CEH Malware, Social Engineering and Network Attacks Practice Test 12 — 15 Questions

Question 1

A security analyst receives an email from what appears to be the company's CEO requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ce0@company.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Whaling. Whaling specifically targets high-profile individuals like executives. The spoofed email address and urgent request for a wire transfer are classic indicators of a whaling attack.

Answer

Vishing

Answer

Phishing

Answer

Spear phishing

Question 2

A security analyst notices that a server is sending an unusually high number of SYN packets to multiple external hosts, but the connections are never completed. The server is most likely involved in which type of attack?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets without completing the handshake, exhausting target resources. The attacker's server is the source, indicating it is being used to launch the attack.

Answer

Ping of Death

Answer

Smurf attack

Answer

UDP flood

Question 3

A penetration tester needs to perform ARP poisoning to intercept traffic between two hosts on the same subnet. Which tool would be the most appropriate choice for this task?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN, including ARP poisoning. It provides packet sniffing, interception, and injection capabilities.

Answer

tcpdump

Answer

Nmap

Answer

Wireshark

Question 4

During a ransomware incident response, a forensic analyst recovers a suspicious file that appears to be a PE executable. The analyst wants to quickly check if the file is known malware without executing it. Which of the following is the BEST first step?

Accepted Answer

Submit the file hash to VirusTotal. VirusTotal aggregates many antivirus engines and provides a quick reputation check. Submitting the file hash (or the file itself) is non-invasive and immediately reveals known malicious indicators.

Answer

Disassemble the file using IDA Pro

Answer

Perform static analysis using PEiD to identify compiler and packer

Answer

Run the file in a sandbox and observe its behavior

Question 5

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware specifically encrypts files and demands ransom. Other malware types may steal data or display ads but do not encrypt files for ransom.

Answer

Spyware

Answer

Keylogger

Answer

Adware

Question 6

A security team wants to mitigate a DNS amplification DDoS attack. Which of the following techniques would be MOST effective in preventing the attack from leveraging open DNS resolvers?

Accepted Answer

Disable recursion on DNS servers for external queries. DNS amplification relies on open resolvers that respond to queries from any source. Restricting recursive queries to trusted clients eliminates the amplification vector.

Answer

Deploy a web application firewall

Answer

Use anycast routing for DNS servers

Answer

Implement rate limiting on DNS responses

Question 7

During a penetration test, an attacker gains access to a system and wants to maintain persistent remote control. Which type of Trojan is specifically designed for this purpose?

Accepted Answer

Backdoor. A Remote Access Trojan (RAT) provides the attacker with remote control over the victim machine, often with features for persistence and stealth.

Answer

Ransomware

Answer

Keylogger

Answer

Downloader

Question 8

A security analyst observes the following in a packet capture: a single source IP sends a large number of ICMP echo request packets to the broadcast address of a subnet, with the source IP spoofed to be the target victim. Which type of attack is being executed?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP echo requests to a broadcast address with the victim's spoofed source IP, causing all hosts on the subnet to reply to the victim, overwhelming it.

Answer

SYN flood

Answer

Ping of Death

Answer

ICMP flood

Question 9

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern with each infection to evade detection. Polymorphic viruses change their code signature each time they replicate, making signature-based detection difficult.

Answer

It remains dormant until a specific date

Answer

It spreads without user interaction

Answer

It attaches to the boot sector of a hard drive

Question 10

An attacker uses the Social Engineering Toolkit (SET) to send a malicious email to employees of a company, claiming to be from IT support and urging them to click a link to reset their password. Which social engineering attack is being performed?

Accepted Answer

Phishing. Phishing is the broad category of sending fraudulent emails to trick recipients. Using SET for email campaigns is a common phishing technique.

Answer

Vishing

Answer

Baiting

Answer

SMiShing

Question 11

An analyst runs the following command: `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap`. What is the primary purpose of this command?

Accepted Answer

To capture only HTTP traffic from a specific source IP and save it to a file. The command captures packets from source IP 192.168.1.10 with destination port 80 (HTTP) and writes them to a file for later analysis.

Answer

To perform a man-in-the-middle attack on HTTP traffic

Answer

To capture all traffic on eth0 and display it in real-time

Answer

To analyze the payload of HTTP packets in real-time

Question 12

A company wants to protect its network from MAC flooding attacks. Which of the following countermeasures is MOST effective?

Accepted Answer

Enable port security on switches. MAC flooding tries to overflow the switch's MAC address table, causing it to act like a hub. Port security limits the number of MAC addresses per port, preventing flooding.

Answer

Use Wireshark to monitor for floods

Answer

Disable CAM table learning

Answer

Implement ARP spoofing detection

Question 13

Which TWO of the following are examples of application layer DDoS attacks? (Select two.)

Accepted Answer

Slowloris. Slowloris and HTTP flood are application layer attacks that target web servers by exhausting connections or sending high volumes of HTTP requests.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 14

Which THREE of the following are techniques used in session hijacking? (Select three.)

Accepted Answer

ARP poisoning. TCP sequence prediction allows an attacker to guess sequence numbers and inject packets. Cookie theft (e.g., via XSS) steals session tokens. ARP poisoning enables MITM to intercept and hijack sessions.

Answer

DNS amplification

Answer

MAC flooding

Question 15

Which TWO of the following are types of malware analysis? (Select two.)

Accepted Answer

Static analysis. Static analysis examines the file without executing it (e.g., examining strings, headers). Dynamic analysis executes the malware in a controlled environment (sandbox) to observe behavior.

Answer

Memory analysis

Answer

Signature analysis

Answer

Heuristic analysis