CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography — All Questions With Answers

Question 1

A forensic analyst examines a firmware image extracted from an IoT thermostat and finds hardcoded credentials for a cloud backend. Which phase of the IoT attack lifecycle does this represent?

Accepted Answer

Reconnaissance. Finding hardcoded credentials in firmware is an act of information gathering about the target device and its backend. This corresponds to the Reconnaissance phase of the IoT attack lifecycle, where attackers collect data to identify vulnerabilities. The exploitation phase would involve using the credentials to gain access, not just discovering them.

Answer

Weaponization

Answer

Installation

Answer

Exploitation

Question 2

Which TWO of the following are valid attacks against wireless networks? (Choose two.)

Accepted Answer

De-authentication attack. Evil twin involves a rogue AP, and de-authentication disconnects clients by targeting 802.11 management frames. SSRF is a web application vulnerability, not a wireless network attack. Dictionary attacks are a method for cracking passwords or keys, which can be used against wireless networks (e.g., WPA/WPA2 pre-shared keys) but are a general technique rather than a specific wireless network attack type. Replay attacks are also a generic technique that can be applied in wireless contexts (e.g., WEP cracking) but are not exclusively wireless-specific. The question asks for specific attacks against wireless networks, making evil twin and de-authentication the most appropriate choices.

Answer

SSRF

Answer

Dictionary attack

Answer

Replay attack

Question 3

A security analyst notices that after a user connects to a corporate Wi-Fi network, all HTTP traffic is redirected to a fake login page that captures credentials. The analyst suspects a rogue access point. Which attack is most likely being used to force client connections to the rogue AP?

Accepted Answer

De-authentication attack followed by evil twin. A de-authentication attack followed by an evil twin is the most likely scenario because the attacker must first forcibly disconnect clients from the legitimate AP before they will associate with the rogue AP. The de-auth frames (802.11 management frames, often spoofed with the legitimate AP's BSSID) cause the client to drop its connection, and the evil twin — broadcasting the same SSID with a stronger signal — then captures the reconnection attempt and serves the fake login page. This combination explains both the forced disconnection and the credential-harvesting captive portal behavior described.

Answer

Evil twin attack using a stronger signal

Answer

WPA2 dictionary attack on the handshake

Answer

WPS PIN brute-force attack

Question 4

Which TWO of the following are valid cryptanalytic attacks?

Accepted Answer

Replay attack. Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces a system to use a weaker cryptographic protocol or cipher suite, which is a form of cryptanalytic attack. SQL injection and XSS are web application attacks, not cryptanalytic.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 5

An analyst notices that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is the MOST effective mitigation against SSRF attacks in a cloud environment?

Accepted Answer

Block outbound traffic to internal IP ranges except through a configured forward proxy. Restricting the application from making requests to internal IP ranges (e.g., 169.254.169.254, a common address for cloud metadata services) is a key defense against SSRF.

Answer

Implement strict input validation on all user-supplied URLs

Answer

Disable the use of external URLs in application features

Answer

Use a web application firewall (WAF) with SSRF signatures

Question 6

An organization is using a cloud IAM policy that allows all actions on all resources. Which TWO security issues are MOST directly related to this configuration? (Choose two.)

Accepted Answer

Excessive privileges. A permissive IAM policy directly grants excessive privileges, which can be exploited to access and expose sensitive data from various cloud resources, including cloud storage buckets.

Answer

Vulnerable software libraries

Answer

Weak encryption algorithms

Answer

Insecure MQTT configuration

Question 7

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA is an asymmetric algorithm using a public/private key pair. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 8

During a cloud penetration test, a tester discovers that an AWS IAM role has the following policy: `{"Effect":"Allow","Action":"*","Resource":"*"}`. This policy is attached to an EC2 instance. Which of the following attacks is the tester MOST likely to perform next?

