CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography Practice Test 8 — 15 Questions

Question 1

A security analyst captures a WPA2 4-way handshake using airodump-ng. Which tool would they use to perform a dictionary attack on the captured handshake to recover the PSK?

Accepted Answer

aircrack-ng. The correct answer is aircrack-ng, which is the standard tool for cracking WPA2 PSK from a captured handshake using a dictionary file.

Answer

Reaver

Answer

Hydra

Answer

John the Ripper

Question 2

During a cloud penetration test, a tester discovers an S3 bucket that allows public listing and write access. Which of the following is the MOST likely misconfiguration?

Accepted Answer

The bucket policy grants 's3:GetObject' and 's3:PutObject' to 'Principal': *. The correct answer is that the bucket policy or ACL is set to 'Everyone' with write permissions, a common misconfiguration leading to data exposure.

Answer

The bucket is in a different region than the EC2 instance

Answer

IAM roles attached to the bucket allow anonymous access

Answer

Server-side encryption is disabled

Question 3

Which of the following cryptographic hash functions is known to be vulnerable to collision attacks and should be avoided for security applications?

Accepted Answer

MD5. MD5 is known to be vulnerable to collision attacks, making it unsuitable for security applications like digital signatures.

Answer

RIPEMD-160

Answer

SHA-256

Answer

SHA-1

Question 4

An attacker sets up a fake access point with the same SSID as a legitimate corporate network. Clients connecting to this AP are prompted to enter their network credentials. Which type of attack is this?

Accepted Answer

Evil twin attack. The attack is an evil twin attack, where a rogue AP mimics a legitimate one to capture credentials or perform man-in-the-middle.

Answer

Replay attack

Answer

WPS PIN attack

Answer

De-authentication attack

Question 5

A penetration tester uses the tool Reaver to target a Wi-Fi network. What vulnerability is the tester attempting to exploit?

Accepted Answer

WPS PIN brute-force weakness. Reaver is a tool specifically designed to exploit the WPS (Wi-Fi Protected Setup) PIN brute-force vulnerability. It targets the WPS registrar's lack of rate-limiting and the fact that the PIN is split into two halves (first half 4 digits, second half 3 digits with a checksum), allowing an attacker to recover the WPS PIN and subsequently the WPA2 pre-shared key in a matter of hours.

Answer

WPA2 4-way handshake capture

Answer

Weak WEP encryption keys

Answer

RADIUS authentication bypass

Question 6

In a cloud environment, which of the following is an example of a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker exploits a web application to send HTTP requests from the server to an internal metadata endpoint. SSRF occurs when an attacker tricks the server into making requests to internal resources, such as a cloud metadata service, to obtain credentials.

Answer

An attacker intercepts traffic between a load balancer and backend servers

Answer

An attacker uses a SQL injection to extract database contents

Answer

An attacker uploads a malicious file to an S3 bucket that executes code on the server

Question 7

A security analyst observes repeated de-authentication packets targeting clients on a corporate Wi-Fi network. What is the MOST likely goal of the attacker?

Accepted Answer

To capture the WPA2 4-way handshake for offline password cracking. De-authentication attacks force clients to reconnect, allowing the attacker to capture the 4-way handshake for offline cracking of the PSK.

Answer

To perform a denial-of-service attack and disrupt all wireless connectivity

Answer

To install malware on the client devices

Answer

To exploit a vulnerability in the RADIUS server

Question 8

Which cryptographic algorithm is classified as symmetric and uses a block cipher with key sizes of 128, 192, or 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits, and is widely used for encryption.

Answer

ECC

Answer

Diffie-Hellman

Answer

RSA

Question 9

During an IoT assessment, a tester examines a smart thermostat that uses the MQTT protocol. The tester finds that the device connects to a broker without any authentication. Which of the following attacks is MOST likely to succeed?

Accepted Answer

Publishing arbitrary messages to control the device and subscribing to data topics. Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.

Answer

Firmware extraction via UART

Answer

Reversing the firmware to find hardcoded credentials

Answer

Performing a dictionary attack on the Wi-Fi PSK

Question 10

A security team uses ScoutSuite to assess their AWS environment. The tool reports that an S3 bucket policy allows access from any IP address. What is the MOST likely misconfiguration?

Accepted Answer

The bucket policy uses 'Principal': '*' and 'Condition': {'IpAddress': {'aws:SourceIp': '0.0.0.0/0'}}. ScoutSuite identifies overly permissive bucket policies; allowing access from any IP (0.0.0.0/0) is a common misconfiguration.

Answer

The bucket has versioning enabled

Answer

The bucket ACL grants 'FullControl' to 'AuthenticatedUsers' group

Answer

The bucket is encrypted with SSE-S3

Question 11

A penetration tester performs a container escape from a Docker container running in a cloud environment. Which of the following is the MOST likely cause?

Accepted Answer

The container is running with the --privileged flag. Container escape often occurs when the container is run with the --privileged flag, granting elevated capabilities that allow access to the host kernel.

Answer

The container uses default credentials for SSH

Answer

The container image has a known vulnerability in the MQTT library

Answer

The host OS is running an outdated kernel version

Question 12

A security analyst captures network traffic and sees the following: Client sends a SYN, server responds with SYN-ACK, then client sends ACK. Immediately after, the client sends an encrypted payload. This traffic is consistent with which phase of a WPA2 attack?

Accepted Answer

WPA2 4-way handshake exchange. The TCP handshake shown is for the 4-way handshake messages: first two messages (AP nonce and supplicant nonce) are exchanged, then the third message is the encrypted GTK, followed by ACK. The encrypted payload indicates the handshake is complete.

Answer

De-authentication attack

Answer

WPS PIN exchange

Answer

WEP initialization vector capture

Question 13

Which TWO of the following are symmetric encryption algorithms? (Select 2)

Accepted Answer

3DES. AES and 3DES are symmetric algorithms; RSA and ECC are asymmetric; MD5 is a hash function.

Answer

ECC

Answer

RSA

Answer

MD5

Question 14

Which TWO of the following are common attack vectors against IoT devices? (Select 2)

Accepted Answer

Default credentials. Default credentials and insecure protocols (e.g., MQTT without TLS) are common IoT attack vectors; firmware extraction is a technique, not a vector; SQL injection is more common in web apps; replay attacks can occur but are not specific to IoT.

Answer

Firmware extraction via JTAG

Answer

Replay attacks on encrypted sessions

Answer

SQL injection

Question 15

Which THREE of the following are valid methods to prevent a downgrade attack on TLS? (Select 3)

Accepted Answer

Disable TLS 1.0 and 1.1 on the server. Disabling older TLS versions, enforcing TLS 1.2+, and using TLS_FALLBACK_SCSV prevent downgrade; disabling cipher suites does not prevent downgrade directly; using self-signed certificates increases risk.

Answer

Use self-signed certificates to avoid CA trust issues

Answer

Disable all cipher suites except those using RC4