CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography — Timed 50 Questions

Question 1

A forensic analyst examines a firmware image extracted from an IoT thermostat and finds hardcoded credentials for a cloud backend. Which phase of the IoT attack lifecycle does this represent?

Accepted Answer

Reconnaissance. Finding hardcoded credentials in firmware is an act of information gathering about the target device and its backend. This corresponds to the Reconnaissance phase of the IoT attack lifecycle, where attackers collect data to identify vulnerabilities. The exploitation phase would involve using the credentials to gain access, not just discovering them.

Answer

Weaponization

Answer

Installation

Answer

Exploitation

Question 2

Which TWO of the following are valid attacks against wireless networks? (Choose two.)

Accepted Answer

De-authentication attack. Evil twin involves a rogue AP, and de-authentication disconnects clients by targeting 802.11 management frames. SSRF is a web application vulnerability, not a wireless network attack. Dictionary attacks are a method for cracking passwords or keys, which can be used against wireless networks (e.g., WPA/WPA2 pre-shared keys) but are a general technique rather than a specific wireless network attack type. Replay attacks are also a generic technique that can be applied in wireless contexts (e.g., WEP cracking) but are not exclusively wireless-specific. The question asks for specific attacks against wireless networks, making evil twin and de-authentication the most appropriate choices.

Answer

SSRF

Answer

Dictionary attack

Answer

Replay attack

Question 3

Which TWO of the following are valid cryptanalytic attacks?

Accepted Answer

Replay attack. Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces a system to use a weaker cryptographic protocol or cipher suite, which is a form of cryptanalytic attack. SQL injection and XSS are web application attacks, not cryptanalytic.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 4

An analyst notices that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is the MOST effective mitigation against SSRF attacks in a cloud environment?

Accepted Answer

Block outbound traffic to internal IP ranges except through a configured forward proxy. Restricting the application from making requests to internal IP ranges (e.g., 169.254.169.254, a common address for cloud metadata services) is a key defense against SSRF.

Answer

Implement strict input validation on all user-supplied URLs

Answer

Disable the use of external URLs in application features

Answer

Use a web application firewall (WAF) with SSRF signatures

Question 5

An organization is using a cloud IAM policy that allows all actions on all resources. Which TWO security issues are MOST directly related to this configuration? (Choose two.)

Accepted Answer

Excessive privileges. A permissive IAM policy directly grants excessive privileges, which can be exploited to access and expose sensitive data from various cloud resources, including cloud storage buckets.

Answer

Vulnerable software libraries

Answer

Weak encryption algorithms

Answer

Insecure MQTT configuration

Question 6

During a cloud penetration test, a tester discovers that an AWS IAM role has the following policy: `{"Effect":"Allow","Action":"*","Resource":"*"}`. This policy is attached to an EC2 instance. Which of the following attacks is the tester MOST likely to perform next?

Accepted Answer

SSRF attack to access the instance metadata service and obtain the IAM credentials. The IAM policy grants full administrative access to the AWS account. To leverage this, the tester must first obtain the temporary credentials associated with this role. This is typically done by exploiting a Server-Side Request Forgery (SSRF) vulnerability in an application running on the EC2 instance to query the Instance Metadata Service (IMDS) at `http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name`. Once the credentials are obtained, the tester can then enumerate and abuse the permissions, such as creating users, accessing data, or escalating privileges further.

Answer

Perform a dictionary attack against the root user password

Answer

Use Pacu to enumerate S3 buckets

Answer

Exploit a container escape vulnerability in Docker

Question 7

Which TWO of the following are common weaknesses in IoT devices that are often exploited by attackers?

Accepted Answer

Use of default or hard-coded credentials. Many IoT devices ship with default usernames and passwords (e.g., 'admin/admin') or hard-coded credentials embedded in firmware. Attackers can easily discover these through simple web searches or Shodan scans, then gain unauthorized access to the device and potentially the entire network. Furthermore, many IoT devices communicate using insecure protocols or implement secure protocols like MQTT without proper encryption (e.g., TLS/SSL), making data vulnerable to eavesdropping, tampering, and man-in-the-middle attacks.

