CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 6 — 15 Questions

Question 1

A penetration tester uses the following command to attack a WPS-enabled AP: 'reaver -i mon0 -b 00:11:22:33:44:55 -vv'. What is the primary goal of this attack?

Accepted Answer

Obtain the WPS PIN and subsequently the WPA2 PSK. Reaver is used to brute force the WPS PIN, recovering the PIN and ultimately the WPA2 PSK.

Answer

Perform a de-authentication attack on all clients

Answer

Capture a WPA2 4-way handshake for offline cracking

Answer

Scan for hidden SSIDs in the area

Question 2

A company wants to ensure that data in transit between its IoT devices and the cloud server is encrypted. Which protocol combination is BEST suited for this purpose?

Accepted Answer

MQTT with TLS. The best choice for encrypting data in transit between IoT devices and a cloud server is MQTT with TLS. MQTT is a lightweight, publish-subscribe protocol ideal for IoT, and TLS provides robust encryption. While CoAP with DTLS is also secure, it is typically used for constrained device-to-device communication, not as the primary protocol for cloud connectivity. HTTP with SSL is too heavy for many IoT devices, and MQTT without encryption lacks security. Therefore, MQTT with TLS is the optimal combination.

Answer

MQTT without encryption

Answer

HTTP with SSL

Answer

CoAP with DTLS

Question 3

Which of the following is a hashing algorithm that produces a 160-bit (20-byte) hash value?

Accepted Answer

SHA-1. SHA-1 produces a 160-bit hash. MD5 produces 128 bits, SHA-256 produces 256 bits, and SHA-512 produces 512 bits.

Answer

MD5

Answer

SHA-256

Answer

SHA-512

Question 4

A security team discovers that an attacker has been intercepting and modifying traffic between a client and server by impersonating both endpoints. Which type of cryptographic attack is this?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and server to intercept and modify traffic.

Answer

Replay attack

Answer

Downgrade attack

Answer

Birthday attack

Question 5

A security analyst runs the following command: 'wget http://example.com/bucket?list-type=2' and receives a listing of objects. Which cloud misconfiguration is this MOST likely exploiting?

Accepted Answer

Publicly accessible S3 bucket with list permissions enabled. An S3 bucket with public listing enabled allows anyone to list objects via HTTP GET requests.

Answer

SSRF vulnerability in the cloud application

Answer

Container escape vulnerability

Answer

Misconfigured IAM roles allowing privilege escalation

Question 6

Which TWO tools are specifically designed for cloud security auditing and exploitation? (Choose two.)

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security-auditing tool that assesses the security posture of AWS, Azure, and GCP environments by checking for misconfigurations, excessive permissions, and compliance violations. Pacu is an AWS exploitation framework designed for offensive security testing, allowing penetration testers to enumerate resources, escalate privileges, and execute post-exploitation modules against cloud accounts. Both tools are purpose-built for cloud security auditing and exploitation, making them the correct choices.

Answer

Nessus

Answer

Aircrack-ng

Answer

Nmap

Question 7

Which THREE of the following are common attack vectors against IoT devices? (Choose three.)

Accepted Answer

Firmware reversing. Default credentials, insecure protocols like MQTT, and firmware reversing are all common IoT attack vectors. SQL injection is more typical for web applications.

Answer

Container escape

Answer

SQL injection

Question 8

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they most likely use next to attempt to crack the PSK using a wordlist?

Accepted Answer

Aircrack-ng. Aircrack-ng is the standard tool for cracking WEP/WPA keys from captured packets, including WPA2 handshakes using a dictionary attack.

Answer

John the Ripper

Answer

ScoutSuite

Answer

Reaver

Question 9

During a wireless penetration test, the tester runs `airodump-ng wlan0mon` and sees numerous beacon frames from a network. The tester then sends deauthentication packets using `aireplay-ng -0 5 -a <BSSID> wlan0mon`. What is the PRIMARY purpose of this deauthentication attack?

Accepted Answer

To force a client to reconnect and capture the WPA/WPA2 handshake. Deauthentication attacks force clients to reconnect, allowing capture of the WPA/WPA2 4-way handshake during reconnection, which is needed for offline cracking.

Answer

To crash the access point and cause a denial of service

Answer

To obtain the WPS PIN of the access point

Answer

To perform a rogue AP attack by spoofing the BSSID

Question 10

A penetration tester is assessing an AWS environment and discovers an S3 bucket with the following bucket policy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}`. Which of the following is the MOST likely security issue?

Accepted Answer

The bucket policy allows public read access to all objects. The policy allows anyone (Principal: *) to read any object in the bucket, making it publicly accessible and a common misconfiguration.

Answer

The bucket policy allows only GetObject, which is too restrictive

Answer

The bucket policy should use a Principal of AWS instead of *

Answer

The bucket policy is missing a Deny statement for write operations

Question 11

An IoT device uses MQTT for communication. An attacker intercepts MQTT packets and observes that the publish messages are not encrypted and contain plaintext sensor data. Which of the following is the BEST recommendation to secure MQTT traffic?

Accepted Answer

Use MQTT over TLS. MQTT itself does not provide encryption; using TLS (MQTT over TLS) encrypts the entire communication channel, protecting data in transit.

Answer

Base64-encode the payload

Answer

Switch to CoAP protocol

Answer

Implement a VPN on the device

Question 12

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA is an asymmetric algorithm using a public/private key pair. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES

Question 13

An attacker performs a downgrade attack on a TLS connection, forcing the client and server to negotiate a weaker cipher suite. This attack exploits which of the following?

Accepted Answer

The fallback mechanism in SSL/TLS implementations. Downgrade attacks exploit the fallback mechanism in TLS where, if a handshake fails, the client retries with a lower version or weaker suite. The attacker forces failure to degrade security.

Answer

A vulnerability in the TLS 1.3 handshake

Answer

A known weakness in the Diffie-Hellman key exchange

Answer

The ability to modify the ClientHello message

Question 14

A security team is evaluating wireless security for a corporate network. They want to implement the strongest current encryption standard for Wi-Fi. Which of the following should they choose?

Accepted Answer

WPA3 with SAE. WPA3 is the latest Wi-Fi security standard, offering stronger encryption with SAE (Simultaneous Authentication of Equals) and replacing WPA2.

Answer

WEP with 128-bit key

Answer

WPA2 with CCMP

Answer

802.1X with EAP-TLS

Question 15

Which of the following tools is specifically designed for auditing cloud environments (AWS, Azure, GCP) for security misconfigurations?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source multi-cloud security auditing tool that checks for common misconfigurations.

Answer

John the Ripper

Answer

Aircrack-ng

Answer

Reaver