CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography — Timed 40 Questions

Question 1

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

Accepted Answer

WEP key recovery using aircrack-ng. WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

Answer

WPS PIN brute-force attack

Answer

Evil twin AP deployment

Answer

WPA handshake capture

Question 2

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Accepted Answer

Brute-force the WPS PIN to recover the Wi-Fi passphrase. Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

Answer

Perform a de-authentication attack on the target AP

Answer

Capture the 4-way handshake for WPA cracking

Answer

Scan for nearby access points and their BSSIDs

Question 3

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

Accepted Answer

The customer is responsible for configuring access controls and permissions. Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

Answer

AWS is responsible for physical security of data centers

Answer

The customer is responsible for patching the S3 service

Answer

AWS is responsible for network infrastructure; the customer for data classification

Question 4

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Accepted Answer

Implement client authentication and enable TLS encryption. MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 5

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Answer

RC4

Answer

3DES

Answer

RSA

Question 6

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)

Question 7

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

Answer

Aircrack-ng

Answer

Nmap

Answer

Wireshark

Question 8

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

Accepted Answer

Run a dictionary attack using aircrack-ng with a wordlist. After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

Answer

Use aircrack-ng to crack the WEP key from the handshake

Answer

Brute-force the WPS PIN using Reaver

Answer

De-authenticate the client from the network again to capture another handshake

Question 9

A security analyst discovers that a containerized application running in a cloud environment can access the host's file system by mounting /var/run/docker.sock inside the container. Which type of attack does this configuration enable?

Accepted Answer

Container escape to the host. Mounting the Docker socket inside a container allows the container to communicate with the Docker daemon on the host, potentially allowing the attacker to create new containers, escape the container, and execute commands on the host.

Answer

Server-Side Request Forgery (SSRF)

Answer

Privilege escalation within the container only

Answer

Denial-of-Service (DoS) attack against the container runtime

Question 10

Which of the following is the PRIMARY reason that MD5 is no longer recommended for use in digital signatures?

Accepted Answer

MD5 is vulnerable to collision attacks. MD5 is vulnerable to collision attacks, where two different inputs produce the same hash. This undermines the integrity and non-repudiation properties required for digital signatures.

Answer

MD5 is a symmetric algorithm, not a hash function

Answer

MD5 is computationally too slow for large data

Answer

MD5 produces a 128-bit hash, which is too short for modern security

Question 11

An attacker intercepts a TLS-encrypted session and attempts to force the client and server to use a weaker cipher suite. Which type of attack is being performed?

Accepted Answer

Downgrade attack. A downgrade attack tricks the communicating parties into negotiating a less secure version of TLS or a weaker cipher suite, making it easier for the attacker to break the encryption.

Answer

Man-in-the-middle (MITM) attack

Answer

Birthday attack

Answer

Replay attack

Question 12

A penetration tester uses the tool 'Pacu' during an assessment. Which of the following actions is Pacu designed to perform?

Accepted Answer

Automate penetration testing tasks in AWS environments. Pacu is an open-source AWS exploitation framework that allows security professionals to test the security of AWS environments. It can perform various attacks, such as IAM privilege escalation, S3 bucket enumeration, and metadata service exploitation.

Answer

Exploit vulnerabilities in Azure cloud infrastructure

Answer

Perform network scanning and service enumeration

Answer

Crack WPA2 handshakes using dictionary attacks

Question 13

Which TWO of the following are common attack vectors against IoT devices? (Select TWO.)

Accepted Answer

Default credentials left unchanged. IoT devices often have default credentials that are not changed, and they use insecure protocols like MQTT without encryption. These are common entry points for attackers.

Answer

Regular firmware updates

Answer

Use of strong encryption protocols

Answer

Use of certificate-based authentication

Question 14

Which THREE of the following are effective countermeasures against evil twin attacks in wireless networks? (Select THREE.)

Accepted Answer

Implementing client-side certificate validation for network authentication. Evil twin attacks involve a rogue AP impersonating a legitimate one. Countermeasures include using WPA3-Enterprise with 802.1X for mutual authentication, implementing client-side certificate validation, and using VPNs to encrypt traffic even over rogue APs.

Answer

Enabling MAC address filtering on the AP

Answer

Disabling SSID broadcast on the legitimate AP

Question 15

Which TWO of the following are symmetric encryption algorithms? (Select TWO.)

Accepted Answer

AES. AES and 3DES are both symmetric block ciphers. RSA and ECC are asymmetric algorithms, and SHA-256 is a hash function.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 16

A security analyst captures network traffic and sees multiple ARP packets with the same source MAC address but different IP addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP spoofing attack. An evil twin attack involves a rogue AP impersonating a legitimate one, but it does not typically cause ARP packets with varied IPs. ARP spoofing involves an attacker sending forged ARP replies to associate their MAC with another IP, causing traffic to be misdirected. The described behavior matches ARP spoofing, where the attacker's MAC appears with multiple IPs.

Answer

WPS PIN attack

Answer

De-authentication attack

Answer

Evil twin attack

Question 17

During a wireless penetration test, a tester captures the 4-way handshake between a client and WPA2-PSK access point. Which tool would the tester MOST likely use to attempt to recover the pre-shared key?

Accepted Answer

Aircrack-ng. The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Answer

Wireshark

Answer

Kismet

Answer

Reaver

Question 18

A cloud security engineer notices that an S3 bucket named 'company-backup' is configured to allow 's3:GetObject' access to 'Principal: *'. Which attack is this misconfiguration MOST likely to enable?

Accepted Answer

Unauthorized data access and exfiltration. When an S3 bucket allows GetObject access to any principal (public), anyone can list and download objects, leading to data exposure. This is a classic unauthorized data access scenario, not privileged escalation or DoS.

Answer

Denial of service by deleting objects

Answer

SSRF attack to internal metadata

Answer

Privilege escalation via IAM role

Question 19

An IoT device uses the MQTT protocol without TLS. A security tester connects to the broker and subscribes to all topics using '#'. What is the tester MOST likely able to accomplish?

Accepted Answer

Eavesdrop on all MQTT communications. MQTT without encryption allows anyone to subscribe to topics. Subscribing to '#' captures all messages, leading to interception of sensitive data. This is a passive eavesdropping attack, not active manipulation like replay or injection.

Answer

Perform a denial of service on the broker

Answer

Inject malicious control commands

Answer

Replay previously captured messages

Question 20

Which of the following cryptographic algorithms is classified as asymmetric?

Accepted Answer

RSA. Asymmetric cryptography uses key pairs (public and private). RSA is a well-known asymmetric algorithm. AES, 3DES, and RC4 are symmetric algorithms.

Answer

RC4

Answer

3DES

Answer

AES