CEH Practice Exam 59 — 20 Questions

Question 1

An attacker is attempting to perform an Insecure Direct Object Reference (IDOR) attack on a web application. Which TWO conditions are necessary for this attack to succeed?

Accepted Answer

The application exposes direct references to internal objects (e.g., user IDs in URLs). Option B is correct because IDOR fundamentally requires the application to expose direct references to internal objects, such as sequential user IDs, file names, or database keys in URLs or parameters, giving the attacker a manipulable identifier to tamper with. Option C is correct because even with exposed direct references, the attack only succeeds if the application fails to validate that the authenticated user is authorized to access the requested object, allowing horizontal or vertical privilege escalation. Option A is incorrect because indirect references using random or hashed tokens are actually a mitigation that makes object identifiers unpredictable and thus harder to enumerate or manipulate. Option D is incorrect because CSRF is a separate vulnerability class that forces a victim's browser to send unintended authenticated requests; it is not a prerequisite for IDOR. Option E is incorrect because strong access controls on every object would prevent IDOR by ensuring authorization checks are enforced, directly defeating the attack rather than enabling it.

Answer

The application uses indirect object references (e.g., random tokens)

Answer

The application has a CSRF vulnerability

Answer

The application implements strong access controls on every object

Question 2

A security analyst identifies that a web application is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are effective mitigation techniques for SSRF?

Accepted Answer

Disable unnecessary URL schemas (e.g., file://, dict://). Option A is correct because restricting or disabling dangerous URL schemas such as file://, dict://, gopher://, and ftp:// prevents an attacker from abusing the server's URL-fetching functionality to read local files or interact with non-HTTP services, which is a core SSRF exploitation vector. Option D is correct because an allowlist (positive validation) of permitted domains, URLs, or IP addresses ensures the application only makes requests to explicitly trusted destinations, which is the most robust defense against SSRF since it rejects all unapproved targets by default. Option B is not ideal because blacklisting private IP ranges is easily bypassed using techniques such as decimal/octal/hex IP encoding, DNS rebinding, IPv6-mapped addresses, or redirects, so it is considered a weak mitigation rather than an effective one. Option C is incorrect because increasing HTTP request timeouts only affects how long the server waits for a response and does nothing to prevent SSRF requests from being made. Option E is incorrect because base64-encoding user input does not validate or restrict the destination; the server would still decode and process the URL, so the SSRF vulnerability remains exploitable.

Answer

Use a blacklist to block private IP ranges

Answer

Increase the timeout for HTTP requests

Answer

Encode user input in base64 before passing to URL functions

Question 3

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. Option A (Using anti-CSRF tokens) is correct because a unique, unpredictable token tied to the user's session and validated server-side ensures that a forged request originating from a malicious third-party site cannot include the correct token, so the request is rejected. Option B (Setting the SameSite attribute on cookies) is correct because SameSite=Lax or SameSite=Strict prevents the browser from attaching session cookies to cross-site requests, which blocks the automatic credential submission that CSRF relies on. Option C (HSTS) is not correct because it only enforces HTTPS and prevents protocol downgrade/SSL-stripping attacks, not cross-site request forgery. Option D (input validation) is not correct because validating input addresses injection flaws like XSS or SQLi but does not stop a browser from sending an authenticated forged request. Option E (CSP headers) is not correct because CSP mitigates XSS and content-injection risks, which is a different attack class than CSRF.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 4

Which TWO of the following are symmetric encryption algorithms? (Select TWO.)

Accepted Answer

AES. AES (B) is correct because it is a symmetric block cipher that uses the same secret key for both encryption and decryption, operating on 128-bit blocks with key sizes of 128, 192, or 256 bits. 3DES (D) is also correct because it is a symmetric block cipher that applies the DES algorithm three times with a shared secret key (effectively 112 or 168 bits of key strength), using the same key for encryption and decryption. ECC (A) is not correct here because it is an asymmetric (public-key) cryptosystem based on elliptic curve mathematics, not a symmetric algorithm. RSA (C) is likewise asymmetric, relying on a public/private key pair for encryption and digital signatures. SHA-256 (E) is a cryptographic hash function, not an encryption algorithm at all, so it cannot be symmetric encryption.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 5

An attacker uses the VRFY command on an SMTP server to check the existence of email addresses. The server responds with '250 OK' for 'admin@company.com' and '550 No such user' for 'fake@company.com'. Which SMTP enumeration technique is being used?

