CEH Enumeration and System Hacking Practice Test 12 — 15 Questions

Question 1

A security analyst runs 'nbtstat -A 192.168.1.105' and sees a table with the computer name 'FILESERVER' and a logged-in user 'admin'. Which of the following BEST describes the purpose of this command?

Accepted Answer

Perform a NetBIOS name table lookup of the remote host. Option A is correct. nbtstat -A performs a NetBIOS name table lookup of a remote machine using its IP address, revealing computer names, logged-in users, and services.

Answer

Perform an SNMP walk to enumerate the remote host's MIB

Answer

Execute a dictionary attack against the remote host's passwords

Answer

Enumerate all SMB shares on the remote host

Question 2

During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?

Accepted Answer

Exploit the SUID binary to execute commands as root. Option C is correct. Exploiting a vulnerable SUID binary is a classic privilege escalation technique that allows a low-privileged user to run the binary with root privileges.

Answer

Perform an SMTP VRFY attack to enumerate users

Answer

Use enum4linux to enumerate SMB shares

Answer

Run 'sudo -l' to list sudo privileges

Question 3

A security analyst wants to enumerate all users from an SMTP server. Which of the following SMTP commands can be used for user enumeration?

Accepted Answer

VRFY. Option B is correct. The SMTP VRFY command is used to verify if a user exists on the server, enabling user enumeration.

Answer

DATA

Answer

MAIL FROM

Answer

HELO

Question 4

During a network assessment, you use SNMPwalk against a target. Which of the following is a prerequisite for successful SNMP enumeration?

Accepted Answer

Knowledge of the SNMP community string. Option D is correct. SNMPwalk requires a valid community string (often 'public') to query the MIB.

Answer

An open TCP port 161

Answer

The target must be running Linux

Answer

A valid username and password

Question 5

An analyst detects an SMB enumeration attempt in network logs. Which of the following tools would MOST likely generate such traffic?

Accepted Answer

enum4linux 192.168.1.1. Option B is correct. enum4linux is a tool specifically designed for SMB enumeration on Linux systems, often used to enumerate shares, users, and OS information.

Answer

nmap -sT 192.168.1.1

Answer

snmpwalk -v 2c 192.168.1.1

Answer

ldapsearch -h 192.168.1.1

Question 6

A penetration tester wants to crack Windows NTLM hashes using rainbow tables. Which tool is specifically designed for this purpose?

Accepted Answer

RainbowCrack. Option A is correct. RainbowCrack uses rainbow tables to crack hashes, including NTLM.

Answer

Hashcat

Answer

John the Ripper

Answer

Ophcrack

Question 7

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 8

After compromising a Windows system, an attacker wants to cover tracks by deleting event logs. Which command would achieve this?

Accepted Answer

wevtutil cl Security. The wevtutil cl Security command clears the Windows Security event log, which is a standard method for an attacker to cover tracks by removing evidence of their activities. This command is built into Windows and can be executed from the command line with administrative privileges, making it a direct and effective way to delete event logs without relying on external tools.

Answer

del *.log

Answer

rm -rf /var/log/*

Answer

clear-eventlog -Log Security

Question 9

Which of the following is a method of hiding files on a system using steganography?

Accepted Answer

Embedding a secret message in an image file. Option A is correct. Steganography hides data within other media like images, audio, or video.

Answer

Encrypting a file with AES

Answer

Renaming a file to a system filename

Answer

Using a rootkit to hide processes

Question 10

A security analyst runs the following command: 'smbclient -L //192.168.1.50 -N'. What is the purpose of this command?

Accepted Answer

List available SMB shares on the remote host anonymously. Option B is correct. smbclient -L lists shares on a remote SMB server, and -N uses a null session (no password).

Answer

Connect to the remote host's SMB share with a null password

Answer

Perform a dictionary attack on SMB passwords

Answer

Enumerate users via SMB

Question 11

Which TWO of the following are techniques used to escalate privileges on a Linux system?

Accepted Answer

Exploiting a SUID binary. Option D is correct because SUID (Set User ID) binaries execute with the file owner's privileges, typically root. If a misconfigured SUID binary (e.g., one that allows command injection or arbitrary file reads) is exploited, an attacker can escalate from a low-privileged user to root. Common examples include exploiting SUID on binaries like `find`, `nmap`, or custom scripts with weak permissions.

Answer

SMB relay attack

Answer

Pass-the-hash attack

Answer

Token impersonation

Question 12

Which THREE of the following are components of the CHPSET system hacking methodology?

Accepted Answer

Cracking passwords. Options A, B, and E are correct. CHPSET stands for Cracking passwords, Hiding files, Privilege escalation, Executing applications, Spying, and Erasing tracks.

Answer

Port scanning

Answer

Vulnerability scanning

Question 13

Which TWO of the following tools are used for password cracking?

Accepted Answer

Hashcat. Options B and D are correct. John the Ripper and Hashcat are well-known password cracking tools.

Answer

Wireshark

Answer

Snmpwalk

Answer

Nmap

Question 14

Which TWO of the following are enumeration techniques?

Accepted Answer

LDAP enumeration. Options C and D are correct. LDAP enumeration and SMTP enumeration are both enumeration techniques used to gather information about users, systems, or services.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

SQL injection

Question 15

Which THREE of the following are methods attackers use to cover their tracks after compromising a system?

Accepted Answer

Modifying file timestamps. Modifying file timestamps (A) is a common anti-forensic technique used to hide the evidence of file creation, modification, or access. Attackers use tools like `touch` on Linux or `SetFileTime` on Windows to alter the MAC (Modify, Access, Change) timestamps, making malicious files appear as legitimate system files. This prevents forensic investigators from identifying when the compromise occurred or which files were altered.

Answer

Performing a dictionary attack

Answer

Running a vulnerability scanner