CEH Malware, Social Engineering and Network Attacks Practice Test 10 — 15 Questions

Question 1

A security analyst notices that an internal server is sending a high volume of DNS queries to external servers for non-existent domains. Which type of malware behavior is MOST likely being observed?

Accepted Answer

A worm spreading across the network. A worm self-replicates across the network, often generating unusual DNS queries as it spreads.

Answer

Spyware exfiltrating data

Answer

A keylogger capturing keystrokes

Answer

Ransomware encrypting files

Question 2

During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain information or action.

Answer

Phishing

Answer

Vishing

Answer

Quid pro quo

Question 3

A security analyst runs 'strings malware.exe' and finds several URLs and IP addresses. The analyst then uploads the file to VirusTotal and gets a detection ratio of 5/70. What type of analysis has been performed?

Accepted Answer

Static analysis. Using strings and VirusTotal are static analysis methods—examining the binary without execution.

Answer

Memory analysis

Answer

Reverse engineering

Answer

Dynamic analysis

Question 4

An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?

Accepted Answer

Slowloris. Slowloris sends partial HTTP requests to keep connections open, exhausting the server's connection pool.

Answer

UDP flood

Answer

SYN flood

Answer

HTTP flood

Question 5

Which tool is specifically designed to automate social engineering attacks, such as phishing and credential harvesting?

Accepted Answer

SET. The Social Engineering Toolkit (SET) is a well-known framework for automating social engineering attacks.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 6

A network administrator receives an alert that the switch's CAM table is full, causing the switch to flood frames out all ports. Which attack has likely occurred?

Accepted Answer

MAC flooding. MAC flooding attacks fill the CAM table to force the switch into hub mode for sniffing.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

SYN flood

Question 7

A security analyst captures network traffic and sees a sequence of ARP replies with the same IP address mapping to different MAC addresses within a short period. Which attack is indicated?

Accepted Answer

ARP poisoning. ARP poisoning involves sending spoofed ARP replies to associate an IP with multiple MACs, enabling MITM.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

MAC flooding

Question 8

An attacker sends an email to the CEO of a company, pretending to be a board member and requesting a wire transfer for a confidential acquisition. Which social engineering attack is this?

Accepted Answer

Whaling. Whaling targets high-profile individuals (e.g., CEO) with a crafted message.

Answer

Vishing

Answer

Spear phishing

Answer

Phishing

Question 9

A security analyst uses a tool to capture packets in promiscuous mode on a network segment. The analyst notices that only traffic to and from the analyst's machine is captured, not all traffic on the segment. What is the most likely reason?

Accepted Answer

The network is using a switch instead of a hub. A switch only forwards traffic to the port where the destination MAC resides; promiscuous mode only affects the local NIC, not switch behavior.

Answer

The switch is preventing sniffing due to port security

Answer

The analyst is not using the correct filter in Wireshark

Answer

The network interface is not in promiscuous mode

Question 10

Which of the following is the BEST defense against a TCP SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies allow the server to avoid allocating resources until the handshake completes, mitigating SYN flood.

Answer

Ingress filtering

Answer

Intrusion detection system

Answer

Rate limiting

Question 11

A penetration tester uses a tool to spoof ARP replies, redirecting traffic through the tester's machine. The tester then captures credentials from the redirected traffic. Which tool is BEST suited for this task?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for MITM attacks, including ARP poisoning and sniffing.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 12

An employee receives an SMS message that claims to be from the IT department, asking the employee to click a link to verify their email account. Which social engineering attack is this?

Accepted Answer

SMiShing. SMiShing is phishing via SMS text messages.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 13

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

It uses encryption to hide its payload. Polymorphic viruses mutate their code to evade signature detection while retaining functionality.

Answer

It requires user interaction to activate

Answer

It infects only the boot sector

Answer

It spreads via email attachments only

Question 14

Which TWO of the following are examples of protocol-based DoS attacks? (Choose two.)

Accepted Answer

Smurf attack. SYN flood and Smurf attack exploit TCP/IP protocol weaknesses.

Answer

HTTP flood

Answer

Slowloris

Answer

UDP flood

Question 15

Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)

Accepted Answer

Configuring port security on switches. Static ARP entries, dynamic ARP inspection, and port security help prevent ARP poisoning.

Answer

Enabling DHCP snooping

Answer

Disabling STP on all ports