CEH Practice Exam 58 — 20 Questions

Question 1

A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?

Accepted Answer

Implement rate limiting and connection timeout. Slowloris works by opening many HTTP connections and keeping them alive by sending partial requests, never completing them, which exhausts the server's connection pool. Rate limiting restricts the number of connections from a single IP, and connection timeouts force idle connections to close, directly countering Slowloris's behavior. This combination prevents the attacker from holding connections open indefinitely.

Answer

Use anycast routing

Answer

Increase the maximum number of simultaneous connections

Answer

Enable SYN cookies

Question 2

An attacker intercepts a request and notices that the server reflects the value of the 'User-Agent' header in the response without sanitization. The attacker crafts a payload that triggers an alert box. This is an example of:

Accepted Answer

Reflected XSS. Reflected XSS occurs when the application immediately returns the user input in the response; here, the User-Agent header is reflected.

Answer

HTTP header injection

Answer

DOM-based XSS

Answer

Stored XSS

Question 3

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA is an asymmetric algorithm using a public/private key pair. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 4

During a web application test, the tester finds that the application includes user-supplied file names in include() statements. Which TWO of the following are indicators of a Remote File Inclusion (RFI) vulnerability? (Choose TWO.)

Accepted Answer

The application includes files from http://attacker.com/shell.txt. RFI allows inclusion of remote files via HTTP/HTTPS URLs. Directory traversal with ../ is more typical of LFI. Inclusion of local files like /etc/passwd indicates LFI, not RFI.

Answer

The application includes files with '..' and '/' sequences

Answer

The application includes /etc/passwd in the response

Answer

The application includes files with .inc extension

Question 5

During a penetration test, a tester observes that a web application's login form does not implement rate limiting and returns different error messages for valid vs invalid usernames. Which THREE attacks are most likely to be successful? (Select three)

Accepted Answer

Credential stuffing. With username enumeration and no rate limiting, brute force (trying many passwords on one user), credential stuffing (using breached credentials), and password spraying (trying common passwords across many users) are all viable. SQL injection is not directly related to the described conditions.

Answer

Directory traversal

Answer

SQL injection

Question 6

In Burp Suite, which tool is used to modify and resend individual HTTP requests to observe responses, allowing manual testing of input validation and parameter manipulation?

Accepted Answer

Repeater. Burp Repeater is designed for manually crafting and resending requests to see individual responses, ideal for testing parameter handling.

Answer

Proxy

Answer

Scanner

Answer

Intruder

Question 7

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

Accepted Answer

Run a dictionary attack using aircrack-ng with a wordlist. After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

Answer

Use aircrack-ng to crack the WEP key from the handshake

Answer

Brute-force the WPS PIN using Reaver

Answer

De-authenticate the client from the network again to capture another handshake

Question 8

Which THREE of the following are common attack vectors against IoT devices?

Accepted Answer

Insecure protocols (e.g., MQTT, CoAP without encryption). Default credentials, insecure protocols (e.g., MQTT without TLS), and firmware reversing (to find hardcoded secrets) are common IoT attack vectors. TLS stripping is a network attack, and container escape is a cloud/container attack.

Answer

Container escape

Answer

TLS stripping attack

Question 9

A security analyst captures a large number of initialization vectors (IVs) on a WEP-protected network. Which tool is most commonly used to crack the WEP key using IVs?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP keys by capturing IVs. Reaver is for WPS, Kismet is a sniffer, and John the Ripper is a general password cracker.

Answer

Reaver

Answer

Kismet

Answer

John the Ripper

Question 10

In the shared responsibility model for cloud computing, which of the following is typically the responsibility of the customer?

Accepted Answer

Data classification and encryption of customer data. The customer is responsible for data classification and account management, while the provider secures the physical infrastructure.

Answer

Physical security of data centers

Answer

Patch management of the virtualization platform

Answer

Network infrastructure security (e.g., hypervisor, network cables)

Question 11

Which TWO of the following are examples of asymmetric cryptography? (Select 2)

Accepted Answer

RSA. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. MD5 is a hash function.

Answer

3DES

Answer

MD5

Answer

AES

Question 12

An analyst sees the following in a log: Client sends a request to https://victim.com/api?url=http://169.254.169.254/latest/meta-data/. This is MOST indicative of which attack?

Accepted Answer

Server-side request forgery (SSRF). The IP 169.254.169.254 is the AWS metadata endpoint. SSRF attacks target internal services by manipulating the url parameter.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 13

A penetration tester is assessing an AWS environment and discovers an S3 bucket with the following bucket policy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}`. Which of the following is the MOST likely security issue?

Accepted Answer

The bucket policy allows public read access to all objects. The policy allows anyone (Principal: *) to read any object in the bucket, making it publicly accessible and a common misconfiguration.

Answer

The bucket policy allows only GetObject, which is too restrictive

Answer

The bucket policy should use a Principal of AWS instead of *

Answer

The bucket policy is missing a Deny statement for write operations

Question 14

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Accepted Answer

Brute-force the WPS PIN to recover the Wi-Fi passphrase. Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

Answer

Perform a de-authentication attack on the target AP

Answer

Capture the 4-way handshake for WPA cracking

Answer

Scan for nearby access points and their BSSIDs

Question 15

A penetration tester performs a container escape by exploiting a misconfigured capability and mounts the host filesystem. Which cloud service model is MOST directly affected?

Accepted Answer

Infrastructure as a Service (IaaS). Container escape compromises the host, affecting the underlying infrastructure in IaaS. In PaaS/SaaS, the provider may manage containers differently.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 16

A penetration tester performs a container escape from a Docker container running in a cloud environment. Which of the following is the MOST likely cause?

Accepted Answer

The container is running with the --privileged flag. Container escape often occurs when the container is run with the --privileged flag, granting elevated capabilities that allow access to the host kernel.

Answer

The container uses default credentials for SSH

Answer

The container image has a known vulnerability in the MQTT library

Answer

The host OS is running an outdated kernel version

Question 17

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts the victim's files using symmetric encryption (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. Unlike other malware types, its primary purpose is data hostage for financial extortion, often leveraging asymmetric encryption (e.g., RSA) to secure the symmetric key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 18

Which Google dork query would an attacker most likely use to find login pages on a web server?

Accepted Answer

intitle:login. The Google dork 'intitle:login' specifically searches for web pages where the word 'login' appears in the HTML title tag. Attackers use this to quickly discover login portals, as many web applications include 'login' in the page title, making it a reliable footprinting technique for identifying authentication interfaces.

Answer

inurl:admin

Answer

site:example.com filetype:pdf

Answer

link:example.com

Question 19

Which of the following commands is used to enumerate SNMP information from a network device using a specific community string?

Accepted Answer

snmpwalk -c public -v 2c 192.168.1.1. `snmpwalk` is the standard command-line tool for enumerating SNMP (Simple Network Management Protocol) information from a network device. By specifying the community string (`-c public`) and SNMP version (`-v 2c`), it retrieves the entire Management Information Base (MIB) tree from the target IP address, allowing an attacker to discover system details, running processes, and network interfaces.

Answer

ldapsearch -x -h 192.168.1.1 -b dc=domain,dc=com

Answer

enum4linux -a 192.168.1.1

Answer

nbtstat -a 192.168.1.1

Question 20

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Accepted Answer

Implementing a mantrap at the entrance. A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.

Answer

Hiring security guards

Answer

Reviewing keycard access logs

Answer

Installing CCTV cameras