CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 7 — 15 Questions

Question 1

An analyst captures the following output from a wireless adapter: `[00:1A:2B:3C:4D:5E] 54 Mbps WPA2 CCMP PSK`. The analyst suspects a malicious rogue AP is impersonating a legitimate network. Which of the following indicators would MOST strongly confirm a rogue AP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BSSID matches a known manufacturer, but the signal strength is unusually high. A rogue AP often has a higher signal strength than expected, especially if it's placed closer to users. Additionally, a mismatch between the BSSID and the known legitimate AP can indicate spoofing.

Answer

The channel number is different from the legitimate AP

Answer

The SSID is broadcasted with the same name as the corporate network

Answer

The encryption type is WPA2 with CCMP

Question 2

An attacker uses Reaver against a Wi-Fi network. What vulnerability is the attacker primarily exploiting?

Accepted Answer

WPS PIN vulnerability. Reaver is designed to exploit the WPS PIN brute-force vulnerability, where an attacker can recover the WPS PIN and then derive the WPA/WPA2 PSK.

Answer

Weak WPA2 passphrase

Answer

Deauthentication attack

Answer

IV weakness in WEP

Question 3

Which of the following is a well-known attack against the MD5 hash function that allows two different inputs to produce the same hash value?

Accepted Answer

Birthday attack. The birthday attack exploits the birthday paradox in probability theory to find two different inputs that produce the same MD5 hash value (a collision) with significantly less effort than a brute-force preimage attack. For an n-bit hash, the birthday attack requires only about 2^(n/2) operations, making MD5's 128-bit output vulnerable to collisions in roughly 2^64 attempts, which is computationally feasible today.

Answer

Replay attack

Answer

Downgrade attack

Answer

Dictionary attack

Question 4

A penetration tester is assessing the security of a cloud application and discovers that it is vulnerable to Server-Side Request Forgery (SSRF). Which TWO of the following are potential impacts of this vulnerability?

Accepted Answer

Access to cloud instance metadata (e.g., AWS IMDS). SSRF can allow access to internal services (like metadata endpoints) and potentially lead to remote code execution if internal services are compromised.

Answer

Ability to perform a man-in-the-middle attack on the user's browser

Answer

Direct modification of DNS records

Answer

Direct access to the database without authentication

Question 5

A security analyst is investigating a potential container escape in a Kubernetes cluster. Which THREE of the following are common indicators of a container escape?

Accepted Answer

A process running inside the container with CAP_SYS_ADMIN capability. Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

Answer

The container has a read-only root filesystem

Answer

The container is running as a non-root user

Question 6

A security analyst captures a large number of weak initialization vectors (IVs) using airodump-ng. Which attack does this preparation indicate?

Accepted Answer

WEP key cracking. WEP (Wired Equivalent Privacy) uses the RC4 stream cipher with a 24-bit initialization vector (IV) that is transmitted in plaintext. Weak IVs, such as those identified by tools like airodump-ng, are predictable or repeatable, allowing an attacker to capture enough packets to recover the WEP key using statistical attacks like the FMS (Fluhrer, Mantin, Shamir) or KoreK attacks. This preparation directly indicates an attempt to crack the WEP key.

Answer

WPS PIN brute force

Answer

WPA2 dictionary attack

Answer

Evil twin attack

Question 7

During a penetration test, an ethical hacker runs the following command: aireplay-ng -0 5 -a 00:11:22:33:44:55 -c 66:77:88:99:AA:BB wlan0mon. What is the immediate effect of this command?

Accepted Answer

It forces the client to disconnect and reconnect, capturing the WPA handshake. The -0 flag sends deauthentication packets to force a client to reconnect, enabling capture of the WPA handshake.

Answer

It performs a WEP injection attack to generate traffic

Answer

It cracks the pre-shared key using a dictionary

Answer

It initiates a brute force attack on the WPS PIN

Question 8

A security engineer analyzes a cloud environment and finds that an S3 bucket named 'company-backups' is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. Which of the following is the MOST likely risk?

Accepted Answer

An attacker can read any object in the bucket without authentication. A bucket policy allowing anonymous GetObject makes all objects publicly readable, leading to data exposure.

Answer

An attacker can modify the bucket policy

Answer

An attacker can delete objects in the bucket

Answer

An attacker can enumerate all objects in the bucket

Question 9

A penetration tester uses the tool 'ScoutSuite' against an AWS target. Which of the following BEST describes the purpose of this tool?

Accepted Answer

Audit cloud infrastructure for misconfigurations and compliance. ScoutSuite is an open-source multi-cloud security auditing tool that assesses cloud environments (AWS, Azure, GCP) by scanning for misconfigurations and compliance violations. It does not perform exploitation or penetration testing; instead, it checks for issues like overly permissive security groups, unencrypted S3 buckets, or unused IAM roles, aligning with option D's description of auditing cloud infrastructure for misconfigurations and compliance.

Answer

Enumerate IAM users and roles for privilege escalation

Answer

Perform automated penetration testing of web applications

Answer

Exploit vulnerabilities in cloud services

Question 10

An IoT device uses the MQTT protocol without TLS. An attacker on the same network captures messages and publishes a fake temperature reading. Which attack is being executed?

Accepted Answer

Man-in-the-middle attack. MQTT over plain TCP allows message interception and injection (man-in-the-middle) because no encryption or authentication is enforced.

Answer

Replay attack

Answer

Firmware reversing attack

Answer

Denial of service attack

Question 11

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that uses a pair of keys (public and private) for encryption and digital signatures, making it an asymmetric algorithm. Unlike symmetric ciphers, RSA relies on the mathematical difficulty of factoring large prime numbers to secure communications.

Answer

3DES

Answer

SHA-256

Answer

AES

Question 12

A security analyst notices that a web application's SSL/TLS certificate is issued by a CA that is not trusted by modern browsers. Which type of attack could this enable?

Accepted Answer

Man-in-the-middle attack. Using a self-signed or untrusted CA certificate can allow an attacker to perform a man-in-the-middle attack by presenting their own certificate that the browser may accept with user warning.

Answer

Downgrade attack

Answer

Birthday attack

Answer

Replay attack

Question 13

Which of the following tools is specifically designed to exploit WPS vulnerabilities on wireless networks?

Accepted Answer

Reaver. Reaver is specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate limiting and the fact that the PIN is split into two halves, making it feasible to guess the 8-digit PIN in under 10,000 attempts. This allows an attacker to recover the WPA/WPA2 pre-shared key without needing to crack the actual encryption.

Answer

John the Ripper

Answer

aircrack-ng

Answer

Kismet

Question 14

In the shared responsibility model for cloud computing, which of the following is typically the customer's responsibility?

Accepted Answer

Configuration of IAM roles and permissions. The customer is responsible for security IN the cloud, including configuring IAM policies, encryption, and access controls.

Answer

Physical security of data centers

Answer

Hypervisor security

Answer

Network infrastructure security

Question 15

A penetration tester discovers that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is a potential impact of this vulnerability?

Accepted Answer

Access to cloud instance metadata. SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.

Answer

Cross-site scripting (XSS) in the browser

Answer

Remote code execution via command injection

Answer

SQL injection in the database