CEH Malware, Social Engineering and Network Attacks — 20 Questions

Question 1

An organization is experiencing repeated DDoS attacks that consume all available bandwidth. Which mitigation technique is MOST effective for handling such volumetric attacks?

Accepted Answer

Scrubbing centers. Scrubbing centers (Option D) are the most effective mitigation for volumetric DDoS attacks because they use specialized hardware and software to filter malicious traffic from legitimate traffic before it reaches the target network. Unlike simpler methods, scrubbing centers can handle massive bandwidth floods by redirecting traffic through high-capacity filtering nodes that inspect packets, drop attack traffic based on signatures or behavioral analysis, and forward only clean traffic. This approach is specifically designed for volumetric attacks that saturate bandwidth, as it offloads the filtering burden from the target's own infrastructure.

Answer

Blackholing all traffic to the target IP

Answer

Anycast network distribution

Answer

Rate limiting on the firewall

Question 2

A network administrator notices that the switch's CAM table is full, causing the switch to flood all incoming traffic out of all ports. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table by sending thousands of frames with unique, random source MAC addresses. Once the CAM table is full, the switch enters a fail-open state and begins flooding all incoming frames out every port, effectively turning it into a hub and allowing the attacker to sniff traffic. This directly matches the scenario where a full CAM table causes flooding.

Answer

ARP poisoning

Answer

DHCP starvation

Answer

DNS spoofing

Question 3

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. B is correct because an HTTP flood attack sends a high volume of seemingly legitimate HTTP GET or POST requests to a web server, overwhelming its connection pool and CPU resources. This targets the application layer (Layer 7) of the OSI model, as it exploits the HTTP protocol's request-handling logic rather than network-layer bandwidth.

Answer

UDP flood

Answer

ICMP flood

Answer

SYN flood

Question 4

A security analyst detects a file named 'invoice.pdf.exe' in an email attachment. When the file is submitted to VirusTotal, multiple engines detect it as a Trojan. The analyst wants to perform dynamic analysis to observe its behavior. Which approach is BEST?

Accepted Answer

Execute the file in a sandboxed environment and monitor system calls. Dynamic analysis involves executing malware in a controlled, isolated environment (sandbox) to observe its runtime behavior, such as file system changes, registry modifications, network connections, and process injections. Option C directly enables this by running the Trojan and monitoring system calls, which is the best approach to understand its actual impact and propagation methods.

Answer

Disassemble the file using IDA Pro to understand its code

Answer

Run 'strings' on the file and analyze the output

Answer

Submit the file again to VirusTotal for a second opinion

Question 5

A penetration tester is performing a session hijacking attack. After capturing packets, the tester successfully predicts the TCP sequence numbers and injects packets to take over the session. Which type of attack is this?

Accepted Answer

TCP session hijacking. TCP session hijacking involves an attacker predicting or spoofing TCP sequence numbers to inject malicious packets into an established TCP connection, effectively taking over the session without the need for authentication. This attack exploits the lack of built-in authentication in TCP's three-way handshake and sequence number generation, allowing the attacker to impersonate one of the communicating parties.

Answer

MAC flooding

Answer

Cookie theft

Answer

ARP poisoning

Question 6

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. HTTP flood is an application-layer DDoS attack because it targets the HTTP protocol (Layer 7) by overwhelming a web server with seemingly legitimate GET or POST requests. Unlike network-layer attacks, HTTP flood exploits the server's processing of application-layer requests, often mimicking normal user behavior to bypass basic rate limiting. This forces the server to allocate resources for each request, eventually exhausting connection pools or CPU cycles. Similarly, Slowloris is also an application-layer DDoS attack that targets web servers by holding open many HTTP connections for as long as possible, sending only partial requests. This exhausts the server's concurrent connection pool, preventing legitimate users from connecting. Both attacks operate at Layer 7, exploiting the application's resource handling rather than just raw bandwidth.

Answer

ICMP flood

Answer

SYN flood

Answer

UDP flood

Question 7

An organization's security team observes a surge in outgoing DNS queries to external servers from a single internal host, with each query returning unusually large responses (e.g., 4000 bytes). The host is not configured as a DNS resolver. Which attack is MOST likely occurring?

