CEH Practice Exam 57 — 20 Questions

Question 1

A security engineer is concerned about DNS zone transfer attacks. Which of the following countermeasures would be MOST effective in preventing unauthorized zone transfers?

Accepted Answer

Restrict zone transfers to authorized IP addresses only. Restricting zone transfers to authorized IP addresses only is the most effective countermeasure because it directly controls which DNS servers are allowed to request a full copy of the zone data. By configuring an allow-transfer list (e.g., using the 'allow-transfer { trusted_servers; };' directive in BIND), the primary DNS server will reject zone transfer requests from any unauthorized IP, preventing attackers from enumerating all DNS records.

Answer

Use DNSSEC to sign the zone

Answer

Change the default port of 53 to a non-standard port

Answer

Disable DNS recursion on the server

Question 2

During a penetration test, an analyst detects that an SNMP agent on a network device is using the default community string 'public'. Which TWO actions can the analyst perform using this information? (Choose TWO.)

Accepted Answer

Enumerate user accounts and system details. The default SNMP community string 'public' typically grants read-only access to the SNMP agent. With read-only access, the analyst can perform an SNMPwalk (using tools like snmpwalk or MIB browsers) to enumerate the entire Management Information Base (MIB) tree, which often includes system details, user accounts, running processes, and network configurations. This enumeration is a key step in the Enumeration phase of a penetration test, as it can reveal sensitive information without authentication.

Answer

Extract encrypted passwords from the device

Answer

Write new configuration to the device

Answer

Disable the SNMP agent remotely

Question 3

A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?

Accepted Answer

Use Shodan to search for target infrastructure. Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.

Answer

Engage in social engineering via phone calls

Answer

Initiate a DNS zone transfer request

Answer

Perform a port scan with Nmap

Question 4

During a penetration test, you discover a Windows service running with SYSTEM privileges that has a weak file permission allowing the 'Everyone' group to modify its executable. Which privilege escalation technique is MOST directly applicable here?

Accepted Answer

Weak service binary permissions. The scenario describes a Windows service executable with weak file permissions that allow the 'Everyone' group to modify it. This directly enables an attacker to replace the legitimate executable with a malicious one, which will then be executed with SYSTEM privileges when the service starts. This is the classic 'weak service binary permissions' privilege escalation vector, often exploited using tools like `icacls` or `accesschk` to identify the vulnerability.

Answer

Token impersonation

Answer

DLL hijacking

Answer

Unquoted service path

Question 5

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Accepted Answer

volatility -f memory.dmp netscan. The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

Answer

volatility -f memory.dmp procdump

Answer

volatility -f memory.dmp svcscan

Answer

volatility -f memory.dmp malfind

Question 6

A security engineer runs SNMPwalk on a network device and receives community strings as 'public' and 'private'. What is the PRIMARY concern?

Accepted Answer

The device may be exposing sensitive configuration information. The SNMP community strings 'public' and 'private' are default read-only and read-write credentials defined in SNMPv1 and SNMPv2c. An attacker who can SNMPwalk the device with these strings can enumerate the entire MIB tree, including system configuration, routing tables, interface details, and user accounts. This directly exposes sensitive configuration information, making C the primary concern.

Answer

The device is vulnerable to buffer overflow attacks

Answer

The device is infected with malware

Answer

The device is using outdated encryption protocols

Question 7

A penetration tester executes the following command: nmap -sS -p 1-1000 --script banner 192.168.1.10. After the scan, the tester notices several filtered ports. Which of the following BEST explains why Nmap reports a port as "filtered"?

Accepted Answer

A firewall is blocking the probe packets, and Nmap cannot determine if the port is open. Nmap's SYN scan (-sS) sends a SYN packet to the target port. When the probe receives no response or an ICMP unreachable message (e.g., type 3 code 13), Nmap classifies the port as 'filtered'. This typically indicates a firewall, ACL, or network filter is dropping the packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is open, and the service is responding with a banner

Answer

The port is open and actively listening

Answer

The port is closed and the target sent an RST packet

Question 8

Which DoS attack exploits the HTTP protocol by sending partial HTTP requests to keep connections open, exhausting server resources?

Accepted Answer

Slowloris. Slowloris is a DoS attack that exploits HTTP by opening multiple connections to the target web server and sending partial HTTP requests (e.g., incomplete headers) while never completing them. The server keeps each connection open, waiting for the rest of the request, eventually exhausting its connection pool and denying service to legitimate users.

Answer

SYN flood

Answer

Ping of Death

Answer

UDP flood

Question 9

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

Accepted Answer

Lack of application-layer encryption. The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.

Answer

Weak TLS cipher suite

Answer

SSL stripping attack

Answer

Man-in-the-middle attack

Question 10

Which of the following tools is specifically designed to perform Google dorking and automate searching for vulnerable web applications and sensitive information?

Accepted Answer

Googledork. Googledork (also known as Google Dork) is a tool specifically designed to automate Google dorking queries, which use advanced search operators to find vulnerable web applications and sensitive information exposed in search results. It systematically executes predefined dork queries against Google's index to identify SQL injection points, exposed configuration files, login pages, and other security weaknesses, making it the correct choice for this task.

