CEH Practice Test 9 — 10 Questions

Question 1

During a social engineering engagement, a tester calls the help desk posing as an employee from the IT department. The tester claims to be working on a critical system update and needs the employee's password to proceed. Which type of social engineering attack is being executed?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into divulging information. In this case, the tester falsely claims to be from the IT department working on a critical system update, which is a classic pretext to gain trust and obtain the employee's password. This differs from other social engineering types because it relies on a constructed identity and false narrative rather than a technical lure or direct exchange.

Answer

Quid pro quo

Answer

Baiting

Answer

Phishing

Question 2

Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?

Accepted Answer

ARP spoofing attack. The correct answer is C because the combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.

Answer

Distributed denial of service (DDoS) attack

Answer

MAC flooding attack

Answer

Ping flood attack

Question 3

Which of the following is the BEST defense against tailgating attacks in a secure facility?

Accepted Answer

Implementing a mantrap at the entrance. A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.

Answer

Hiring security guards

Answer

Reviewing keycard access logs

Answer

Installing CCTV cameras

Question 4

An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.

Answer

Pharming

Answer

Spear phishing

Answer

Vishing

Question 5

A security analyst notices unusual traffic from a smart thermostat to an external IP address. The thermostat is on a separate IoT VLAN. Which action should the analyst take to investigate and mitigate the threat?

Accepted Answer

Create a firewall rule to block traffic from the thermostat's MAC address to the external IP.. Option D is correct because creating a firewall rule to block traffic from the thermostat's MAC address to the specific external IP is a targeted, least-disruptive mitigation. It preserves the IoT VLAN's functionality for other devices while stopping the suspicious communication. This approach allows the analyst to investigate further without losing visibility into the threat, as the thermostat remains on the network for forensic analysis.

Answer

Disconnect the thermostat from the network.

Answer

Block all outbound traffic from the IoT VLAN.

Answer

Uninstall the companion app from the user's smartphone.

Question 6

Match each encryption algorithm to its type.

Question 7

Match each cloud security concept to its description.

Question 8

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Question 9

Drag and drop the steps to conduct a penetration test using the CEH methodology into the correct order.

Question 10

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.