Accepted Answer

DNS tunneling. The scenario describes a single internal host initiating a surge of outgoing DNS queries to external servers and receiving unusually large responses (e.g., 4000 bytes). This behavior, particularly from a host not configured as a DNS resolver, is a strong indicator of DNS tunneling. In DNS tunneling, a compromised host establishes a covert communication channel by encapsulating data within DNS queries and responses, often for data exfiltration or command and control. Large DNS responses, frequently utilizing record types like TXT, are commonly employed to transfer significant amounts of data back to the compromised host. DNS amplification DDoS attacks, in contrast, involve an attacker spoofing a victim's IP address to send small queries to open resolvers, causing the victim to be overwhelmed by large, unsolicited responses; the victim does not actively send the initial queries in this scenario.

Answer

DNS cache poisoning

Answer

DNS zone transfer

Answer

DNS amplification DDoS attack

Question 8

A security analyst is investigating a suspicious file and wants to quickly determine whether it is known malware without executing it. Which approach should the analyst use FIRST?

Accepted Answer

Submit the file to VirusTotal for hash lookup. Submitting the file's hash to VirusTotal is the fastest and safest first step to determine if the file is known malware. VirusTotal aggregates results from over 70 antivirus engines and threat intelligence feeds, allowing the analyst to check the file's reputation without any risk of execution or analysis overhead. This approach leverages existing threat intelligence to instantly identify known malicious samples, which is the most efficient initial triage step.

Answer

Disassemble the file with IDA Pro

Answer

Check for strings in the binary

Answer

Run the file in a sandbox environment

Question 9

A company's security team wants to deploy a DDoS mitigation technique that distributes incoming traffic across multiple servers in different geographic locations, making it harder for an attacker to overwhelm a single target. Which technique BEST fits this description?

Accepted Answer

Anycast network. Anycast network routing allows the same IP address to be advertised from multiple geographically distributed servers. When traffic arrives, BGP (Border Gateway Protocol) automatically directs each packet to the nearest or best-path server, effectively spreading the load and absorbing volumetric DDoS attacks by preventing any single server from becoming a bottleneck.

Answer

Rate limiting

Answer

Load balancer

Answer

Scrubbing center

Question 10

Which TWO types of malware typically require user interaction (e.g., opening a file or clicking a link) to activate? (Select two.)

Accepted Answer

Ransomware. Ransomware often requires user interaction to execute, such as opening a malicious email attachment or clicking a deceptive link, which triggers the encryption process. The Trojan horse similarly relies on user action to install, as it disguises itself as a legitimate file or program that the user willingly opens or runs. Both types depend on social engineering to bypass technical controls and initiate the infection.

Answer

Polymorphic virus

Answer

Worm

Question 11

Which TWO of the following are examples of static malware analysis techniques? (Select two.)

Accepted Answer

Checking file hash on VirusTotal. Checking a file hash on VirusTotal is a static analysis technique: it compares the cryptographic hash (e.g., MD5, SHA-1, SHA-256) of the binary against known malware signatures without executing the file. This allows you to leverage community-sourced detection results and metadata without running the sample, preserving the integrity of the analysis environment. Examining strings in the binary is also a static analysis technique, as it involves inspecting the file's contents for readable text, function names, or other embedded data without executing the code.

Answer

Running the malware in a sandbox

Answer

Capturing network traffic during execution

Answer

Monitoring process behavior with Process Monitor

Question 12

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's webmail portal. The attempts use common usernames like 'admin', 'user', and 'test'. Which type of social engineering attack is MOST likely being attempted?

Accepted Answer

Pretexting. The explanation incorrectly attempts to redefine 'pretexting' to encompass automated login attempts against a system. Pretexting is a social engineering technique that relies on manipulating human psychology by creating a fabricated scenario to deceive a *human* target into divulging information or performing an action. Automated login attempts, even with common usernames, are a technical attack against an authentication mechanism, not a social engineering attack against a human. The attacker is not 'creating a false pretext' to a system in the social engineering sense; they are attempting to authenticate.

Answer

Tailgating

Answer

Baiting

Answer

Phishing

Question 13

Which TWO of the following are valid techniques for session hijacking? (Select 2)

Accepted Answer

TCP sequence prediction. TCP sequence prediction is a valid session hijacking technique because it allows an attacker to spoof a legitimate client's TCP connection by predicting the sequence numbers used for packet ordering. By correctly guessing the next sequence number, the attacker can inject malicious packets into the established session, effectively hijacking it without needing the client's credentials.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning

Question 14

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Anycast network distribution. Anycast network distribution is effective because it routes traffic to the nearest or best-performing server among multiple geographically dispersed nodes, using BGP to announce the same IP address from multiple locations. This disperses attack traffic across many servers, preventing any single node from being overwhelmed and absorbing volumetric DDoS attacks at the network edge.

