CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 2 — 15 Questions

Question 1

A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP spoofing attack. An evil twin attack involves a rogue AP impersonating a legitimate one, but it does not typically cause ARP packets with varied IPs. ARP spoofing involves an attacker sending forged ARP replies to associate their MAC with another IP, causing traffic to be misdirected. The described behavior matches ARP spoofing, where the attacker's MAC appears with multiple IPs.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

Evil twin attack

Question 2

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

Accepted Answer

Aircrack-ng. The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Answer

Wireshark

Answer

Kismet

Answer

Reaver

Question 3

A cloud security engineer notices that an S3 bucket named 'company-backup' is configured to allow 's3:GetObject' access to 'Principal: *'. Which attack is this misconfiguration MOST likely to enable?

Accepted Answer

Unauthorized data access and exfiltration. When an S3 bucket allows GetObject access to any principal (public), anyone can list and download objects, leading to data exposure. This is a classic unauthorized data access scenario, not privileged escalation or DoS.

Answer

Denial of service by deleting objects

Answer

SSRF attack to internal metadata

Answer

Privilege escalation via IAM role

Question 4

An IoT device uses the MQTT protocol without TLS. A security tester connects to the broker and subscribes to all topics using '#'. What is the tester MOST likely able to accomplish?

Accepted Answer

Eavesdrop on all MQTT communications. MQTT without encryption allows anyone to subscribe to topics. Subscribing to '#' captures all messages, leading to interception of sensitive data. This is a passive eavesdropping attack, not active manipulation like replay or injection.

Answer

Perform a denial of service on the broker

Answer

Inject malicious control commands

Answer

Replay previously captured messages

Question 5

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 6

A penetration tester executes the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. Which attack is being performed?

Accepted Answer

WPS PIN brute-force attack. Reaver is a tool used for brute-forcing WPS PINs to recover the WPA/WPA2 pre-shared key. The command specifies the interface and BSSID, indicating a WPS attack.

Answer

WEP IV attack

Answer

Evil twin attack

Answer

De-authentication attack

Question 7

A security analyst observes an SSL/TLS handshake where the client and server negotiate TLS 1.0 instead of TLS 1.2, despite the server supporting TLS 1.2. Which attack BEST describes the manipulation of the handshake to force weaker encryption?

Accepted Answer

Downgrade attack. A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Birthday attack

Question 8

An attacker gains access to a cloud environment and attempts to move laterally by assuming an IAM role with higher privileges. Which cloud attack vector is the attacker exploiting?

Accepted Answer

IAM misuse. IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

Answer

SSRF attack

Answer

S3 bucket misconfiguration

Answer

Container escape

Question 9

Which cloud security assessment tool is specifically designed to audit AWS environments for misconfigurations and provides a detailed report of findings?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations. It generates a comprehensive HTML report. Pacu is an exploitation framework, not an audit tool.

Answer

Pacu

Answer

Metasploit

Answer

Nmap

Question 10

A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?

Accepted Answer

Server-Side Request Forgery (SSRF). SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.

Answer

SQL injection

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 11

Which of the following is a recommended countermeasure against WPA2 KRACK attacks?

Accepted Answer

Patch all clients and access points. KRACK attacks exploit vulnerabilities in the WPA2 4-way handshake key reinstallation. The primary fix is to install security patches on clients and APs that implement the IEEE 802.11 standard update. Disabling WPS does not prevent KRACK, and switching to WEP is less secure.

Answer

Enable MAC filtering

Answer

Disable WPS

Answer

Switch to WEP encryption

Question 12

A forensic analyst examines a firmware image extracted from an IoT thermostat and finds hardcoded credentials for a cloud backend. Which phase of the IoT attack lifecycle does this represent?

Accepted Answer

Exploitation. Hardcoded credentials in firmware represent a vulnerability in the device itself. This is part of the exploitation phase, where attackers use discovered credentials to gain unauthorized access to backend systems.

Answer

Weaponization

Answer

Installation

Answer

Reconnaissance

Question 13

Which TWO of the following are valid attacks against wireless networks? (Choose two.)

Accepted Answer

De-authentication attack. Evil twin involves a rogue AP, and de-authentication disconnects clients. Dictionary attacks are for cracking, not network attacks. SSRF is cloud-based. Replay attacks are generic but not wireless-specific. The question asks for attacks against wireless networks, so evil twin and de-authentication are correct.

Answer

SSRF

Answer

Dictionary attack

Answer

Replay attack

Question 14

Which THREE of the following are cryptanalysis attacks that target hash functions? (Choose three.)

Accepted Answer

Preimage attack. Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.

Answer

Man-in-the-middle attack

Answer

Dictionary attack

Question 15

Which TWO of the following are asymmetric encryption algorithms? (Choose two.)

Accepted Answer

ECC. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. SHA-256 is a hash function.

Answer

3DES

Answer

SHA-256

Answer

AES