CEH Practice Exam 60 — 20 Questions

Question 1

Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?

Accepted Answer

Masscan. Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.

Answer

hping3

Answer

OpenVAS

Answer

Nmap

Question 2

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area without presenting their own credentials. The attacker exploits the authorized person's trust or politeness to bypass access control systems such as badge readers or biometric locks. This technique relies on the human factor rather than technical vulnerabilities.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 3

Which TWO techniques are commonly used for privilege escalation on Linux systems? (Select two.)

Accepted Answer

Kernel exploits. Kernel exploits (A) are a common privilege escalation technique on Linux because they target vulnerabilities in the kernel itself, allowing an attacker to execute arbitrary code with root privileges. By exploiting flaws such as buffer overflows or race conditions in kernel modules, an attacker can elevate from a low-privileged user to full root access. This is a classic method because the kernel runs with the highest system privileges, and a successful exploit bypasses all user-level security controls.

Answer

Token impersonation

Answer

DLL hijacking

Answer

Pass-the-hash

Question 4

Which TWO of the following are passive reconnaissance techniques?

Accepted Answer

Google hacking (dorking). Google hacking (dorking) is a passive reconnaissance technique because it involves using advanced search operators in Google to discover publicly indexed information about a target, such as exposed configuration files or login pages, without sending any packets directly to the target's systems. It relies entirely on the search engine's pre-existing index, making it undetectable and non-intrusive. Similarly, WHOIS lookup is a passive reconnaissance technique because it queries public WHOIS databases to retrieve domain registration information, such as registrant details, name servers, and expiration dates, without directly interacting with the target's own infrastructure. Both techniques align with the CEH definition of passive reconnaissance, where no direct interaction with the target occurs.

Answer

Ping sweep

Answer

Nmap SYN scan

Answer

Banner grabbing with Netcat

Question 5

During a penetration test, an analyst uses a tool that sends forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This technique allows the attacker to intercept traffic. Which tool is commonly used for this purpose?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN. It supports ARP poisoning, where it sends forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This causes the target's traffic destined for the gateway to be sent to the attacker, allowing interception and modification of packets.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 6

Which TWO of the following are symmetric encryption algorithms?

Accepted Answer

AES. AES (Option C) is a symmetric block cipher standardized by NIST (FIPS 197) that uses the same secret key for both encryption and decryption, with key sizes of 128, 192, or 256 bits. 3DES (Option E) is also symmetric: it applies the DES cipher three times to each data block using a shared secret key (typically two or three 56-bit keys, giving 112 or 168 bits of effective key strength). In contrast, Diffie-Hellman (Option A) is a key-exchange protocol used to establish a shared secret over an insecure channel, not an encryption algorithm itself. RSA (Option B) and ECC (Option D) are asymmetric (public-key) cryptosystems, where encryption uses a public key and decryption uses a distinct private key, so they do not qualify as symmetric algorithms.

Answer

Diffie-Hellman

Answer

RSA

Answer

ECC

Question 7

A network administrator notices a large number of SYN packets from various spoofed source IP addresses targeting a web server. The server's connection table is full, and legitimate users cannot connect. Which type of attack is this?

Accepted Answer

SYN flood. The attack uses spoofed SYN packets to exhaust the server's connection table, preventing legitimate connections. This is a SYN flood, a common TCP-based denial-of-service attack. The other options describe different flood attacks using ICMP or UDP.

Answer

Ping flood

Answer

Smurf attack

Answer

UDP flood

Question 8

A penetration tester is authorized to test a company's wireless network. After capturing the WPA2 4-way handshake, the tester attempts to crack it offline but fails because the passphrase is long and complex. The tester then decides to create a rogue access point that mimics the corporate SSID and captures the handshake from a connecting client. Which attack is the tester performing?

Accepted Answer

Evil twin. The tester sets up a rogue access point with the same SSID as the corporate network to trick a client into connecting, thereby capturing the WPA2 handshake. This is the definition of an evil twin attack. The other options describe different wireless attacks that do not match the scenario's details.

Answer

WPS PIN brute force

Answer

Deauthentication attack

Answer

KRACK attack

Question 9

A security analyst is investigating a malware incident. The analyst observes that the malware creates a scheduled task to run a script every time the system starts, and it also modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run to execute a payload. Which two persistence techniques is the malware using? (Choose two.)

Accepted Answer

Registry Run key. The malware uses two persistence techniques: creating a scheduled task to run at startup and modifying the registry Run key to execute a payload on user logon. Both are explicitly described in the scenario. The other options are different persistence methods not mentioned.

