CEH Practice Exam 56 — 20 Questions

Question 1

Which of the following tools is primarily used for automated SQL injection exploitation and database fingerprinting?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool specifically designed to automate the detection and exploitation of SQL injection flaws and database server fingerprinting. It supports a wide range of database management systems (MySQL, Oracle, PostgreSQL, Microsoft SQL Server, etc.) and can automate tasks such as retrieving data, accessing the file system, and executing commands. Its core purpose aligns exactly with automated SQL injection exploitation and database fingerprinting.

Answer

Nmap

Answer

Burp Suite

Answer

John the Ripper

Question 2

Which THREE of the following are valid defenses against WPA2 attacks? (Select three)

Accepted Answer

Disable WPS. Option A (Disable WPS) is correct because the WPS PIN mechanism is vulnerable to brute-force attacks (e.g., via Reaver) that can recover the WPA2 pre-shared key, so turning WPS off removes that attack surface. Option B (Implement 802.1X/EAP with RADIUS) is correct because enterprise mode replaces the shared PSK with per-user credentials and mutual authentication, defeating offline dictionary attacks against a captured 4-way handshake. Option E (Use a strong, complex pre-shared key) is correct because WPA2-Personal's main weakness is offline cracking of the handshake, and a long high-entropy passphrase makes dictionary and brute-force recovery computationally infeasible. Option C is wrong because WEP is cryptographically broken (RC4 with weak IVs) and is far less secure than WPA2. Option D is wrong because WPA2-Mixed mode merely allows both TKIP and AES-CCMP clients, and TKIP is deprecated and vulnerable, so it does not defend against WPA2 attacks.

Answer

Use WEP instead of WPA2

Answer

Enable WPA2-Mixed mode

Question 3

A penetration tester executes the following command: nmap -sS -p 1-1000 --script banner 192.168.1.10. After the scan, the tester notices several filtered ports. Which of the following BEST explains why Nmap reports a port as "filtered"?

Accepted Answer

A firewall is blocking the probe packets, and Nmap cannot determine if the port is open. Nmap's SYN scan (-sS) sends a SYN packet to the target port. When the probe receives no response or an ICMP unreachable message (e.g., type 3 code 13), Nmap classifies the port as 'filtered'. This typically indicates a firewall, ACL, or network filter is dropping the packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is open, and the service is responding with a banner

Answer

The port is open and actively listening

Answer

The port is closed and the target sent an RST packet

Question 4

An attacker sets up a rogue access point with the same SSID as a legitimate corporate network and broadcasts a stronger signal. Clients connect to the rogue AP. What type of attack is this?

Accepted Answer

Evil twin attack. An evil twin attack is defined by a rogue access point that impersonates a legitimate AP by broadcasting the same SSID, often with a stronger signal to lure clients into associating with it. Once clients connect, the attacker can capture credentials, perform man-in-the-middle interception, or serve malicious content. The scenario described matches this definition exactly.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

MAC spoofing attack

Question 5

In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?

Accepted Answer

Server-Side Request Forgery (SSRF) targeting cloud metadata. The attack described is Server-Side Request Forgery (SSRF) because the attacker manipulates the web application into making HTTP requests to an internal resource—specifically the cloud instance metadata service at 169.254.169.254. This allows the attacker to retrieve IAM temporary credentials that are normally only accessible from within the instance. The key is that the server itself is tricked into performing the request, bypassing network restrictions.

Answer

XML External Entity (XXE) injection

Answer

Insecure Direct Object Reference (IDOR) on metadata

Answer

Cross-Site Request Forgery (CSRF) targeting cloud APIs

Question 6

A security analyst notices unusual outbound traffic from an internal server to a known malicious IP address on port 4444. The server is running a web application that was recently scanned using a vulnerability scanner. Which of the following is the MOST likely cause?

Accepted Answer

A vulnerability discovered during the scan was exploited, establishing a reverse shell connection to the attacker. Outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

Answer

The server is performing a DNS lookup to resolve the malicious IP address

Answer

The web application is sending log data to a SIEM system for analysis

Answer

The vulnerability scan caused a false positive and triggered a legitimate backup process

Question 7

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Accepted Answer

Implement client authentication and enable TLS encryption. The vulnerability is that the MQTT broker accepts connections from anyone (no authentication) and transmits data in cleartext (no encryption), allowing an attacker to subscribe to all topics. Implementing client authentication (username/password or client certificates) prevents unauthorized subscriptions, while enabling TLS encrypts the payload and credentials in transit. Together these directly close the two gaps that let the attacker eavesdrop.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 8

During a web application penetration test, a tester uses Burp Suite's Repeater tool to manually manipulate a request and observe the response. After sending the same request multiple times, the application returns a 302 redirect pointing to a login page. What is the MOST likely cause?

