CEH Practice Exam 55 — 20 Questions

Question 1

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts the victim's files using symmetric encryption (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. Unlike other malware types, its primary purpose is data hostage for financial extortion, often leveraging asymmetric encryption (e.g., RSA) to secure the symmetric key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 2

Which HTTP method is commonly used by WebDAV to upload files to a web server, and if misconfigured, could allow an attacker to upload malicious scripts?

Accepted Answer

PUT. The PUT method is used by WebDAV to upload files to a web server. If WebDAV is misconfigured to allow unauthenticated PUT requests, an attacker can upload malicious scripts (e.g., web shells) to the server, leading to remote code execution. PUT is idempotent and directly places the request body at the specified URI.

Answer

DELETE

Answer

GET

Answer

POST

Question 3

Which Google dork query would an attacker most likely use to find login pages on a web server?

Accepted Answer

intitle:login. The Google dork 'intitle:login' specifically searches for web pages where the word 'login' appears in the HTML title tag. Attackers use this to quickly discover login portals, as many web applications include 'login' in the page title, making it a reliable footprinting technique for identifying authentication interfaces.

Answer

inurl:admin

Answer

site:example.com filetype:pdf

Answer

link:example.com

Question 4

Which of the following commands is used to enumerate SNMP information from a network device using a specific community string?

Accepted Answer

snmpwalk -c public -v 2c 192.168.1.1. `snmpwalk` is the standard command-line tool for enumerating SNMP (Simple Network Management Protocol) information from a network device. By specifying the community string (`-c public`) and SNMP version (`-v 2c`), it retrieves the entire Management Information Base (MIB) tree from the target IP address, allowing an attacker to discover system details, running processes, and network interfaces.

Answer

ldapsearch -x -h 192.168.1.1 -b dc=domain,dc=com

Answer

enum4linux -a 192.168.1.1

Answer

nbtstat -a 192.168.1.1

Question 5

A penetration tester uses SQLMap with the following command: sqlmap -u 'http://target.com/page.php?id=1' --batch --dbs. Which database enumeration technique is SQLMap using by default?

Accepted Answer

In-band SQL injection. SQLMap's default enumeration technique is in-band (union/error-based) SQL injection, which extracts data through the same channel as the request — typically via UNION SELECT or error messages reflected in the HTTP response. With --dbs and no technique flag, SQLMap first attempts in-band methods before falling back to blind or time-based if those fail.

Answer

Out-of-band SQL injection

Answer

Blind SQL injection

Answer

Time-based SQL injection

Question 6

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Accepted Answer

Implementing a mantrap at the entrance. A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.

Answer

Hiring security guards

Answer

Reviewing keycard access logs

Answer

Installing CCTV cameras

Question 7

An organization experiences a DDoS attack where a large volume of DNS queries with spoofed source IPs are sent to open DNS resolvers, which then amplify the traffic to the victim. Which type of attack is this?

Accepted Answer

DNS amplification. This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends a small DNS query (e.g., ANY type) with a spoofed source IP (the victim's IP) to an open resolver, which responds with a much larger response (up to 50-100x the query size), flooding the victim. The key mechanism is the amplification factor combined with the spoofed source address, which directs the amplified traffic to the victim.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 8

A penetration tester uses a tool to perform ARP poisoning and then launches a man-in-the-middle attack. The tool also allows session hijacking and sniffing. Which of the following tools is being used?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LANs, featuring built-in ARP poisoning, session hijacking, and sniffing capabilities. It actively intercepts traffic by spoofing ARP replies to redirect packets through the attacker's machine, enabling real-time manipulation of sessions. This matches the question's description of a tool that performs ARP poisoning, MITM attacks, session hijacking, and sniffing.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 9

An attacker gains physical access to a restricted area by following an authorized employee through a secured door without swiping a badge. This technique is known as:

Accepted Answer

Tailgating. Tailgating is a social engineering attack where an unauthorized person physically follows an authorized employee through a secured entry point (e.g., a badge-protected door) without presenting their own credentials. This exploits the human tendency to hold the door for others, bypassing electronic access control systems (e.g., RFID badge readers) that would otherwise deny entry. The CEH exam defines this as a physical breach of perimeter security, distinct from digital or verbal manipulation.

Answer

Pretexting

Answer

Quid pro quo

Answer

Baiting

Question 10

A security analyst captures a large number of weak initialization vectors (IVs) using airodump-ng. Which attack does this preparation indicate?

Accepted Answer

WEP key cracking. WEP (Wired Equivalent Privacy) uses the RC4 stream cipher with a 24-bit initialization vector (IV) that is transmitted in plaintext. Weak IVs, such as those identified by tools like airodump-ng, are predictable or repeatable, allowing an attacker to capture enough packets to recover the WEP key using statistical attacks like the FMS (Fluhrer, Mantin, Shamir) or KoreK attacks. This preparation directly indicates an attempt to crack the WEP key.

Answer

WPS PIN brute force

Answer

WPA2 dictionary attack

Answer

Evil twin attack

Question 11

Which of the following is the PRIMARY purpose of steganography in the context of covering tracks after a system compromise?

Accepted Answer

To hide data within other files to avoid detection. The primary purpose of steganography in covering tracks is to hide stolen data or malicious payloads within innocuous files (e.g., images, audio, video) so that forensic tools and analysts do not detect the exfiltration or persistence. Unlike encryption, which makes data unreadable but still visible, steganography conceals the very existence of the hidden data, allowing an attacker to bypass network monitoring and file inspection. This aligns with the CEH objective of covering tracks by avoiding detection of unauthorized data transfers.

Answer

To create a backdoor for future access

Answer

To delete system logs permanently

Answer

To encrypt log files so they cannot be read

Question 12

Which TWO vulnerabilities are associated with buffer overflow attacks?

Accepted Answer

Arbitrary code execution. Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.

Answer

Authentication bypass via SQL injection

Answer

Cross-site scripting (XSS)

Answer

Race condition

Question 13

A penetration tester is assessing the security of a cloud application and discovers that it is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are potential impacts of this vulnerability?

Accepted Answer

Access to cloud instance metadata (e.g., AWS IMDS). Option B is correct because SSRF lets the attacker make the vulnerable server issue HTTP requests to the cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/ for AWS IMDS), potentially exposing IAM credentials, instance identity, and other sensitive data. Option D is correct because SSRF can be chained to reach internal-only services (such as Redis, Elasticsearch, or admin panels) that are not exposed externally, and those services may allow command execution or be exploited via deserialization/RCE vulnerabilities. Option A is not a direct SSRF impact because man-in-the-middle attacks on a user's browser require network interception or TLS compromise, not server-side request forgery. Option C is incorrect because modifying DNS records requires access to the DNS provider or zone management interface, which SSRF does not directly grant. Option E is incorrect because SSRF does not bypass database authentication; it only enables the server to make requests, and direct unauthenticated database access would require separate misconfiguration or credentials.

Answer

Ability to perform a man-in-the-middle attack on the user's browser

Answer

Direct modification of DNS records

Answer

Direct access to the database without authentication

Question 14

A web application is vulnerable to server-side request forgery (SSRF). An attacker sends a request that causes the server to make an internal HTTP request to http://169.254.169.254/latest/meta-data/. What is the attacker attempting to achieve?

Accepted Answer

Access the cloud instance metadata to obtain temporary credentials. The IP address 169.254.169.254 is the link-local address used by AWS EC2 Instance Metadata Service (IMDS). When an SSRF vulnerability forces the server to request this URL, the attacker is attempting to retrieve instance metadata, which can include IAM role temporary credentials, instance identity documents, and user data. These credentials can then be used to pivot into the AWS account.

Answer

Exploit a command injection vulnerability in the web server

Answer

Perform a denial-of-service attack on the internal network

Answer

Perform a port scan on the internal network

Question 15

A penetration tester wants to evade an IDS while scanning a target network. The tester uses the Nmap command: nmap -sS -f 10.10.10.1. What does the -f flag accomplish?

Accepted Answer

It fragments the IP packets into 8-byte fragments. The -f flag in Nmap instructs the tool to fragment the IP packets into 8-byte fragments (or smaller, depending on the MTU). This is a common evasion technique used to bypass Intrusion Detection Systems (IDS) and firewalls by splitting the TCP header across multiple packets, making it harder for signature-based detection to reassemble and match the scan pattern.

Answer

It increases the timing template to T5 (insane)

Answer

It uses an idle scan by bouncing off a zombie host

Answer

It sends packets with a spoofed source IP address

Question 16

A user receives a text message claiming their bank account is locked and requiring them to click a link to verify. This social engineering method is called:

Accepted Answer

SMiShing. SMiShing (SMS phishing) is the correct term because the attack vector is a text message (SMS) that tricks the user into clicking a malicious link. Unlike email-based phishing, SMiShing exploits the higher trust users often place in SMS messages and the limited security controls on mobile devices.

Answer

Phishing

Answer

Whaling

Answer

Vishing

Question 17

A network administrator notices unusual traffic patterns: the internal DNS server is receiving large DNS queries with the source IP spoofed to appear as the internal DNS server itself. The queries appear to be amplification requests. Which TWO characteristics describe this attack?

Accepted Answer

It relies on open DNS resolvers to amplify traffic. The attack described relies on open DNS resolvers to amplify traffic. The attacker sends small DNS queries with a spoofed source IP (the victim's DNS server), causing the open resolver to send large responses to the victim, thus amplifying the traffic volume. This is a classic DNS amplification attack, which is a type of reflection attack that exploits the UDP protocol and the fact that DNS response sizes can be significantly larger than query sizes.

Answer

It is a protocol-specific attack targeting TCP SYN packets

Answer

It exploits the ARP protocol to redirect traffic

Answer

It requires the attacker to be on the same subnet as the victim

Question 18

During a web application penetration test, a tester discovers a file inclusion vulnerability. Which THREE of the following are potential impacts or exploitation scenarios? (Choose THREE.)

Accepted Answer

Disclosure of sensitive files like /etc/passwd. Option A is correct because a Local File Inclusion (LFI) vulnerability allows an attacker to traverse the filesystem using sequences like ../../ and read arbitrary files the web server can access, with /etc/passwd being the classic proof-of-concept target for confirming file disclosure on Linux. Option B is correct because LFI can be escalated to Remote Code Execution through log poisoning: the attacker injects PHP code into a log file (e.g., Apache access.log via a crafted User-Agent header) and then includes that log file, causing the server to execute the injected code. Option E is correct because if PHP session files are stored in a predictable, web-accessible location (e.g., /var/lib/php/sessions/sess_<id>), an attacker who can control or know a session ID can include that file to read or manipulate session data, enabling session hijacking. Option C is not a typical LFI impact: port scanning is associated with SSRF, where the server makes outbound requests to internal hosts, not with file inclusion, which reads local files. Option D is not a standard LFI impact either: while including very large files could theoretically consume resources, denial of service is not a recognized primary exploitation scenario for file inclusion vulnerabilities in this context.

Answer

Port scanning of internal network hosts

Answer

Denial of service by including large files

Question 19

A security analyst notices that after submitting a form on a web application, the URL changes to include the user's ID parameter, e.g., 'user?id=123'. The analyst modifies the ID in the URL and accesses another user's profile without authorization. Which type of vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). The vulnerability is Insecure Direct Object Reference (IDOR), which occurs when an application exposes a direct reference to an internal object, such as a user ID in a URL, without verifying that the requester is authorized to access that object. By changing 'id=123' to another value, the analyst accesses another user's profile because the application trusts the client-supplied identifier. This is a classic access control flaw, not an injection or scripting issue.

Answer

Reflected Cross-Site Scripting (XSS)

Answer

Command Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 20

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.

Answer

Nikto

Answer

Hydra

Answer

Nmap