CEH Malware, Social Engineering and Network Attacks — 30 Questions

Question 1

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. In this case, the caller impersonates IT support to establish a false sense of authority and urgency, directly asking for the password. This differs from vishing, which is voice-based phishing but typically involves a generic, automated or scripted request rather than a crafted, interactive pretext.

Answer

Phishing

Answer

Baiting

Answer

Vishing

Question 2

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

Accepted Answer

An attacker is performing TCP sequence prediction to hijack the session.. The observed sequence numbers (initial seq=100, ack=300, then seq=300, ack=101) indicate that the ACK packet acknowledges a sequence number that was never sent by the original sender, which is a classic sign of TCP sequence number prediction. An attacker who predicts the next expected sequence number can inject a spoofed packet to hijack the session, and the subsequent RST is often used by the attacker to tear down the legitimate connection or cover their tracks.

Answer

A normal TCP connection establishment followed by an immediate termination.

Answer

A man-in-the-middle attack using ARP spoofing.

Answer

A TCP SYN flood attack is in progress.

Question 3

An IDS alerts on a large number of outbound DNS queries from an internal host to a suspicious domain. The queries have random subdomains and the response size is large. Which attack is MOST likely in progress?

Accepted Answer

DNS amplification attack. The described behavior—large numbers of outbound DNS queries with random subdomains and large response sizes—is the hallmark of a DNS amplification attack. In this attack, the attacker spoofs the victim's IP address and sends queries with random subdomains to open DNS resolvers, which then send large responses (often 10x to 50x larger than the query) to the victim, overwhelming their bandwidth. The IDS alerts on the outbound queries from the internal host because that host is the victim receiving the amplified responses, not the attacker.

Answer

Slowloris attack

Answer

UDP flood

Answer

DNS tunneling

Question 4

A security analyst receives an alert indicating that a host on the internal network is sending a high volume of ICMP echo requests to multiple external IP addresses. The analyst notices that the source IP address is spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

Ping flood. The attack described is a Ping flood (option D). A Ping flood involves sending a high volume of ICMP echo requests (pings) directly to multiple target IP addresses, often with a spoofed source IP to hide the attacker's identity. This overwhelms the targets' network resources. Unlike a Smurf attack, which uses a network broadcast address to amplify traffic, this scenario shows direct flooding of multiple external IPs, characteristic of a Ping flood.

Answer

Fraggle attack

Answer

ICMP flood

Answer

Smurf attack

Question 5

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. HTTP flood (A) is an application-layer (Layer 7) DDoS attack because it sends massive volumes of seemingly legitimate HTTP GET or POST requests to exhaust a web server's resources, such as worker threads, database connections, or CPU. Slowloris (E) is also an application-layer attack: it opens many partial HTTP connections and sends incomplete headers slowly, keeping sockets open and tying up the web server's connection pool without ever completing a request. By contrast, ICMP flood (B) operates at the network layer (Layer 3) using ICMP echo requests, SYN flood (C) targets the transport layer (Layer 4) by abusing the TCP three-way handshake with half-open connections, and UDP flood (D) is a transport/network-layer volumetric attack that saturates bandwidth with UDP datagrams — none of these three are application-layer attacks.

Answer

ICMP flood

Answer

SYN flood

Answer

UDP flood

Question 6

Which TWO types of malware typically require user interaction (e.g., opening a file or clicking a link) to activate? (Select two.)

Accepted Answer

Ransomware. Ransomware (A) is correct because it typically arrives as an email attachment or malicious link that the victim must open or click before the payload encrypts files and demands payment. Macro virus (B) is correct because it lives inside documents such as Word or Excel files and only executes when the user opens the file and enables macros. Trojan horse (E) is correct because it masquerades as legitimate software and requires the user to download and run it before its malicious code activates. Polymorphic virus (C) is not correct here because its defining trait is mutating its code to evade signature detection, not requiring user interaction. Worm (D) is not correct because it self-replicates and spreads across networks automatically without any user action.

Answer

Polymorphic virus

Answer

Worm

Question 7

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's webmail portal. The attempts use common usernames like 'admin', 'user', and 'test'. Which type of social engineering attack is MOST likely being attempted?

Accepted Answer

Pretexting. The explanation incorrectly attempts to redefine 'pretexting' to encompass automated login attempts against a system. Pretexting is a social engineering technique that relies on manipulating human psychology by creating a fabricated scenario to deceive a *human* target into divulging information or performing an action. Automated login attempts, even with common usernames, are a technical attack against an authentication mechanism, not a social engineering attack against a human. The attacker is not 'creating a false pretext' to a system in the social engineering sense; they are attempting to authenticate.

