CEH Malware, Social Engineering and Network Attacks — 40 Questions

Question 1

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP Echo Request packets to a network broadcast address with a spoofed source IP (the target). All hosts on the network reply to the target, flooding it with ICMP Echo Replies.

Answer

UDP flood

Answer

Ping of Death

Answer

ICMP flood

Question 2

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain information. Here the attacker pretends to be IT support to trick the user into revealing their password.

Answer

Phishing

Answer

Baiting

Answer

Vishing

Question 3

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning, DNS spoofing, and packet sniffing.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 4

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

Accepted Answer

An attacker is performing TCP sequence prediction to hijack the session.. The sequence numbers (100, 300) suggest the attacker correctly guessed the TCP sequence numbers to spoof a connection. The three-way handshake completes (SYN, SYN-ACK, ACK), then the attacker sends a RST to close. This is indicative of TCP sequence prediction attack (session hijacking attempt).

Answer

A normal TCP connection establishment followed by an immediate termination.

Answer

A man-in-the-middle attack using ARP spoofing.

Answer

A TCP SYN flood attack is in progress.

Question 5

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Accepted Answer

Static analysis using strings and PEiD. Static analysis (e.g., examining strings, digital signatures, PE headers) is the first step because it is safe and can quickly identify suspicious indicators without executing the file.

Answer

Upload to VirusTotal

Answer

Dynamic analysis in a sandbox

Answer

Run the file on a production system to observe behavior

Question 6

An organization is experiencing repeated DDoS attacks that consume all available bandwidth. Which mitigation technique is MOST effective for handling such volumetric attacks?

Accepted Answer

Scrubbing centers. Scrubbing centers filter malicious traffic and forward clean traffic to the target, handling high-volume attacks effectively.

Answer

Blackholing all traffic to the target IP

Answer

Anycast network distribution

Answer

Rate limiting on the firewall

Question 7

Which type of malware is characterized by self-replication and spreading across networks without needing a host file?

Accepted Answer

Worm. Worms are standalone programs that replicate and spread independently, often exploiting network vulnerabilities.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 8

A penetration tester uses the Social Engineering Toolkit (SET) to create a malicious USB drive that autoruns when inserted. Which social engineering technique is being employed?

Accepted Answer

Baiting. Baiting involves leaving a physical device (e.g., USB drive) in a location where the victim will find and use it, often with enticing labels.

Answer

Tailgating

Answer

Pretexting

Answer

Phishing

Question 9

An IDS alerts on a large number of outbound DNS queries from an internal host to a suspicious domain. The queries have random subdomains and the response size is large. Which attack is MOST likely in progress?

Accepted Answer

DNS amplification attack. A DNS amplification attack uses open DNS resolvers to send large responses to a spoofed victim IP. The random subdomains are used to generate large responses, and the outbound queries are from the internal host acting as reflector.

Answer

Slowloris attack

Answer

UDP flood

Answer

DNS tunneling

Question 10

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files and demand ransom for the decryption key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 11

A network administrator notices that the switch's CAM table is full, causing the switch to flood all incoming traffic out of all ports. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. MAC flooding sends many Ethernet frames with different source MAC addresses to fill the switch's CAM table, forcing it into hub mode (flooding all traffic).

Answer

ARP poisoning

Answer

DHCP starvation

Answer

DNS spoofing

Question 12

During a penetration test, you capture the following output: 'HTTP/1.1 200 OK ... Set-Cookie: sessionid=abc123; path=/'. You then send a request with a modified cookie value 'sessionid=abc124' and receive a valid session. Which type of vulnerability has been exploited?

Accepted Answer

Session hijacking via cookie prediction. Session hijacking via cookie theft/prediction. The attacker guessed or brute-forced a valid session ID (abc124) after seeing the pattern (abc123).

Answer

Cross-site scripting

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 13

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature on each infection.. Polymorphic viruses change their code signature each time they replicate, making detection difficult. They often use encryption to hide malicious code.

Answer

It spreads without user interaction.

Answer

It attaches to a host file and does not change.

Answer

It only infects the boot sector.

Question 14

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Rate limiting. Scrubbing centers filter malicious traffic, rate limiting reduces impact, and anycast distribution spreads traffic across multiple servers. Blackholing drops all traffic (including legitimate), and IP spoofing is an attack technique.

Answer

Blackholing all traffic to the target

Answer

IP spoofing

Question 15

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. Slowloris holds connections open, and HTTP floods send many HTTP requests. SYN flood and ICMP flood are network-layer attacks.

Answer

UDP flood

Answer

ICMP flood

Answer

SYN flood

Question 16

A security analyst receives an alert indicating that a host on the internal network is sending a high volume of ICMP echo requests to multiple external IP addresses. The analyst notices that the source IP address is spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. A Smurf attack uses spoofed ICMP echo requests sent to a broadcast address, causing all hosts on the network to reply to the victim. However, the scenario describes sending to multiple external IPs, which is more characteristic of a DDoS amplification attack using ICMP. But given the options, Smurf is the closest match because it involves ICMP and spoofed source. Ping flood is a simpler flood without spoofing necessarily, and Fraggle uses UDP. Therefore, Smurf is correct.

Answer

Fraggle attack

Answer

ICMP flood

Answer

Ping flood

Question 17

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN, featuring ARP poisoning capabilities. Wireshark is a packet analyzer, Nmap is a network scanner, and Metasploit is an exploitation framework.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 18

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

Accepted Answer

Backdoor Trojan. Port 4444 is commonly associated with Metasploit's default reverse shell payload. The presence of 'cmd.exe /c' and an IP address indicates a backdoor that provides remote command execution, which is a Trojan backdoor or RAT.

Answer

Worm

Answer

Keylogger

Answer

Ransomware

Question 19

An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is a dedicated framework for social engineering attacks, including phishing campaigns. PhishMe and KnowBe4 are commercial platforms, but SET is the well-known open-source tool for this purpose.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 20

A security team observes that a switch's MAC address table is full, and the switch has started flooding unicast traffic to all ports. Which attack has MOST likely been performed?

Accepted Answer

MAC flooding. MAC flooding attacks fill the switch's CAM table, causing it to fail open and flood frames, enabling sniffing. MAC spoofing is about impersonating, ARP poisoning manipulates ARP caches, and DHCP starvation exhausts IP addresses.

Answer

ARP poisoning

Answer

MAC spoofing

Answer

DHCP starvation