CEH Malware, Social Engineering and Network Attacks Practice Test 10 — 15 Questions

Question 1

During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?

Accepted Answer

Ettercap. Ettercap is the correct answer because it is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing (poisoning) capabilities. It actively sends forged ARP replies to associate the tester's MAC address with the IP address of the target hosts, allowing interception of traffic between them on the same subnet. Other tools like Wireshark, Metasploit, and Nmap are not primarily designed for ARP spoofing.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 2

A security analyst runs the following command: 'python macof -i eth0 -n 1000'. Shortly after, the switch begins flooding traffic to all ports. What is the analyst trying to achieve?

Accepted Answer

MAC flooding to force the switch into hub mode for sniffing. The command 'python macof -i eth0 -n 1000' runs the macof tool, which generates a large number of frames with random source MAC addresses. This is a classic MAC flooding attack designed to overflow the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch can no longer learn new MAC addresses and falls back to flooding all incoming frames out of every port, effectively behaving like a hub, which allows the attacker to sniff traffic that would normally be isolated.

Answer

DHCP starvation to exhaust IP addresses

Answer

STP manipulation to cause network loops

Answer

ARP cache poisoning to redirect traffic

Question 3

A user reports that their system has become sluggish and they see pop-up advertisements even when no browser is open. Additionally, unknown processes are running in Task Manager. Which type of malware is most likely responsible?

Accepted Answer

Adware. Adware is designed to display unwanted advertisements, often in the form of pop-ups, and can degrade system performance by consuming CPU and memory resources. The presence of unknown processes in Task Manager indicates that the adware has installed additional components or bundled software that runs persistently, even when no browser is open, which is a hallmark of adware behavior.

Answer

Worm

Answer

Ransomware

Answer

Spyware

Question 4

A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?

Accepted Answer

DNS amplification. This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to multiple DNS servers, which then send large responses to the victim, overwhelming its DNS port (53). The key indicators are the use of UDP, port 53, spoofed source IP of the target, and the amplification effect where a small query generates a much larger response.

Answer

UDP flood

Answer

SYN flood

Answer

ICMP flood

Question 5

After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?

Accepted Answer

Static analysis. The analyst is performing static analysis because they are examining the file without executing it. Running the 'strings' command extracts readable text from the binary, and uploading to VirusTotal checks the file's hash against known malware signatures — both are non-behavioral, non-runtime techniques. Static analysis focuses on file properties, code structure, and metadata without triggering the malware's execution.

Answer

Behavioral analysis

Answer

Code analysis

Answer

Dynamic analysis

Question 6

A penetration tester successfully predicts the TCP sequence numbers of a target and sends crafted packets to impersonate a trusted host. Which type of attack is this?

Accepted Answer

TCP session hijacking. C is correct because the attacker predicts TCP sequence numbers to inject crafted packets, effectively impersonating a trusted host and taking over an established TCP session. This is the defining mechanism of TCP session hijacking, where the attacker spoofs the source IP and uses the predicted sequence numbers to insert malicious data or commands into the ongoing session.

Answer

ARP poisoning

Answer

TCP sequence prediction attack

Answer

DNS spoofing

Question 7

Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?

Accepted Answer

File virus. A file virus (also known as a file infector) is a type of malware that replicates by inserting its code into executable files (e.g., .exe, .com, .dll). It requires human action to spread, such as opening an infected email attachment or running an infected program, because the virus code is only activated when the host executable is executed.

Answer

Worm

Answer

Ransomware

Answer

Trojan

Question 8

A security analyst notices that a web server is responding very slowly to legitimate requests. The server logs show many incomplete HTTP GET requests that never complete, each opened slowly over time from many different IP addresses. Which attack is most likely occurring?

Accepted Answer

Slowloris. Slowloris is a denial-of-service attack that works by opening multiple HTTP connections to a target web server and sending partial HTTP GET requests, never completing them. The server keeps these connections open waiting for the request to finish, eventually exhausting its connection pool and denying service to legitimate users. The key indicators are many incomplete GET requests from diverse IPs and slow server response, which match the scenario exactly.

Answer

Ping of Death

Answer

HTTP flood

Answer

SYN flood

Question 9

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area without presenting their own credentials. The attacker exploits the authorized person's trust or politeness to bypass access control systems such as badge readers or biometric locks. This technique relies on the human factor rather than technical vulnerabilities.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 10

A system administrator receives a phone call from someone claiming to be from IT support, asking for the administrator's password to 'fix a server issue'. This is an example of which social engineering attack?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker fabricates a scenario (pretext) to manipulate the target into divulging sensitive information. In this case, the attacker impersonates IT support and invokes a fake server issue to create urgency, directly requesting the administrator's password. This aligns with the CEH definition of pretexting as a confidence-building deception, not a technical exploit.

Answer

Vishing

Answer

Baiting

Answer

Phishing

Question 11

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It uses a decryption routine that varies. A polymorphic virus uses a decryption routine that varies with each infection, preventing signature-based detection. Option C is also correct because the changing decryption routine causes the virus's code signature to change each time it replicates, further evading signature matching.

Answer

It uses a constant signature across all infections

Answer

It can only infect boot sectors

Answer

It always remains in memory

Question 12

A security analyst notices that an internal server is sending a high volume of DNS queries to external servers for non-existent domains. Which type of malware behavior is MOST likely being observed?

Accepted Answer

A worm spreading across the network. A high volume of DNS queries to external servers for non-existent domains is a classic indicator of a worm using DNS as a covert channel for command-and-control (C2) communication or propagation. Worms often generate random domain names (e.g., Domain Generation Algorithm, DGA) to evade static blocklists, and the high query rate reflects attempts to resolve these domains to locate a C2 server or to spread to new hosts via DNS-based discovery.

Answer

Spyware exfiltrating data

Answer

A keylogger capturing keystrokes

Answer

Ransomware encrypting files

Question 13

During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is the correct answer because the attacker fabricates a scenario (the pretext of being a new employee with a locked account) to manipulate the help desk into performing a password reset. This technique relies on a crafted story to gain trust and bypass security procedures, rather than using technical exploits or direct requests for information.

Answer

Phishing

Answer

Vishing

Answer

Quid pro quo

Question 14

An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?

Accepted Answer

Slowloris. Slowloris is a low-and-slow application-layer DoS attack that opens multiple HTTP connections to the target server and keeps them alive by sending partial HTTP GET requests with random parameters, never completing the request. This exhausts the server's connection pool, preventing legitimate users from connecting, while each request takes a long time due to the server waiting for the final headers.

Answer

UDP flood

Answer

SYN flood

Answer

HTTP flood

Question 15

Which tool is specifically designed to automate social engineering attacks, such as phishing and credential harvesting?

Accepted Answer

SET. The Social Engineering Toolkit (SET) is an open-source Python-driven framework specifically designed to automate social engineering attacks, including phishing campaigns, credential harvesting via cloned websites, and spear-phishing payloads. It integrates with Metasploit for payload delivery but is distinct in its focus on manipulating human behavior rather than exploiting technical vulnerabilities.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit