CEH Malware, Social Engineering and Network Attacks Practice Test 13 — 15 Questions

Question 1

An analyst runs the following command: `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap`. What is the primary purpose of this command?

Accepted Answer

To capture only HTTP traffic from a specific source IP and save it to a file. The command `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap` uses a BPF (Berkeley Packet Filter) expression to capture only packets originating from source IP 192.168.1.10 and destined for TCP port 80 (HTTP). The `-w` flag writes the filtered packets directly to a pcap file, not to standard output, making the primary purpose to capture and save specific HTTP traffic for later analysis.

Answer

To perform a man-in-the-middle attack on HTTP traffic

Answer

To capture all traffic on eth0 and display it in real-time

Answer

To analyze the payload of HTTP packets in real-time

Question 2

A company wants to protect its network from MAC flooding attacks. Which of the following countermeasures is MOST effective?

Accepted Answer

Enable port security on switches. Enabling port security on switches directly limits the number of MAC addresses that can be learned on a switch port, preventing an attacker from flooding the CAM table with fake MAC addresses. When the configured limit is exceeded, the switch can either drop traffic, shut down the port, or send an alert, effectively stopping the MAC flooding attack at the access layer.

Answer

Use Wireshark to monitor for floods

Answer

Disable CAM table learning

Answer

Implement ARP spoofing detection

Question 3

Which TWO of the following are examples of application layer DDoS attacks? (Select two.)

Accepted Answer

Slowloris. Slowloris is an application layer DDoS attack that targets HTTP servers by opening multiple connections and sending partial HTTP requests, keeping them open as long as possible. It exploits the server's connection handling by sending incomplete headers, preventing the server from timing out the connection and exhausting its connection pool. This attack operates at Layer 7 and does not require high bandwidth, making it effective against web servers.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 4

Which THREE of the following are techniques used in session hijacking? (Select three.)

Accepted Answer

ARP poisoning. ARP poisoning is correct because it allows an attacker on the same local network to associate their MAC address with the IP address of a legitimate host (e.g., the default gateway). This redirects traffic through the attacker's machine, enabling them to intercept and hijack active sessions by capturing or modifying packets in transit, a classic man-in-the-middle (MITM) technique used in session hijacking.

Answer

DNS amplification

Answer

MAC flooding

Question 5

Which TWO of the following are types of malware analysis? (Select two.)

Accepted Answer

Static analysis. Static analysis involves examining malware without executing it, such as inspecting file headers, strings, and disassembled code. Dynamic analysis executes the malware in a controlled sandbox to observe its runtime behavior, including network traffic, registry changes, and process creation. Both are fundamental malware analysis methodologies recognized in CEH.

Answer

Memory analysis

Answer

Signature analysis

Answer

Heuristic analysis

Question 6

A security analyst observes a sudden flood of ICMP echo request packets from multiple external IPs to a single internal server. The packets have varying sizes and spoofed source addresses. Which type of attack is MOST likely occurring?

Accepted Answer

ICMP flood. An ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request (ping) packets, often with spoofed source addresses and varying packet sizes, to consume bandwidth and processing resources. The description matches this exactly: multiple external IPs sending a flood of ICMP echo requests to a single server, which is the classic behavior of a distributed ICMP flood.

Answer

Ping of Death

Answer

Smurf attack

Answer

SYN flood

Question 7

Which tool is specifically designed to create fake login pages for phishing campaigns and can be integrated with Metasploit?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed to automate social engineering attacks, including the creation of fake login pages (credential harvesting) for phishing campaigns. It includes a built-in 'Website Attack Vectors' module that can clone legitimate sites and capture submitted credentials, and it offers direct integration with Metasploit to deliver payloads or establish reverse shells upon credential submission.

Answer

Nmap

Answer

Wireshark

Answer

Ettercap

Question 8

During a forensic investigation, an analyst retrieves a suspicious executable. Running 'strings' reveals no readable text, and VirusTotal shows zero detections. However, when executed in a sandbox, the binary connects to a remote IP and injects code into 'explorer.exe'. Which conclusion is MOST accurate?

Accepted Answer

The file is likely a packed trojan that evades signature-based detection. The absence of readable strings and zero VirusTotal detections strongly suggest the executable is packed or obfuscated, a common evasion technique used by trojans. The sandbox behavior—connecting to a remote IP and injecting code into explorer.exe—confirms malicious intent, specifically trojan-like remote access and process injection. This combination of static stealth and dynamic malicious activity indicates a packed trojan designed to bypass signature-based antivirus.

Answer

The file is a worm because it connects to a remote IP

Answer

The file is benign because static analysis found no indicators

Answer

The file is a false positive and the sandbox environment is compromised

Question 9

Which malware type is characterized by self-replication across networks without needing a host file?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across network connections without requiring a host file or user intervention. It exploits vulnerabilities in network protocols or services (e.g., SMB, RDP) to propagate autonomously, as seen with WannaCry's use of EternalBlue.

Answer

Trojan

Answer

Rootkit

Answer

Ransomware

Question 10

An attacker gains physical access to a restricted area by following an authorized employee through a secured door without swiping a badge. This technique is known as:

Accepted Answer

Tailgating. Tailgating is a social engineering attack where an unauthorized person physically follows an authorized employee through a secured entry point (e.g., a badge-protected door) without presenting their own credentials. This exploits the human tendency to hold the door for others, bypassing electronic access control systems (e.g., RFID badge readers) that would otherwise deny entry. The CEH exam defines this as a physical breach of perimeter security, distinct from digital or verbal manipulation.

Answer

Pretexting

Answer

Quid pro quo

Answer

Baiting

Question 11

A security team detects that an internal host is sending ARP replies claiming to have the IP address of the default gateway. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a dedicated man-in-the-middle (MITM) attack tool that includes built-in ARP poisoning functionality. It sends forged ARP replies to associate the attacker's MAC address with the default gateway's IP, redirecting traffic through the attacker's host. This matches the described behavior of claiming the gateway's IP address via ARP replies.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 12

Which DDoS attack type exploits a small query to a vulnerable service that generates a large response directed at the victim?

Accepted Answer

Amplification attack. An amplification attack is correct because it exploits a small query (e.g., a DNS lookup with a spoofed source IP) sent to a vulnerable service like an open DNS resolver or NTP server, which then generates a large response (e.g., 50-100x the query size) directed at the victim. This leverages the protocol's amplification factor and the lack of source IP validation, overwhelming the victim's bandwidth. The attack is a type of reflection attack, where the intermediary service unwittingly amplifies traffic toward the target.

Answer

HTTP flood

Answer

SYN flood

Answer

ICMP flood

Question 13

A user receives a text message claiming their bank account is locked and requiring them to click a link to verify. This social engineering method is called:

Accepted Answer

SMiShing. SMiShing (SMS phishing) is the correct term because the attack vector is a text message (SMS) that tricks the user into clicking a malicious link. Unlike email-based phishing, SMiShing exploits the higher trust users often place in SMS messages and the limited security controls on mobile devices.

Answer

Phishing

Answer

Whaling

Answer

Vishing

Question 14

Which malware analysis approach involves running the suspicious file in a controlled environment to observe its behavior?

Accepted Answer

Dynamic analysis. Dynamic analysis is the correct approach because it involves executing the suspicious file in a controlled, isolated environment (such as a sandbox or virtual machine) to monitor its runtime behavior, including file system changes, registry modifications, network connections, and process injections. This allows analysts to observe actual malicious actions without risking the production environment, making it essential for understanding zero-day threats and obfuscated malware that static analysis might miss.

Answer

Code review

Answer

Signature detection

Answer

Static analysis

Question 15

A penetration tester uses a tool to perform a MAC flooding attack. What is the intended result of this attack?

Accepted Answer

Read all network traffic by turning the switch into a hub. A MAC flooding attack exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively turning it into a hub. This allows the attacker to capture network traffic that would normally be isolated to a specific port.

Answer

Modify the MAC address of the attacker's NIC

Answer

Cause a denial of service on the switch

Answer

Poison the ARP cache of the target hosts