CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 5 — 15 Questions

Question 1

Which cloud security assessment tool is specifically designed to audit AWS environments against best practices and CIS benchmarks?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source tool that audits cloud environments (AWS, Azure, GCP) for security misconfigurations.

Answer

Pacu

Answer

Nessus

Answer

Metasploit

Question 2

An IoT device uses the MQTT protocol without TLS. An attacker on the same network subscribes to all topics and captures messages. What is the MOST significant security risk?

Accepted Answer

Loss of message confidentiality. Without TLS, MQTT traffic is sent in cleartext, allowing interception and reading of sensitive data.

Answer

Firmware corruption

Answer

Denial of service

Answer

Replay attacks

Question 3

A penetration tester performs a container escape by exploiting a misconfigured capability and mounts the host filesystem. Which cloud service model is MOST directly affected?

Accepted Answer

Infrastructure as a Service (IaaS). Container escape compromises the host, affecting the underlying infrastructure in IaaS. In PaaS/SaaS, the provider may manage containers differently.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 4

Which cryptographic algorithm is vulnerable to a birthday attack on its hash output size of 128 bits, reducing the effective security to 64 bits against collision resistance?

Accepted Answer

MD5. MD5 produces 128-bit hashes. Birthday attack complexity for collision is 2^(n/2) = 2^64 for n=128. SHA-1 is 160-bit, SHA-256 is 256-bit, RC4 is a stream cipher not a hash.

Answer

SHA-256

Answer

SHA-1

Answer

RC4

Question 5

In PKI, what is the primary role of a Certificate Authority (CA)?

Accepted Answer

To issue and digitally sign certificates. A CA issues and signs digital certificates, validating the identity of certificate requestors.

Answer

To revoke user passwords

Answer

To generate random session keys

Answer

To encrypt data between client and server

Question 6

An analyst sees the following in a log: Client sends a request to https://victim.com/api?url=http://169.254.169.254/latest/meta-data/. This is MOST indicative of which attack?

Accepted Answer

Server-side request forgery (SSRF). The IP 169.254.169.254 is the AWS metadata endpoint. SSRF attacks target internal services by manipulating the url parameter.

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Answer

SQL injection

Question 7

Which TWO of the following are common defense measures against wireless de-authentication attacks? (Select 2)

Accepted Answer

Enabling 802.11w (Management Frame Protection). Using WPA3 (SAE) mitigates de-auth because management frame protection is mandatory. 802.11w (MFP) also protects de-auth frames. Changing default SSID and disabling SSID broadcast do not prevent de-auth.

Answer

Changing the default SSID

Answer

Implementing MAC address filtering

Answer

Disabling SSID broadcast

Question 8

Which THREE of the following are valid methods for exploiting cloud misconfigurations? (Select 3)

Accepted Answer

Using a container escape to access the host OS. S3 bucket public read access, overly permissive IAM roles, and container escape are all cloud misconfiguration exploitation vectors. SQL injection is a web app vulnerability, not cloud-specific. DDoS is an attack type, not a misconfiguration.

Answer

Performing a SQL injection on a web application

Answer

Launching a DDoS attack from a botnet

Question 9

Which TWO of the following are examples of asymmetric cryptography? (Select 2)

Accepted Answer

RSA. RSA and ECC are asymmetric algorithms. AES and 3DES are symmetric. MD5 is a hash function.

Answer

3DES

Answer

MD5

Answer

AES

Question 10

A security analyst captures a WPA2 4-way handshake using airodump-ng. To crack the PSK, which tool would they MOST likely use next?

Accepted Answer

Aircrack-ng. The correct tool for cracking a WPA2 PSK from a captured handshake is aircrack-ng, which performs dictionary attacks against the handshake file.

Answer

Kismet

Answer

John the Ripper

Answer

Reaver

Question 11

During a cloud penetration test, you discover an S3 bucket that allows listing objects. You find a file named 'config.json' that contains an IAM access key and secret key. Which of the following is the BEST next step?

Accepted Answer

Use the keys to call sts:GetCallerIdentity and then enumerate permissions via IAM. The correct action is to use the discovered credentials to enumerate permissions via the AWS CLI, as they may grant further access.

Answer

Delete the bucket to prevent further data exposure

Answer

Download all objects from the bucket and exfiltrate them

Answer

Immediately rotate the keys in the AWS console

Question 12

Which of the following attacks is characterized by an attacker placing a fake wireless access point with the same SSID as a legitimate network to capture client credentials?

Accepted Answer

Evil twin attack. An evil twin attack involves setting up a rogue access point that mimics a legitimate SSID to intercept traffic and capture credentials.

Answer

De-authentication attack

Answer

WPS PIN brute force attack

Answer

Replay attack

Question 13

In the shared responsibility model for cloud computing, which of the following is typically the responsibility of the customer?

Accepted Answer

Data classification and encryption of customer data. The customer is responsible for data classification and account management, while the provider secures the physical infrastructure.

Answer

Physical security of data centers

Answer

Patch management of the virtualization platform

Answer

Network infrastructure security (e.g., hypervisor, network cables)

Question 14

A security analyst observes that a server running an IoT device management platform is sending MQTT traffic to an unexpected IP address. The analyst also notes that the device's firmware contains hardcoded credentials. Which attack vector is MOST likely being exploited?

Accepted Answer

Insecure MQTT protocol exploitation via default credentials. The combination of hardcoded credentials and unexpected MQTT traffic suggests an attacker has used default credentials to compromise the device and is exfiltrating data via MQTT.

Answer

CoAP protocol attack

Answer

Firmware reversing attack

Answer

Container escape attack

Question 15

Which of the following is a symmetric encryption algorithm that uses a block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm that operates as a block cipher with a fixed block size of 128 bits and supports key sizes of 128, 192, or 256 bits. It was established by NIST in 2001 (FIPS 197) and is widely used in modern cryptographic systems, including wireless security (WPA2/WPA3) and TLS.

Answer

3DES

Answer

RC4

Answer

RSA