CEH Enumeration and System Hacking Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are examples of privilege escalation on Linux? (Select 2)

Accepted Answer

SUID bit abuse. SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.

Answer

Pass-the-Hash

Answer

Token impersonation

Answer

DLL hijacking

Question 2

A security analyst runs the command: nbtstat -A 192.168.1.10. The output shows the table of names for the remote machine. Which of the following is the MOST likely purpose of this command?

Accepted Answer

To enumerate NetBIOS names and services on the remote host. The `nbtstat -A` command performs a NetBIOS name table lookup against a remote IP address, displaying the registered NetBIOS names and their associated service types (e.g., workstation, server, messenger). This is a core technique for NetBIOS enumeration, which reveals the remote host's computer name, logged-in user, and running NetBIOS services, making option C correct.

Answer

To perform a DNS zone transfer

Answer

To enumerate SNMP community strings on the remote host

Answer

To enumerate SMB shares on the remote host

Question 3

During a penetration test, you receive a list of password hashes from a Windows server. Which of the following tools would be BEST suited to perform a dictionary attack against these hashes?

Accepted Answer

John the Ripper. John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 4

A penetration tester obtains a list of password hashes and uses RainbowCrack. Which statement BEST describes how RainbowCrack works?

Accepted Answer

It uses time-memory trade-off with precomputed hash chains. RainbowCrack implements a time-memory trade-off attack by precomputing hash chains for a given set of passwords and storing them in rainbow tables. When a password hash is provided, the tool looks up the hash in these tables to reverse it, avoiding the need to recompute hashes for every possible password. This makes it far faster than brute-force for cracking hashes, provided the password is covered by the precomputed chains.

Answer

It uses a dictionary attack with word mangling rules

Answer

It uses online password guessing against the target service

Answer

It uses a brute-force attack by trying all possible character combinations

Question 5

After gaining initial access, an attacker attempts to escalate privileges by exploiting a misconfigured service running as SYSTEM. They find that the service's binary path is writable by the Everyone group. Which privilege escalation technique is the attacker MOST likely using?

Accepted Answer

Weak service permissions. The attacker can exploit weak service permissions where the binary path of a service running as SYSTEM is writable by the Everyone group. This allows the attacker to replace the legitimate service binary with a malicious executable, and when the service restarts (or the system reboots), the malicious code executes with SYSTEM privileges, achieving privilege escalation.

Answer

SUID/GUID abuse

Answer

Unquoted service path

Answer

Token impersonation

Question 6

A security engineer runs SNMPwalk on a network device and receives community strings as 'public' and 'private'. What is the PRIMARY concern?

Accepted Answer

The device may be exposing sensitive configuration information. The SNMP community strings 'public' and 'private' are default read-only and read-write credentials defined in SNMPv1 and SNMPv2c. An attacker who can SNMPwalk the device with these strings can enumerate the entire MIB tree, including system configuration, routing tables, interface details, and user accounts. This directly exposes sensitive configuration information, making C the primary concern.

Answer

The device is vulnerable to buffer overflow attacks

Answer

The device is infected with malware

Answer

The device is using outdated encryption protocols

Question 7

Which of the following is the PRIMARY purpose of steganography in the context of covering tracks after a system compromise?

Accepted Answer

To hide data within other files to avoid detection. The primary purpose of steganography in covering tracks is to hide stolen data or malicious payloads within innocuous files (e.g., images, audio, video) so that forensic tools and analysts do not detect the exfiltration or persistence. Unlike encryption, which makes data unreadable but still visible, steganography conceals the very existence of the hidden data, allowing an attacker to bypass network monitoring and file inspection. This aligns with the CEH objective of covering tracks by avoiding detection of unauthorized data transfers.

Answer

To create a backdoor for future access

Answer

To delete system logs permanently

Answer

To encrypt log files so they cannot be read

Question 8

A penetration tester uses the SMTP commands VRFY and EXPN on a mail server. What is the tester MOST likely trying to accomplish?

Accepted Answer

To enumerate valid email addresses and distribution lists. The VRFY command asks the mail server to verify whether a given email address exists, while EXPN requests the members of a mailing list or alias. By issuing these commands, the tester can enumerate valid user accounts and distribution lists on the server, which is a key step in building a target list for further attacks such as password guessing or phishing.

Answer

To extract email content from the server

Answer

To perform a mail relay attack

Answer

To test for open relay

Question 9

During a penetration test, an analyst uses enum4linux with the -a flag against a target. Which of the following is the MOST comprehensive set of information that can be obtained?

