CEH Malware, Social Engineering and Network Attacks Practice Test 11 — 15 Questions

Question 1

A security analyst captures network traffic and sees a sequence of ARP replies with the same IP address mapping to different MAC addresses within a short period. Which attack is indicated?

Accepted Answer

ARP poisoning. B is correct because ARP poisoning (also called ARP spoofing) involves sending forged ARP replies that map a target IP address (e.g., the default gateway) to the attacker's MAC address. The rapid sequence of ARP replies with the same IP but different MACs is a classic indicator of an active ARP poisoning attack, where the attacker floods the network to corrupt the ARP cache of hosts.

Answer

DNS spoofing

Answer

DHCP starvation

Answer

MAC flooding

Question 2

An attacker sends an email to the CEO of a company, pretending to be a board member and requesting a wire transfer for a confidential acquisition. Which social engineering attack is this?

Accepted Answer

Whaling. Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like C-suite executives or board members. In this scenario, the attacker impersonates a board member to trick the CEO into authorizing a wire transfer, which is a classic whaling tactic because it exploits the authority and trust associated with senior leadership.

Answer

Vishing

Answer

Spear phishing

Answer

Phishing

Question 3

A security analyst uses a tool to capture packets in promiscuous mode on a network segment. The analyst notices that only traffic to and from the analyst's machine is captured, not all traffic on the segment. What is the most likely reason?

Accepted Answer

The network is using a switch instead of a hub. A switch forwards frames only to the specific port associated with the destination MAC address, unlike a hub which floods all traffic to every port. When a security analyst captures packets in promiscuous mode on a switch, the NIC can see only the frames destined for or originating from that port, plus broadcast/multicast frames. Therefore, the most likely reason only traffic to/from the analyst's machine is captured is that the network uses a switch, not a hub.

Answer

The switch is preventing sniffing due to port security

Answer

The analyst is not using the correct filter in Wireshark

Answer

The network interface is not in promiscuous mode

Question 4

Which of the following is the BEST defense against a TCP SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies are the best defense against TCP SYN flood attacks because they allow the server to avoid allocating resources for half-open connections until the handshake is completed. When a SYN cookie is used, the server encodes connection state information into the initial sequence number (ISN) sent in the SYN-ACK, and only commits memory upon receiving a valid ACK from the client. This prevents the exhaustion of the SYN backlog queue, which is the primary target of a SYN flood.

Answer

Ingress filtering

Answer

Intrusion detection system

Answer

Rate limiting

Question 5

A penetration tester uses a tool to spoof ARP replies, redirecting traffic through the tester's machine. The tester then captures credentials from the redirected traffic. Which tool is BEST suited for this task?

Accepted Answer

Ettercap. Ettercap is the best tool for ARP spoofing because it is specifically designed for man-in-the-middle (MITM) attacks on local networks. It actively sends forged ARP replies to poison the ARP cache of target hosts, redirecting traffic through the attacker's machine, and includes built-in packet capture and credential extraction features.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 6

An employee receives an SMS message that claims to be from the IT department, asking the employee to click a link to verify their email account. Which social engineering attack is this?

Accepted Answer

SMiShing. C is correct because SMiShing (SMS phishing) specifically uses SMS text messages as the attack vector to deliver a malicious link or request, exactly as described in the scenario. Unlike email-based phishing, SMiShing exploits the trust users place in text messages and often bypasses email security filters.

Answer

Vishing

Answer

Phishing

Answer

Whaling

Question 7

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

It uses encryption to hide its payload. Polymorphic viruses use encryption to hide their payload from signature-based detection. Each time the virus replicates, it generates a new encryption key and a corresponding decryption routine, making the encrypted payload appear different while the underlying malicious code remains the same.

Answer

It requires user interaction to activate

Answer

It infects only the boot sector

Answer

It spreads via email attachments only

Question 8

Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)

Accepted Answer

Configuring port security on switches. Configuring port security on switches is effective against ARP poisoning because it limits the number of MAC addresses allowed on a port, preventing an attacker from flooding the network with spoofed MAC addresses. By restricting the port to a single or limited set of MAC addresses, it stops unauthorized devices from injecting fake ARP replies. This is a Layer 2 security control that directly mitigates the ability to perform ARP cache poisoning at the access edge.