Accepted Answer

The session token has expired and the user must re-authenticate. A 302 redirect to the login page is the classic server-side signal that the session cookie presented in the request is no longer valid — either it expired, was invalidated server-side, or the session store lost the record. Burp Repeater replays the exact same request with the same session token, so once that token ages out or is rotated, every subsequent replay gets bounced to authentication. This is expected behavior, not a security control firing.

Answer

The server is rate-limiting the requests

Answer

A cross-site request forgery (CSRF) token mismatch occurred

Answer

The server detected the use of a proxy and blocked the request

Question 9

A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing . When an admin views the feedback page, the script executes. Which type of XSS is this?

Accepted Answer

Stored XSS. Stored XSS occurs when malicious script is persisted on the server (e.g., in a database, comment field, or log) and later served to other users without proper output encoding. Here, the attacker's <script> payload is saved as feedback and executed when the admin views the page, which is the defining characteristic of stored (persistent) XSS. The payload executes in the admin's browser session, potentially stealing cookies or performing actions as the admin.

Answer

Blind XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Question 10

During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?

Accepted Answer

Insecure Direct Object Reference (IDOR). Insecure Direct Object Reference (IDOR) occurs when an application exposes an internal object identifier, such as a numeric id in a URL, and fails to verify that the requester is authorized to access that object. Changing the id to another user's value and retrieving their data is the classic IDOR exploitation pattern.

Answer

SQL injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Cross-Site Request Forgery (CSRF)

Question 11

Which of the following tools is specifically designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications?

Accepted Answer

SQLMap. SQLMap is an open-source penetration testing tool specifically designed to automate the detection and exploitation of SQL injection flaws in web applications. It supports a wide range of database backends, injection techniques (boolean-based, time-based, error-based, UNION, stacked queries), and post-exploitation actions such as dumping database contents. This makes it the correct answer for automated SQLi detection and exploitation.

Answer

Burp Suite

Answer

Nikto

Answer

Metasploit

Question 12

A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP spoofing attack. ARP spoofing (also called ARP poisoning) involves an attacker sending forged ARP replies to associate their MAC address with the IP address of another host (often the gateway), causing traffic to be redirected through the attacker. Multiple ARP packets with the same source MAC but different IP addresses is the classic signature of an attacker claiming multiple IPs to intercept traffic. This enables man-in-the-middle attacks, session hijacking, and traffic sniffing on the local subnet.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

Evil twin attack

Question 13

Which TWO of the following are common OSINT tools for passive reconnaissance? (Select 2)

Accepted Answer

theHarvester. theHarvester (B) is a passive OSINT tool that gathers emails, subdomains, hosts, employee names, and open ports from public sources such as search engines, PGP key servers, and Shodan without directly touching the target. Maltego (D) is a graphical OSINT and link-analysis tool that queries public data sources and transforms to map relationships among people, domains, IPs, and organizations, making it a staple of passive reconnaissance. Metasploit (A) is an exploitation framework used for active attacks, not passive information gathering. hping3 (C) is a packet-crafting tool for active network probing and firewall testing. Nmap (E) performs active scanning by sending probes to targets, so it is not a passive OSINT tool.

Answer

Metasploit

Answer

hping3

Answer

Nmap

Question 14

Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)

Accepted Answer

A (IPv4 address). Option B (A record) is correct because an A record maps a hostname to its IPv4 address, so querying it during reconnaissance reveals the IP addresses of the target's web, mail, or other hosts for further scanning. Option C (NS record) is correct because NS records identify the authoritative name servers for the domain, letting an attacker map the DNS infrastructure and potentially attempt zone transfers or subdomain enumeration. Option E (MX record) is correct because MX records list the mail exchange servers handling email for the domain, exposing mail infrastructure, third-party providers, and additional hostnames to investigate. Options A (FTP) and D (HTTP) are not DNS record types at all; they are application-layer protocols, and no DNS query returns an 'FTP' or 'HTTP' record, so they do not belong among valid DNS reconnaissance record types.

Answer

FTP (file transfer)

Answer

HTTP (hypertext transfer)

Question 15

Which TWO of the following are techniques used in session hijacking attacks? (Choose two.)

Accepted Answer

TCP sequence prediction. TCP sequence prediction (A) is a classic session hijacking technique: the attacker sniffs or guesses the next expected TCP sequence and acknowledgment numbers of an established connection, then injects forged packets that the server accepts as belonging to the legitimate session. Cookie theft (C) is also a session hijacking technique because session cookies carry the session ID; if an attacker obtains them via XSS, sniffing, or malware, they can replay the cookie to impersonate the authenticated user without knowing credentials. MAC flooding (B) is a Layer 2 switch CAM-table overflow attack that can enable sniffing, but it is not itself a session hijacking technique. DNS spoofing (D) redirects name resolution to a rogue IP address, which supports phishing or man-in-the-middle but does not hijack an existing session. ARP poisoning (E) is a Layer 2 man-in-the-middle enabler that can facilitate session hijacking, but it is not itself classified as a session hijacking technique.