Accepted Answer

User list, share list, OS information, password policy, and group memberships. enum4linux with the -a flag performs a comprehensive enumeration against a target, leveraging SMB, RPC, and NetBIOS over TCP/IP. It retrieves user lists, share lists, OS information, password policy details, and group memberships by querying the remote Windows system via SMB RPC calls (e.g., SAMR, LSA, SRVSVC). This makes it the most complete set of information obtainable from a single command, as the -a flag essentially runs all available enumeration modules.

Answer

Only the domain admins and local admins

Answer

Only the SMB shares and open sessions

Answer

Only the NetBIOS name table

Question 10

An attacker has gained access to a system and wants to erase evidence of their activities. Which of the following actions is MOST effective for covering tracks on a Windows system?

Accepted Answer

Clearing the Security event log. Clearing the Security event log (C) is the most effective action for covering tracks on a Windows system because it removes all logged security events, such as logon attempts, privilege use, and audit failures, which are the primary records that would reveal an attacker's activities. The Security log is maintained by the Windows Event Log service and is the default location for audit records under the Local Security Policy; deleting it eliminates forensic evidence of unauthorized access or changes.

Answer

Disabling the Windows Firewall

Answer

Installing a rootkit

Answer

Changing the administrator password

Question 11

A penetration tester finds that a Linux binary has the SUID bit set and is owned by root. Which of the following does this indicate?

Accepted Answer

The binary will run with root privileges when executed by any user. When the SUID (Set User ID) bit is set on a binary owned by root, the binary executes with the effective user ID of the file owner (root), regardless of which user runs it. This allows any user to run the binary with root privileges, which is why option D is correct. The SUID bit is represented by an 's' in the owner's execute position (e.g., -rwsr-xr-x).

Answer

The binary is immutable and cannot be deleted

Answer

The binary can be executed only by the root user

Answer

The binary is a symbolic link to a root-owned file

Question 12

Which tool is specifically designed to crack Windows LM and NTLM hashes using precomputed tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM hashes using precomputed rainbow tables. It relies on the time-memory trade-off technique, where hashes are looked up in precomputed tables rather than computed on the fly, making it highly efficient for these specific hash types. The tool is bundled with free rainbow tables for LM hashes and supports NTLM through additional table sets.

Answer

John the Ripper

Answer

Cain & Abel

Answer

Hashcat

Question 13

A security analyst observes repeated attempts to validate user accounts via SMTP using VRFY commands from an external IP. What is the BEST immediate action to mitigate this reconnaissance?

Accepted Answer

Disable VRFY and EXPN commands in the SMTP server configuration. The VRFY command is an SMTP protocol feature (RFC 821) that allows a client to verify whether a specific email address exists on the server. Attackers use VRFY and EXPN to enumerate valid user accounts during the reconnaissance phase. Disabling these commands in the SMTP server configuration directly stops this enumeration technique without affecting legitimate mail delivery.

Answer

Upgrade to the latest version of the SMTP server

Answer

Enable SMTP authentication for all incoming connections

Answer

Block the external IP address at the firewall

Question 14

Which TWO techniques are commonly used for privilege escalation on Linux systems? (Select two.)

Accepted Answer

Kernel exploits. Kernel exploits (A) are a common privilege escalation technique on Linux because they target vulnerabilities in the kernel itself, allowing an attacker to execute arbitrary code with root privileges. By exploiting flaws such as buffer overflows or race conditions in kernel modules, an attacker can elevate from a low-privileged user to full root access. This is a classic method because the kernel runs with the highest system privileges, and a successful exploit bypasses all user-level security controls.

Answer

Token impersonation

Answer

DLL hijacking

Answer

Pass-the-hash

Question 15

Which THREE of the following are components of the CHPSET system hacking methodology? (Select three.)

Accepted Answer

Sniffing network traffic. The CHPSET system hacking methodology includes six phases: Cracking (C), Hiding (H), Privilege Escalation (P), Sniffing (S), Executing (E), and Targeting (T). Among the given options, Sniffing network traffic (A) corresponds to Sniffing, Cracking passwords (C) to Cracking, and Executing applications (E) to Executing. Hiding files (B) is a specific activity under the Hiding phase but is not a distinct phase itself. Scanning ports (D) is a reconnaissance step performed during the pre-hacking phase, not part of CHPSET. Therefore, the three correct components are A, C, and E.

Answer

Hiding files

Answer

Scanning ports