Answer

Enabling DHCP snooping

Answer

Disabling STP on all ports

Question 9

A security analyst notices a significant increase in outbound traffic from an internal server to multiple external IPs on port 443. The server is not a web server and should not be initiating such connections. Which type of malware is MOST likely causing this behavior?

Accepted Answer

A backdoor Trojan. A backdoor Trojan is designed to give an attacker remote control over an infected system, often using outbound connections on common ports like 443 (HTTPS) to blend in with normal traffic. Since the server is not a web server and should not be initiating outbound HTTPS connections, this anomalous behavior strongly indicates a backdoor Trojan is exfiltrating data or receiving commands via encrypted channels.

Answer

A boot sector virus

Answer

A fileless virus

Answer

A worm

Question 10

Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing capabilities. It actively sends forged ARP replies to poison the ARP cache of target hosts, allowing the attacker to intercept, modify, or drop traffic between them. This makes it the standard tool for ARP-based MITM attacks.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 11

An attacker uses the Social Engineering Toolkit (SET) to craft a phishing email that appears to come from the company's CEO, requesting the recipient to urgently wire funds to a new vendor. This attack is BEST described as which type of social engineering?

Accepted Answer

Whaling. Whaling is a targeted phishing attack aimed at high-profile individuals like the CEO or CFO. In this scenario, the attacker uses SET to impersonate the CEO and requests an urgent wire transfer, which is a classic whaling tactic because it targets a senior executive (the recipient) with a business-critical request. The attack is not generic phishing but specifically targets a 'big fish' within the organization.

Answer

Pretexting

Answer

Spear phishing

Answer

Quid pro quo

Question 12

During a penetration test, a tester captures network traffic and notices a large number of ARP replies claiming that 192.168.1.1 is at MAC address 00:11:22:33:44:55, which is different from the legitimate gateway MAC. Which attack is likely in progress?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) is the correct answer because the attacker is sending forged ARP replies that associate the legitimate gateway IP (192.168.1.1) with an attacker-controlled MAC address (00:11:22:33:44:55). This causes victim hosts to update their ARP cache with the false mapping, redirecting traffic intended for the gateway to the attacker's machine, enabling man-in-the-middle (MITM) attacks.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 13

A security administrator notices that the network switch is broadcasting traffic to all ports as if it were a hub. The switch logs show a sudden flood of packets with random MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. B is correct because MAC flooding attacks exploit the limited size of a switch's Content Addressable Memory (CAM) table. By sending a flood of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail-open into hub mode (broadcasting all traffic to all ports) so that the attacker can capture frames not originally destined for their port.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 14

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

Accepted Answer

UDP flood. A UDP flood attack works by overwhelming a target server with a high volume of UDP packets sent to random high-numbered ports. The server checks each port for a listening application, and when none is found, it responds with ICMP Destination Unreachable messages, consuming CPU and bandwidth until the server becomes unresponsive. The use of spoofed source IP addresses makes it difficult to filter the attack traffic based on source alone.

Answer

ICMP flood

Answer

SYN flood

Answer

Smurf attack

Question 15

A SOC analyst observes a high number of incomplete TCP connections with the SYN flag set but no corresponding ACK from the target. The source IPs are spoofed and the connections are targeting port 80 on a web server. Which DDoS mitigation technique would be MOST effective in this scenario?

Accepted Answer

SYN cookies. SYN cookies are the most effective mitigation against SYN flood attacks because they allow the server to avoid allocating resources for half-open connections until the handshake is completed. When the SYN queue is full, the server generates a cookie based on the connection parameters and sends it in the SYN-ACK; only when the client returns a valid ACK with the cookie does the server establish the connection. This technique prevents resource exhaustion from spoofed SYN packets targeting port 80.

Answer

Rate limiting

Answer

Anycast distribution

Answer

Ingress filtering