CEH Practice Exam 56 — 20 Questions

Question 1

A penetration tester executes the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. Which attack is being performed?

Accepted Answer

WPS PIN brute-force attack. Reaver is a tool used for brute-forcing WPS PINs to recover the WPA/WPA2 pre-shared key. The command specifies the interface and BSSID, indicating a WPS attack.

Answer

WEP IV attack

Answer

Evil twin attack

Answer

De-authentication attack

Question 2

Which THREE of the following are valid methods to prevent a downgrade attack on TLS? (Select 3)

Accepted Answer

Disable TLS 1.0 and 1.1 on the server. Disabling older TLS versions, enforcing TLS 1.2+, and using TLS_FALLBACK_SCSV prevent downgrade; disabling cipher suites does not prevent downgrade directly; using self-signed certificates increases risk.

Answer

Use self-signed certificates to avoid CA trust issues

Answer

Disable all cipher suites except those using RC4

Question 3

During a cloud penetration test, you discover an S3 bucket that allows listing objects. You find a file named 'config.json' that contains an IAM access key and secret key. Which of the following is the BEST next step?

Accepted Answer

Use the keys to call sts:GetCallerIdentity and then enumerate permissions via IAM. The correct action is to use the discovered credentials to enumerate permissions via the AWS CLI, as they may grant further access.

Answer

Delete the bucket to prevent further data exposure

Answer

Download all objects from the bucket and exfiltrate them

Answer

Immediately rotate the keys in the AWS console

Question 4

A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?

Accepted Answer

Server-Side Request Forgery (SSRF). SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.

Answer

SQL injection

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 5

Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?

Accepted Answer

File virus. A file virus (also known as a file infector) is a type of malware that replicates by inserting its code into executable files (e.g., .exe, .com, .dll). It requires human action to spread, such as opening an infected email attachment or running an infected program, because the virus code is only activated when the host executable is executed.

Answer

Worm

Answer

Ransomware

Answer

Trojan

Question 6

Which THREE of the following are effective countermeasures against evil twin attacks in wireless networks? (Select THREE.)

Accepted Answer

Implementing client-side certificate validation for network authentication. Evil twin attacks involve a rogue AP impersonating a legitimate one. Countermeasures include using WPA3-Enterprise with 802.1X for mutual authentication, implementing client-side certificate validation, and using VPNs to encrypt traffic even over rogue APs.

Answer

Enabling MAC address filtering on the AP

Answer

Disabling SSID broadcast on the legitimate AP

Question 7

During a cloud penetration test, a tester discovers an AWS S3 bucket that allows public 's3:PutObject' access. The tester uploads a file containing JavaScript that steals cookies. Which type of attack is this an example of?

Accepted Answer

Cross-Site Scripting (XSS) via uploaded file. Uploading malicious content to an S3 bucket with public write access enables storage of attacker-controlled files. When users access these files, a client-side attack (like XSS) can occur. This is a classic example of a storage-based attack via misconfigured S3 bucket.

Answer

Server-Side Request Forgery (SSRF)

Answer

Insecure Direct Object Reference (IDOR)

Answer

S3 bucket privilege escalation

Question 8

A security team uses ScoutSuite to assess their AWS environment. The tool reports that an S3 bucket policy allows access from any IP address. What is the MOST likely misconfiguration?

Accepted Answer

The bucket policy uses 'Principal': '*' and 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}}. ScoutSuite identifies overly permissive bucket policies; allowing access from any IP (0.0.0.0/0) is a common misconfiguration.

Answer

The bucket has versioning enabled

Answer

The bucket ACL grants 'FullControl' to 'AuthenticatedUsers' group

Answer

The bucket is encrypted with SSE-S3

Question 9

A cloud security engineer notices that an S3 bucket named 'company-backup' is configured to allow 's3:GetObject' access to 'Principal: *'. Which attack is this misconfiguration MOST likely to enable?

Accepted Answer

Unauthorized data access and exfiltration. When an S3 bucket allows GetObject access to any principal (public), anyone can list and download objects, leading to data exposure. This is a classic unauthorized data access scenario, not privileged escalation or DoS.

Answer

Denial of service by deleting objects

Answer

SSRF attack to internal metadata

Answer

Privilege escalation via IAM role

Question 10

During a cloud security audit, a tool reports that an AWS IAM role has a policy allowing 'ec2:RunInstances' with a condition 'aws:SourceIp': '0.0.0.0/0'. What is the most immediate risk?

Accepted Answer

An attacker can launch expensive EC2 instances from any IP. The condition allows all IP addresses (0.0.0.0/0) to launch EC2 instances, meaning any user who can assume this role can create instances from anywhere, potentially for cryptocurrency mining or other malicious purposes.

Answer

An attacker can delete all EC2 instances

Answer

An attacker can modify VPC security groups

Answer

An attacker can read data from any S3 bucket

Question 11

An IoT device uses MQTT for communication. An attacker intercepts MQTT packets and observes that the publish messages are not encrypted and contain plaintext sensor data. Which of the following is the BEST recommendation to secure MQTT traffic?

Accepted Answer

Use MQTT over TLS. MQTT itself does not provide encryption; using TLS (MQTT over TLS) encrypts the entire communication channel, protecting data in transit.

Answer

Base64-encode the payload

Answer

Switch to CoAP protocol

Answer

Implement a VPN on the device

Question 12

Which TWO of the following tools are used for cloud security auditing or exploitation?

Accepted Answer

ScoutSuite. ScoutSuite is an auditing tool and Pacu is an exploitation framework for cloud environments.

Answer

John the Ripper

Answer

Nessus

Answer

Aircrack-ng

Question 13

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

Accepted Answer

The customer is responsible for configuring access controls and permissions. Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

Answer

AWS is responsible for physical security of data centers

Answer

The customer is responsible for patching the S3 service

Answer

AWS is responsible for network infrastructure; the customer for data classification

Question 14

While performing reconnaissance, a tester uses a Google dork to find login pages exposed on the internet. Which of the following is an example of a Google dork that could be used for this purpose?

Accepted Answer

inurl:login.php. The Google dork 'inurl:login.php' instructs Google to return only URLs that contain the string 'login.php' in the URL path. This is a classic reconnaissance technique to discover exposed login pages, as many web applications use 'login.php' as the default authentication endpoint. The 'inurl:' operator filters search results based on the literal text in the URL, making it ideal for footprinting specific web resources.

Answer

site:example.com -www

Answer

filetype:pdf

Answer

link:example.com

Question 15

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. A 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 16

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

Answer

Pharming

Answer

Spear phishing

Answer

Vishing

Question 17

During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?

Accepted Answer

SUID/GUID abuse. SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.

Answer

Pass-the-hash

Answer

Token impersonation

Answer

Kerberoasting

Question 18

Which of the following best describes a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker tricks the server into making requests to internal or external resources. A Server-Side Request Forgery (SSRF) attack occurs when an attacker manipulates a vulnerable server into making HTTP requests to arbitrary destinations, often bypassing network segmentation to access internal resources (e.g., 127.0.0.1, RFC 1918 addresses) or external services. The server acts as a proxy, allowing the attacker to interact with systems that are not directly reachable, such as cloud metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/) or internal databases.

Answer

An attacker sends a malicious script that executes in a user's browser

Answer

An attacker forges HTTP requests to perform actions on behalf of an authenticated user

Answer

An attacker injects SQL commands into a database query

Question 19

Which of the following tools would be BEST to use for identifying all live hosts in a large IP range (e.g., 10.0.0.0/8) quickly?

Accepted Answer

Masscan. Masscan is the best choice because it is designed for high-speed scanning across large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. It uses asynchronous transmission and raw sockets to quickly identify live hosts by sending SYN probes and analyzing responses, making it ideal for scanning a /8 subnet (16.7 million addresses) in minutes.

Answer

OpenVAS

Answer

Nmap with -sL flag

Answer

hping3

Question 20

A security analyst reviews the following command output from a Linux system: `uid=0(root) gid=0(root) groups=0(root)`. The analyst suspects a privilege escalation attack. Which of the following techniques could have been used to achieve root access from a standard user account?

Accepted Answer

SUID/GUID abuse. The command output shows the current user has UID 0, which is the root user. On Linux, SUID (Set User ID) and GUID (Group ID) bits allow executables to run with the permissions of the file owner (e.g., root). A standard user can exploit a misconfigured SUID binary (like `passwd` or a custom script) to execute commands with root privileges, achieving privilege escalation. This is a classic Linux privilege escalation technique directly tied to the UID/GID output shown.

Answer

Token impersonation

Answer

Pass-the-hash attack

Answer

LLMNR/NBT-NS poisoning