CEH Enumeration and System Hacking Practice Test 4 — 15 Questions

Question 1

During a penetration test, you run the command `enum4linux -a 192.168.1.10` and receive output containing user account names, group memberships, and share listings. Which protocol is primarily being enumerated?

Accepted Answer

SMB. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via the SMB (Server Message Block) protocol. The command `enum4linux -a 192.168.1.10` performs a comprehensive scan that retrieves user accounts, group memberships, and share listings, all of which are exposed through SMB's named pipe and RPC mechanisms. SMB is the correct protocol because it is the primary means for file and printer sharing in Windows networks, and enum4linux leverages SMB's IPC$ share and SAMR/LSA RPC services to extract this data.

Answer

NFS

Answer

SNMP

Answer

SMTP

Question 2

A security analyst suspects an attacker has used a rainbow table to crack password hashes from a compromised system. Which password cracking technique involves precomputed hash chains?

Accepted Answer

Rainbow table attack. A rainbow table attack is the correct answer because it specifically uses precomputed hash chains to reverse cryptographic hash functions. Rainbow tables are a form of time-memory trade-off where chains of hashes are computed and stored, allowing an attacker to look up a hash and quickly find the original plaintext without recomputing all possible hashes. This technique is distinct from other methods because it relies on precomputation rather than real-time guessing or dictionary lookups.

Answer

Dictionary attack

Answer

Brute force attack

Answer

Hybrid attack

Question 3

During a security assessment, you find a Linux binary with the SUID bit set and owned by root. You execute it and obtain a root shell. This is an example of which privilege escalation technique?

Accepted Answer

SUID abuse. Option D is correct because the SUID (Set User ID) bit on a binary owned by root allows it to execute with root privileges regardless of the user running it. When you execute such a binary and it spawns a shell, that shell inherits the elevated privileges, effectively granting you a root shell. This is a classic example of SUID abuse, a common privilege escalation technique on Linux systems.

Answer

DLL hijacking

Answer

Kernel exploit

Answer

Token impersonation

Question 4

A penetration tester is attempting to enumerate user accounts on a mail server. They connect to port 25 and issue the commands `VRFY root` and `EXPN support`. Which protocol is being targeted?

Accepted Answer

SMTP. The commands VRFY and EXPN are SMTP (Simple Mail Transfer Protocol) commands defined in RFC 821 and RFC 5321. VRFY is used to verify whether a mailbox exists on the server, while EXPN expands a mailing list alias to reveal its members. Since the tester connected to port 25 (the default SMTP port) and issued these commands, SMTP is the protocol being targeted.

Answer

LDAP

Answer

SMB

Answer

SNMP

Question 5

After gaining access to a system, an attacker modifies log files to remove evidence of their activities. This action is part of which phase of the system hacking methodology?

Accepted Answer

Erasing tracks. The correct answer is D, 'Erasing tracks,' because after gaining access, the attacker's goal is to cover their footprints by modifying or deleting log files, clearing event logs, or using tools like `wevtutil` or `clearev` to remove evidence of their activities. This phase ensures the system administrator cannot detect the intrusion or trace the attacker's actions.

Answer

Spying

Answer

Executing applications

Answer

Hiding files

Question 6

Which tool is specifically designed to crack Windows LM and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 7

A security analyst runs `snmpwalk -v2c -c public 192.168.1.1` and receives extensive output about the device's configuration. Which of the following is the MOST effective countermeasure against this enumeration?

Accepted Answer

Change the default community string and restrict SNMP access to specific IPs. Option C is correct because the most effective countermeasure against SNMP enumeration via a default community string is to change the default 'public' (or 'private') string to a strong, non-guessable value and restrict SNMP access to trusted management IPs using an access control list (ACL). This prevents unauthorized querying of the MIB tree while still allowing legitimate SNMP monitoring.

Answer

Disable SNMP entirely

Answer

Use SNMPv3 with encryption

Answer

Block ICMP echo requests

Question 8

During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?

Accepted Answer

ldapsearch. ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.

Answer

nbtstat

Answer

smbclient

Answer

snmpwalk

Question 9

An attacker uses a tool that sends crafted RCPT TO commands to an SMTP server to verify email addresses. Which SMTP enumeration technique is being used?

Accepted Answer

RCPT TO. The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

Answer

AUTH

Answer

EXPN

Answer

VRFY

Question 10

Which password cracking technique involves trying every possible combination of characters until the correct password is found?

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters from a defined character set (e.g., lowercase, uppercase, digits, special symbols) until the correct password is found. This method guarantees eventual success but is computationally expensive and time-consuming, especially for long or complex passwords. It is the most exhaustive form of password cracking, as it does not rely on any precomputed data or wordlists.

Answer

Rainbow table attack

Answer

Dictionary attack

Answer

Hybrid attack

Question 11

A security analyst examines a compromised Linux server and finds a hidden directory `/usr/share/.syslog` containing a modified version of `sshd` and a log cleaner script. This is indicative of which technique used to erase tracks?

Accepted Answer

Rootkit installation. The presence of a hidden directory containing a modified `sshd` binary and a log cleaner script is a classic sign of a rootkit installation. Rootkits replace core system binaries (like `sshd`) to maintain backdoor access and use log cleaners to erase evidence of their activity, directly aligning with the technique of erasing tracks.

Answer

Token impersonation

Answer

DLL injection

Answer

Steganography

Question 12

Which of the following commands would a tester use to enumerate NetBIOS names and their associated IP addresses on a local subnet?

Accepted Answer

nbtstat -A 192.168.1.10. Option D is correct because the `nbtstat -A` command (with a capital 'A') performs a NetBIOS name table lookup against a remote IP address, listing the NetBIOS names registered by that host along with their associated IP addresses. This is the standard method for enumerating NetBIOS names on a specific target within a local subnet, as it queries the NetBIOS name service (UDP port 137) directly.

Answer

nbtstat -n

Answer

nbtstat -c

Answer

nbtstat -a 192.168.1.10

Question 13

Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)

Accepted Answer

smbclient -L //target -U ''. Option A is correct because `smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.

Answer

snmpwalk -v2c -c public target

Answer

nmap -sU -p 445 target

Answer

nbtstat -A target

Question 14

Which THREE of the following are common techniques used in the 'Cracking passwords' phase of system hacking? (Select 3)

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

Answer

Keylogging

Answer

Social engineering

Question 15

Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)

Accepted Answer

Restrict SNMP access to trusted IP addresses using ACLs. Restricting SNMP access to trusted IP addresses using ACLs is effective because it limits the attack surface by allowing only authorized management stations to query SNMP agents. This prevents unauthorized hosts from performing SNMP enumeration, even if they know the community string or exploit default configurations.

Answer

Disable SNMP on all devices

Answer

Enable SNMPv3 with default passwords

Answer

Use SNMPv1 with community string 'private'