CEH Practice Test 7 — 10 Questions

Question 1

A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning and DNS spoofing. It can intercept DNS requests and forge fake responses to redirect victims to a malicious IP, making it the correct tool for DNS spoofing.

Answer

Nmap

Answer

Wireshark

Answer

tcpdump

Question 2

Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?

Accepted Answer

-sS. The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.

Answer

-sT

Answer

-sU

Answer

-sA

Question 3

During a penetration test, you run `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.10` and receive responses '252 2.5.2 User <username>' for some users and '550 5.1.1 User unknown' for others. What does this indicate?

Accepted Answer

The SMTP server is revealing valid usernames via the VRFY command. The VRFY command in SMTP (RFC 821) asks the server to verify whether a mailbox exists. A response starting with '252' indicates the user is valid, while '550 5.1.1' means the user does not exist. By comparing these responses, the attacker can enumerate valid usernames on the mail server, which is exactly what the output shows.

Answer

The SMTP server is using EXPN instead of VRFY

Answer

The SMTP server is vulnerable to command injection

Answer

The SMTP server is properly configured to prevent enumeration

Question 4

A penetration tester wants to perform a ping sweep on a /24 subnet to identify live hosts. Which command would accomplish this efficiently?

Accepted Answer

nmap -sn 192.168.1.0/24. `nmap -sn` performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. This efficiently identifies live hosts on a /24 subnet without the overhead of port scanning or OS detection.

Answer

nmap -O 192.168.1.0/24

Answer

nmap -p- 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24

Question 5

A company wants to protect its network from MAC flooding attacks. Which of the following countermeasures is MOST effective?

Accepted Answer

Enable port security on switches. Enabling port security on switches directly limits the number of MAC addresses that can be learned on a switch port, preventing an attacker from flooding the CAM table with fake MAC addresses. When the configured limit is exceeded, the switch can either drop traffic, shut down the port, or send an alert, effectively stopping the MAC flooding attack at the access layer.

Answer

Use Wireshark to monitor for floods

Answer

Disable CAM table learning

Answer

Implement ARP spoofing detection

Question 6

Which of the following is a well-known attack against the MD5 hash function that allows two different inputs to produce the same hash value?

Accepted Answer

Birthday attack. The birthday attack exploits the birthday paradox in probability theory to find two different inputs that produce the same MD5 hash value (a collision) with significantly less effort than a brute-force preimage attack. For an n-bit hash, the birthday attack requires only about 2^(n/2) operations, making MD5's 128-bit output vulnerable to collisions in roughly 2^64 attempts, which is computationally feasible today.

Answer

Replay attack

Answer

Downgrade attack

Answer

Dictionary attack

Question 7

A security analyst wants to perform passive reconnaissance on a target organization without generating any traffic to the target's network. Which of the following techniques would be MOST appropriate?

Accepted Answer

Performing a WHOIS lookup. WHOIS lookup is a passive reconnaissance technique that queries public databases (e.g., whois.arin.net) for domain registration details without sending any packets to the target's network. It relies on external, publicly available data, thus generating zero traffic to the target organization's infrastructure.

Answer

Running Nmap SYN scan

Answer

Executing hping3 to probe ports

Answer

Using Netcat to connect to a service

Question 8

A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?

Accepted Answer

Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.. It targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.

Answer

Conduct a full TCP port scan of the entire network using SYN scan.

Answer

Use a ping sweep to identify live hosts, then perform a version scan on each.

Answer

Perform an ARP scan of the entire subnet and then check each host manually.

Question 9

An analyst observes repeated failed login attempts to a Windows server from an internal IP, followed by a successful login using the account 'admin' from the same IP. The analyst checks the Security log and finds Event ID 4624 with Logon Type 3. What type of attack is MOST likely occurring?

Accepted Answer

Dictionary attack on the admin account. Event ID 4624 with Logon Type 3 indicates a network logon (typically SMB or other network resource access). The sequence of repeated failed attempts followed by a successful login from the same internal IP strongly suggests a dictionary (brute-force) attack against the 'admin' account. The attacker systematically tried passwords until one succeeded, which is the hallmark of a dictionary attack.

Answer

SMB relay attack

Answer

Kerberos golden ticket attack

Answer

Pass-the-hash attack

Question 10

Which of the following is the PRIMARY purpose of banner grabbing during the reconnaissance phase?

Accepted Answer

To determine the version of a running service. Banner grabbing is a technique used to extract service banners that often include software name and version details. The primary purpose is to determine the version of a running service, as this information allows an attacker to identify known vulnerabilities specific to that version for further exploitation.

Answer

To discover open ports

Answer

To identify the operating system

Answer

To map the network topology