CEH Practice Exam 54 — 20 Questions

Question 1

A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?

Accepted Answer

MAC flooding. MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.

Answer

ARP poisoning

Answer

STP attack

Answer

DNS spoofing

Question 2

A penetration tester successfully predicts the TCP sequence numbers of a target and sends crafted packets to impersonate a trusted host. Which type of attack is this?

Accepted Answer

TCP session hijacking. C is correct because the attacker predicts TCP sequence numbers to inject crafted packets, effectively impersonating a trusted host and taking over an established TCP session. This is the defining mechanism of TCP session hijacking, where the attacker spoofs the source IP and uses the predicted sequence numbers to insert malicious data or commands into the ongoing session.

Answer

ARP poisoning

Answer

TCP sequence prediction attack

Answer

DNS spoofing

Question 3

During a penetration test, a tester gains a low-privilege shell on a Linux server. The command `sudo -l` reveals that the user can run `/usr/bin/find` as root. Which technique can the tester use to escalate privileges?

Accepted Answer

Use find with the -exec flag to spawn a shell. The `sudo -l` output shows the user can run `/usr/bin/find` as root without a password. The `find` command has a built-in `-exec` flag that allows executing arbitrary commands on each found file. By running `sudo find / -exec /bin/sh \;`, the tester can spawn a root shell, escalating privileges because the command runs with sudo (root) privileges.

Answer

Abuse the SUID bit on find

Answer

Exploit a kernel vulnerability

Answer

Run a buffer overflow on the find binary

Question 4

A network administrator notices an unusual amount of traffic on port 389 from an internal server to multiple external IP addresses. Which type of malware might be present?

Accepted Answer

Trojan backdoor. Port 389 is used by LDAP. Outbound traffic to multiple external IPs could indicate LDAP query-based command and control or data exfiltration, but more commonly, port 389 is associated with directory services. However, in malware context, it could be a sign of a backdoor or RAT using LDAP for C2. The most likely is that the malware is using LDAP for communication, but given options, a Trojan backdoor is plausible.

Answer

Adware

Answer

Worm

Answer

Ransomware

Question 5

A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?

Accepted Answer

Implement rate limiting and connection timeout. Slowloris works by opening many HTTP connections and keeping them alive by sending partial requests, never completing them, which exhausts the server's connection pool. Rate limiting restricts the number of connections from a single IP, and connection timeouts force idle connections to close, directly countering Slowloris's behavior. This combination prevents the attacker from holding connections open indefinitely.

Answer

Use anycast routing

Answer

Increase the maximum number of simultaneous connections

Answer

Enable SYN cookies

Question 6

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Accepted Answer

Reflected XSS. Reflected XSS occurs when the application immediately returns the user input in the response; here, the User-Agent header is reflected.

Answer

HTTP header injection

Answer

DOM-based XSS

Answer

Stored XSS

Question 7

During a web application test, the tester finds that the application includes user-supplied file names in include() statements. Which TWO of the following are indicators of a Remote File Inclusion (RFI) vulnerability? (Choose TWO.)

Accepted Answer

The application includes files from http://attacker.com/shell.txt. RFI allows inclusion of remote files via HTTP/HTTPS URLs. Directory traversal with ../ is more typical of LFI. Inclusion of local files like /etc/passwd indicates LFI, not RFI.

Answer

The application includes files with '..' and '/' sequences

Answer

The application includes /etc/passwd in the response

Answer

The application includes files with .inc extension

Question 8

During a penetration test, a tester observes that a web application's login form does not implement rate limiting and returns different error messages for valid vs invalid usernames. Which THREE attacks are most likely to be successful? (Select three)

Accepted Answer

Credential stuffing. With username enumeration and no rate limiting, brute force (trying many passwords on one user), credential stuffing (using breached credentials), and password spraying (trying common passwords across many users) are all viable. SQL injection is not directly related to the described conditions.

Answer

Directory traversal

Answer

SQL injection

Question 9

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Accepted Answer

Repeater. Burp Repeater is designed for manually crafting and resending requests to see individual responses, ideal for testing parameter handling.

Answer

Proxy

Answer

Scanner

Answer

Intruder

Question 10

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

Accepted Answer

Run a dictionary attack using aircrack-ng with a wordlist. After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

Answer

Use aircrack-ng to crack the WEP key from the handshake

Answer

Brute-force the WPS PIN using Reaver

Answer

De-authenticate the client from the network again to capture another handshake

Question 11

Which THREE of the following are common attack vectors against IoT devices?