Answer

Maltego

Answer

theHarvester

Answer

Shodan

Question 11

Which TWO of the following are common indicators of a DNS spoofing attack? (Select 2)

Accepted Answer

The resolved IP address for a domain does not match the legitimate server. DNS spoofing (cache poisoning) involves an attacker injecting forged DNS records into a resolver's cache. When a user's system queries a domain, the resolver returns the attacker-controlled IP address instead of the legitimate server's IP, causing traffic to be misdirected.

Answer

High volume of DNS queries from a single source

Answer

ARP cache entries show unexpected MAC-IP mappings

Answer

The switch's CAM table is full

Question 12

Which THREE of the following are valid Nmap flags that can be used to evade detection by an IDS? (Select exactly 3.)

Accepted Answer

-D. (-D) is correct because the decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for an IDS to distinguish the real scanning host from the decoys. This technique floods the target with scan traffic from many IPs, obscuring the true origin and evading detection.

Answer

-O

Answer

-sS

Question 13

During a penetration test, a tester runs 'dnsrecon -d example.com -t axfr' and receives a full list of DNS records. What does this indicate about the target's DNS configuration?

Accepted Answer

The DNS server allows zone transfers from any host. The 'dnsrecon -d example.com -t axfr' command performs a DNS zone transfer (AXFR) request. Receiving a full list of DNS records indicates that the target DNS server is misconfigured to allow zone transfers from any host, which exposes the entire DNS zone data (including internal hostnames and IP addresses) to unauthorized parties. This is a critical information disclosure vulnerability.

Answer

The DNS server has DNSSEC enabled

Answer

The DNS server allows recursive queries

Answer

The DNS server is authoritative for the domain

Question 14

Which malware analysis approach involves running the suspicious file in a controlled environment to observe its behavior?

Accepted Answer

Dynamic analysis. Dynamic analysis is the correct approach because it involves executing the suspicious file in a controlled, isolated environment (such as a sandbox or virtual machine) to monitor its runtime behavior, including file system changes, registry modifications, network connections, and process injections. This allows analysts to observe actual malicious actions without risking the production environment, making it essential for understanding zero-day threats and obfuscated malware that static analysis might miss.

Answer

Code review

Answer

Signature detection

Answer

Static analysis

Question 15

A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?

Accepted Answer

MAC flooding. MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.

Answer

ARP poisoning

Answer

STP attack

Answer

DNS spoofing

Question 16

Which TWO techniques are commonly used for privilege escalation on Linux systems? (Select two.)

Accepted Answer

Kernel exploits. Kernel exploits (A) are a common privilege escalation technique on Linux because they target vulnerabilities in the kernel itself, allowing an attacker to execute arbitrary code with root privileges. By exploiting flaws such as buffer overflows or race conditions in kernel modules, an attacker can elevate from a low-privileged user to full root access. This is a classic method because the kernel runs with the highest system privileges, and a successful exploit bypasses all user-level security controls.

Answer

Token impersonation

Answer

DLL hijacking

Answer

Pass-the-hash

Question 17

A penetration tester successfully predicts the TCP sequence numbers of a target and sends crafted packets to impersonate a trusted host. Which type of attack is this?

Accepted Answer

TCP session hijacking. C is correct because the attacker predicts TCP sequence numbers to inject crafted packets, effectively impersonating a trusted host and taking over an established TCP session. This is the defining mechanism of TCP session hijacking, where the attacker spoofs the source IP and uses the predicted sequence numbers to insert malicious data or commands into the ongoing session.

Answer

ARP poisoning

Answer

TCP sequence prediction attack

Answer

DNS spoofing

Question 18

During a penetration test, a tester gains a low-privilege shell on a Linux server. The command `sudo -l` reveals that the user can run `/usr/bin/find` as root. Which technique can the tester use to escalate privileges?

Accepted Answer

Use find with the -exec flag to spawn a shell. The `sudo -l` output shows the user can run `/usr/bin/find` as root without a password. The `find` command has a built-in `-exec` flag that allows executing arbitrary commands on each found file. By running `sudo find / -exec /bin/sh \;`, the tester can spawn a root shell, escalating privileges because the command runs with sudo (root) privileges.

Answer

Abuse the SUID bit on find

Answer

Exploit a kernel vulnerability

Answer

Run a buffer overflow on the find binary

Question 19

During a penetration test, you discover a process named 'svch0st.exe' running on a Windows server with high CPU usage. The file is not digitally signed. Which type of malware is MOST likely present?

Accepted Answer

Trojan. The process name 'svch0st.exe' mimics the legitimate Windows service host 'svchost.exe' but uses a zero instead of 'o', a common masquerading technique. The lack of a digital signature and high CPU usage indicate malicious activity, and because it appears to be a standalone executable disguised as a system process, it fits the definition of a Trojan—malware that deceives users into running it by appearing legitimate.

Answer

Polymorphic virus

Answer

Ransomware

Answer

Worm

Question 20

A network administrator notices an unusual amount of traffic on port 389 from an internal server to multiple external IP addresses. Which type of malware might be present?

Accepted Answer

Trojan backdoor. Port 389 is used by LDAP. Outbound traffic to multiple external IPs could indicate LDAP query-based command and control or data exfiltration, but more commonly, port 389 is associated with directory services. However, in malware context, it could be a sign of a backdoor or RAT using LDAP for C2. The most likely is that the malware is using LDAP for communication, but given options, a Trojan backdoor is plausible.

Answer

Adware

Answer

Worm

Answer

Ransomware