CEH Practice Exam 54 — 20 Questions

Question 1

A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)

Accepted Answer

WHOIS lookup. WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.

Answer

Telnet banner grab

Answer

Ping sweep

Answer

Nmap SYN scan

Question 2

Which tool is specifically designed to create fake login pages for phishing campaigns and can be integrated with Metasploit?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed to automate social engineering attacks, including the creation of fake login pages (credential harvesting) for phishing campaigns. It includes a built-in 'Website Attack Vectors' module that can clone legitimate sites and capture submitted credentials, and it offers direct integration with Metasploit to deliver payloads or establish reverse shells upon credential submission.

Answer

Nmap

Answer

Wireshark

Answer

Ettercap

Question 3

An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?

Accepted Answer

Slowloris. Slowloris is a low-and-slow application-layer DoS attack that opens multiple HTTP connections to the target server and keeps them alive by sending partial HTTP GET requests with random parameters, never completing the request. This exhausts the server's connection pool, preventing legitimate users from connecting, while each request takes a long time due to the server waiting for the final headers.

Answer

UDP flood

Answer

SYN flood

Answer

HTTP flood

Question 4

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. In this case, the caller impersonates IT support to establish a false sense of authority and urgency, directly asking for the password. This differs from vishing, which is voice-based phishing but typically involves a generic, automated or scripted request rather than a crafted, interactive pretext.

Answer

Phishing

Answer

Baiting

Answer

Vishing

Question 5

During a vulnerability assessment, a security analyst receives an alert from the IDS that a scan with fragmented packets and spoofed source IPs is targeting the internal network. Which Nmap command MOST likely caused this alert?

Accepted Answer

nmap -f -D 10.0.0.1,10.0.0.2 192.168.1.1. The `-f` flag fragments the packets into smaller IP fragments, and the `-D` flag performs a decoy scan by spoofing source IPs. This combination causes the IDS to detect fragmented packets with spoofed source addresses, matching the alert description.

Answer

nmap -sS -O 192.168.1.1

Answer

nmap -sV -p 80 192.168.1.1

Answer

nmap -sU 192.168.1.1

Question 6

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 7

Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. HTTP flood is a Layer 7 DDoS attack because it targets the application layer by sending seemingly legitimate HTTP GET or POST requests to overwhelm a web server's resources. Unlike network-layer attacks, HTTP flood exploits the server's ability to process requests, often mimicking normal user behavior to bypass basic rate limiting. Slowloris is also a Layer 7 attack that works by opening multiple HTTP connections and keeping them open with partial requests, exhausting the server's connection pool without completing the handshake.

Answer

Smurf attack

Answer

SYN flood

Answer

UDP flood

Question 8

A company wants to defend against DNS amplification attacks. Which mitigation technique would be MOST effective?

Accepted Answer

Implementing rate limiting on DNS servers. B is correct because rate limiting restricts the number of DNS responses a server sends to a single source, reducing the volume of traffic that can be generated in an amplification attack. DNS amplification exploits open recursive resolvers to send small queries that yield large responses, and rate limiting directly curbs the attacker's ability to flood the victim with amplified traffic. This technique is specifically recommended in RFC 5358 and by industry best practices for mitigating reflection/amplification DDoS attacks.

Answer

Disabling recursive queries on DNS servers

Answer

Deploying anycast routing

Answer

Using a scrubbing center

Question 9

A penetration tester uses a tool to perform a MAC flooding attack. What is the intended result of this attack?

Accepted Answer

Read all network traffic by turning the switch into a hub. A MAC flooding attack exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively turning it into a hub. This allows the attacker to capture network traffic that would normally be isolated to a specific port.

Answer

Modify the MAC address of the attacker's NIC

Answer

Cause a denial of service on the switch

Answer

Poison the ARP cache of the target hosts

Question 10

A security analyst receives an alert indicating that a host on the internal network is sending a high volume of ICMP echo requests to multiple external IP addresses. The analyst notices that the source IP address is spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

Ping flood. The attack described is a Ping flood (option D). A Ping flood involves sending a high volume of ICMP echo requests (pings) directly to multiple target IP addresses, often with a spoofed source IP to hide the attacker's identity. This overwhelms the targets' network resources. Unlike a Smurf attack, which uses a network broadcast address to amplify traffic, this scenario shows direct flooding of multiple external IPs, characteristic of a Ping flood.

Answer

Fraggle attack

Answer

ICMP flood

Answer

Smurf attack

Question 11

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

Accepted Answer

The CRL published by the online issuing CA. The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.

Answer

The CRL published by the certificate authority that signed the issuing CA's certificate

Answer

The CRL published by the intermediate CA, if any

Answer

The CRL published by the offline root CA

Question 12

A security analyst discovers a file named invoice.exe in an email attachment. Static analysis with PEiD indicates the file is packed with UPX. What is the BEST next step in analyzing this malware?

