CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 3 — 15 Questions

Question 1

A security analyst captures WPA2 handshake packets using airodump-ng and then runs aircrack-ng with a wordlist. After several minutes, aircrack-ng reports 'KEY FOUND!' followed by a hex string. Which attack was successfully performed?

Accepted Answer

Dictionary attack on the 4-way handshake. The analyst captured the 4-way handshake and used a dictionary attack (wordlist) to recover the PSK. This is a dictionary attack, not brute force (which tries all combinations), rainbow table, or hash length extension (which is for hash-based MACs).

Answer

Hash length extension attack on the MIC

Answer

Rainbow table attack on the WPA2 handshake

Answer

Brute-force attack against the PSK

Question 2

During a cloud penetration test, a tester discovers an AWS S3 bucket that allows public 's3:PutObject' access. The tester uploads a file containing JavaScript that steals cookies. Which type of attack is this an example of?

Accepted Answer

Cross-Site Scripting (XSS) via uploaded file. Uploading malicious content to an S3 bucket with public write access enables storage of attacker-controlled files. When users access these files, a client-side attack (like XSS) can occur. This is a classic example of a storage-based attack via misconfigured S3 bucket.

Answer

Server-Side Request Forgery (SSRF)

Answer

Insecure Direct Object Reference (IDOR)

Answer

S3 bucket privilege escalation

Question 3

An IoT device uses MQTT protocol with default credentials 'admin/admin' and no TLS encryption. An attacker on the same network captures MQTT packets and extracts sensor data. Which two vulnerabilities are being exploited? (Choose the best combination)

Accepted Answer

Default credentials and cleartext communication. The use of default credentials and lack of encryption (no TLS) are the vulnerabilities. MQTT itself is not insecure when properly configured; the issues are weak authentication and cleartext communication.

Answer

Buffer overflow and command injection

Answer

Insecure firmware and hardcoded backdoor

Answer

Weak encryption and replay attack

Question 4

Which tool is specifically designed to assess the security configuration of AWS, Azure, and GCP cloud environments by scanning for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for misconfigurations across AWS, Azure, and GCP. Pacu is an AWS exploitation framework; Aircrack-ng is for wireless; Reaver is for WPS.

Answer

Pacu

Answer

Reaver

Answer

Aircrack-ng

Question 5

A security analyst notices that after a user connects to a corporate Wi-Fi network, all HTTP traffic is redirected to a fake login page that captures credentials. The analyst suspects a rogue access point. Which attack is most likely being used to force client connections to the rogue AP?

Accepted Answer

De-authentication attack followed by evil twin. De-authentication packets force clients to disconnect from the legitimate AP, after which they may automatically reconnect to a rogue AP with the same SSID. Evil twin is the fake AP, but the mechanism to disconnect clients is de-authentication.

Answer

Evil twin attack using a stronger signal

Answer

WPA2 dictionary attack on the handshake

Answer

WPS PIN brute-force attack

Question 6

In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?

Accepted Answer

Server-Side Request Forgery (SSRF) targeting cloud metadata. SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.

Answer

XML External Entity (XXE) injection

Answer

Insecure Direct Object Reference (IDOR) on metadata

Answer

Cross-Site Request Forgery (CSRF) targeting cloud APIs

Question 7

Which wireless security standard introduced in 2018 uses Simultaneous Authentication of Equals (SAE) to replace the pre-shared key exchange in WPA2, providing forward secrecy and resistance to offline dictionary attacks?

Accepted Answer

WPA3. WPA3 uses SAE (Dragonfly handshake) to provide forward secrecy and protect against offline dictionary attacks. WPA2 used PSK which is vulnerable to dictionary attacks. WEP and 802.1X are older or different.

Answer

802.1X/EAP

Answer

WEP

Answer

WPA2

Question 8

A penetration tester uses the tool 'Pacu' during an AWS security assessment. Which phase of testing is Pacu most commonly associated with?

Accepted Answer

Exploitation and post-exploitation. Pacu is an exploitation framework for AWS, used after initial access to escalate privileges, pivot, and maintain access. It is not typically used for initial reconnaissance (Nmap, ScoutSuite) or reporting.

Answer

Reporting and documentation

Answer

Vulnerability scanning

Answer

Reconnaissance

Question 9

A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?

Accepted Answer

Man-in-the-middle using a rogue certificate. A certificate from an untrusted root CA suggests a rogue or misissued certificate, possibly from a malicious CA or a man-in-the-middle attack using a proxy with its own CA certificate not trusted by the client.

Answer

Birthday attack on the certificate signature

Answer

Downgrade attack to SSLv3

Answer

Replay attack on the TLS handshake

Question 10

In an IoT environment, a researcher finds that the firmware of a smart lock can be extracted via UART and reversed to reveal hardcoded encryption keys. Which type of vulnerability is this?

Accepted Answer

Hardcoded backdoor credentials. Hardcoded keys in firmware are a classic example of a backdoor or hardcoded credential vulnerability, allowing attackers to decrypt traffic or authenticate without proper authorization.

Answer

Insecure firmware update mechanism

Answer

Insufficient entropy in random number generation

Answer

Use of deprecated cryptographic algorithm

Question 11

Which asymmetric encryption algorithm is based on the algebraic structure of elliptic curves over finite fields and provides equivalent security to RSA with smaller key sizes?

Accepted Answer

Elliptic Curve Cryptography (ECC). ECC (Elliptic Curve Cryptography) offers strong security with smaller keys compared to RSA. Diffie-Hellman is a key exchange protocol, 3DES is symmetric, and SHA-256 is a hash function.

Answer

SHA-256

Answer

Diffie-Hellman (DH)

Answer

Triple DES (3DES)

Question 12

During a cloud security audit, a tool reports that an AWS IAM role has a policy allowing 'ec2:RunInstances' with a condition 'aws:SourceIp': '0.0.0.0/0'. What is the most immediate risk?

Accepted Answer

An attacker can launch expensive EC2 instances from any IP. The condition allows all IP addresses (0.0.0.0/0) to launch EC2 instances, meaning any user who can assume this role can create instances from anywhere, potentially for cryptocurrency mining or other malicious purposes.

Answer

An attacker can delete all EC2 instances

Answer

An attacker can modify VPC security groups

Answer

An attacker can read data from any S3 bucket

Question 13

Which TWO of the following are valid cryptanalytic attacks?

Accepted Answer

Replay attack. Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces weaker protocol (not cryptanalytic per se, but relevant). SQL injection and XSS are web application attacks, not cryptanalytic.

Answer

SQL injection

Answer

Downgrade attack

Answer

Cross-site scripting (XSS)

Question 14

Which THREE of the following are common attack vectors against IoT devices?

Accepted Answer

Insecure protocols (e.g., MQTT, CoAP without encryption). Default credentials, insecure protocols (e.g., MQTT without TLS), and firmware reversing (to find hardcoded secrets) are common IoT attack vectors. TLS stripping is a network attack, and container escape is a cloud/container attack.

Answer

Container escape

Answer

TLS stripping attack

Question 15

Which TWO of the following correctly describe aspects of the shared responsibility model in cloud computing?

Accepted Answer

The customer is responsible for securing data stored in the cloud. The customer is responsible for securing data and application configurations (security IN the cloud). The provider is responsible for the physical infrastructure (security OF the cloud). Option B is incorrect because customers are responsible for OS patching in IaaS. Option E is wrong because providers do not manage customer-applied encryption.

Answer

The cloud provider is responsible for managing customer application encryption keys

Answer

The customer is responsible for network firewall configuration in PaaS

Answer

The cloud provider is responsible for patching the guest operating system in IaaS