CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 8 — 15 Questions

Question 1

Which of the following is a cryptographic attack that exploits collisions in hash functions?

Accepted Answer

Birthday attack. A birthday attack exploits the birthday paradox to find two different inputs that produce the same hash output (collision).

Answer

Dictionary attack

Answer

Downgrade attack

Answer

Replay attack

Question 2

A security engineer wants to ensure that a wireless network uses the most secure encryption available. Which of the following should be configured on the access point?

Accepted Answer

WPA3. WPA3 is the latest Wi-Fi security standard, providing stronger encryption (GCMP-256) and protection against dictionary attacks via SAE.

Answer

WEP

Answer

WPA2 with TKIP

Answer

WPA2 with AES

Question 3

Which TWO of the following are common attack vectors for IoT devices? (Select two)

Accepted Answer

Default credentials. Default credentials (e.g., admin/admin) and insecure protocols (e.g., MQTT without TLS) are frequently exploited in IoT.

Answer

SQL injection

Answer

Side-channel attacks

Answer

ARP spoofing

Question 4

Which THREE of the following are valid defenses against WPA2 attacks? (Select three)

Accepted Answer

Disable WPS. Using a strong passphrase makes dictionary attacks harder. 802.1X/EAP provides enterprise authentication. Disabling WPS removes PIN brute-force vector. WPA2-Mixed mode still allows TKIP clients, reducing security.

Answer

Use WEP instead of WPA2

Answer

Enable WPA2-Mixed mode

Question 5

Which TWO of the following are characteristics of symmetric encryption? (Select two)

Accepted Answer

Uses a single shared key for encryption and decryption. Symmetric encryption uses a single shared key for both encryption and decryption, and is generally faster than asymmetric.

Answer

Slower than asymmetric encryption

Answer

Provides non-repudiation

Answer

Uses a pair of public and private keys

Question 6

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they use to perform a dictionary attack on the captured handshake to recover the PSK?

Accepted Answer

aircrack-ng. Aircrack-ng, which is the standard tool for cracking WPA2 PSK from a captured handshake using a dictionary file.

Answer

Reaver

Answer

Hydra

Answer

John the Ripper

Question 7

Which of the following cryptographic hash functions is known to be vulnerable to collision attacks and should be avoided for security applications?

Accepted Answer

MD5. MD5 is known to be vulnerable to collision attacks, making it unsuitable for security applications like digital signatures.

Answer

RIPEMD-160

Answer

SHA-256

Answer

SHA-1

Question 8

An attacker sets up a fake access point with the same SSID as a legitimate corporate network. Clients connecting to this AP are prompted to enter their network credentials. Which type of attack is this?

Accepted Answer

Evil twin attack. The attack is an evil twin attack, where a rogue AP mimics a legitimate one to capture credentials or perform man-in-the-middle.

Answer

Replay attack

Answer

WPS PIN attack

Answer

De-authentication attack

Question 9

A penetration tester uses the tool Reaver to target a Wi-Fi network. What vulnerability is the tester attempting to exploit?

Accepted Answer

WPS PIN brute-force weakness. Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.

Answer

WPA2 4-way handshake capture

Answer

Weak WEP encryption keys

Answer

RADIUS authentication bypass

Question 10

In a cloud environment, which of the following is an example of a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker exploits a web application to send HTTP requests from the server to an internal metadata endpoint. SSRF occurs when an attacker tricks the server into making requests to internal resources, such as a cloud metadata service, to obtain credentials.

Answer

An attacker intercepts traffic between a load balancer and backend servers

Answer

An attacker uses a SQL injection to extract database contents

Answer

An attacker uploads a malicious file to an S3 bucket that executes code on the server

Question 11

A security analyst observes repeated de-authentication packets targeting clients on a corporate Wi-Fi network. What is the MOST likely goal of the attacker?

Accepted Answer

To capture the WPA2 4-way handshake for offline password cracking. De-authentication attacks force clients to reconnect, allowing the attacker to capture the 4-way handshake for offline cracking of the PSK.

Answer

To perform a denial-of-service attack and disrupt all wireless connectivity

Answer

To install malware on the client devices

Answer

To exploit a vulnerability in the RADIUS server

Question 12

Which cryptographic algorithm is classified as symmetric and uses a block cipher with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits, and is widely used for encryption.

Answer

ECC

Answer

Diffie-Hellman

Answer

RSA

Question 13

During an IoT assessment, a tester examines a smart thermostat that uses the MQTT protocol. The tester finds that the device connects to a broker without any authentication. Which of the following attacks is MOST likely to succeed?

Accepted Answer

Publishing arbitrary messages to control the device and subscribing to data topics. Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.

Answer

Firmware extraction via UART

Answer

Reversing the firmware to find hardcoded credentials

Answer

Performing a dictionary attack on the Wi-Fi PSK

Question 14

A security team uses ScoutSuite to assess their AWS environment. The tool reports that an S3 bucket policy allows access from any IP address. What is the MOST likely misconfiguration?

Accepted Answer

The bucket policy uses 'Principal': '*' and 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}}. ScoutSuite identifies overly permissive bucket policies; allowing access from any IP (0.0.0.0/0) is a common misconfiguration.

Answer

The bucket has versioning enabled

Answer

The bucket ACL grants 'FullControl' to 'AuthenticatedUsers' group

Answer

The bucket is encrypted with SSE-S3

Question 15

A penetration tester performs a container escape from a Docker container running in a cloud environment. Which of the following is the MOST likely cause?

Accepted Answer

The container is running with the --privileged flag. Container escape often occurs when the container is run with the --privileged flag, granting elevated capabilities that allow access to the host kernel.

Answer

The container uses default credentials for SSH

Answer

The container image has a known vulnerability in the MQTT library

Answer

The host OS is running an outdated kernel version