Accepted Answer

SSRF attack to access the instance metadata service and obtain the IAM credentials. The IAM policy grants full administrative access to the AWS account. To leverage this, the tester must first obtain the temporary credentials associated with this role. This is typically done by exploiting a Server-Side Request Forgery (SSRF) vulnerability in an application running on the EC2 instance to query the Instance Metadata Service (IMDS) at `http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name`. Once the credentials are obtained, the tester can then enumerate and abuse the permissions, such as creating users, accessing data, or escalating privileges further.

Answer

Perform a dictionary attack against the root user password

Answer

Use Pacu to enumerate S3 buckets

Answer

Exploit a container escape vulnerability in Docker

Question 9

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that uses a pair of keys (public and private) for encryption and digital signatures, making it an asymmetric algorithm. Unlike symmetric ciphers, RSA relies on the mathematical difficulty of factoring large prime numbers to secure communications.

Answer

3DES

Answer

SHA-256

Answer

AES

Question 10

During a cloud penetration test, a tester discovers an S3 bucket that allows public listing and write access. Which of the following is the MOST likely misconfiguration?

Accepted Answer

IAM roles attached to the bucket allow anonymous access. That IAM roles attached to the bucket allow anonymous access. This is a common misconfiguration where an IAM role's trust policy permits any user to assume the role, granting them the permissions of that role, which could include listing and writing to the bucket. Option B is incorrect because s3:GetObject and s3:PutObject do not allow listing the bucket; s3:ListBucket is required for listing.

Answer

The bucket is in a different region than the EC2 instance

Answer

The bucket policy grants 's3:GetObject' and 's3:PutObject' to 'Principal': *

Answer

Server-side encryption is disabled

Question 11

Which THREE of the following attacks target cryptographic weaknesses?

Accepted Answer

Downgrade attack. A downgrade attack is correct because it targets a cryptographic weakness by forcing two parties to negotiate a weaker protocol, cipher suite, or key length (e.g., SSL 3.0 instead of TLS 1.2, or export-grade ciphers) that can then be broken. The birthday attack is correct because it exploits a mathematical weakness in hash functions: by the birthday paradox, collisions can be found in roughly 2^(n/2) attempts rather than 2^n, undermining collision resistance of hashes like MD5 or SHA-1. Replay attack is not marked correct because it abuses valid captured authentication traffic rather than breaking the cryptography itself; it is typically mitigated with nonces or timestamps. Cross-site scripting and SQL injection are not marked correct because they are injection flaws targeting web application input handling and database queries, not cryptographic algorithms or protocols.

Answer

Replay attack

Answer

Cross-site scripting

Answer

SQL injection

Question 12

A penetration tester is conducting a wireless assessment against a corporate network that uses WPA3-Enterprise with 192-bit security mode. The tester observes that the AP advertises the RSN with AKM suite 00-0F-AC:12. Which of the following attacks is MOST likely to succeed against this configuration?

Accepted Answer

Rogue RADIUS server attack to capture EAP-MSCHAPv2 challenge-response. WPA3-Enterprise with 192-bit mode enhances encryption but does not automatically prevent attacks against weak EAP methods. If EAP-MSCHAPv2 is enabled, a rogue RADIUS server can capture the challenge-response and crack it offline. The other attacks target different protocols or are mitigated by the 192-bit security mode's cryptographic improvements.

Answer

Dragonblood downgrade attack forcing the AP to use WPA2-Personal

Answer

Evil twin attack capturing EAP-TLS certificate exchange for offline cracking

Answer

KRACK key reinstallation attack against the 4-way handshake

Question 13

A security researcher is assessing an IoT deployment that uses CoAP (Constrained Application Protocol) for device management. The researcher observes that the CoAP server supports the Block-Wise transfer option and uses DTLS for security. Which two of the following attacks are MOST relevant to this CoAP implementation? (Choose two.)