Answer

Bootkit

Answer

Service creation

Answer

DLL hijacking

Question 10

A penetration tester needs to discover live hosts on a target subnet but must avoid sending any TCP packets, because the client's IDS only alerts on TCP-based probes. The tester decides to use Nmap with a host-discovery technique that relies on ICMP echo requests. Which Nmap option should the tester use?

Accepted Answer

nmap -sn -PE 192.168.10.0/24. ICMP echo request discovery is enabled with the -PE option in Nmap. When combined with -sn, it performs host discovery without port scanning, sending only ICMP packets. This satisfies the scenario's constraint of avoiding TCP probes that would trigger the client's IDS, while still identifying live hosts on the subnet through ICMP replies.

Answer

nmap -sn -PS 192.168.10.0/24

Answer

nmap -sn -PU 192.168.10.0/24

Answer

nmap -sn -PA 192.168.10.0/24

Question 11

A security analyst is conducting passive reconnaissance against a target organization. The analyst wants to enumerate subdomains without sending any packets directly to the target's infrastructure, relying instead on publicly available data. Which technique BEST fits this requirement?

Accepted Answer

Querying Certificate Transparency logs for the target domain. Certificate Transparency logs are publicly accessible and contain certificate details, including subdomains listed in SAN fields. Querying these logs requires no direct contact with the target's systems, making it a purely passive technique. This satisfies the analyst's need to enumerate subdomains without sending any packets to the target's infrastructure.

Answer

Running Nmap with the dns-brute script against the target's public IP range

Answer

Performing a DNS zone transfer against the target's authoritative name server

Answer

Using a subdomain brute-force tool with a wordlist against the target's DNS resolvers

Question 12

A tester finds that a Java web application stores a serialized user profile object in a cookie named 'profile'. The application deserializes this cookie on every request using ObjectInputStream without validating its contents. The tester wants to demonstrate remote code execution rather than merely causing a denial of service. Which approach best demonstrates this?

Accepted Answer

Craft a serialized payload using a gadget chain from a library present on the classpath, such as a Commons Collections chain, and submit it as the cookie value.. Exploiting Java deserialization for code execution depends on the presence of a usable gadget chain in libraries the application loads. Building a serialized payload from such a chain and delivering it through the vulnerable cookie causes the deserialization process itself to invoke methods that run attacker-supplied commands, which is the strongest possible demonstration of impact.

Answer

Send a serialized object of an arbitrary custom class that the tester writes, because any class can be deserialized remotely.

Answer

Base64-encode the original cookie value and append a comment marker to bypass any signature check.

Answer

Replace the cookie value with a long string of random bytes to trigger a deserialization exception and confirm the parsing path.

Question 13

A security analyst is using Nmap to discover live hosts on a subnet without performing a port scan. Which Nmap option should the analyst use to achieve this?

Accepted Answer

-sn. The -sn option in Nmap performs a ping scan, which is used for host discovery only. It disables port scanning and uses a combination of ICMP and TCP probes to determine if hosts are online. This is the correct choice for identifying live hosts without scanning ports. The other options either perform port scans or are deprecated.

Answer

-sP

Answer

-sU

Answer

-F

Question 14

An ethical hacker is hired to assess a hospital's network. The contract permits vulnerability discovery but explicitly forbids exploiting a flaw to access patient records. During testing, the hacker finds a SQL injection that would expose the patient database. Which action best reflects the ethical hacking principle of maintaining integrity and minimizing harm?

Accepted Answer

Document the vulnerability with a non-destructive proof of concept, such as a boolean-based test, and report it without accessing patient data.. Ethical hacking requires proving risk without causing harm or exceeding authorization. A non-destructive proof of concept, such as a boolean-based injection test or retrieving only non-sensitive metadata, demonstrates the vulnerability exists while honoring the contract's restriction on patient data. This approach protects patients, preserves the client relationship, and still gives the hospital actionable evidence for remediation.

Answer

Stop testing entirely and immediately terminate the engagement because a serious flaw was found.

Answer

Share the injection details with a public forum to pressure the hospital into patching quickly.

Answer

Exploit the injection fully and download a sample of patient records to prove the vulnerability is real.

Question 15

An ethical hacker is performing a vulnerability scan against a Windows Server 2019 host using Nessus. The scan returns a finding titled 'Microsoft Windows SMB Registry Remotely Accessible' with a CVSS base score of 5.0. The report marks the vulnerability as 'Medium' severity but does not provide a specific patch. Which of the following should the tester do NEXT to determine the actual risk and remediation?

Accepted Answer

Correlate the finding with the Microsoft Security Response Center (MSRC) advisory and verify the registry key exposure with a manual check.. A scanner finding without a specific patch requires validation against vendor advisories and manual confirmation. Correlating with MSRC advisories and checking the registry key manually establishes whether the exposure is real and what patch applies. This avoids false positives and provides precise remediation, which is essential in vulnerability analysis before any exploitation.

Answer

Run a full credential brute-force attack against SMB to see if the registry can be accessed.

Answer

Immediately exploit the SMB registry exposure using Metasploit to prove impact before reporting.

Answer

Mark the finding as a false positive because CVSS 5.0 is not critical and ignore it.

Question 16

A penetration tester is reviewing the difference between a white-box, black-box, and gray-box assessment for a client's new e-commerce platform. The client wants the most realistic simulation of an external attacker with no inside knowledge, but also wants the tester to spend time efficiently rather than performing lengthy reconnaissance. Which assessment type best matches the client's stated priorities?

Accepted Answer

Gray-box assessment. Gray-box testing supplies the tester with partial knowledge, such as a standard user account or network diagrams, which simulates an attacker who has some insider access while cutting down on time-consuming discovery. This matches the client's dual goal: realistic external-style testing and efficient use of the testing window. Full-knowledge and no-knowledge assessments each satisfy only one of those priorities.

Answer

Black-box assessment

Answer

White-box assessment

Answer

Double-blind assessment

Question 17

During a web application assessment, a tester notices that a page reflects the value of a query parameter directly into the HTML response body without encoding, and the reflected value executes script in the browser when the crafted link is opened. Which of the following most accurately describes this vulnerability?

Accepted Answer

Reflected cross-site scripting, because the injected script is returned in the immediate response to the crafted request.. The defining feature is that unencoded user input is reflected in the immediate HTTP response and executes in the browser, which is reflected cross-site scripting. Stored XSS would require persistence, DOM-based XSS would originate in client-side JavaScript, and CSRF concerns forged state-changing requests rather than script execution.

Answer

DOM-based cross-site scripting, because the payload is processed entirely within the client-side JavaScript.

Answer

Cross-site request forgery, because the crafted link causes the victim's browser to issue an unintended request.

Answer

Stored cross-site scripting, because the payload persists on the server and is served to other users.

Question 18

A tester is reviewing a web application that builds SQL queries using string concatenation and places user input directly into the query text. The development team wants to eliminate the SQL injection class of vulnerability rather than patch individual reports. Which TWO measures should the tester recommend to the team? (Choose two.)

Accepted Answer

Apply strict allowlist validation on input that is expected to have a known format, such as numeric identifiers or enumerated values.. Eliminating SQL injection at the class level requires fixing how queries are constructed. Parameterized queries bind input as data so it cannot change query syntax, and allowlist validation restricts fields with known formats. Together they address the root cause, whereas firewalls, credential storage, and verbose errors affect other concerns without removing the vulnerability.

Answer

Deploy a web application firewall rule set and rely on it as the sole control to block injection payloads.

Answer

Store database connection credentials in the application source code to simplify deployment and rotation.

Answer

Enable verbose database error messages in production so developers can debug malformed queries faster.

Question 19

During an authorized external assessment, a tester wants to determine which mail exchangers and third-party SaaS providers a target uses without alerting the target's security team. The tester already knows the primary domain. Which single command best reveals the target's MX records using a public resolver while sending no traffic to the target itself?

Accepted Answer

dig @8.8.8.8 target.com MX +noall +answer. Directing a DNS query to a public resolver such as 8.8.8.8 keeps the request off the target's systems while still returning the MX records needed to identify mail and SaaS providers. The +noall +answer flags trim the output to just the relevant records, making the result easy to parse, and the technique leaves no footprint on target-owned name servers.

Answer

dig target.com ANY @target.com

Answer

host -t MX target.com 10.0.0.53

Answer

nslookup -type=MX target.com ns1.target.com

Question 20

A security analyst is investigating a malware incident and needs to determine whether a suspicious file is malicious. The analyst has a hash of the file and wants to quickly check if it is a known malware sample without executing it. Which action should the analyst take?

Accepted Answer

Query the hash against an online malware hash repository such as MalwareBazaar or VirusTotal's hash search.. Querying the hash against an online malware hash repository is the fastest and safest way to check if a file is known malware. It avoids uploading the potentially sensitive file and provides immediate results from community-sourced threat intelligence. This method is ideal when the analyst only has a hash and needs a quick determination.

Answer

Perform static analysis by disassembling the file to look for malicious code patterns.

Answer

Upload the file to a public malware analysis service like VirusTotal and review the detection results.

Answer

Run the file in a sandbox and observe its behavior to determine if it is malicious.