Accepted Answer

VRFY enumeration. The VRFY command is an SMTP command defined in RFC 821 that asks the server to verify whether a given email address exists. When the server responds with '250 OK' for a valid address and '550 No such user' for an invalid one, the attacker is directly using the VRFY command to enumerate valid users. This is explicitly known as VRFY enumeration.

Answer

EXPN enumeration

Answer

SMTP banner grabbing

Answer

RCPT TO enumeration

Question 6

A malware analyst wants to examine a suspicious executable without executing it. The goal is to extract strings, view the PE header, and check for known signatures. Which approach is the analyst using?

Accepted Answer

Static analysis. Static analysis involves examining a binary without executing it. The analyst extracts strings (e.g., using `strings`), views the PE header (e.g., with `pefile` or `dumpbin`), and checks for known signatures (e.g., YARA rules or antivirus hashes). This approach is safe and preserves the original state of the file.

Answer

Dynamic analysis

Answer

Heuristic analysis

Answer

Reverse engineering

Question 7

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Rate limiting. Rate limiting is effective because it restricts the number of requests a server will accept from a single IP address or session within a given time window, typically enforced via token bucket or leaky bucket algorithms. This prevents a single attacker or botnet node from overwhelming server resources, though it must be carefully tuned to avoid blocking legitimate users.

Answer

Blackholing all traffic to the target

Answer

IP spoofing

Question 8

During a penetration test, you execute a command that sends a large number of spoofed ICMP echo request packets to a subnet's broadcast address. This results in a flood of replies to the target system. Which attack have you performed?

Accepted Answer

Smurf attack. The Smurf attack works by sending a large number of ICMP echo request packets with a spoofed source IP (the victim's address) to a subnet's broadcast address. All hosts on that subnet receive the request and reply to the spoofed source, overwhelming the victim with ICMP echo replies. This amplifies traffic because a single request triggers many responses, making it a classic amplification DDoS attack.

Answer

Ping of Death

Answer

UDP flood

Answer

ICMP flood

Question 9

A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?

Accepted Answer

nbtstat. The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.

Answer

nslookup

Answer

netstat

Answer

net view

Question 10

A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. The attacker is fabricating a scenario (IT help desk performing a security update) to manipulate the target into revealing sensitive information. This is the essence of pretexting, where the attacker creates a false identity or situation to gain trust and extract data. Unlike phishing, which typically uses malicious links or attachments, this attack relies purely on verbal impersonation and social manipulation.

Answer

Tailgating

Answer

Quid pro quo

Answer

Phishing

Question 11

A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?

Accepted Answer

DNS amplification. This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to multiple DNS servers, which then send large responses to the victim, overwhelming its DNS port (53). The key indicators are the use of UDP, port 53, spoofed source IP of the target, and the amplification effect where a small query generates a much larger response.

Answer

UDP flood

Answer

SYN flood

Answer

ICMP flood

Question 12

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

Accepted Answer

Exploit the SUID binary to execute commands as root. The SUID binary owned by root runs with root privileges regardless of the user executing it. Exploiting a vulnerable SUID binary (e.g., via command injection, buffer overflow, or misconfigured capabilities) allows the low-privileged user to execute arbitrary commands as root, directly escalating privileges. This is the most effective method because it leverages a known privilege escalation vector specific to Linux SUID binaries.

Answer

Perform an SMTP VRFY attack to enumerate users

Answer

Use enum4linux to enumerate SMB shares

Answer

Run 'sudo -l' to list sudo privileges

Question 13

A security analyst notices that the ARP cache on a workstation contains multiple entries for the same IP address with different MAC addresses. Which attack is likely occurring?

Accepted Answer

ARP poisoning. ARP poisoning (also called ARP spoofing) occurs when an attacker sends forged ARP replies to a network, associating their own MAC address with the IP address of a legitimate host (e.g., the default gateway). The workstation's ARP cache then stores multiple MAC addresses for the same IP, as the cache is updated with each fraudulent reply. This allows the attacker to intercept, modify, or block traffic intended for that IP, enabling man-in-the-middle attacks.

Answer

Session hijacking

Answer

DNS spoofing

Answer

MAC flooding

Question 14

A network administrator notices that the ARP cache on several workstations contains entries mapping the default gateway IP to an unknown MAC address. Users report intermittent connectivity issues. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs, including ARP cache poisoning. By sending forged ARP replies, it maps the default gateway IP to an attacker-controlled MAC address, causing traffic to be intercepted and resulting in intermittent connectivity. This directly matches the symptoms described.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 15

A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP echo requests. The attacker sends ICMP echo request packets with a spoofed source IP (the victim's IP) to the network's broadcast address, causing every host on that network to reply to the victim, overwhelming it with ICMP echo replies. This amplification effect makes the attack highly effective, as a single request generates many responses.

Answer

UDP flood

Answer

SYN flood

Answer

Ping of Death

Question 16

Which tool is specifically designed to automate social engineering attacks, such as phishing and credential harvesting?

Accepted Answer

SET. The Social Engineering Toolkit (SET) is an open-source Python-driven framework specifically designed to automate social engineering attacks, including phishing campaigns, credential harvesting via cloned websites, and spear-phishing payloads. It integrates with Metasploit for payload delivery but is distinct in its focus on manipulating human behavior rather than exploiting technical vulnerabilities.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 17

Which TWO of the following are examples of application layer DDoS attacks? (Select two.)

Accepted Answer

Slowloris. Slowloris (A) is an application-layer (Layer 7) DDoS attack because it opens many partial HTTP connections and sends incomplete request headers, exhausting the web server's connection pool without ever completing a request. HTTP flood (D) is also an application-layer attack, since it overwhelms a web server with seemingly legitimate HTTP GET or POST requests that consume CPU, memory, and application resources. By contrast, UDP flood (B) is a volumetric transport/network-layer attack that saturates bandwidth with User Datagram Protocol packets. Smurf attack (C) is an ICMP-based network-layer amplification attack using broadcast addresses and spoofed source IPs. SYN flood (E) is a transport-layer attack that exploits the TCP three-way handshake by leaving half-open connections, not an application-layer attack.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 18

Which type of malware spreads by replicating itself across a network without requiring a host file to attach to?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself across a network without needing a host file, exploiting vulnerabilities or using network protocols like SMB, RDP, or email to spread autonomously. Unlike viruses, worms do not attach to a host program; they self-propagate via network connections, often consuming bandwidth and system resources.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 19

A Linux system has a script named 'backup' owned by root with the SUID bit set and world-executable permissions. A standard user executes the script and discovers it runs a command that reads /etc/shadow and writes output to a world-readable file. What is the most likely intended exploitation path?

Accepted Answer

SUID abuse to read sensitive files. The SUID bit on the 'backup' script, owned by root and world-executable, allows any user to execute it with root privileges. If the script reads /etc/shadow (which is normally root-only) and writes the output to a world-readable file, an attacker can exploit this to exfiltrate password hashes. This is a classic SUID abuse scenario where a privileged binary or script is used to access sensitive files.

Answer

GUID abuse

Answer

LD_PRELOAD injection

Answer

Token impersonation

Question 20

A security analyst runs the following Nmap command: nmap -sS -sV -O -p 22,80,443,3389 192.168.1.0/24. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

Perform a TCP SYN scan on four ports, detect service versions, and attempt OS fingerprinting. The `-sS` flag initiates a TCP SYN stealth scan, `-sV` enables service version detection, and `-O` attempts OS fingerprinting. The `-p 22,80,443,3389` limits the scan to those four ports, and the target `192.168.1.0/24` scans the entire Class C subnet. This combination performs a half-open scan on the specified ports, probes for application versions, and tries to identify the operating system of each live host.

Answer

Perform a full TCP connect scan with UDP service detection on all ports

Answer

Perform an aggressive scan of all open ports and enumerate SMB shares

Answer

Perform a UDP scan on the four specified ports and identify running services