Accepted Answer

DTLS replay attack by capturing and retransmitting handshake messages. DTLS replay attacks and DTLS cookie exchange bypass are both relevant because they target the DTLS layer that secures CoAP. The cookie exchange is a DoS mitigation that can be bypassed if not implemented correctly, and replay attacks can occur if anti-replay mechanisms are weak. The other options are either not attacks or are mitigated by DTLS.

Answer

CoAP resource discovery enumeration using the /.well-known/core resource

Answer

CoAP observe option hijacking to intercept notifications

Answer

CoAP amplification attack using the Block-Wise option to cause resource exhaustion

Question 14

A cloud security engineer is configuring a new AWS S3 bucket to store sensitive financial data. The engineer wants to ensure that the data is encrypted at rest using a key that is managed by AWS and automatically rotated annually. Which of the following should the engineer use?

Accepted Answer

SSE-KMS with an AWS managed key. SSE-KMS with an AWS managed key provides encryption at rest and automatically rotates the key every year. AWS managed keys are designed for ease of use and meet compliance requirements for key rotation. The other options either do not support automatic rotation or require manual key management.

Answer

Client-side encryption with a KMS CMK

Answer

SSE-S3 with default encryption

Answer

SSE-C with a customer-provided key

Question 15

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

Accepted Answer

WEP key recovery using aircrack-ng. WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

Answer

WPS PIN brute-force attack

Answer

Evil twin AP deployment

Answer

WPA handshake capture

Question 16

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Accepted Answer

Brute-force the WPS PIN to recover the Wi-Fi passphrase. Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

Answer

Perform a de-authentication attack on the target AP

Answer

Capture the 4-way handshake for WPA cracking

Answer

Scan for nearby access points and their BSSIDs

Question 17

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

Accepted Answer

The customer is responsible for configuring access controls and permissions. Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

Answer

AWS is responsible for physical security of data centers

Answer

The customer is responsible for patching the S3 service

Answer

AWS is responsible for network infrastructure; the customer for data classification

Question 18

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Accepted Answer

Implement client authentication and enable TLS encryption. The vulnerability is that the MQTT broker accepts connections from anyone (no authentication) and transmits data in cleartext (no encryption), allowing an attacker to subscribe to all topics. Implementing client authentication (username/password or client certificates) prevents unauthorized subscriptions, while enabling TLS encrypts the payload and credentials in transit. Together these directly close the two gaps that let the attacker eavesdrop.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 19

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Answer

RC4

Answer

3DES

Answer

RSA

Question 20

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The log shows a GET request with a 'url' parameter pointing to 'http://169.254.169.254/latest/meta-data/', which is the AWS Instance Metadata Service (IMDS) endpoint. An attacker is attempting to trick the server into making an HTTP request to this internal address on their behalf, a classic Server-Side Request Forgery (SSRF) attack. By accessing the metadata service, the attacker could retrieve sensitive information such as IAM credentials, instance identity documents, or user data. The presence of the 'url' parameter strongly indicates the application is designed to fetch remote resources, and the attacker is abusing that functionality to reach internal-only services.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)

CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography — All Questions With Answers

A forensic analyst examines a firmware image extracted from an IoT thermostat and finds hardcoded credentials for a cloud backend. Which phase of the IoT attack lifecycle does this represent?

Which TWO of the following are valid attacks against wireless networks? (Choose two.)

A security analyst notices that after a user connects to a corporate Wi-Fi network, all HTTP traffic is redirected to a fake login page that captures credentials. The analyst suspects a rogue access point. Which attack is most likely being used to force client connections to the rogue AP?

Which TWO of the following are valid cryptanalytic attacks?

An analyst notices that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is the MOST effective mitigation against SSRF attacks in a cloud environment?

An organization is using a cloud IAM policy that allows all actions on all resources. Which TWO security issues are MOST directly related to this configuration? (Choose two.)

Which of the following cryptographic algorithms is classified as asymmetric?