Accepted Answer

Insecure protocols (e.g., MQTT, CoAP without encryption). Default credentials, insecure protocols (e.g., MQTT without TLS), and firmware reversing (to find hardcoded secrets) are common IoT attack vectors. TLS stripping is a network attack, and container escape is a cloud/container attack.

Answer

Container escape

Answer

TLS stripping attack

Question 12

A security analyst captures a large number of initialization vectors (IVs) on a WEP-protected network. Which tool is most commonly used to crack the WEP key using IVs?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP keys by capturing IVs. Reaver is for WPS, Kismet is a sniffer, and John the Ripper is a general password cracker.

Answer

Reaver

Answer

Kismet

Answer

John the Ripper

Question 13

In the shared responsibility model for cloud computing, which of the following is typically the responsibility of the customer?

Accepted Answer

Data classification and encryption of customer data. The customer is responsible for data classification and account management, while the provider secures the physical infrastructure.

Answer

Physical security of data centers

Answer

Patch management of the virtualization platform

Answer

Network infrastructure security (e.g., hypervisor, network cables)

Question 14

Which TWO of the following are examples of asymmetric cryptography? (Select 2)

Accepted Answer

RSA. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. MD5 is a hash function.

Answer

3DES

Answer

MD5

Answer

AES

Question 15

An analyst sees the following in a log: Client sends a request to https://victim.com/api?url=http://169.254.169.254/latest/meta-data/. This is MOST indicative of which attack?

Accepted Answer

Server-side request forgery (SSRF). The IP 169.254.169.254 is the AWS metadata endpoint. SSRF attacks target internal services by manipulating the url parameter.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 16

A penetration tester is assessing an AWS environment and discovers an S3 bucket with the following bucket policy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}`. Which of the following is the MOST likely security issue?

Accepted Answer

The bucket policy allows public read access to all objects. The policy allows anyone (Principal: *) to read any object in the bucket, making it publicly accessible and a common misconfiguration.

Answer

The bucket policy allows only GetObject, which is too restrictive

Answer

The bucket policy should use a Principal of AWS instead of *

Answer

The bucket policy is missing a Deny statement for write operations

Question 17

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Accepted Answer

Brute-force the WPS PIN to recover the Wi-Fi passphrase. Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

Answer

Perform a de-authentication attack on the target AP

Answer

Capture the 4-way handshake for WPA cracking

Answer

Scan for nearby access points and their BSSIDs

Question 18

A penetration tester performs a container escape by exploiting a misconfigured capability and mounts the host filesystem. Which cloud service model is MOST directly affected?

Accepted Answer

Infrastructure as a Service (IaaS). Container escape compromises the host, affecting the underlying infrastructure in IaaS. In PaaS/SaaS, the provider may manage containers differently.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 19

A penetration tester performs a container escape from a Docker container running in a cloud environment. Which of the following is the MOST likely cause?

Accepted Answer

The container is running with the --privileged flag. Container escape often occurs when the container is run with the --privileged flag, granting elevated capabilities that allow access to the host kernel.

Answer

The container uses default credentials for SSH

Answer

The container image has a known vulnerability in the MQTT library

Answer

The host OS is running an outdated kernel version

Question 20

Which THREE of the following are legitimate uses of the Shodan search engine in a security assessment? (Select 3)

Accepted Answer

Discovering internet-connected industrial control systems (ICS) with default passwords. Option B is correct because Shodan indexes internet-facing devices and exposes banners and metadata for ICS/SCADA systems (e.g., Modbus, Siemens, BACnet), allowing an assessor to identify exposed industrial control systems that may still use default credentials. Option C is correct because Shodan indexes SSL/TLS certificate data, including subject CN and SAN fields, so querying by certificate or domain reveals related subdomains and hostnames tied to a target's certificates. Option E is correct because Shodan continuously scans the internet and stores port/banner data, so an assessor can query an IP range (e.g., net:192.168.0.0/16) to enumerate open ports and running services without directly scanning the hosts. Option A is not a Shodan use because Shodan is a passive search engine for internet-connected device banners and does not perform active SQL injection attacks against web applications. Option D is not a Shodan use because Shodan does not send phishing emails; that is a social-engineering activity unrelated to its search/indexing capabilities.

Answer

Performing SQL injection on a web application

Answer

Sending phishing emails to employees of a target organization