CEH Practice Exam 59 — 20 Questions

Question 1

A security analyst is conducting a vulnerability scan on a web server using Nessus. After the scan, they notice that the server's performance has degraded significantly, and some services have become unresponsive. Which of the following actions could have prevented this issue?

Accepted Answer

Configure Nessus to use a 'safe' scan policy that disables disruptive plugins. Option B is correct because Nessus 'safe' scan policies disable plugins known to cause service disruption, such as those performing denial-of-service tests or exploiting vulnerabilities that may crash services. By using a safe policy, the analyst avoids aggressive checks that can degrade server performance or cause unresponsiveness, which is a common risk during vulnerability scanning.

Answer

Increase the scan intensity to complete faster and reduce the load

Answer

Use a different scanner like OpenVAS which is less intrusive

Answer

Run the scan during peak hours to blend in with normal traffic

Question 2

A security analyst receives an alert about a scan originating from an IP address that appears to be using a 'sIdle scan' technique. Which of the following characteristics would confirm this?

Accepted Answer

The scan sends SYN packets with the zombie host's IP address as the source and monitors IPID changes on the zombie to determine open ports. Option C is correct because an idle scan (also known as a zombie scan) relies on sending SYN packets to the target with the spoofed source IP address of a zombie host, then monitoring the IPID sequence on that zombie to infer whether the target port is open, closed, or filtered. The key characteristic is the use of the zombie's IP as the source and the observation of IPID changes on the zombie, which is exactly what option C describes.

Answer

The scan uses fragmented packets and decoy IP addresses

Answer

The scan uses FTP bounce to hide the true source IP

Answer

The scan shows a SYN packet with the attacker's real IP but uses a zombie host to relay replies

Question 3

Which TWO of the following are valid port states that Nmap can report? (Select 2)

Accepted Answer

Open. Nmap reports 'Open' when a port responds to a probe (e.g., SYN, ACK, or connect scan) with a positive acknowledgment, indicating a service is actively listening. This is one of the six fundamental port states defined in Nmap's output, directly derived from the TCP/IP protocol behavior during the scan.

Answer

Unknown

Answer

Secured

Answer

Blocked

Question 4

A penetration tester runs `nmap -sS -sV -O -p- 192.168.1.10` and receives the following output snippet: 'PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.6 443/tcp open ssl/http Apache httpd 2.4.6'. Which THREE pieces of information can the tester derive from this output? (Choose 3)

Accepted Answer

The -sV flag was used for version detection. Option B is correct because the `-sV` flag in Nmap explicitly enables version detection, which probes open ports to determine the service and version information displayed in the output (e.g., 'OpenSSH 7.4', 'Apache httpd 2.4.6'). Without `-sV`, Nmap would only report the service name based on its port mapping (e.g., 'ssh', 'http'), not the specific version numbers.

Answer

The target has a vulnerability in OpenSSH 7.4

Answer

The target is vulnerable to the Heartbleed bug

Question 5

During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?

Accepted Answer

MX record. An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.

Answer

CNAME record

Answer

A record

Answer

NS record

Question 6

Which TWO OSINT tools are commonly used to gather email addresses and subdomains associated with a target domain? (Select 2)

Accepted Answer

theHarvester. theHarvester is a dedicated OSINT tool designed to gather email addresses, subdomains, IPs, and virtual hosts from public sources such as search engines (Google, Bing), PGP key servers, and the SHODAN database. It directly queries these sources to enumerate email addresses and subdomains associated with a target domain, making it a primary choice for passive reconnaissance.

Answer

Nmap

Answer

Nessus

Answer

Shodan

Question 7

Which of the following tools is specifically designed to perform Google dorking and automate searching for vulnerable web applications and sensitive information?

Accepted Answer

Googledork. Googledork (also known as Google Dork) is a tool specifically designed to automate Google dorking queries, which use advanced search operators to find vulnerable web applications and sensitive information exposed in search results. It systematically executes predefined dork queries against Google's index to identify SQL injection points, exposed configuration files, login pages, and other security weaknesses, making it the correct choice for this task.