Answer

Disabling TCP SYN cookies

Answer

Using a single server with high bandwidth

Question 15

A security analyst observes repeated failed login attempts from a single IP address targeting multiple user accounts. Which type of social engineering attack is being attempted?

Accepted Answer

Brute force attack. The explanation accurately describes a brute force attack and correctly links it to the scenario provided. However, it does not address the 'social engineering' aspect of the stem, as a brute force attack is not typically classified as social engineering.

Answer

Tailgating

Answer

Phishing attack

Answer

Shoulder surfing

Question 16

An attacker sends an email that appears to come from the CEO, requesting that the recipient urgently transfer funds to a specified account. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. This is a whaling attack because the attacker impersonates a high-profile individual (the CEO) to manipulate the recipient into transferring funds. Whaling is a targeted phishing attack that either targets senior executives or uses their identity to deceive others. Here, the impersonation of the CEO characterizes it as whaling, as it leverages the authority of a top executive to bypass security protocols.

Answer

Whaling

Answer

Baiting

Answer

Phishing

Question 17

Which TWO of the following are effective mitigation techniques against DDoS attacks? (Select two)

Accepted Answer

Rate limiting. Rate limiting is a direct mitigation technique against DDoS attacks because it restricts the number of requests a server or network device will accept from a single source within a specific time window, preventing any single source from overwhelming resources. It operates at various layers (e.g., network, application) and can be implemented via iptables, mod_evasive, or cloud-based Web Application Firewalls (WAFs) to throttle traffic and maintain availability.

Scrubbing centers are specialized services, often provided by third-party vendors, that act as an intermediary for network traffic. During a DDoS attack, all incoming traffic is rerouted to the scrubbing center, where sophisticated filtering techniques are applied to identify and remove malicious DDoS traffic. Only clean, legitimate traffic is then forwarded to the target server or network, ensuring service availability and protecting infrastructure from the attack's full impact.

Answer

Port knocking

Answer

ARP poisoning

Answer

MAC filtering

Question 18

Which THREE of the following are indicators that a system may be infected with a backdoor Trojan? (Select three)

Accepted Answer

Unexpected network traffic on ports typically used for remote administration. A backdoor Trojan often opens a port on the infected system to allow remote access. Unexpected traffic on ports commonly used for remote administration (e.g., TCP 3389 for RDP, TCP 22 for SSH, or TCP 23 for Telnet) indicates that the Trojan may be listening for or communicating with an attacker, as legitimate use of these ports would be known and expected.

Answer

Persistent high CPU usage by a single process

Answer

Increased number of DNS queries to known legitimate sites

Question 19

During a penetration test, a security analyst captures network traffic and observes a series of ARP replies without corresponding ARP requests. An internal host's IP address is suddenly associated with two different MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP poisoning. D is correct because ARP poisoning (also known as ARP spoofing) involves sending forged ARP replies to associate a target IP address with an attacker's MAC address, allowing man-in-the-middle attacks. The observation of unsolicited ARP replies (gratuitous ARPs) that map one IP to two different MAC addresses is the classic signature of an ongoing ARP poisoning attack.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 20

Which THREE of the following are common indicators of a man-in-the-middle attack using ARP spoofing? (Choose three.)

Accepted Answer

Multiple MAC addresses associated with the same IP in the ARP cache. {"A":"Multiple MAC addresses associated with the same IP in the ARP cache is a primary indicator. ARP spoofing causes an IP address (e.g., the default gateway's IP) to be associated with the attacker's MAC address in the victim's ARP cache. Detection tools often look for an IP address being claimed by multiple MAC addresses or for frequent, unexpected changes in an IP's MAC mapping.","B":"Duplicate IP addresses in the ARP table is less precise. While ARP spoofing causes an IP to be associated with an incorrect MAC, an ARP table typically maintains a single entry per IP, updating the MAC address. The core issue is the *change* or *conflict* in MAC addresses for a single IP, which is better described by option A.","D":"Unusual ARP replies without corresponding requests is correct. Attackers send unsolicited (gratuitous) ARP replies to poison ARP caches without waiting for an ARP request.","E":"Increased network latency on the victim's connection is correct. Traffic routed through an attacker adds an extra hop and processing overhead, leading to noticeable latency."}

Answer

Duplicate IP addresses in the ARP table

Answer

A sudden spike in DNS traffic