CEH Practice Exam 55 — 20 Questions

Question 1

You are a penetration tester for a security firm. Your client, Acme Corp, has requested an external reconnaissance assessment. They have provided their primary domain 'acme.com'. You begin by performing passive footprinting using public sources. After gathering initial information, you want to identify their email servers, subdomains, and any exposed services. You also want to map their network infrastructure without directly interacting with their systems to avoid detection. Which course of action should you take next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Shodan to search for Acme Corp's IP ranges and perform DNS enumeration to discover subdomains and mail servers.. Shodan allows passive identification of exposed services, including email servers and subdomains, by querying its indexed data of internet-facing devices without sending any packets to Acme Corp's systems. DNS enumeration can then be performed passively using public DNS records (e.g., MX, NS, A records) to map subdomains and mail servers, fulfilling the requirement to avoid direct interaction and detection.

Answer

Call Acme Corp's IT help desk posing as an employee to ask about their email server configuration.

Answer

Perform a traceroute to Acme Corp's web server to map the network path.

Answer

Run an Nmap scan against the entire IP range of Acme Corp to identify open ports and services.

Question 2

A security engineer notices repeated log entries showing a user account logging in at odd hours and then clearing event logs. The engineer suspects credential theft. Which phase of the CHPSET methodology involves erasing tracks?

Accepted Answer

Erasing tracks. The CHPSET methodology (Cracking passwords, Hiding files, Planting backdoors, Spying, Erasing tracks, and Transferring files) defines the phases of system hacking. Erasing tracks is the phase where attackers clear event logs, modify log files, or use tools like `wevtutil` or `clearlogs.exe` to remove evidence of their activities, matching the engineer's observation of cleared logs after suspicious logins.

Answer

Hiding files

Answer

Spying

Answer

Cracking passwords

Question 3

Which THREE of the following are types of SQL injection attacks? (Select 3)

Accepted Answer

Blind SQL injection (boolean-based, time-based). Blind SQL injection is a recognized type of SQL injection attack where the attacker does not receive direct error messages or data from the database but instead infers information by observing the application's response (boolean-based) or by causing time delays (time-based). This technique is commonly used when the application is configured to suppress error output, forcing the attacker to rely on side-channel behaviors.

Answer

DOM-based SQL injection

Answer

Stored SQL injection

Question 4

During a penetration test, you run the following Nmap command: nmap -sS -sV -O -A -T4 --script=default 10.0.0.1. The scan results show that port 443 is open and the service is 'Apache httpd 2.4.29'. However, banner grabbing with Netcat shows 'Apache/2.4.41 (Ubuntu)'. What is the MOST likely explanation for the discrepancy?

Accepted Answer

Netcat banner grabbing is more reliable because it reads the actual server response. Netcat performs a direct TCP connection to the service and reads the raw banner as sent by the application, which is the most immediate and unfiltered version information. Nmap's version detection (-sV) relies on probe-response matching against its signature database, which can be outdated or misinterpret the service if the server uses banner obfuscation or if the Nmap database does not have an exact match for the newer version. In this case, Netcat reveals the actual server version (2.4.41), while Nmap's database may only have a signature for 2.4.29, leading to a false lower version.

Answer

The server is using a reverse proxy that presents a different version to Nmap

Answer

The discrepancy is due to Nmap's OS fingerprinting conflicting with version detection

Answer

Nmap is more accurate because it uses deep packet inspection

Question 5

A security administrator notices that the network switch is broadcasting traffic to all ports as if it were a hub. The switch logs show a sudden flood of packets with random MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. B is correct because MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending a flood of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail-open into hub mode (broadcasting all traffic to all ports) so that the attacker can capture frames not originally destined for their port.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 6

A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. The attacker is fabricating a scenario (IT help desk performing a security update) to manipulate the target into revealing sensitive information. This is the essence of pretexting, where the attacker creates a false identity or situation to gain trust and extract data. Unlike phishing, which typically uses malicious links or attachments, this attack relies purely on verbal impersonation and social manipulation.

Answer

Tailgating

Answer

Quid pro quo

Answer

Phishing

Question 7

Which TWO of the following describe the state of a port when Nmap reports it as 'filtered'? (Select 2)

Accepted Answer

A firewall is dropping the probe packets. Nmap reports a port as 'filtered' when it cannot determine whether the port is open or closed because probe packets are being dropped or blocked. Option C is correct because a firewall dropping probe packets (e.g., via a DROP rule in iptables or an ACL) prevents Nmap from receiving any response, leading to a 'filtered' state. Option D is correct because a firewall responding with ICMP unreachable errors (e.g., ICMP Type 3 Code 13, 'Communication Administratively Prohibited') also causes Nmap to classify the port as 'filtered', as the response indicates a filtering device is interfering.

Answer

The port is closed and the target sends a RST packet

Answer

The port is open and a service is listening

Answer

The port is open but no service is responding

Question 8

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Accepted Answer

Use Google dorking to find publicly exposed email lists. Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.

