CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 3 — 15 Questions

Question 1

An IoT device uses the MQTT protocol without TLS. A security tester connects to the broker and subscribes to all topics using '#'. What is the tester MOST likely able to accomplish?

Accepted Answer

Eavesdrop on all MQTT communications. MQTT without encryption allows anyone to subscribe to topics. Subscribing to '#' captures all messages, leading to interception of sensitive data. This is a passive eavesdropping attack, not active manipulation like replay or injection.

Answer

Perform a denial of service on the broker

Answer

Inject malicious control commands

Answer

Replay previously captured messages

Question 2

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 3

A penetration tester executes the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. Which attack is being performed?

Accepted Answer

WPS PIN brute-force attack. Reaver is a tool used for brute-forcing WPS PINs to recover the WPA/WPA2 pre-shared key. The command specifies the interface and BSSID, indicating a WPS attack.

Answer

WEP IV attack

Answer

Evil twin attack

Answer

De-authentication attack

Question 4

A security analyst observes an SSL/TLS handshake where the client and server negotiate TLS 1.0 instead of TLS 1.2, despite the server supporting TLS 1.2. Which attack BEST describes the manipulation of the handshake to force weaker encryption?

Accepted Answer

Downgrade attack. A downgrade attack occurs when an attacker forces the client and server to negotiate a lower, less secure version of a protocol (e.g., from TLS 1.2 to TLS 1.0) to exploit vulnerabilities in the older version.

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Birthday attack

Question 5

An attacker gains access to a cloud environment and attempts to move laterally by assuming an IAM role with higher privileges. Which cloud attack vector is the attacker exploiting?

Accepted Answer

IAM misuse. IAM misuse involves exploiting misconfigured IAM roles or policies to escalate privileges. Assuming a role with higher privileges is a form of privilege escalation via IAM abuse.

Answer

SSRF attack

Answer

S3 bucket misconfiguration

Answer

Container escape

Question 6

Which cloud security assessment tool is specifically designed to audit AWS environments for misconfigurations and provides a detailed report of findings?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations. It generates a comprehensive HTML report. Pacu is an exploitation framework, not an audit tool.

Answer

Pacu

Answer

Metasploit

Answer

Nmap

Question 7

A security team finds that a web application accepts a user-supplied URL and fetches it server-side without validation. The application runs on AWS EC2 with a metadata endpoint at 169.254.169.254. Which attack is MOST likely to succeed?

Accepted Answer

Server-Side Request Forgery (SSRF). SSRF (Server-Side Request Forgery) occurs when an application fetches a user-controlled URL. By supplying the metadata endpoint, an attacker can retrieve IAM credentials, making this the most likely attack.

Answer

SQL injection

Answer

Remote file inclusion (RFI)

Answer

Cross-site scripting (XSS)

Question 8

Which of the following is a recommended countermeasure against WPA2 KRACK attacks?

Accepted Answer

Patch all clients and access points. KRACK attacks exploit vulnerabilities in the WPA2 4-way handshake key reinstallation. The primary fix is to install security patches on clients and APs that implement the IEEE 802.11 standard update. Disabling WPS does not prevent KRACK, and switching to WEP is less secure.

Answer

Enable MAC filtering

Answer

Disable WPS

Answer

Switch to WEP encryption

Question 9

Which THREE of the following are cryptanalysis attacks that target hash functions? (Choose three.)

Accepted Answer

Preimage attack. Birthday attack exploits hash collisions, preimage attack finds an input that hashes to a given output, and collision attack finds two inputs with same hash. Man-in-the-middle is not specific to hash functions, and dictionary attack is a password cracking technique, not pure cryptanalysis.

Answer

Man-in-the-middle attack

Answer

Dictionary attack

Question 10

Which TWO of the following are asymmetric encryption algorithms? (Choose two.)

Accepted Answer

ECC. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. SHA-256 is a hash function.

Answer

3DES

Answer

SHA-256

Answer

AES

Question 11

A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?

Accepted Answer

Dictionary attack on the 4-way handshake. The analyst captured the 4-way handshake and used a dictionary attack (wordlist) to recover the PSK. This is a dictionary attack, not brute force (which tries all combinations), rainbow table, or hash length extension (which is for hash-based MACs).

Answer

Hash length extension attack on the MIC

Answer

Rainbow table attack on the WPA2 handshake

Answer

Brute-force attack against the PSK

Question 12

During a cloud penetration test, a tester discovers an AWS S3 bucket that allows public 's3:PutObject' access. The tester uploads a file containing JavaScript that steals cookies. Which type of attack is this an example of?

Accepted Answer

Cross-Site Scripting (XSS) via uploaded file. Uploading malicious content to an S3 bucket with public write access enables storage of attacker-controlled files. When users access these files, a client-side attack (like XSS) can occur. This is a classic example of a storage-based attack via misconfigured S3 bucket.

Answer

Server-Side Request Forgery (SSRF)

Answer

Insecure Direct Object Reference (IDOR)

Answer

S3 bucket privilege escalation

Question 13

An IoT device uses MQTT protocol with default credentials 'admin/admin' and no TLS encryption. An attacker on the same network captures MQTT packets and extracts sensor data. Which two vulnerabilities are being exploited? (Choose the best combination)

Accepted Answer

Default credentials and cleartext communication. The use of default credentials and lack of encryption (no TLS) are the vulnerabilities. MQTT itself is not insecure when properly configured; the issues are weak authentication and cleartext communication.

Answer

Buffer overflow and command injection

Answer

Insecure firmware and hardcoded backdoor

Answer

Weak encryption and replay attack

Question 14

Which tool is specifically designed to assess the security configuration of AWS, Azure, and GCP cloud environments by scanning for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for misconfigurations across AWS, Azure, and GCP. Pacu is an AWS exploitation framework; Aircrack-ng is for wireless; Reaver is for WPS.

Answer

Pacu

Answer

Reaver

Answer

Aircrack-ng

Question 15

A security analyst notices that after a user connects to a corporate Wi-Fi network, all HTTP traffic is redirected to a fake login page that captures credentials. The analyst suspects a rogue access point. Which attack is most likely being used to force client connections to the rogue AP?

Accepted Answer

De-authentication attack followed by evil twin. De-authentication packets force clients to disconnect from the legitimate AP, after which they may automatically reconnect to a rogue AP with the same SSID. Evil twin is the fake AP, but the mechanism to disconnect clients is de-authentication.

Answer

Evil twin attack using a stronger signal

Answer

WPA2 dictionary attack on the handshake

Answer

WPS PIN brute-force attack