Answer

MAC flooding

Answer

DNS spoofing

Answer

ARP poisoning

Question 16

Which TWO of the following attacks are specifically associated with wireless networks?

Accepted Answer

De-authentication attack. Option B, the de-authentication attack, is specifically associated with wireless networks because it exploits unencrypted 802.11 management frames: an attacker spoofs the source MAC of an access point and sends deauthentication (or disassociation) frames to a client, forcibly disconnecting it from the WLAN. Option C, the evil twin attack, is also wireless-specific: the attacker sets up a rogue access point that broadcasts the same SSID (and often the same BSSID/channel) as a legitimate AP, tricking clients into associating with it to harvest credentials or launch a man-in-the-middle. The unmarked options do not belong because A (man-in-the-middle) and D (replay) are generic attacks that apply to wired, wireless, and application-layer contexts, and E (birthday attack) is a cryptographic hash-collision attack unrelated to wireless networking.

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Birthday attack

Question 17

Which THREE of the following are techniques used in session hijacking?

Accepted Answer

Man-in-the-middle (MITM) interception. Session hijacking is the takeover of an established, authenticated session, and MITM interception (B) is a core technique because an attacker positioned between client and server can capture the session token or cookie as it traverses the network and then impersonate the victim. Cookie theft and replay (D) is correct because session cookies are the credential that identifies an authenticated session; stealing one (e.g., via XSS or sniffing) and replaying it lets the attacker assume the victim's authenticated state without knowing the password. TCP sequence number prediction (E) is correct because TCP session hijacking works by guessing or sniffing the next expected sequence/acknowledgment numbers so the attacker can inject packets into an already-established TCP connection and desynchronize the legitimate client. DNS cache poisoning (A) is not a session hijacking technique; it corrupts name resolution to redirect users to malicious hosts, which is a redirection/spoofing attack rather than takeover of an existing session. MAC flooding (C) is a Layer 2 switch attack that overflows the CAM table to force hub-like flooding, enabling sniffing but not itself hijacking a session.

Answer

DNS cache poisoning

Answer

MAC flooding

Question 18

Which TWO tools are commonly used for enumerating NFS exports on a target system? (Select 2 correct answers)

Accepted Answer

nmap (with script nfs-ls). Option B, nmap with the nfs-ls script, is correct because Nmap's NSE script nfs-ls queries an NFS server and lists the files and directories available through its exports, making it a valid enumeration tool for NFS. Option D, showmount, is correct because showmount -e <target> directly queries the target's mountd/rpcbind service and displays the list of exported file systems, which is the classic NFS enumeration command. The other options do not belong: enum4linux (A) and smbclient (C) target SMB/NetBIOS/Windows shares rather than NFS, and ldapsearch (E) queries LDAP directory services, not NFS exports.

Answer

enum4linux

Answer

smbclient

Answer

ldapsearch

Question 19

Which THREE of the following are common countermeasures to prevent DNS zone transfers from being abused? (Choose THREE.)

Accepted Answer

Restrict zone transfers to only specific authorized secondary name servers. Option B is correct because restricting zone transfers to specific authorized secondary name servers (for example, via BIND's allow-transfer ACL) ensures that only trusted servers can request a copy of the zone, blocking unauthorized AXFR/IXFR attempts. Option C is correct because split DNS separates internal and external views, so external clients querying the public name server never see internal-only records, limiting what a leaked zone transfer could expose. Option D is correct because TSIG uses a shared secret and HMAC to cryptographically authenticate zone transfer requests, so a server will only honor an AXFR/IXFR from a peer that presents a valid signature. Option A is not a countermeasure—enabling recursion actually increases exposure to cache poisoning and amplification abuse and is unrelated to zone transfer protection. Option E is the opposite of a countermeasure, since allowing zone transfers from any host permits anyone to pull the entire zone with a single AXFR query.

Answer

Enable DNS recursion on the name server

Answer

Configure the name server to allow zone transfers from any host

Question 20

Which TWO tools can be used to enumerate SMB shares and users on a Windows target? (Choose two.)

Accepted Answer

smbclient. smbclient (A) is correct because its -L and -N options let you list SMB shares and, with -U, authenticate to enumerate shares and users on a Windows host over TCP 445/139. enum4linux (B) is correct because it wraps smbclient, rpcclient, and nmblookup to pull share lists, user lists, and group/password-policy data from SMB/RPC on Windows targets. nslookup (C) is wrong because it only queries DNS records and cannot touch SMB. snmpwalk (D) is wrong because it walks SNMP OIDs (UDP 161) and does not enumerate SMB shares or users. ldapsearch (E) is wrong because it queries LDAP directories (TCP 389/636) rather than SMB/RPC services.

Answer

nslookup

Answer

snmpwalk

Answer

ldapsearch