Answer

Use of hardware security modules (HSM)

Answer

Implementation of secure boot

Answer

Firmware update mechanism with signed updates

Question 8

During a cloud penetration test, a tester discovers an S3 bucket that allows public listing and write access. Which of the following is the MOST likely misconfiguration?

Accepted Answer

IAM roles attached to the bucket allow anonymous access. That IAM roles attached to the bucket allow anonymous access. This is a common misconfiguration where an IAM role's trust policy permits any user to assume the role, granting them the permissions of that role, which could include listing and writing to the bucket. Option B is incorrect because s3:GetObject and s3:PutObject do not allow listing the bucket; s3:ListBucket is required for listing.

Answer

The bucket is in a different region than the EC2 instance

Answer

The bucket policy grants 's3:GetObject' and 's3:PutObject' to 'Principal': *

Answer

Server-side encryption is disabled

Question 9

A security analyst captures network traffic and sees the following: Client sends a SYN, server responds with SYN-ACK, then client sends ACK. Immediately after, the client sends an encrypted payload. This traffic is consistent with which phase of a WPA2 attack?

Accepted Answer

De-authentication attack. The captured TCP three-way handshake followed by encrypted payload indicates that a client has just successfully reconnected to the wireless network. This reconnection occurs as a result of a deauthentication attack, which disconnects the client and forces it to reassociate. Therefore, this traffic is consistent with the reconnection phase triggered by a deauthentication attack within a WPA2 attack sequence.

Answer

WPA2 4-way handshake exchange

Answer

WPS PIN exchange

Answer

WEP initialization vector capture

Question 10

Which TWO of the following are cloud-specific security threats?

Accepted Answer

S3 bucket misconfiguration. S3 bucket misconfiguration is a cloud-specific threat because it involves improper access control settings on Amazon S3 storage, such as public read/write permissions, which can lead to data exposure or unauthorized access. This threat is unique to cloud environments where object storage is managed via APIs and IAM policies, unlike traditional on-premises storage. SSRF (Server-Side Request Forgery) in cloud environments is also cloud-specific because it can be exploited to access sensitive cloud metadata services (e.g., AWS EC2 metadata service, Azure Instance Metadata Service) which provide information like temporary credentials or instance details, a vector unique to cloud infrastructure.

Answer

SQL injection

Answer

De-authentication attack

Answer

ARP spoofing

Question 11

Which TWO of the following attacks are specifically associated with wireless networks?

Accepted Answer

De-authentication attack. A de-authentication attack targets the management frames in IEEE 802.11 wireless networks. An attacker sends forged de-authentication frames to disconnect a client from an access point, often as a precursor to capturing the WPA handshake or launching an evil twin attack. This is a wireless-specific attack because it exploits the unencrypted nature of 802.11 management frames. An evil twin attack involves setting up a rogue access point that mimics a legitimate one (often with the same SSID and security settings) to trick users into connecting to it instead of the legitimate AP. This attack is specifically associated with wireless networks because it exploits the way wireless clients discover and connect to access points, often relying on the broadcast nature of SSIDs and client auto-connection features.

Answer

Man-in-the-middle attack

Answer

Replay attack

Answer

Birthday attack

Question 12

Which THREE of the following attacks target cryptographic weaknesses?

Accepted Answer

Downgrade attack. A downgrade attack is correct because it forces a system to use a weaker, less secure cryptographic protocol or algorithm (e.g., forcing TLS 1.2 down to SSL 3.0 or using export-grade ciphers). This exploits the cryptographic weakness of the older protocol, making it easier for an attacker to decrypt or manipulate the communication. The attack directly targets the cryptographic strength of the negotiated security parameters.