Accepted Answer

Unpack the file with UPX and then perform static analysis. B is correct because UPX-packed executables cannot be properly analyzed statically; the code is compressed and obfuscated. Unpacking with the UPX tool restores the original binary, enabling accurate static analysis of imports, strings, and structure. This step is essential before any dynamic analysis or submission to sandboxes.

Answer

Execute the packed file on a production server

Answer

Submit the packed file directly to VirusTotal

Answer

Delete the file immediately

Question 13

An analyst is analyzing a suspicious file using VirusTotal and observes that only 3 out of 60 antivirus engines detect it as malicious. The file has been submitted before but with no detections. What should the analyst conclude?

Accepted Answer

The file is likely malicious and requires further analysis. A detection rate of 3 out of 60 (5%) is extremely low, but the fact that the file was previously submitted with zero detections and now has three detections indicates that the antivirus engines have updated their signatures to identify it. This pattern is consistent with a new or polymorphic malware strain that initially evaded detection but is now being recognized by a few engines. A low detection rate does not guarantee safety; it often signals a targeted or zero-day threat that requires further analysis through sandboxing or dynamic analysis.

Answer

The file is a clean file with a rare hash

Answer

The file is safe because most engines don't detect it

Answer

The file is likely a false positive

Question 14

During a penetration test, an ethical hacker captures a WPA2 handshake and successfully cracks the PSK. Which additional action must be taken to decrypt previously captured traffic?

Accepted Answer

Capture the nonce values from the access point.. Once the PSK is cracked, the PMK is derived from the PSK and SSID. To decrypt captured WPA2 traffic, the Pairwise Transient Key (PTK) must be derived from the PMK, the AP and client MAC addresses, and the nonces (ANonce and SNonce) from the 4-way handshake. Therefore, the additional required step is to obtain/use the nonce values from the captured handshake; computing the PMKID is not necessary for decrypting captured traffic.

Answer

Compute the Pairwise Master Key Identifier (PMKID) from the PSK and AP MAC.

Answer

Use the PSK directly to compute the Michael Integrity Check (MIC).

Answer

Obtain the Group Temporal Key (GTK) from the access point.

Question 15

Which TWO of the following are symmetric encryption algorithms?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm that uses the same key for both encryption and decryption. It is widely adopted for securing sensitive data and is a block cipher with key sizes of 128, 192, or 256 bits.

Answer

Diffie-Hellman

Answer

RSA

Answer

ECC

Question 16

Which TWO of the following are common techniques for covering tracks after compromising a system? (Select 2)

Accepted Answer

Manipulating event logs to remove evidence of intrusion. Manipulating event logs (e.g., clearing, modifying, or deleting entries in Windows Event Log or syslog) is a standard post-exploitation step to remove traces of unauthorized access, such as failed login attempts or privilege escalation events. Attackers often use tools like `wevtutil` or `clearlogs` to erase evidence, making forensic reconstruction difficult.

Answer

Increasing the frequency of password changes

Answer

Enabling verbose logging for future attacks

Answer

Setting up a honeypot to distract defenders

Question 17

An organization experiences a DDoS attack where a large volume of DNS queries with spoofed source IPs are sent to open DNS resolvers, which then amplify the traffic to the victim. Which type of attack is this?

Accepted Answer

DNS amplification. This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends a small DNS query (e.g., ANY type) with a spoofed source IP (the victim's IP) to an open resolver, which responds with a much larger response (up to 50-100x the query size), flooding the victim. The key mechanism is the amplification factor combined with the spoofed source address, which directs the amplified traffic to the victim.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 18

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY enumeration. The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

Answer

EXPN enumeration

Answer

SMTP banner grabbing

Answer

RCPT TO enumeration

Question 19

During a penetration test, you capture the following output: 'HTTP/1.1 200 OK ... Set-Cookie: sessionid=abc123; path=/'. You then send a request with a modified cookie value 'sessionid=abc124' and receive a valid session. Which type of vulnerability has been exploited?

Accepted Answer

Session hijacking via cookie prediction. The attacker successfully predicted or guessed a valid session identifier (sessionid=abc124) after observing the pattern of the original session cookie (sessionid=abc123). This is a classic session hijacking via cookie prediction attack, where weak or sequential session IDs allow an attacker to impersonate another user's session without needing to intercept traffic or inject code.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 20

An attacker calls a company's help desk, pretending to be a new employee who forgot his username and password. The attacker provides some employee details gleaned from social media and convinces the help desk to reset the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where the attacker fabricates a scenario (pretext) to manipulate the target into performing an action. In this case, the attacker pretends to be a new employee, using details from social media to establish credibility, and convinces the help desk to reset credentials. This is a classic example of pretexting because the entire interaction is based on a false identity and fabricated story.

Answer

Tailgating

Answer

Quid pro quo

Answer

Baiting