Answer

Maltego

Answer

theHarvester

Answer

Shodan

Question 8

Which THREE of the following are valid Nmap NSE scripts that could be used for service version detection or vulnerability scanning? (Choose THREE.)

Accepted Answer

ssl-heartbleed. Option C is correct because the ssl-heartbleed NSE script (ssl-heartbleed.nse) specifically checks for the Heartbleed vulnerability (CVE-2014-0160) in OpenSSL implementations. It sends a malformed TLS heartbeat request and inspects the response for leaked memory contents, making it a direct vulnerability scanning script. This script is part of Nmap's NSE library and is widely used for identifying vulnerable SSL/TLS services.

Answer

dns-zone-transfer

Answer

smb-os-discovery

Question 9

Which TWO of the following are common OSINT tools for passive reconnaissance? (Select 2)

Accepted Answer

theHarvester. theHarvester is a passive OSINT tool that gathers email addresses, subdomains, IPs, and virtual hosts from public sources like search engines (Google, Bing), PGP key servers, and the SHODAN database without sending any packets directly to the target. This aligns with passive reconnaissance, which relies on publicly available information rather than active probing.

Answer

Metasploit

Answer

hping3

Answer

Nmap

Question 10

A penetration tester observes that an Nmap SYN scan shows all 1000 TCP ports as open. The tester suspects the target is using a security appliance that responds with SYN-ACK to all connection attempts, regardless of the actual port state. Which type of Nmap scan would be MOST effective in determining the true state of the ports?

Accepted Answer

TCP connect scan (-sT). Option C is correct because a TCP connect scan (-sT) completes the full three-way handshake, which forces the target to respond with a RST if the port is actually closed, even if a security appliance initially sends SYN-ACK to all ports. This distinguishes between ports that are truly open (where the handshake completes) and those that are falsely reported as open by the appliance (where the handshake fails or a RST is received).

Answer

UDP scan (-sU)

Answer

Ping sweep (-sn)

Answer

Idle scan (-sI)

Question 11

A security analyst notices that their Nmap scan results show all ports as 'filtered' despite the target host being alive and responsive to ping. Which of the following is the MOST likely cause?

Accepted Answer

The target has a host-based firewall that drops all incoming traffic silently. When an Nmap scan shows all ports as 'filtered', it indicates that the target is reachable (since ping succeeds) but the probe packets (e.g., SYN, ACK) are being dropped without any response. A host-based firewall configured to silently drop all incoming traffic is the most likely cause, as it prevents Nmap from receiving RST or SYN/ACK replies, leading to the 'filtered' state for every port.

Answer

The analyst's machine has a misconfigured routing table

Answer

The target is running a honeypot that mimics multiple services

Answer

The target is an idle host that does not respond to any traffic

Question 12

During a penetration test, you need to enumerate all DNS records for example.com using a zone transfer. Which TWO tools can be used to attempt this?

Accepted Answer

dnsenum. A is correct because dnsenum is a specialized tool designed to enumerate DNS information, including attempting a zone transfer (AXFR query) to retrieve all DNS records for a domain. It automates the process of querying the DNS server for a full zone transfer, which is the primary method to enumerate all records if the server is misconfigured to allow it.

Answer

dig

Answer

theHarvester

Answer

nslookup

Question 13

A security analyst is performing reconnaissance on a target domain and wants to discover all subdomains using DNS enumeration. Which of the following commands would be MOST effective for performing a DNS zone transfer attempt?

Accepted Answer

dnsrecon -d example.com -t axfr. Option D is correct because the `-t axfr` flag in `dnsrecon` specifically attempts a DNS zone transfer (AXFR query) against the target domain's authoritative nameservers. A successful zone transfer returns all DNS records, including all subdomains, making it the most direct and effective method for subdomain enumeration via DNS zone transfer.

Answer

dig example.com ANY

Answer

nslookup -type=ns example.com

Answer

theHarvester -d example.com -l 500 -b google

Question 14

What is the PRIMARY purpose of performing a DNS zone transfer?

Accepted Answer

To obtain all DNS records for a domain from an authoritative server. DNS zone transfer (AXFR) is a mechanism defined in RFC 1034 and 1035 that allows a secondary DNS server to replicate the entire zone file from a primary authoritative server. The primary purpose is to obtain all DNS records for a domain, which is critical for reconnaissance during the footprinting phase, as it reveals subdomains, mail servers, and other infrastructure without brute-forcing.

