this attack?

Accepted Answer

Obtain the WPS PIN and subsequently the WPA2 PSK. Reaver is used to brute force the WPS PIN, recovering the PIN and ultimately the WPA2 PSK.

Answer

Perform a de-authentication attack on all clients

Answer

Capture a WPA2 4-way handshake for offline cracking

Answer

Scan for hidden SSIDs in the area

Question 19

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)

Question 20

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

Accepted Answer

Run a dictionary attack using aircrack-ng with a wordlist. After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

Answer

Use aircrack-ng to crack the WEP key from the handshake

Answer

Brute-force the WPS PIN using Reaver

Answer

De-authenticate the client from the network again to capture another handshake