During a cloud penetration test, a tester discovers that an AWS IAM role has the following policy: `{"Effect":"Allow","Action":"*","Resource":"*"}`. This policy is attached to an EC2 instance. Which of the following attacks is the tester MOST likely to perform next?

Which of the following cryptographic algorithms is classified as asymmetric?

During a cloud penetration test, a tester discovers an S3 bucket that allows public listing and write access. Which of the following is the MOST likely misconfiguration?

Which THREE of the following attacks target cryptographic weaknesses?

A cloud security engineer is configuring a new AWS S3 bucket to store sensitive financial data. The engineer wants to ensure that the data is encrypted at rest using a key that is managed by AWS and automatically rotated annually. Which of the following should the engineer use?

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

A security analyst discovers that a containerized application running in a cloud environment can access the host's file system by mounting /var/run/docker.sock inside the container. Which type of attack does this configuration enable?

Which of the following is the PRIMARY reason that MD5 is no longer recommended for use in digital signatures?

An attacker intercepts a TLS-encrypted session and attempts to force the client and server to use a weaker cipher suite. Which type of attack is being performed?

A penetration tester uses the tool 'Pacu' during an assessment. Which of the following actions is Pacu designed to perform?

Which TWO of the following are common attack vectors against IoT devices? (Select TWO.)

Which THREE of the following are effective countermeasures against evil twin attacks in wireless networks? (Select THREE.)

Which TWO of the following are symmetric encryption algorithms? (Select TWO.)

A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

A cloud security engineer notices that an S3 bucket named 'company-backup' is configured to allow 's3:GetObject' access to 'Principal: *'. Which attack is this misconfiguration MOST likely to enable?

An IoT device uses the MQTT protocol without TLS. A security tester connects to the broker and subscribes to all topics using '#'. What is the tester MOST likely able to accomplish?

Which of the following cryptographic algorithms is classified as asymmetric?

A penetration tester executes the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. Which attack is being performed?

A security analyst observes an SSL/TLS handshake where the client and server negotiate TLS 1.0 instead of TLS 1.2, despite the server supporting TLS 1.2. Which attack BEST describes the manipulation of the handshake to force weaker encryption?

An attacker gains access to a cloud environment and attempts to move laterally by assuming an IAM role with higher privileges. Which cloud attack vector is the attacker exploiting?

Which cloud security assessment tool is specifically designed to audit AWS environments for misconfigurations and provides a detailed report of findings?

A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?

Which of the following is a recommended countermeasure against WPA2 KRACK attacks?

Which THREE of the following are cryptanalysis attacks that target hash functions? (Choose three.)

Which TWO of the following are asymmetric encryption algorithms? (Choose two.)

A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?

During a cloud penetration test, a tester discovers an AWS S3 bucket that allows public 's3:PutObject' access. The tester uploads a file containing JavaScript that steals cookies. Which type of attack is this an example of?

An IoT device uses MQTT protocol with default credentials 'admin/admin' and no TLS encryption. An attacker on the same network captures MQTT packets and extracts sensor data. Which two vulnerabilities are being exploited? (Choose the best combination)

Which tool is specifically designed to assess the security configuration of AWS, Azure, and GCP cloud environments by scanning for misconfigurations in services like S3, IAM, and EC2?

In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?

Which wireless security standard introduced in 2018 uses Simultaneous Authentication of Equals (SAE) to replace the pre-shared key exchange in WPA2, providing forward secrecy and resistance to offline dictionary attacks?

A penetration tester uses the tool 'Pacu' during an AWS security assessment. Which phase of testing is Pacu most commonly associated with?

A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?

In an IoT environment, a researcher finds that the firmware of a smart lock can be extracted via UART and reversed to reveal hardcoded encryption keys. Which type of vulnerability is this?

Which asymmetric encryption algorithm is based on the algebraic structure of elliptic curves over finite fields and provides equivalent security to RSA with smaller key sizes?