Answer

To cache DNS queries locally

Answer

To resolve IP addresses to hostnames

Answer

To verify the DNS server's response time

Question 15

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

Accepted Answer

The port is closed. Option C is correct because when hping3 sends a SYN packet to a closed port, the target responds with an RST/ACK packet per TCP RFC 793. This indicates that the port is reachable but no service is listening on it, hence the immediate reset.

Answer

The port is open and listening

Answer

The port is filtered by a firewall

Answer

The port is in a TIME_WAIT state

Question 16

During a security assessment, a tester uses `nmap -sU 192.168.1.1`. What type of scan does this command perform?

Accepted Answer

UDP scan. The `-sU` flag in Nmap explicitly instructs the tool to perform a UDP scan. This sends UDP packets to the target ports and analyzes responses (or lack thereof) to determine if a UDP port is open, closed, or filtered. Unlike TCP, UDP is connectionless, so the scan relies on ICMP unreachable messages or lack of response to infer port status.

Answer

TCP SYN scan

Answer

Ping sweep

Answer

OS fingerprinting

Question 17

You are performing a penetration test and need to quickly scan a large IP range (e.g., 10.0.0.0/8) for open ports 80 and 443. Which tool is BEST suited for this high-speed scanning task?

Accepted Answer

Masscan. Masscan is the best tool for this task because it is designed specifically for high-speed port scanning, capable of transmitting packets at rates exceeding 10 million packets per second, which is necessary to scan a /8 subnet (over 16 million IPs) for ports 80 and 443 in a reasonable timeframe. Unlike Nmap, which optimizes for accuracy and service detection, Masscan uses asynchronous raw socket transmission and can be tuned with the --rate parameter to maximize throughput, making it ideal for large-scale reconnaissance.

Answer

OpenVAS

Answer

hping3

Answer

Nmap

Question 18

A security analyst wants to perform passive reconnaissance on a target organization without generating any traffic to the target's network. Which of the following techniques would be MOST appropriate?

Accepted Answer

Performing a WHOIS lookup. WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., whois.arin.net) for domain registration details without sending any packets to the target's network. It relies on external, publicly available data, thus generating zero traffic to the target organization's infrastructure.

Answer

Running Nmap SYN scan

Answer

Executing hping3 to probe ports

Answer

Using Netcat to connect to a service

Question 19

An attacker uses a technique where they send a SYN packet with a spoofed source IP address to the target, and the target responds with SYN/ACK to the spoofed IP. The attacker never completes the handshake. This technique is known as:

Accepted Answer

Idle scan. The idle scan (option C) is correct because it uses a spoofed SYN packet with a zombie host's IP address to probe open ports on the target. The target sends a SYN/ACK to the zombie, but the attacker never completes the handshake; instead, the attacker monitors the zombie's IPID (IP Identification) field to infer whether the target's port is open or closed. This technique is defined in RFC 793 and leverages the zombie's predictable IPID sequence to perform a blind, stealthy scan.

Answer

SYN flood

Answer

TCP connect scan

Answer

Half-open scan

Question 20

A security analyst observes the following Nmap output for a target host: PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https. The analyst then runs a version detection scan and notices that port 80 reports 'Apache httpd 2.4.41' but port 443 reports 'Apache httpd 2.4.41' as well. What is the MOST likely conclusion?

Accepted Answer

The target is likely running a single web server that handles both HTTP and HTTPS traffic. Option B is correct because when both port 80 (HTTP) and port 443 (HTTPS) report the same Apache httpd version (2.4.41), it strongly indicates that the same web server process is listening on both ports. Apache httpd can be configured to handle both plain HTTP and TLS-encrypted HTTPS traffic simultaneously, typically using separate VirtualHost directives or a single configuration that binds to both ports. The identical version string makes it unlikely that two separate web server instances are running, as they would often differ in patch level or configuration.

Answer

The target is running two separate web servers on different ports

Answer

The target is running a reverse proxy that forwards traffic to different backends

Answer

The version detection is incorrect due to false positives