CEH Practice Exam 57 — 20 Questions

Question 1

Which TWO of the following are techniques used to escalate privileges on a Linux system?

Accepted Answer

Exploiting a SUID binary. Option D (Exploiting a SUID binary) is correct because a file with the SUID bit set executes with the privileges of its owner (often root), so a misconfigured or vulnerable SUID program can be abused to run commands as root and escalate from a normal user. Option E (Kernel exploit) is correct because flaws in the Linux kernel (e.g., Dirty COW, Dirty Pipe) allow a local unprivileged user to corrupt kernel memory or abuse syscalls and gain root-level privileges. Option A (SMB relay attack) is not a Linux privilege-escalation technique; it is a network attack that relays captured SMB/NTLM authentication to another host to gain access, typically in Windows/AD environments. Option B (Pass-the-hash attack) is a credential-reuse technique for authenticating with captured NTLM hashes, not a local Linux privilege-escalation method. Option C (Token impersonation) is a Windows access-token abuse technique (e.g., via SeImpersonatePrivilege), not a Linux privilege-escalation technique.

Answer

SMB relay attack

Answer

Pass-the-hash attack

Answer

Token impersonation

Question 2

An IoT device uses the MQTT protocol without TLS. An attacker on the same network subscribes to all topics and captures messages. What is the MOST significant security risk?

Accepted Answer

Loss of message confidentiality. MQTT without TLS transmits messages in plaintext, so an attacker subscribing to all topics can read all message payloads. The most significant risk is loss of message confidentiality, as sensitive data (credentials, telemetry) is exposed. While other risks exist, confidentiality loss is the direct and primary impact.

Answer

Firmware corruption

Answer

Denial of service

Answer

Replay attacks

Question 3

Which TWO of the following are techniques used in session hijacking? (Choose 2)

Accepted Answer

Cookie theft. Cookie theft (A) is a session hijacking technique because an attacker who captures a valid session cookie — for example via XSS, sniffing an unencrypted HTTP session, or malware — can replay it to impersonate the authenticated user without knowing credentials. TCP sequence prediction (D) is also a session hijacking technique: the attacker guesses the next ISN/sequence and acknowledgment numbers to inject packets into an established TCP session, spoofing the victim's address and taking over the connection. MAC flooding (B) is a Layer 2 switch attack that overflows the CAM table to force hub-like flooding; it enables sniffing but is not itself session hijacking. ARP poisoning (C) is a man-in-the-middle technique that redirects traffic by falsifying IP-to-MAC mappings; it can facilitate hijacking but is not the hijacking technique itself. DNS spoofing (E) forges DNS responses to redirect name resolution to a malicious host, which is a redirection/phishing technique rather than session hijacking.

Answer

MAC flooding

Answer

ARP poisoning

Answer

DNS spoofing

Question 4

An analyst reviews a web server log and sees the following request: GET /search?q= HTTP/1.1. The response from the server includes the search term inside a

tag without any sanitization. Which type of XSS vulnerability does this indicate?

Accepted Answer

Reflected XSS. The payload appears in the URL query string and is immediately echoed back in the response inside a

without sanitization. This is the classic signature of reflected XSS: the malicious script is not stored on the server but is reflected from the request to the response, executing in the victim's browser when they click a crafted link. The single request/response cycle in the log confirms it is not stored.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 5

While performing reconnaissance, a tester uses a Google dork to find login pages exposed on the internet. Which of the following is an example of a Google dork that could be used for this purpose?

Accepted Answer

inurl:login.php. The Google dork 'inurl:login.php' instructs Google to return only URLs that contain the string 'login.php' in the URL path. This is a classic reconnaissance technique to discover exposed login pages, as many web applications use 'login.php' as the default authentication endpoint. The 'inurl:' operator filters search results based on the literal text in the URL, making it ideal for footprinting specific web resources.

Answer

site:example.com -www

Answer

filetype:pdf

Answer

link:example.com

Question 6

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Accepted Answer

SYN scan. C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

Answer

TCP connect scan

Answer

UDP scan

Answer

FIN scan

Question 7

A penetration tester has obtained a low-privilege shell on a Windows Server 2019 host during an internal assessment. While enumerating local accounts, the tester notices the account 'svc_backup' is a member of the Backup Operators group. The tester wants to leverage this membership to extract the SAM database and obtain local password hashes. Which action should the tester take to accomplish this goal?

Accepted Answer

Use the Backup Operators privilege to copy the SAM and SYSTEM files by enabling the SeBackupPrivilege and using a tool like robocopy or diskshadow to access the files.. Backup Operators possess the SeBackupPrivilege, which permits reading any file on the system by bypassing ACL checks. By enabling this privilege and using tools like robocopy with the /b switch or diskshadow, the tester can copy the SAM and SYSTEM registry hives. These hives can then be processed offline to extract local password hashes, effectively escalating privileges or enabling lateral movement.

Answer

Extract password hashes by dumping the LSASS process memory using Task Manager and analyzing the dump with Mimikatz.

Answer

Run 'reg save HKLM\SAM C:\Temp\sam.hiv' and 'reg save HKLM\SYSTEM C:\Temp\system.hiv' directly from the low-privilege shell.

Answer

Use Windows Task Scheduler to create a task that runs as SYSTEM and copies the SAM and SYSTEM registry hives to a readable location.

Question 8

A web server is found to have directory listing enabled for the /uploads folder. An attacker discovers a shell.php file uploaded earlier. Which attack is the attacker MOST likely to perform next?

Accepted Answer

Remote code execution via uploaded shell. With directory listing enabled and a known uploaded shell.php, the attacker can directly request the file via HTTP, causing the web server to execute the PHP shell and return a remote command shell — this is remote code execution (RCE) via the uploaded web shell. The uploaded file is already server-side code, so the next step is simply invoking it.

Answer

File inclusion

Answer

Cross-site scripting

Answer

SQL injection

Question 9

Which THREE of the following are valid Nmap port states?

Accepted Answer

Open. Nmap classifies a port as 'open' when it receives a SYN/ACK response to a SYN probe, indicating that an application is actively listening on that port. This is the standard TCP three-way handshake behavior defined in RFC 793, and it is the most fundamental port state in Nmap's scanning logic.

Answer

Blocked

Answer

Stealth

Question 10

A security analyst runs `nmap -sU -p 161,162 10.0.0.1` and receives output showing port 161/udp is open. Which service is MOST likely running on this port?

Accepted Answer

SNMP. Port 161/udp is the default port for SNMP (Simple Network Management Protocol) used by SNMP agents to receive management queries (GET, SET) from SNMP managers. The `-sU` flag performs a UDP scan, and the open result on 161/udp strongly indicates an SNMP service is listening, as defined in RFC 1157.

Answer

DHCP

Answer

TFTP

Answer

DNS

Question 11

A company's security team wants to deploy a DDoS mitigation technique that distributes incoming traffic across multiple servers in different geographic locations, making it harder for an attacker to overwhelm a single target. Which technique BEST fits this description?

Accepted Answer

Anycast network. Anycast network routing allows the same IP address to be advertised from multiple geographically distributed servers. When traffic arrives, BGP (Border Gateway Protocol) automatically directs each packet to the nearest or best-path server, effectively spreading the load and absorbing volumetric DDoS attacks by preventing any single server from becoming a bottleneck.

Answer

Rate limiting

Answer

Load balancer

Answer

Scrubbing center

Question 12

A penetration tester discovers a Linux server with the SUID bit set on the 'find' command. How could this be exploited for privilege escalation?

Accepted Answer

By running 'find / -exec /bin/sh \;' to spawn a root shell. When the SUID bit is set on the 'find' command, it executes with the privileges of the file owner (typically root). The '-exec' option allows arbitrary command execution. Running 'find / -exec /bin/sh \;' spawns a shell with root privileges, enabling full system compromise.

Answer

By using 'find' to delete log files

Answer

By using 'find' to search for files owned by root

Answer

By using 'find' to mount a remote share

Question 13

A security analyst is investigating a compromised Linux system and finds the following: - A binary with SUID bit set owned by root that is not a standard system binary - The file /etc/ld.so.preload contains a reference to a shared object in /tmp - The system logs show gaps of several minutes during peak hours. Which TWO techniques has the attacker MOST likely used to maintain access and evade detection?

Accepted Answer

SUID privilege escalation. Option A (SUID privilege escalation) is correct because the non-standard binary owned by root with the SUID bit set allows any user executing it to run with root privileges, which is a classic persistence and privilege-escalation mechanism an attacker leaves behind to regain elevated access. Option D (LD_PRELOAD rootkit) is correct because /etc/ld.so.preload forces the dynamic linker to load the referenced shared object from /tmp into every dynamically linked process, letting the attacker hook libc functions to hide files, processes, and connections; the log gaps during peak hours are consistent with such userland hooking that suppresses or filters logging. Option B (password cracking) is not indicated: cracking offline hashes does not create SUID binaries, ld.so.preload entries, or log gaps. Option C (kernel module rootkit) is not indicated because the evidence points to userland dynamic-linker hijacking via ld.so.preload rather than a loadable kernel module. Option E (steganography) is not indicated since no covert data hiding in files or images is described.

Answer

Password cracking

Answer

Kernel module rootkit

Answer

Steganography

Question 14

Which TWO tools are commonly used for password cracking against hashed passwords? (Select two.)

Accepted Answer

John the Ripper. John the Ripper (B) is a dedicated offline password-cracking tool that takes captured hash files and performs dictionary, brute-force, and rule-based attacks against formats like NTLM, MD5-crypt, and bcrypt. Hashcat (D) is likewise a purpose-built password-recovery utility that leverages CPU and GPU acceleration to crack hashes via dictionary, mask, combinator, and hybrid attacks. Both are the standard tools referenced in penetration-testing and certification material for attacking hashed credentials. Wireshark (A) is a packet analyzer for capturing and inspecting network traffic, not for cracking hashes. Nmap (C) is a port scanner and service/OS fingerprinting tool with NSE scripts, but it does not perform hash cracking. Metasploit (E) is an exploitation framework that can harvest or pass hashes, yet its core role is not dedicated password cracking against hash files.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 15

Which THREE of the following are indicators that a system has been compromised by a rootkit? (Select 3)

Accepted Answer

Anti-virus software is disabled and cannot be restarted. Option A is correct because rootkits commonly disable or interfere with security tools such as anti-virus software, and the inability to restart them is a strong indicator of kernel-level or user-mode tampering. Option B is correct because rootkits are specifically designed to hide their presence, often by hooking system calls or modifying kernel structures so that processes, files, or registry keys do not appear in standard tools like Task Manager, ps, or top. Option C is correct because rootkits frequently maintain persistence and remote control by establishing covert connections to command-and-control (C2) servers, and such unexplained outbound traffic is a classic sign of compromise. Option D is not correct because repeated successful logins from unknown IPs suggest credential compromise or brute-force success, but they do not specifically indicate a rootkit, which is characterized by stealth and system-level hiding. Option E is not correct because increased disk space usage is a generic symptom that can result from many benign causes such as log growth, updates, or user data, and is not a specific indicator of rootkit activity.

Answer

Event logs show repeated successful logins from unknown IPs

Answer

Increased disk space usage without explanation

Question 16

Which TWO of the following are examples of static malware analysis techniques? (Select two.)

Accepted Answer

Checking file hash on VirusTotal. Option D is correct because checking a file hash on VirusTotal is a static technique: you compute a cryptographic hash (e.g., MD5/SHA-256) of the sample and look it up in a database without ever executing the code. Option E is correct because examining strings in the binary uses tools like strings or a disassembler to extract embedded ASCII/Unicode text and other artifacts from the file on disk, again without running it. Both D and E analyze the malware's static properties (hash values, embedded strings) rather than its runtime behavior. In contrast, A (sandbox execution), B (capturing network traffic during execution), and C (monitoring process behavior with Process Monitor) all require the malware to run, making them dynamic analysis techniques, not static ones.