Answer

Tailgating

Answer

Baiting

Answer

Phishing

Question 8

Which THREE of the following are examples of application-layer DDoS attacks? (Select 3)

Accepted Answer

Slowloris. Slowloris (A) is an application-layer DDoS attack because it opens many partial HTTP connections and holds them open with incomplete headers, exhausting the web server's connection pool at Layer 7. HTTP flood (B) is also application-layer, as it sends seemingly legitimate HTTP GET or POST requests to overwhelm a web application or API rather than the network stack. DNS amplification (D) is an application-layer attack because it abuses DNS queries (UDP/53) with spoofed source addresses to generate large responses toward the victim, magnifying traffic at the application protocol level. By contrast, SYN flood (C) is a transport-layer attack exploiting the TCP three-way handshake, and UDP flood (E) is a transport/network-layer volumetric attack, so neither belongs in the application-layer category.

Answer

SYN flood

Answer

UDP flood

Question 9

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature each time it replicates. A polymorphic virus mutates its code signature—often by altering the decryption routine or using different encryption keys—each time it replicates, which allows it to evade signature-based detection by antivirus software. Option E is correct because polymorphic viruses typically use encryption to hide their payload, with a variable decryption engine that changes the encrypted form of the virus body upon each infection.

Answer

It spreads via email attachments only

Answer

It requires a host file to attach

Answer

It self-replicates without user interaction

Question 10

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Anycast network distribution. Anycast network distribution (B) is effective because it advertises the same IP prefix from many geographically dispersed points of presence, so attack traffic is spread across many edge locations and can be absorbed or dropped close to its source rather than overwhelming one host. Scrubbing centers (C) are effective because they divert and clean traffic, using BGP announcements or DNS redirection to route suspicious flows through specialized appliances that filter malicious packets and forward only legitimate traffic to the origin. Rate limiting (D) is effective because it caps the number of requests or connections per source, subnet, or service within a time window, throttling volumetric floods such as HTTP request floods or SYN floods before they exhaust server resources. Disabling TCP SYN cookies (A) is wrong because SYN cookies are themselves a mitigation for SYN flood attacks, so turning them off removes a protection. Relying on a single server with high bandwidth (E) is wrong because a single point of presence has finite capacity and no redundancy, so a sufficiently large or multi-vector DDoS can still saturate its link and take the service offline.

Answer

Disabling TCP SYN cookies

Answer

Using a single server with high bandwidth

Question 11

A security analyst observes repeated failed login attempts from a single IP address targeting multiple user accounts. Which type of social engineering attack is being attempted?

Accepted Answer

Brute force attack. The explanation accurately describes a brute force attack and correctly links it to the scenario provided. However, it does not address the 'social engineering' aspect of the stem, as a brute force attack is not typically classified as social engineering.

Answer

Tailgating

Answer

Phishing attack

Answer

Shoulder surfing

Question 12

During a penetration test, you discover a process named 'svch0st.exe' running on a Windows server with high CPU usage. The file is not digitally signed. Which type of malware is MOST likely present?

Accepted Answer

Trojan. The process name 'svch0st.exe' mimics the legitimate Windows service host 'svchost.exe' but uses a zero instead of 'o', a common masquerading technique. The lack of a digital signature and high CPU usage indicate malicious activity, and because it appears to be a standalone executable disguised as a system process, it fits the definition of a Trojan—malware that deceives users into running it by appearing legitimate.

Answer

Polymorphic virus

Answer

Ransomware

Answer

Worm

Question 13

An attacker sends an email that appears to come from the CEO, requesting that the recipient urgently transfer funds to a specified account. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. This is a whaling attack because the attacker impersonates a high-profile individual (the CEO) to manipulate the recipient into transferring funds. Whaling is a targeted phishing attack that either targets senior executives or uses their identity to deceive others. Here, the impersonation of the CEO characterizes it as whaling, as it leverages the authority of a top executive to bypass security protocols.

Answer

Whaling

Answer

Baiting

Answer

Phishing

Question 14

An attacker wants to perform a man-in-the-middle attack on a local network. Which two tools from the following list would be most effective? (Select the best answer from the options below; note: this is a multiple choice, not multi-select) A) Wireshark B) Ettercap C) Nmap D) Metasploit E) Aircrack-ng

Accepted Answer

Ettercap and Wireshark. Ettercap is a dedicated man-in-the-middle (MITM) tool that performs ARP spoofing to intercept traffic between hosts on a switched LAN. Wireshark captures and analyzes the intercepted packets, allowing the attacker to view unencrypted data. Together, they form the classic ARP poisoning attack chain: Ettercap redirects traffic, Wireshark inspects it.

Answer

Nmap and Metasploit

Answer

Aircrack-ng and Wireshark

Answer

Ettercap and Nmap

Question 15

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is specifically designed to encrypt files on a victim's system using strong cryptographic algorithms (e.g., AES-256 for symmetric encryption, often paired with RSA-2048 for key exchange). After encryption, the malware displays a ransom note demanding payment (typically in cryptocurrency like Bitcoin) in exchange for the decryption key. This matches the description exactly, making option A correct.

Answer

Trojan

Answer

Spyware

Answer

Adware

Question 16

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern every time it infects a new file or system.. A polymorphic virus is designed to evade signature-based detection by mutating its code—typically using an encryption engine and a mutation engine—so that each infection generates a functionally identical but byte-wise different payload. This constant change in the virus's signature pattern prevents antivirus software from recognizing it through static file hashes or fixed byte sequences.

Answer

It spreads through network shares without requiring user interaction.

Answer

It remains dormant until a specific date or time.

Answer

It infects the master boot record of a hard drive.

Question 17

A company wants to defend against DNS amplification attacks. Which mitigation technique would be MOST effective?

Accepted Answer

Implementing rate limiting on DNS servers. B is correct because rate limiting restricts the number of DNS responses a server sends to a single source, reducing the volume of traffic that can be generated in an amplification attack. DNS amplification exploits open recursive resolvers to send small queries that yield large responses, and rate limiting directly curbs the attacker's ability to flood the victim with amplified traffic. This technique is specifically recommended in RFC 5358 and by industry best practices for mitigating reflection/amplification DDoS attacks.

Answer

Disabling recursive queries on DNS servers

Answer

Deploying anycast routing

Answer

Using a scrubbing center

Question 18

Which THREE of the following are common indicators of a man-in-the-middle attack using ARP spoofing? (Choose three.)

Accepted Answer

Multiple MAC addresses associated with the same IP in the ARP cache. Option A is correct because ARP spoofing often manifests as multiple MAC addresses mapped to the same IP in the ARP cache, indicating that an attacker is sending forged ARP replies to redirect traffic. Option D is correct because gratuitous or unsolicited ARP replies, which are ARP responses sent without a preceding ARP request, are a hallmark of ARP poisoning tools like arpspoof or Ettercap. Option E is correct because a man-in-the-middle attacker relays traffic through their own machine, adding an extra hop that typically introduces measurable latency on the victim's connection. Option B is not a standard indicator because duplicate IP addresses in an ARP table more commonly point to IP address conflicts or misconfiguration rather than ARP spoofing, which involves MAC-to-IP manipulation. Option C is not specific to ARP spoofing, as DNS traffic spikes can result from many benign causes such as malware, misconfigured clients, or legitimate high query volumes.

Answer

Duplicate IP addresses in the ARP table

Answer

A sudden spike in DNS traffic

Question 19

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

Slowloris. Slowloris (A) is an application-layer (Layer 7) DDoS attack because it opens many partial HTTP connections to a web server and keeps them alive by sending incomplete request headers, exhausting the server's connection pool without ever completing a request. HTTP flood (E) is also an application-layer attack because it sends a high volume of seemingly legitimate HTTP GET or POST requests that consume server, application, and database resources. Both target the application/HTTP protocol rather than the network or transport layers. By contrast, SYN flood (B) exploits the TCP three-way handshake at the transport layer, Smurf attack (C) abuses ICMP echo requests with a spoofed source address at the network layer, and UDP flood (D) overwhelms a target with UDP packets at the transport layer, so none of these are application-layer attacks.

Answer

SYN flood

Answer

Smurf attack

Answer

UDP flood

Question 20

Which THREE of the following are static malware analysis techniques? (Select 3)

Accepted Answer

Examining strings in the binary. Static malware analysis examines a file without executing it, so option A (examining strings in the binary) is correct because extracting printable ASCII/Unicode strings from the sample reveals URLs, IPs, registry keys, and API names without running the code. Option B (using PEiD to identify packers) is correct because PEiD inspects the PE header, section names, and signatures to detect packers/cryptors, which is a purely file-based inspection technique. Option C (scanning the file with VirusTotal) is correct because VirusTotal hashes the file and runs signature/static engines against it, providing detection results without executing the sample on the analyst's system. Option D (analyzing network traffic) is not static because it requires the malware to execute and communicate, making it dynamic/behavioral analysis. Option E (running the malware in a sandbox) is also dynamic analysis, since the sample is executed and its behavior observed.

Answer

Analyzing network traffic

Answer

Running the malware in a sandbox