During a cloud security audit, a tool reports that an AWS IAM role has a policy allowing 'ec2:RunInstances' with a condition 'aws:SourceIp': '0.0.0.0/0'. What is the most immediate risk?

Which THREE of the following are common attack vectors against IoT devices?

Which TWO of the following correctly describe aspects of the shared responsibility model in cloud computing?

A security analyst captures a large number of initialization vectors (IVs) on a WEP-protected network. Which tool is most commonly used to crack the WEP key using IVs?

What is the primary purpose of the 4-way handshake in WPA/WPA2-Personal?

During a penetration test, a tester captures the WPA2 4-way handshake with airodump-ng and then uses aircrack-ng with a wordlist. However, the PSK is not found. Which of the following is the MOST likely reason?

An attacker sets up a rogue access point with the same SSID as a legitimate corporate network and broadcasts a stronger signal. Clients connect to the rogue AP. What type of attack is this?

In the cloud shared responsibility model, which of the following is typically the responsibility of the customer when using AWS EC2 (IaaS)?

A security team discovers that an S3 bucket configured for static website hosting is exposing sensitive documents. The bucket policy allows public read access. Which AWS misconfiguration is MOST likely present?

Which cloud security assessment tool is specifically designed to audit AWS environments against best practices and CIS benchmarks?

An IoT device uses the MQTT protocol without TLS. An attacker on the same network subscribes to all topics and captures messages. What is the MOST significant security risk?

A penetration tester performs a container escape by exploiting a misconfigured capability and mounts the host filesystem. Which cloud service model is MOST directly affected?

Which cryptographic algorithm is vulnerable to a birthday attack on its hash output size of 128 bits, reducing the effective security to 64 bits against collision resistance?

In PKI, what is the primary role of a Certificate Authority (CA)?

An analyst sees the following in a log: Client sends a request to https://victim.com/api?url=http://169.254.169.254/latest/meta-data/. This is MOST indicative of which attack?

Which TWO of the following are common defense measures against wireless de-authentication attacks? (Select 2)

Which THREE of the following are valid methods for exploiting cloud misconfigurations? (Select 3)

Which TWO of the following are examples of asymmetric cryptography? (Select 2)

A security analyst captures a WPA2 4-way handshake using airodump-ng. To crack the PSK, which tool would they MOST likely use next?

During a cloud penetration test, you discover an S3 bucket that allows listing objects. You find a file named 'config.json' that contains an IAM access key and secret key. Which of the following is the BEST next step?

Which of the following attacks is characterized by an attacker placing a fake wireless access point with the same SSID as a legitimate network to capture client credentials?

In the shared responsibility model for cloud computing, which of the following is typically the responsibility of the customer?

A security analyst observes that a server running an IoT device management platform is sending MQTT traffic to an unexpected IP address. The analyst also notes that the device's firmware contains hardcoded credentials. Which attack vector is MOST likely being exploited?

Which of the following is a symmetric encryption algorithm that uses a block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits?

A penetration tester uses the following command to attack a WPS-enabled AP: 'reaver -i mon0 -b 00:11:22:33:44:55 -vv'. What is the primary goal of this attack?

A company wants to ensure that data in transit between its IoT devices and the cloud server is encrypted. Which protocol combination is BEST suited for this purpose?

Which of the following is a hashing algorithm that produces a 160-bit (20-byte) hash value?

A security team discovers that an attacker has been intercepting and modifying traffic between a client and server by impersonating both endpoints. Which type of cryptographic attack is this?

A security analyst runs the following command: 'wget http://example.com/bucket?list-type=2' and receives a listing of objects. Which cloud misconfiguration is this MOST likely exploiting?

During a cloud penetration test, a tester discovers that an AWS IAM role has the following policy: `{"Effect":"Allow","Action":"","Resource":""}`. This policy is attached to an EC2 instance. Which of the following attacks is the tester MOST likely to perform next?