CEH Enumeration and System Hacking Practice Test 5 — 15 Questions

Question 1

Which tool is specifically designed to crack Windows LM and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper

Question 2

A security analyst runs `snmpwalk -v2c -c public 192.168.1.1` and receives extensive output about the device's configuration. Which of the following is the MOST effective countermeasure against this enumeration?

Accepted Answer

Change the default community string and restrict SNMP access to specific IPs. The most effective countermeasure against SNMP enumeration via a default community string is to change the default 'public' (or 'private') string to a strong, non-guessable value and restrict SNMP access to trusted management IPs using an access control list (ACL). This prevents unauthorized querying of the MIB tree while still allowing legitimate SNMP monitoring.

Answer

Disable SNMP entirely

Answer

Use SNMPv3 with encryption

Answer

Block ICMP echo requests

Question 3

During a penetration test, you need to enumerate all users and groups from a Windows domain controller. Which tool is BEST suited for this task?

Accepted Answer

ldapsearch. ldapsearch is the best tool for enumerating users and groups from a Windows domain controller because it directly queries the Active Directory LDAP directory service (port 389 or 636 for LDAPS) using standard LDAP search filters. This allows retrieval of all user and group objects, including their attributes, without relying on NetBIOS or SMB file sharing. It is the most efficient and comprehensive method for structured directory enumeration in a domain environment.

Answer

nbtstat

Answer

smbclient

Answer

snmpwalk

Question 4

An attacker uses a tool that sends crafted RCPT TO commands to an SMTP server to verify email addresses. Which SMTP enumeration technique is being used?

Accepted Answer

RCPT TO. The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.

Answer

AUTH

Answer

EXPN

Answer

VRFY

Question 5

Which password cracking technique involves trying every possible combination of characters until the correct password is found?

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters from a defined character set (e.g., lowercase, uppercase, digits, special symbols) until the correct password is found. This method guarantees eventual success but is computationally expensive and time-consuming, especially for long or complex passwords. It is the most exhaustive form of password cracking, as it does not rely on any precomputed data or wordlists.

Answer

Rainbow table attack

Answer

Dictionary attack

Answer

Hybrid attack

Question 6

A security analyst examines a compromised Linux server and finds a hidden directory `/usr/share/.syslog` containing a modified version of `sshd` and a log cleaner script. This is indicative of which technique used to erase tracks?

Accepted Answer

Rootkit installation. The presence of a hidden directory containing a modified `sshd` binary and a log cleaner script is a classic sign of a rootkit installation. Rootkits replace core system binaries (like `sshd`) to maintain backdoor access and use log cleaners to erase evidence of their activity, directly aligning with the technique of erasing tracks.

Answer

Token impersonation

Answer

DLL injection

Answer

Steganography

Question 7

Which of the following commands would a tester use to enumerate NetBIOS names and their associated IP addresses on a local subnet?

Accepted Answer

nbtstat -A 192.168.1.10. The `nbtstat -A` command (with a capital 'A') performs a NetBIOS name table lookup against a remote IP address, listing the NetBIOS names registered by that host along with their associated IP addresses. This is the standard method for enumerating NetBIOS names on a specific target within a local subnet, as it queries the NetBIOS name service (UDP port 137) directly.

Answer

nbtstat -n

Answer

nbtstat -c

Answer

nbtstat -a 192.168.1.10

Question 8

Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)

Accepted Answer

smbclient -L //target -U ''. `smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.

Answer

snmpwalk -v2c -c public target

Answer

nmap -sU -p 445 target

Answer

nbtstat -A target

Question 9

Which THREE of the following are common techniques used in the 'Cracking passwords' phase of system hacking? (Select 3)

Accepted Answer

Brute force attack. A brute force attack systematically tries every possible combination of characters until the correct password is found. This is a fundamental technique in the password cracking phase, often used when no prior knowledge of the password exists. It is computationally expensive but guaranteed to succeed given enough time.

Answer

Keylogging

Answer

Social engineering

Question 10

Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)

Accepted Answer

Restrict SNMP access to trusted IP addresses using ACLs. Option A is correct because applying ACLs to restrict SNMP access to trusted IP addresses limits who can query the SNMP agent, preventing unauthorized enumeration from untrusted hosts. Option C is correct because changing default community strings (such as 'public' and 'private') to strong, unique values removes the easily guessed credentials that attackers use to enumerate SNMP data. Option B is not the best countermeasure because disabling SNMP entirely is impractical in environments where it is needed for legitimate monitoring and management. Option D is incorrect because enabling SNMPv3 with default passwords still leaves weak, guessable credentials that undermine SNMPv3's security features. Option E is incorrect because SNMPv1 with the community string 'private' uses a well-known default credential and lacks encryption and strong authentication, making enumeration easier.

Answer

Disable SNMP on all devices

Answer

Enable SNMPv3 with default passwords

Answer

Use SNMPv1 with community string 'private'

Question 11

A security analyst uses the nbtstat -a command against a target IP address. What information is the analyst MOST likely attempting to retrieve?

Accepted Answer

NetBIOS name table of the remote machine. The nbtstat -a command is used to query the NetBIOS name table of a remote machine by its IP address. This table contains the NetBIOS names registered by the remote host, such as the computer name, workgroup/domain, and any services running over NetBIOS (e.g., file sharing). The analyst is most likely attempting to enumerate these names for reconnaissance or to identify potential targets for further exploitation.

Answer

Active directory domain controllers

Answer

List of all open TCP ports

Answer

The MAC address of the target

Question 12

During a penetration test, an analyst runs the command 'snmpwalk -v2c -c public 192.168.1.10' and receives a large amount of output. Which protocol and community string are being used?

Accepted Answer

SNMPv2c with community string public. The command 'snmpwalk -v2c -c public 192.168.1.10' explicitly specifies SNMP version 2c with the '-v2c' flag and the community string 'public' with the '-c' flag. SNMPv2c is the most common version for read-only queries, and 'public' is the default read-only community string. The large output indicates successful enumeration of the MIB tree, confirming the community string is correct.

Answer

SNMPv1 with community string public

Answer

SNMPv1 with community string private

Answer

SNMPv3 with user public

Question 13

An attacker uses a tool that precomputes hash chains for common passwords to crack password hashes quickly. Which technique is the attacker employing?

Accepted Answer

Rainbow table attack. Rainbow table attack. This technique involves precomputing hash chains for common passwords and storing them in a table, allowing the attacker to reverse password hashes quickly by looking up the hash in the table rather than computing hashes on the fly. The tool described matches the core concept of a rainbow table, which uses a time-memory trade-off to crack hashes efficiently.

Answer

Dictionary attack

Answer

Brute-force attack

Answer

Hybrid attack

Question 14

After gaining initial access to a Windows server, a penetration tester wants to escalate privileges. The tester finds that the current user has the 'SeImpersonatePrivilege' enabled. Which attack technique could the tester use to abuse this privilege?

Accepted Answer

Token impersonation via Juicy Potato. The SeImpersonatePrivilege allows a process to impersonate a user after obtaining a token. Juicy Potato (and its variants like RoguePotato) exploits this by coercing the SYSTEM account to connect to a malicious named pipe, capturing its token, and using it to spawn a process with SYSTEM privileges. This is a well-known privilege escalation technique on Windows systems where the user has the SeImpersonatePrivilege.

Answer

SUID bit abuse

Answer

Pass-the-Hash attack

Answer

Log manipulation to hide tracks

Question 15

Which of the following tools is specifically designed to crack Windows LAN Manager (LM) and NTLM hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper