CEH Malware, Social Engineering and Network Attacks Practice Test 11 — 15 Questions

Question 1

A security analyst notices a significant increase in outbound traffic from an internal server to multiple external IPs on port 443. The server is not a web server and should not be initiating such connections. Which type of malware is MOST likely causing this behavior?

Accepted Answer

A backdoor Trojan. A backdoor Trojan allows an attacker to remotely control the infected system. The outbound connections are likely command-and-control traffic over HTTPS to hide from network monitoring.

Answer

A boot sector virus

Answer

A fileless virus

Answer

A worm

Question 2

Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a well-known suite for ARP poisoning, enabling MITM attacks. It can intercept traffic between hosts on a switched network.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 3

An attacker uses the Social Engineering Toolkit (SET) to craft a phishing email that appears to come from the company's CEO, requesting the recipient to urgently wire funds to a new vendor. This attack is BEST described as which type of social engineering?

Accepted Answer

Whaling. Whaling targets senior executives or high-profile individuals. The email impersonates the CEO, a typical whaling scenario. Spear phishing is targeted but not necessarily at executives.

Answer

Pretexting

Answer

Spear phishing

Answer

Quid pro quo

Question 4

During a penetration test, a tester captures network traffic and notices a large number of ARP replies claiming that 192.168.1.1 is at MAC address 00:11:22:33:44:55, which is different from the legitimate gateway MAC. Which attack is likely in progress?

Accepted Answer

ARP poisoning. ARP spoofing (or ARP poisoning) involves sending forged ARP replies to associate the attacker's MAC with the IP of a legitimate host (here, the gateway). This enables MITM attacks.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 5

A security administrator notices that the network switch is broadcasting traffic to all ports as if it were a hub. The switch logs show a sudden flood of packets with random MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. MAC flooding attacks send many frames with different source MAC addresses, overflowing the switch's CAM table. The switch then fails to learn MAC addresses and broadcasts frames to all ports.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 6

A malware analyst wants to examine a suspicious executable without executing it. The goal is to extract strings, view the PE header, and check for known signatures. Which approach is the analyst using?

Accepted Answer

Static analysis. Static analysis involves examining the file without executing it. Techniques include string extraction, PE header analysis, and signature-based checks (e.g., VirusTotal).

Answer

Dynamic analysis

Answer

Heuristic analysis

Answer

Reverse engineering

Question 7

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

Accepted Answer

UDP flood. A UDP flood is a volumetric attack that sends many UDP packets to random ports, overwhelming the target's ability to process them.

Answer

ICMP flood

Answer

SYN flood

Answer

Smurf attack

Question 8

A SOC analyst observes a high number of incomplete TCP connections with the SYN flag set but no corresponding ACK from the target. The source IPs are spoofed and the connections are targeting port 80 on a web server. Which DDoS mitigation technique would be MOST effective in this scenario?

Accepted Answer

SYN cookies. SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake. SYN cookies allow the server to avoid storing half-open connections, effectively mitigating SYN floods.

Answer

Rate limiting

Answer

Anycast distribution

Answer

Ingress filtering

Question 9

Which type of malware is characterized by encrypting a victim's files and demanding a ransom payment for the decryption key?

Accepted Answer

Ransomware. Ransomware encrypts files and demands payment for decryption. Examples include CryptoLocker, WannaCry, and Locky.

Answer

Spyware

Answer

Adware

Answer

Keylogger

Question 10

A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?

Accepted Answer

Ettercap. Ettercap includes a DNS spoofing plugin that allows the attacker to redirect DNS requests to arbitrary IP addresses.

Answer

Nmap

Answer

Wireshark

Answer

tcpdump

Question 11

During a forensic investigation, an analyst finds a suspicious file that changes its code signature each time it replicates. The file uses encryption and polymorphism to evade signature-based detection. Which type of virus is this?

Accepted Answer

Polymorphic virus. A polymorphic virus mutates its code (often using encryption) while preserving its functionality, producing different signatures with each infection.

Answer

Macro virus

Answer

File infector virus

Answer

Boot sector virus

Question 12

An employee receives a text message claiming to be from the company's IT department, stating that their account will be suspended unless they click a link to verify their credentials. Which type of social engineering attack is this?

Accepted Answer

SMiShing. SMiShing (SMS phishing) is a phishing attack conducted via SMS text messages. The message uses urgency to trick the recipient into revealing credentials.

Answer

Vishing

Answer

Phishing

Answer

Baiting

Question 13

Which TWO of the following are characteristics of a SYN flood attack? (Select 2)

Accepted Answer

It exploits the TCP three-way handshake. SYN flood attacks send many SYN packets (often with spoofed IPs) and do not complete the handshake, leaving half-open connections that exhaust server resources.

Answer

It uses UDP amplification

Answer

It sends a large number of ICMP echo requests

Answer

It requires the attacker to have a botnet

Question 14

Which THREE of the following are common methods used to mitigate DDoS attacks? (Select 3)

Accepted Answer

Rate limiting. Rate limiting reduces traffic volume, scrubbing centers filter malicious traffic, and anycast distributes traffic across multiple nodes to absorb attacks. Black hole routing is also used but is a more drastic measure.

Answer

MAC flooding

Answer

ARP poisoning

Question 15

Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. Slowloris keeps many connections open by sending partial HTTP requests, and HTTP flood sends a high volume of legitimate-looking HTTP requests. Both target the application layer.

Answer

Smurf attack

Answer

SYN flood

Answer

UDP flood