Answer

Replay attack

Answer

Cross-site scripting

Answer

SQL injection

Question 13

A security analyst captures a large number of unique initialization vectors (IVs) from a wireless network using airodump-ng. Which attack are they MOST likely preparing to execute?

Accepted Answer

WEP key recovery using aircrack-ng. WEP encryption is vulnerable to statistical attacks that require capturing many unique IVs to recover the WEP key. The large number of unique IVs indicates preparation for a WEP cracking attack using a tool like aircrack-ng.

Answer

WPS PIN brute-force attack

Answer

Evil twin AP deployment

Answer

WPA handshake capture

Question 14

During a penetration test, an analyst runs the following command: 'reaver -i wlan0mon -b 00:11:22:33:44:55 -vv'. What is the PRIMARY purpose of this command?

Accepted Answer

Brute-force the WPS PIN to recover the Wi-Fi passphrase. Reaver is a tool designed to exploit the WPS PIN authentication mechanism. The command targets a specific BSSID to perform a brute-force attack on the WPS PIN, which can reveal the WPA/WPA2 passphrase if successful.

Answer

Perform a de-authentication attack on the target AP

Answer

Capture the 4-way handshake for WPA cracking

Answer

Scan for nearby access points and their BSSIDs

Question 15

A cloud security engineer discovers that an S3 bucket named 'acme-backups' is accessible to anyone with the bucket URL. The bucket contains sensitive customer data. Which AWS shared responsibility model component does this misconfiguration primarily violate?

Accepted Answer

The customer is responsible for configuring access controls and permissions. Under the AWS shared responsibility model, the customer is responsible for configuring S3 bucket policies and access controls. The misconfiguration is a customer-side issue, not an infrastructure vulnerability.

Answer

AWS is responsible for physical security of data centers

Answer

The customer is responsible for patching the S3 service

Answer

AWS is responsible for network infrastructure; the customer for data classification

Question 16

An IoT device uses the MQTT protocol without any authentication or encryption. An attacker on the same network subscribes to all topics on the MQTT broker. Which of the following is the MOST effective immediate countermeasure?

Accepted Answer

Implement client authentication and enable TLS encryption. MQTT without authentication and encryption can be secured by enabling TLS for transport encryption and requiring credentials for clients. This prevents unauthorized access and eavesdropping.

Answer

Disable the MQTT broker entirely and switch to HTTP

Answer

Change the default topic names to obfuscated strings

Answer

Use a VPN for all IoT device communication

Question 17

Which cryptographic algorithm is classified as symmetric and uses a block cipher with a fixed block size of 128 bits, supporting key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

Answer

RC4

Answer

3DES

Answer

RSA

Question 18

A security analyst observes the following log entry on a web server: 'GET /?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1'. This request appears to originate from a compromised web application. Which cloud attack technique is being attempted?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP address 169.254.169.254 is the AWS instance metadata service endpoint. An attacker using a Server-Side Request Forgery (SSRF) vulnerability can force the server to request this URL and retrieve sensitive instance metadata, such as IAM credentials.

Answer

SQL Injection

Answer

Container escape

Answer

Cross-Site Scripting (XSS)

Question 19

Which of the following tools is specifically designed for assessing the security of AWS environments by checking for misconfigurations in services like S3, IAM, and EC2?

Accepted Answer

ScoutSuite. ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.

Answer

Aircrack-ng

Answer

Nmap

Answer

Wireshark

Question 20

During a penetration test, a tester captures a WPA2 4-way handshake. Which of the following is the NEXT step to attempt to recover the Wi-Fi passphrase?

Accepted Answer

Run a dictionary attack using aircrack-ng with a wordlist. After capturing the handshake, the tester must perform a dictionary attack against the handshake file. Tools like aircrack-ng or hashcat can compare the handshake against a wordlist of potential passphrases.

Answer

Use aircrack-ng to crack the WEP key from the handshake

Answer

Brute-force the WPS PIN using Reaver

Answer

De-authenticate the client from the network again to capture another handshake