CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 4 — 15 Questions

Question 1

In a cloud environment, an attacker exploits a vulnerability in a web application to make the server send requests to internal metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). This yields IAM temporary credentials. Which attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server-Side Request Forgery (SSRF) targeting cloud metadata. SSRF occurs when an application fetches user-controlled URLs without proper validation. The attacker used it to access cloud metadata endpoints (like AWS IMDS) to retrieve temporary credentials.

Answer

XML External Entity (XXE) injection

Answer

Insecure Direct Object Reference (IDOR) on metadata

Answer

Cross-Site Request Forgery (CSRF) targeting cloud APIs

Question 2

Which wireless security standard introduced in 2018 uses Simultaneous Authentication of Equals (SAE) to replace the pre-shared key exchange in WPA2, providing forward secrecy and resistance to offline dictionary attacks?

Accepted Answer

WPA3. WPA3 uses SAE (Dragonfly handshake) to provide forward secrecy and protect against offline dictionary attacks. WPA2 used PSK which is vulnerable to dictionary attacks. WEP and 802.1X are older or different.

Answer

802.1X/EAP

Answer

WEP

Answer

WPA2

Question 3

A penetration tester uses the tool 'Pacu' during an AWS security assessment. Which phase of testing is Pacu most commonly associated with?

Accepted Answer

Exploitation and post-exploitation. Pacu is an exploitation framework for AWS, used after initial access to escalate privileges, pivot, and maintain access. It is not typically used for initial reconnaissance (Nmap, ScoutSuite) or reporting.

Answer

Reporting and documentation

Answer

Vulnerability scanning

Answer

Reconnaissance

Question 4

A security engineer observes the following log event: 'Certificate for www.example.com was issued by an intermediate CA that chains to a root CA not in the trusted store.' Which type of attack might this indicate?

Accepted Answer

Man-in-the-middle using a rogue certificate. A certificate from an untrusted root CA suggests a rogue or misissued certificate, possibly from a malicious CA or a man-in-the-middle attack using a proxy with its own CA certificate not trusted by the client.

Answer

Birthday attack on the certificate signature

Answer

Downgrade attack to SSLv3

Answer

Replay attack on the TLS handshake

Question 5

In an IoT environment, a researcher finds that the firmware of a smart lock can be extracted via UART and reversed to reveal hardcoded encryption keys. Which type of vulnerability is this?

Accepted Answer

Hardcoded backdoor credentials. Hardcoded keys in firmware are a classic example of a backdoor or hardcoded credential vulnerability, allowing attackers to decrypt traffic or authenticate without proper authorization.

Answer

Insecure firmware update mechanism

Answer

Insufficient entropy in random number generation

Answer

Use of deprecated cryptographic algorithm

Question 6

Which asymmetric encryption algorithm is based on the algebraic structure of elliptic curves over finite fields and provides equivalent security to RSA with smaller key sizes?

Accepted Answer

Elliptic Curve Cryptography (ECC). ECC (Elliptic Curve Cryptography) offers strong security with smaller keys compared to RSA. Diffie-Hellman is a key exchange protocol, 3DES is symmetric, and SHA-256 is a hash function.

Answer

SHA-256

Answer

Diffie-Hellman (DH)

Answer

Triple DES (3DES)

Question 7

During a cloud security audit, a tool reports that an AWS IAM role has a policy allowing 'ec2:RunInstances' with a condition 'aws:SourceIp': '0.0.0.0/0'. What is the most immediate risk?

Accepted Answer

An attacker can launch expensive EC2 instances from any IP. The condition allows all IP addresses (0.0.0.0/0) to launch EC2 instances, meaning any user who can assume this role can create instances from anywhere, potentially for cryptocurrency mining or other malicious purposes.

Answer

An attacker can delete all EC2 instances

Answer

An attacker can modify VPC security groups

Answer

An attacker can read data from any S3 bucket

Question 8

Which THREE of the following are common attack vectors against IoT devices?

Accepted Answer

Insecure protocols (e.g., MQTT, CoAP without encryption). Default credentials, insecure protocols (e.g., MQTT without TLS), and firmware reversing (to find hardcoded secrets) are common IoT attack vectors. TLS stripping is a network attack, and container escape is a cloud/container attack.

Answer

Container escape

Answer

TLS stripping attack

Question 9

Which TWO of the following correctly describe aspects of the shared responsibility model in cloud computing?

Accepted Answer

The customer is responsible for securing data stored in the cloud. In the shared responsibility model, the customer is responsible for security IN the cloud (e.g., data, application configurations, identity management) while the provider is responsible for security OF the cloud (e.g., physical security, network infrastructure). Option C is correct because customers must secure their stored data. Option E is correct because providers secure data center physical access. Option A is incorrect: the cloud provider does not manage customer encryption keys; that is the customer's responsibility. Option B is incorrect: in PaaS, the provider manages the network firewall; the customer manages application-level security only. Option D is incorrect: in IaaS, the customer patches the guest OS; the provider patches the hypervisor and physical infrastructure.

Answer

The cloud provider is responsible for managing customer application encryption keys

Answer

The customer is responsible for network firewall configuration in PaaS

Answer

The cloud provider is responsible for patching the guest operating system in IaaS

Question 10

A security analyst captures a large number of initialization vectors (IVs) on a WEP-protected network. Which tool is most commonly used to crack the WEP key using IVs?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP keys by capturing IVs. Reaver is for WPS, Kismet is a sniffer, and John the Ripper is a general password cracker.

Answer

Reaver

Answer

Kismet

Answer

John the Ripper

Question 11

What is the primary purpose of the 4-way handshake in WPA/WPA2-Personal?

Accepted Answer

To establish encryption keys without transmitting the pre-shared key. The 4-way handshake confirms that both client and AP possess the pre-shared key (PSK) without exposing it, and generates temporal keys for encryption.

Answer

To authenticate the user with a username and password

Answer

To synchronize the beacon intervals between client and AP

Answer

To exchange digital certificates between client and AP

Question 12

During a penetration test, a tester captures the WPA2 4-way handshake with airodump-ng and then uses aircrack-ng with a wordlist. However, the PSK is not found. Which of the following is the MOST likely reason?

Accepted Answer

The wordlist does not contain the PSK. If the PSK is not in the wordlist, dictionary attacks will fail. Other steps (capture, cracking) were done correctly.

Answer

Aircrack-ng does not support WPA2 cracking

Answer

The handshake was not captured correctly

Answer

The network uses WPA3 instead of WPA2

Question 13

An attacker sets up a rogue access point with the same SSID as a legitimate corporate network and broadcasts a stronger signal. Clients connect to the rogue AP. What type of attack is this?

Accepted Answer

Evil twin attack. An evil twin attack involves a rogue AP mimicking a legitimate SSID to intercept traffic.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

MAC spoofing attack

Question 14

In the cloud shared responsibility model, which of the following is typically the responsibility of the customer when using AWS EC2 (IaaS)?

Accepted Answer

Configuring security groups and firewall rules. AWS is responsible for the physical host and network infrastructure; the customer manages the guest OS, applications, and security groups.

Answer

Patching the hypervisor

Answer

Network infrastructure redundancy

Answer

Physical security of data centers

Question 15

A security team discovers that an S3 bucket configured for static website hosting is exposing sensitive documents. The bucket policy allows public read access. Which AWS misconfiguration is MOST likely present?

Accepted Answer

The bucket policy allows s3:GetObject for all principals. Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.

Answer

The bucket versioning is disabled

Answer

The bucket is not using server-side encryption

Answer

The bucket ACL grants write access to authenticated users