Answer

Perform a WHOIS lookup on the domain

Answer

Attempt a DNS zone transfer

Answer

Run an nmap scan against the mail server

Question 9

A security analyst runs `nbtstat -A 192.168.1.50` from a Windows command prompt and receives output showing a table with names like 'WORKGROUP<00>', 'PC01<20>', and 'USER<03>'. What is the MOST likely purpose of this command?

Accepted Answer

Display the NetBIOS name table of the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote host using its IP address. The output shows NetBIOS names and their associated suffixes (e.g., <00> for Workstation service, <20> for File Server service, <03> for Messenger service), which are used for NetBIOS over TCP/IP (NBT) name resolution and service discovery. This is the correct purpose because the command specifically queries the remote host's NetBIOS name table, not DNS or ICMP.

Answer

Perform a reverse DNS lookup

Answer

Test connectivity to the remote host using ICMP

Answer

Enumerate DNS records for the domain

Question 10

Which of the following is a form of social engineering where an attacker physically follows an authorized person into a restricted area without proper authentication?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area, bypassing authentication mechanisms such as badge readers, PIN pads, or biometric scanners. The attacker exploits the natural courtesy of the authorized person holding the door open, thereby gaining physical access without any credential validation.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 11

Which TWO of the following are features of a Remote Access Trojan (RAT)?

Accepted Answer

It often includes a backdoor to bypass authentication. A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.

Answer

It encrypts files and demands ransom

Answer

It infects the Master Boot Record

Answer

It replicates itself across the network autonomously

Question 12

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

Accepted Answer

Remote Access Trojan (RAT). The behavior described—downloading a file that, when executed, creates a hidden process that connects to a remote server and provides full remote control—is the classic definition of a Remote Access Trojan (RAT). A RAT is a type of malware that allows an attacker to remotely control the victim's system, often using a command-and-control (C2) channel over protocols like TCP or HTTP. The hidden process and outbound connection to a remote server are key indicators of a RAT, distinguishing it from other malware types that do not provide interactive remote control.

Answer

Worm

Answer

Ransomware

Answer

Polymorphic virus

Question 13

A web server is configured with WebDAV and allows PUT requests. An attacker uploads a .asp file and accesses it to execute code. Which tool or method is most directly associated with exploiting this misconfiguration?

Accepted Answer

File upload vulnerability. WebDAV with PUT enabled allows attackers to upload arbitrary files, including web shells, leading to remote code execution.

Answer

SQL injection

Answer

Directory brute forcing

Answer

Cross-site scripting (XSS)

Question 14

A web application has an endpoint that takes a URL parameter and fetches content from that URL, returning it to the user. An attacker supplies 'file:///etc/passwd' and reads the server's passwd file. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). This is SSRF because the server is making requests to internal resources based on user input; file:// is a protocol that can be used for local file access.

Answer

Command injection

Answer

Remote File Inclusion (RFI)

Answer

Directory traversal

Question 15

A penetration tester finds that a web application accepts XML input and returns the parsed data in the response. The tester submits the following payload: ]>&xxe;. The server returns the contents of /etc/passwd. Which vulnerability is being exploited?

Accepted Answer

XXE injection. The payload defines an external entity (XXE) that reads a local file, indicating an XML External Entity (XXE) injection vulnerability.

Answer

SSRF

Answer

Command injection

Answer

XPath injection

Question 16

A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: . When an admin views the public page, the script executes. Which type of attack occurred?

Accepted Answer

Stored XSS. The script is stored on the server (feedback) and executed when the admin views the page. This is persistent (stored) XSS.

Answer

Reflected XSS

Answer

Cross-site request forgery (CSRF)

Answer

DOM-based XSS

Question 17

During a penetration test, you identify a parameter in a web application that appears to fetch a file from the server. You modify the parameter to '../../../etc/passwd' and see the contents of the passwd file. Which type of vulnerability is this?

Accepted Answer

Directory traversal. The use of '../' sequences to traverse directories and access files outside the web root is classic directory traversal.

Answer

Remote File Inclusion (RFI)

Answer

Server-Side Request Forgery (SSRF)

Answer

Local File Inclusion (LFI)

Question 18

Which THREE of the following are valid defenses against CSRF attacks? (Select 3)

Accepted Answer

Custom request headers (e.g., X-Requested-With). CSRF tokens, SameSite cookies (Lax or Strict), and custom headers (e.g., X-Requested-With with XMLHttpRequest) are all effective CSRF defenses.

Answer

Input validation

Answer

Output encoding

Question 19

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they use to perform a dictionary attack on the captured handshake to recover the PSK?

Accepted Answer

aircrack-ng. Aircrack-ng, which is the standard tool for cracking WPA2 PSK from a captured handshake using a dictionary file.

Answer

Reaver

Answer

Hydra

Answer

John the Ripper

Question 20

An IoT device uses the MQTT protocol without TLS. A security tester connects to the broker and subscribes to all topics using '#'. What is the tester MOST likely able to accomplish?

Accepted Answer

Eavesdrop on all MQTT communications. MQTT without encryption allows anyone to subscribe to topics. Subscribing to '#' captures all messages, leading to interception of sensitive data. This is a passive eavesdropping attack, not active manipulation like replay or injection.

Answer

Perform a denial of service on the broker

Answer

Inject malicious control commands

Answer

Replay previously captured messages