CEH Practice Exam 58 — 20 Questions

Question 1

Which TWO of the following are examples of protocol-based DoS attacks? (Choose two.)

Accepted Answer

Smurf attack. A Smurf attack (A) is a protocol-based DoS attack because it abuses ICMP by sending echo requests to a network's broadcast address with a spoofed source IP, causing every host to reply to the victim and amplifying traffic. A SYN flood (B) is protocol-based because it exploits the TCP three-way handshake: the attacker sends many SYN packets with spoofed source addresses, filling the victim's half-open connection table so legitimate connections cannot complete. HTTP flood (C) and Slowloris (D) are application-layer (Layer 7) attacks that target web services rather than exploiting a network protocol's mechanics, and UDP flood (E) is a volumetric attack that simply overwhelms bandwidth with generic UDP datagrams rather than abusing a specific protocol behavior.

Answer

HTTP flood

Answer

Slowloris

Answer

UDP flood

Question 2

Which TWO of the following are characteristics of a SYN flood attack? (Select 2)

Accepted Answer

It exploits the TCP three-way handshake. Option A is correct because a SYN flood specifically abuses the TCP three-way handshake: the attacker sends many SYN packets with spoofed source addresses, and the server replies with SYN-ACK while waiting for the final ACK that never arrives. Option E is correct because those half-open connections accumulate in the server's SYN backlog queue, exhausting available connection slots and preventing legitimate clients from completing the handshake. Option B is incorrect because UDP amplification describes volumetric reflection attacks such as DNS or NTP amplification, not the TCP handshake-based SYN flood. Option C is incorrect because a large volume of ICMP echo requests describes an ICMP flood or smurf-style attack, not a SYN flood. Option D is incorrect because a SYN flood can be launched from a single host with spoofed source IP addresses and does not inherently require a botnet.

Answer

It uses UDP amplification

Answer

It sends a large number of ICMP echo requests

Answer

It requires the attacker to have a botnet

Question 3

During a forensic investigation, you find a file named 'svch0st.exe' in the startup folder. The file has a suspicious icon and was downloaded from an untrusted source. Analysis shows it opens a backdoor on port 4444 and sends system information to a remote server. Which THREE best describe this malware and its characteristics?

Accepted Answer

It functions as a remote access Trojan (RAT). Option A is correct because a program that covertly opens a backdoor on port 4444 and accepts remote commands is functioning as a remote access Trojan (RAT), giving an attacker interactive control of the host. Option B is correct because the file masquerades as a legitimate executable (svch0st.exe mimicking svchost.exe), was downloaded from an untrusted source, and hides malicious functionality, which is the defining behavior of a Trojan horse. Option E is correct because the malware sends system information to a remote server, which is data exfiltration over the network to an attacker-controlled endpoint. Option C is not correct because nothing in the scenario indicates self-mutating code or signature changes on each execution, which would be required for a polymorphic virus. Option D is not correct because there is no evidence of self-replication or automatic propagation across the network, which is the defining trait of a worm.

Answer

It is a polymorphic virus that changes its signature each time it runs

Answer

It is a worm that replicates across the network automatically

Question 4

Which TWO of the following are valid techniques for session hijacking? (Select 2)

Accepted Answer

TCP sequence prediction. TCP sequence prediction (C) is a valid session hijacking technique because an attacker who can guess or infer the next expected TCP sequence and acknowledgment numbers can inject forged packets into an established TCP session, impersonating the legitimate client without ever seeing the authentication exchange. Cookie theft (D) is also valid because session cookies often serve as the bearer token for an authenticated HTTP session, so stealing a cookie (via XSS, sniffing, or malware) lets the attacker replay it and take over the victim's session. DNS spoofing (A), MAC flooding (B), and ARP poisoning (E) are not session hijacking techniques themselves: DNS spoofing redirects name resolution, MAC flooding overflows a switch's CAM table to force hub-like flooding, and ARP poisoning enables man-in-the-middle traffic interception — each may facilitate an attack, but none directly hijacks an existing session.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning

Question 5

A penetration tester is performing a session hijacking attack. After capturing packets, the tester successfully predicts the TCP sequence numbers and injects packets to take over the session. Which type of attack is this?

Accepted Answer

TCP session hijacking. TCP session hijacking involves an attacker predicting or spoofing TCP sequence numbers to inject malicious packets into an established TCP connection, effectively taking over the session without the need for authentication. This attack exploits the lack of built-in authentication in TCP's three-way handshake and sequence number generation, allowing the attacker to impersonate one of the communicating parties.

Answer

MAC flooding

Answer

Cookie theft

Answer

ARP poisoning

Question 6

A security analyst suspects an attacker has replaced system binaries with a rootkit to hide malicious processes. Which covering tracks technique is the attacker using?

Accepted Answer

Rootkit installation. The attacker is using rootkit installation to replace system binaries (e.g., ps, ls, netstat) with trojaned versions that filter out malicious processes from system calls like readdir() or /proc listings. This is a classic covering tracks technique because the rootkit hides evidence of compromise by intercepting and modifying kernel or user-space output, making the attacker's activities invisible to standard monitoring tools.

Answer

Timestomping

Answer

Steganography

Answer

Log manipulation

Question 7

A penetration tester uses Burp Suite to intercept and modify web traffic. Which TWO features in Burp Suite would be MOST useful for performing a brute-force attack on a login form? (Choose TWO.)

Accepted Answer

Burp Proxy. Burp Proxy (B) is correct because it sits as an intercepting HTTP/S man-in-the-middle, allowing the tester to capture the login POST request, inspect its parameters, and forward it to other tools for automated manipulation. Burp Intruder (D) is correct because it is the dedicated Burp component for automating customized attacks: the tester marks the username/password parameters as payload positions, loads a wordlist (e.g., a Sniper or Cluster bomb attack type), and sends many login attempts while analyzing status codes, lengths, or grep-match results to spot a successful credential. Together, Proxy captures the base request and Intruder replays it with varying payloads, which is the standard Burp workflow for brute-forcing a login form. Burp Scanner (A) is an automated vulnerability scanner for issues like SQLi or XSS, not a credential-guessing engine, so it does not belong. Burp Decoder (C) only encodes/decodes data (e.g., Base64, URL, hex) and cannot generate or send repeated login requests. Burp Repeater (E) manually resends a single request for tweaking, but it lacks the payload-position and wordlist automation needed for brute force.

Answer

Burp Scanner

Answer

Burp Decoder

Answer

Burp Repeater

Question 8

A security analyst discovers a file named invoice.exe in an email attachment. Static analysis with PEiD indicates the file is packed with UPX. What is the BEST next step in analyzing this malware?

Accepted Answer

Unpack the file with UPX and then perform static analysis. B is correct because UPX-packed executables cannot be properly analyzed statically; the code is compressed and obfuscated. Unpacking with the UPX tool restores the original binary, enabling accurate static analysis of imports, strings, and structure. This step is essential before any dynamic analysis or submission to sandboxes.

Answer

Execute the packed file on a production server

Answer

Submit the packed file directly to VirusTotal

Answer

Delete the file immediately

Question 9

Which of the following is a common indicator of a stored (persistent) Cross-Site Scripting (XSS) attack?

Accepted Answer

A script is permanently stored on the server and executed when users view a page. Stored (persistent) XSS occurs when malicious script is permanently stored on the server (e.g., in a database, comment field, or forum post) and is served to every user who views the affected page. The script executes in the victim's browser without requiring any additional interaction, as it is part of the page's HTML response from the server.

Answer

A script executes in the victim's browser without any server interaction

Answer

A script is executed when a user submits a form with malicious input

Answer

A script executes only after clicking a manipulated URL

Question 10

A security analyst observes repeated attempts to validate user accounts via SMTP using VRFY commands from an external IP. What is the BEST immediate action to mitigate this reconnaissance?

Accepted Answer

Disable VRFY and EXPN commands in the SMTP server configuration. The VRFY command is an SMTP protocol feature (RFC 821) that allows a client to verify whether a specific email address exists on the server. Attackers use VRFY and EXPN to enumerate valid user accounts during the reconnaissance phase. Disabling these commands in the SMTP server configuration directly stops this enumeration technique without affecting legitimate mail delivery.

Answer

Upgrade to the latest version of the SMTP server

Answer

Enable SMTP authentication for all incoming connections

Answer

Block the external IP address at the firewall

Question 11

During a system hacking phase, a tester successfully gains access to a Windows machine and wants to hide a malicious executable. Which of the following techniques is MOST effective for hiding files from standard directory listings without using third-party tools?

Accepted Answer

Store the executable in an Alternate Data Stream (ADS). Storing the executable in an Alternate Data Stream (ADS) is a highly effective method for hiding files on NTFS file systems. Files stored in ADS are not visible in standard directory listings (e.g., `dir` command or Windows Explorer) and require specific knowledge or commands to discover. This technique can be implemented using built-in Windows commands like `type` or `echo` for creation, and `start` or PowerShell for execution, thus adhering to the 'no third-party tools' constraint. It offers a greater degree of concealment than simply setting hidden and system attributes, which can be easily revealed by changing folder options.

Answer

Use the `attrib +h +s` command to set hidden and system attributes

Answer

Rename the file to a system filename like svchost.exe and place it in C:\Windows\System32

Answer

Encrypt the file using EFS

Question 12

After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?

Accepted Answer

wevtutil cl Security. The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.

Answer

del *.log

Answer

rm -rf /var/log/*

Answer

clear-eventlog -Log Security

Question 13

An attacker uses a tool that sends crafted RCPT TO commands to an SMTP server to verify email addresses. Which SMTP enumeration technique is being used?

Accepted Answer

RCPT TO. The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

Answer

AUTH

Answer

EXPN

Answer

VRFY

Question 14

Which TWO of the following tools are used for cloud security auditing or exploitation?

Accepted Answer

ScoutSuite. ScoutSuite (A) is a multi-cloud security auditing tool that queries cloud provider APIs (AWS, Azure, GCP, etc.) to enumerate resources and flag misconfigurations, making it a cloud security auditing tool. Pacu (C) is an open-source AWS exploitation framework designed for offensive security testing of cloud environments, providing modules for enumeration, privilege escalation, and persistence, so it fits cloud exploitation. John the Ripper (B) is an offline password cracker, Nessus (D) is a general-purpose vulnerability scanner for hosts and networks, and Aircrack-ng (E) is a Wi-Fi (802.11) wireless security auditing suite — none of these are specifically cloud security auditing or exploitation tools.

Answer

John the Ripper

Answer

Nessus

Answer

Aircrack-ng

Question 15

Which TWO of the following are valid techniques used in password spraying attacks? (Choose 2.)

Accepted Answer

Using a list of common passwords (e.g., 'Password123', 'Welcome1') against a large set of usernames. Password spraying is defined by trying a small number of common passwords against many accounts to avoid lockout thresholds, and both D and E describe exactly this. Option D is correct because it uses a list of common passwords such as 'Password123' and 'Welcome1' against a large set of usernames, which is the classic horizontal brute-force pattern. Option E is correct because it attempts one common password across multiple users before moving to the next common password, which is the defining low-and-slow technique that evades account lockout policies. Option A is credential stuffing, not spraying, since it replays previously compromised username/password pairs. Option B is keylogging, a host-based credential theft technique, not a password spraying method. Option C is a traditional brute-force attack against a single username, which is vertical rather than horizontal and would trigger lockouts.

Answer

Using previously compromised username/password pairs from a breach

Answer

Capturing keystrokes to obtain a user's password

Answer

Trying every possible password from a dictionary against a single username

Question 16

Which THREE of the following are common types of SQL injection attacks? (Select three)

Accepted Answer

Out-of-band SQL injection. The three correct answers are C, D, and E. Out-of-band SQL injection (C) is a recognized type where the attacker uses a different channel (e.g., DNS or HTTP requests via functions like UTL_HTTP or xp_dirtree) to exfiltrate data when the web response does not return query results. Blind SQL injection (D) is a standard category where the attacker infers data by observing boolean true/false responses or time delays (e.g., WAITFOR DELAY, SLEEP), rather than seeing query output directly. In-band SQL injection (E) is the classic category where data is retrieved through the same channel used to inject the payload, typically via UNION-based or error-based techniques. The unmarked options A and B are not standard SQL injection classifications: 'reflected' and 'stored' describe XSS variants, not SQLi types, so they do not belong here.

Answer

Reflected SQL injection

Answer

Stored SQL injection

Question 17

Which TWO of the following are symmetric encryption algorithms? (Select 2)

Accepted Answer

3DES. 3DES (Triple DES) is correct because it is a symmetric block cipher that applies the DES algorithm three times with keys, using the same secret key for both encryption and decryption. AES (Advanced Encryption Standard) is correct because it is a symmetric block cipher that uses a single shared secret key for encryption and decryption, with key sizes of 128, 192, or 256 bits. ECC (Elliptic Curve Cryptography) is not correct because it is an asymmetric public-key algorithm based on elliptic curve mathematics. RSA is not correct because it is an asymmetric algorithm using a public/private key pair. MD5 is not correct because it is a cryptographic hash function, not an encryption algorithm.

Answer

ECC

Answer

RSA

Answer

MD5

Question 18

Which TWO of the following are effective mitigations against Clickjacking attacks? (Choose 2)

Accepted Answer

Set Content-Security-Policy: frame-ancestors 'none'. Option B is correct because the Content-Security-Policy directive frame-ancestors 'none' instructs the browser that the page must never be embedded in a frame, iframe, or object, which directly blocks the framing technique clickjacking relies on. Option D is correct because the X-Frame-Options: DENY response header prevents the page from being rendered inside a frame on any site, including the same origin, thereby stopping clickjacking overlay attacks. Option A is not a clickjacking mitigation because HSTS only forces HTTPS connections and prevents protocol downgrade or cookie hijacking, not framing. Option C is unrelated since CSRF tokens defend against forged state-changing requests, not UI redressing. Option E is also unrelated because SameSite cookie attributes limit cross-site cookie sending to mitigate CSRF, not framing-based clickjacking.

Answer

Enable HTTP Strict-Transport-Security (HSTS)

Answer

Use CSRF tokens

Answer

Set SameSite cookies to Strict

Question 19

Which THREE of the following are valid methods for exploiting cloud misconfigurations? (Select 3)

Accepted Answer

Using a container escape to access the host OS. Option A is correct because a container escape exploits a misconfigured or vulnerable container runtime (e.g., privileged containers, exposed Docker socket, or kernel flaws) to break isolation and reach the underlying host OS, a classic cloud misconfiguration risk. Option B is correct because an S3 bucket configured with public read access is a well-known cloud storage misconfiguration that lets anyone list and download objects, exposing sensitive files. Option E is correct because overly permissive IAM roles (e.g., wildcard actions like iam:* or sts:AssumeRole on broad resources) are a cloud identity misconfiguration that attackers abuse to escalate privileges. Option C is not specific to cloud misconfigurations—SQL injection is an application-layer vulnerability independent of cloud configuration. Option D is also not a cloud misconfiguration exploit; a DDoS attack from a botnet abuses network/volumetric resources rather than a misconfigured cloud setting.

Answer

Performing a SQL injection on a web application

Answer

Launching a DDoS attack from a botnet

Question 20

An analyst captures network traffic and sees a large number of packets with source IP 10.0.0.1, destination IP 192.168.1.1, TCP SYN flag set, with sequence numbers that appear incremental. The destination responds with SYN-ACK but the source never completes the handshake. Which attack is MOST likely occurring?

Accepted Answer

SYN flood. This behavior describes a classic SYN flood attack. The source (10.0.0.1) sends a high volume of TCP SYN packets with incremental sequence numbers to the target (192.168.1.1). The target responds with SYN-ACK packets, but the source never sends the final ACK to complete the three-way handshake. This leaves the target with half-open connections that exhaust its connection table, denying service to legitimate traffic.

Answer

ARP poisoning

Answer

ICMP flood

Answer

DNS amplification