Answer

Running the malware in a sandbox

Answer

Capturing network traffic during execution

Answer

Monitoring process behavior with Process Monitor

Question 17

Which TWO of the following are valid enumeration techniques used to identify user accounts on a system? (Select 2)

Accepted Answer

SMTP VRFY command. SMTP VRFY (option C) is a valid user-enumeration technique because the SMTP VRFY command asks the mail server to verify whether a given mailbox or username exists, and servers that respond with 250/251 confirm the account while 550 indicates it does not exist. SMB enumeration with enum4linux (option E) is also valid because it queries SMB/RPC services (such as SAMR and LSA) to extract usernames, groups, shares, and password policy information from Windows and Samba hosts. Port scanning with nmap (option A) only identifies open ports and services, not user accounts, so it is not an enumeration technique for accounts. A DNS zone transfer (option B) can reveal hostnames and subdomains but does not enumerate system user accounts. SNMPwalk of the entire MIB (option D) gathers device and system information via OIDs but does not directly enumerate user accounts on the target system.

Answer

Port scanning with nmap

Answer

DNS zone transfer

Answer

SNMPwalk of the entire MIB

Question 18

Which TWO of the following are enumeration techniques?

Accepted Answer

LDAP enumeration. LDAP enumeration (C) is a valid enumeration technique because it queries directory services on port 389 (or 636 for LDAPS) to extract information such as user accounts, group memberships, and organizational structure via anonymous or authenticated binds. SMTP enumeration (E) is also a valid enumeration technique, using commands like VRFY, EXPN, and RCPT TO to discover valid email addresses and usernames on a mail server. Both techniques focus on gathering information about a target rather than exploiting it. In contrast, buffer overflow (A), cross-site scripting (B), and SQL injection (D) are exploitation or attack techniques that compromise or manipulate a system, not enumeration methods.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

SQL injection

Question 19

Which THREE of the following are indicators that a system may be infected with a backdoor Trojan? (Select three)

Accepted Answer

Unexpected network traffic on ports typically used for remote administration. Option A is correct because backdoor Trojans commonly open or connect to remote-administration ports (e.g., TCP 3389 for RDP, 22 for SSH, or 4444/31337 for malware C2) to give attackers remote control, so unexpected traffic on such ports signals compromise. Option C is correct because a backdoor typically installs itself as a hidden or unauthorized background process (often masquerading as a legitimate service) to maintain persistence and accept attacker commands. Option E is correct because backdoors beacon out to attacker-controlled command-and-control servers, producing unusual outbound connections to unknown or suspicious IP addresses. Option B is not a reliable indicator because high CPU usage by one process is more characteristic of cryptominers, fork bombs, or buggy applications than of a stealthy backdoor, which usually minimizes resource use to avoid detection. Option D is not a reliable indicator because DNS queries to known legitimate sites are normal user or system activity and do not by themselves suggest a backdoor, which would more likely resolve unknown or algorithmically generated domains.

Answer

Persistent high CPU usage by a single process

Answer

Increased number of DNS queries to known legitimate sites

Question 20

Which TWO of the following are examples of application-layer DDoS attacks?

Accepted Answer

Slowloris. Slowloris (B) is an application-layer DDoS attack because it operates at Layer 7 by opening many partial HTTP connections and sending incomplete request headers, exhausting the web server's connection pool without ever completing a request. HTTP flood (D) is also an application-layer attack, since it overwhelms a web server with a high volume of seemingly legitimate HTTP GET or POST requests that consume CPU, memory, and application resources. In contrast, ICMP flood (A), SYN flood (C), and UDP flood (E) are network- or transport-layer attacks: ICMP and UDP floods simply blast packets at Layers 3/4, and a SYN flood exploits the TCP three-way handshake at Layer 4, so none of them target application-layer protocols like HTTP.

Answer

ICMP flood

Answer

SYN flood

Answer

UDP flood