CEH Malware, Social Engineering and Network Attacks Practice Test 13 — 15 Questions

Question 1

A security analyst observes a sudden flood of ICMP echo request packets from multiple external IPs to a single internal server. The packets have varying sizes and spoofed source addresses. Which type of attack is MOST likely occurring?

Accepted Answer

ICMP flood. A distributed ICMP flood (ping flood) uses multiple sources to overwhelm a target with ICMP echo requests. Spoofed source addresses and varying packet sizes are common characteristics.

Answer

Ping of Death

Answer

Smurf attack

Answer

SYN flood

Question 2

Which tool is specifically designed to create fake login pages for phishing campaigns and can be integrated with Metasploit?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) has a website attack vector for cloning login pages and can interface with Metasploit for payload delivery.

Answer

Nmap

Answer

Wireshark

Answer

Ettercap

Question 3

During a forensic investigation, an analyst retrieves a suspicious executable. Running 'strings' reveals no readable text, and VirusTotal shows zero detections. However, when executed in a sandbox, the binary connects to a remote IP and injects code into 'explorer.exe'. Which conclusion is MOST accurate?

Accepted Answer

The file is likely a packed trojan that evades signature-based detection. The binary evades static analysis (packed, no strings, undetected by AV) but exhibits malicious behavior in dynamic analysis (network connection, process injection). This suggests it is a packed or obfuscated trojan.

Answer

The file is a worm because it connects to a remote IP

Answer

The file is benign because static analysis found no indicators

Answer

The file is a false positive and the sandbox environment is compromised

Question 4

A security analyst notices that users receive emails from a known vendor requesting urgent payment to a new bank account. The email domain is misspelled (e.g., vvendorfake.com). Which type of social engineering is this?

Accepted Answer

Spear phishing. Spear phishing targets specific individuals or organizations with personalized content. The misspelled domain and urgency are classic spear phishing indicators.

Answer

Whaling

Answer

Phishing

Answer

Vishing

Question 5

Which malware type is characterized by self-replication across networks without needing a host file?

Accepted Answer

Worm. Worms are standalone malware that replicate across networks autonomously, unlike viruses that require a host file.

Answer

Trojan

Answer

Rootkit

Answer

Ransomware

Question 6

An attacker gains physical access to a restricted area by following an authorized employee through a secured door without swiping a badge. This technique is known as:

Accepted Answer

Tailgating. Tailgating (or piggybacking) is when an unauthorized person follows an authorized person into a restricted area without proper authentication.

Answer

Pretexting

Answer

Quid pro quo

Answer

Baiting

Question 7

A security team detects that an internal host is sending ARP replies claiming to have the IP address of the default gateway. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a well-known tool for ARP poisoning attacks. ARP spoofing involves sending fake ARP replies to associate the attacker's MAC with the gateway's IP.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 8

Which DDoS attack type exploits a small query to a vulnerable service that generates a large response directed at the victim?

Accepted Answer

Amplification attack. Amplification attacks (e.g., DNS, NTP, SNMP) send small queries with spoofed source IP to servers that reply with large responses to the victim.

Answer

HTTP flood

Answer

SYN flood

Answer

ICMP flood

Question 9

A user receives a text message claiming their bank account is locked and requiring them to click a link to verify. This social engineering method is called:

Accepted Answer

SMiShing. SMiShing (SMS phishing) uses text messages to trick victims into clicking malicious links or providing personal information.

Answer

Phishing

Answer

Whaling

Answer

Vishing

Question 10

Which malware analysis approach involves running the suspicious file in a controlled environment to observe its behavior?

Accepted Answer

Dynamic analysis. Dynamic analysis is the correct approach because it involves executing the suspicious file in a controlled, isolated environment (such as a sandbox or virtual machine) to monitor its runtime behavior, including file system changes, registry modifications, network connections, and process injections. This allows analysts to observe actual malicious actions without risking the production environment, making it essential for understanding zero-day threats and obfuscated malware that static analysis might miss.

Answer

Code review

Answer

Signature detection

Answer

Static analysis

Question 11

A penetration tester uses a tool to perform a MAC flooding attack. What is the intended result of this attack?

Accepted Answer

Read all network traffic by turning the switch into a hub. MAC flooding overwhelms a switch's CAM table, causing it to enter fail-open mode and broadcast all frames, allowing the attacker to sniff traffic.

Answer

Modify the MAC address of the attacker's NIC

Answer

Cause a denial of service on the switch

Answer

Poison the ARP cache of the target hosts

Question 12

Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?

Accepted Answer

Wireshark. Wireshark is the standard tool for capturing and analyzing network packets in pcap format.

Answer

Ettercap

Answer

tcpdump

Answer

Nmap

Question 13

Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)

Accepted Answer

It changes its code signature each time it replicates. Polymorphic viruses change their code signature each time they replicate, using mutation engines to evade signature detection.

Answer

It does not require a host file to spread

Answer

It only infects the master boot record

Answer

It attaches to email messages automatically

Question 14

Which THREE of the following are effective DDoS mitigation techniques? (Choose 3)

Accepted Answer

Scrubbing centers. Rate limiting restricts traffic per source, scrubbing centers filter malicious traffic, and anycast disperses traffic across multiple nodes to absorb attacks.

Answer

MAC address filtering

Answer

Disabling DHCP

Question 15

Which TWO of the following are techniques used in session hijacking? (Choose 2)

Accepted Answer

Cookie theft. Session hijacking involves stealing or predicting session tokens. TCP sequence prediction allows an attacker to inject packets, and cookie theft reveals session identifiers.

Answer

MAC flooding

Answer

ARP poisoning

Answer

DNS spoofing