CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 2 — 15 Questions

Question 1

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement client authentication and enable TLS encryption. MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 2

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Answer

RC4

Answer

3DES

Answer

RSA

Question 3

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)

Question 4

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

Answer

Aircrack-ng

Answer

Nmap

Answer

Wireshark

Question 5

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

Accepted Answer

Run a dictionary attack using aircrack-ng with a wordlist. After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

Answer

Use aircrack-ng to crack the WEP key from the handshake

Answer

Brute-force the WPS PIN using Reaver

Answer

De-authenticate the client from the network again to capture another handshake

Question 6

A security analyst discovers that a containerized application running in a cloud environment can access the host's file system by mounting /var/run/docker.sock inside the container. Which type of attack does this configuration enable?

Accepted Answer

Container escape to the host. Mounting the Docker socket inside a container allows the container to communicate with the Docker daemon on the host, potentially allowing the attacker to create new containers, escape the container, and execute commands on the host.

Answer

Server-Side Request Forgery (SSRF)

Answer

Privilege escalation within the container only

Answer

Denial-of-Service (DoS) attack against the container runtime

Question 7

Which of the following is the PRIMARY reason that MD5 is no longer recommended for use in digital signatures?

Accepted Answer

MD5 is vulnerable to collision attacks. MD5 is vulnerable to collision attacks, where two different inputs produce the same hash. This undermines the integrity and non-repudiation properties required for digital signatures.

Answer

MD5 is a symmetric algorithm, not a hash function

Answer

MD5 is computationally too slow for large data

Answer

MD5 produces a 128-bit hash, which is too short for modern security

Question 8

An attacker intercepts a TLS-encrypted session and attempts to force the client and server to use a weaker cipher suite. Which type of attack is being performed?

Accepted Answer

Downgrade attack. A downgrade attack tricks the communicating parties into negotiating a less secure version of TLS or a weaker cipher suite, making it easier for the attacker to break the encryption.

Answer

Man-in-the-middle (MITM) attack

Answer

Birthday attack

Answer

Replay attack

Question 9

A penetration tester uses the tool 'Pacu' during an assessment. Which of the following actions is Pacu designed to perform?

Accepted Answer

Automate penetration testing tasks in AWS environments. Pacu is an open-source AWS exploitation framework that allows security professionals to test the security of AWS environments. It can perform various attacks, such as IAM privilege escalation, S3 bucket enumeration, and metadata service exploitation.

Answer

Exploit vulnerabilities in Azure cloud infrastructure

Answer

Perform network scanning and service enumeration

Answer

Crack WPA2 handshakes using dictionary attacks

Question 10

Which TWO of the following are common attack vectors against IoT devices? (Select TWO.)

Accepted Answer

Default credentials left unchanged. IoT devices often have default credentials that are not changed, and they use insecure protocols like MQTT without encryption. These are common entry points for attackers.

Answer

Regular firmware updates

Answer

Use of strong encryption protocols

Answer

Use of certificate-based authentication

Question 11

Which THREE of the following are effective countermeasures against evil twin attacks in wireless networks? (Select THREE.)

Accepted Answer

Implementing client-side certificate validation for network authentication. Evil twin attacks involve a rogue AP impersonating a legitimate one. Countermeasures include using WPA3-Enterprise with 802.1X for mutual authentication, implementing client-side certificate validation, and using VPNs to encrypt traffic even over rogue APs.

Answer

Enabling MAC address filtering on the AP

Answer

Disabling SSID broadcast on the legitimate AP

Question 12

Which TWO of the following are symmetric encryption algorithms? (Select TWO.)

Accepted Answer

AES. AES and 3DES are both symmetric block ciphers. RSA and ECC are asymmetric algorithms, and SHA-256 is a hash function.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 13

A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP spoofing attack. An evil twin attack involves a rogue AP impersonating a legitimate one, but it does not typically cause ARP packets with varied IPs. ARP spoofing involves an attacker sending forged ARP replies to associate their MAC with another IP, causing traffic to be misdirected. The described behavior matches ARP spoofing, where the attacker's MAC appears with multiple IPs.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

Evil twin attack

Question 14

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

Accepted Answer

Aircrack-ng. The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Answer

Wireshark

Answer

Kismet

Answer

Reaver

Question 15

A cloud security engineer notices that an S3 bucket named 'company-backup' is configured to allow 's3:GetObject' access to 'Principal: *'. Which attack is this misconfiguration MOST likely to enable?

Accepted Answer

Unauthorized data access and exfiltration. When an S3 bucket allows GetObject access to any principal (public), anyone can list and download objects, leading to data exposure. This is a classic unauthorized data access scenario, not privileged escalation or DoS.

Answer

Denial of service by deleting objects

Answer

SSRF attack to internal metadata

Answer

Privilege escalation via IAM role