CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 6 — 15 Questions

Question 1

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they most likely use next to attempt to crack the PSK using a wordlist?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP/WPA keys from captured packets, including WPA2 handshakes using a dictionary attack.

Answer

John the Ripper

Answer

ScoutSuite

Answer

Reaver

Question 2

During a wireless penetration test, the tester runs `airodump-ng wlan0mon` and sees numerous beacon frames from a network. The tester then sends deauthentication packets using `aireplay-ng -0 5 -a <BSSID> wlan0mon`. What is the PRIMARY purpose of this deauthentication attack?

Accepted Answer

To force a client to reconnect and capture the WPA/WPA2 handshake. Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.

Answer

To crash the access point and cause a denial of service

Answer

To obtain the WPS PIN of the access point

Answer

To perform a rogue AP attack by spoofing the BSSID

Question 3

A penetration tester is assessing an AWS environment and discovers an S3 bucket with the following bucket policy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}`. Which of the following is the MOST likely security issue?

Accepted Answer

The bucket policy allows public read access to all objects. The policy allows anyone (Principal: *) to read any object in the bucket, making it publicly accessible and a common misconfiguration.

Answer

The bucket policy allows only GetObject, which is too restrictive

Answer

The bucket policy should use a Principal of AWS instead of *

Answer

The bucket policy is missing a Deny statement for write operations

Question 4

An IoT device uses MQTT for communication. An attacker intercepts MQTT packets and observes that the publish messages are not encrypted and contain plaintext sensor data. Which of the following is the BEST recommendation to secure MQTT traffic?

Accepted Answer

Use MQTT over TLS. MQTT itself does not provide encryption; using TLS (MQTT over TLS) encrypts the entire communication channel, protecting data in transit.

Answer

Base64-encode the payload

Answer

Switch to CoAP protocol

Answer

Implement a VPN on the device

Question 5

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA is an asymmetric algorithm using a public/private key pair. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 6

An attacker performs a downgrade attack on a TLS connection, forcing the client and server to negotiate a weaker cipher suite. This attack exploits which of the following?

Accepted Answer

The fallback mechanism in SSL/TLS implementations. Downgrade attacks exploit the fallback mechanism in TLS where, if a handshake fails, the client retries with a lower version or weaker suite. The attacker forces failure to degrade security.

Answer

A vulnerability in the TLS 1.3 handshake

Answer

A known weakness in the Diffie-Hellman key exchange

Answer

The ability to modify the ClientHello message

Question 7

During a cloud penetration test, a tester discovers that an AWS IAM role has the following policy: `{"Effect":"Allow","Action":"*","Resource":"*"}`. This policy is attached to an EC2 instance. Which of the following attacks is the tester MOST likely to perform next?

Accepted Answer

SSRF attack to access the instance metadata service and obtain the IAM credentials. With full admin privileges, the tester can attempt to enumerate and abuse the permissions, such as creating users, accessing data, or escalating privileges further.

Answer

Perform a dictionary attack against the root user password

Answer

Use Pacu to enumerate S3 buckets

Answer

Exploit a container escape vulnerability in Docker

Question 8

A security team is evaluating wireless security for a corporate network. They want to implement the strongest current encryption standard for Wi-Fi. Which of the following should they choose?

Accepted Answer

WPA3 with SAE. WPA3 is the latest Wi-Fi security standard, offering stronger encryption with SAE (Simultaneous Authentication of Equals) and replacing WPA2.

Answer

WEP with 128-bit key

Answer

WPA2 with CCMP

Answer

802.1X with EAP-TLS

Question 9

Which of the following tools is specifically designed for auditing cloud environments (AWS, Azure, GCP) for security misconfigurations?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for common misconfigurations.

Answer

John the Ripper

Answer

Aircrack-ng

Answer

Reaver

Question 10

An analyst captures the following output from a wireless adapter: `[00:1A:2B:3C:4D:5E] 54 Mbps WPA2 CCMP PSK`. The analyst suspects a malicious rogue AP is impersonating a legitimate network. Which of the following indicators would MOST strongly confirm a rogue AP?

Accepted Answer

The BSSID matches a known manufacturer, but the signal strength is unusually high. A rogue AP often has a higher signal strength than expected, especially if it's placed closer to users. Additionally, a mismatch between the BSSID and the known legitimate AP can indicate spoofing.

Answer

The channel number is different from the legitimate AP

Answer

The SSID is broadcasted with the same name as the corporate network

Answer

The encryption type is WPA2 with CCMP

Question 11

An attacker uses Reaver against a Wi-Fi network. What vulnerability is the attacker primarily exploiting?

Accepted Answer

WPS PIN vulnerability. Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.

Answer

Weak WPA2 passphrase

Answer

Deauthentication attack

Answer

IV weakness in WEP

Question 12

Which of the following is a well-known attack against the MD5 hash function that allows two different inputs to produce the same hash value?

Accepted Answer

Birthday attack. The birthday attack exploits the birthday paradox in probability theory to find two different inputs that produce the same MD5 hash value (a collision) with significantly less effort than a brute-force preimage attack. For an n-bit hash, the birthday attack requires only about 2^(n/2) operations, making MD5's 128-bit output vulnerable to collisions in roughly 2^64 attempts, which is computationally feasible today.

Answer

Replay attack

Answer

Downgrade attack

Answer

Dictionary attack

Question 13

A penetration tester is assessing the security of a cloud application and discovers that it is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are potential impacts of this vulnerability?

Accepted Answer

Access to cloud instance metadata (e.g., AWS IMDS). SSRF can allow access to internal services (like metadata endpoints) and potentially lead to remote code execution if internal services are compromised.

Answer

Ability to perform a man-in-the-middle attack on the user's browser

Answer

Direct modification of DNS records

Answer

Direct access to the database without authentication

Question 14

A security analyst is investigating a potential container escape in a Kubernetes cluster. Which THREE of the following are common indicators of a container escape?

Accepted Answer

A process running inside the container with CAP_SYS_ADMIN capability. Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

Answer

The container has a read-only root filesystem

Answer

The container is running as a non-root user

Question 15

Which TWO of the following are common weaknesses in IoT devices that are often exploited by attackers?

Accepted Answer

Use of default or hard-coded credentials. Option C is correct because many IoT devices ship with default usernames and passwords (e.g., 'admin/admin') or hard-coded credentials embedded in firmware. Attackers can easily discover these through simple web searches or Shodan scans, then gain unauthorized access to the device and potentially the entire network.

Answer

Use of hardware security modules (HSM)

Answer

Implementation of secure boot

Answer

Firmware update mechanism with signed updates