CEH Malware, Social Engineering and Network Attacks Practice Test 14 — 15 Questions

Question 1

Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is designed for both live packet capture and offline analysis of pcap files. It provides a rich graphical interface with advanced filtering, protocol dissection, and statistical analysis capabilities, making it ideal for examining captured traffic for signs of an attack such as suspicious patterns, malformed packets, or known exploit signatures.

Answer

Ettercap

Answer

tcpdump

Answer

Nmap

Question 2

Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)

Accepted Answer

It changes its code signature each time it replicates. A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.

Answer

It does not require a host file to spread

Answer

It only infects the master boot record

Answer

It attaches to email messages automatically

Question 3

Which THREE of the following are effective DDoS mitigation techniques? (Choose 3)

Accepted Answer

Scrubbing centers. Scrubbing centers are effective DDoS mitigation because they act as a centralized traffic-cleaning facility. When an attack is detected, malicious traffic is diverted to the scrubbing center, where it is filtered using signature-based, anomaly-based, and rate-based techniques, allowing only legitimate traffic to pass through to the target network. This offloads the attack burden from the victim's infrastructure.

Answer

MAC address filtering

Answer

Disabling DHCP

Question 4

Which TWO of the following are techniques used in session hijacking? (Choose 2)

Accepted Answer

Cookie theft. Cookie theft is a session hijacking technique where an attacker captures a user's session cookie (e.g., via XSS, packet sniffing, or malware) and uses it to impersonate the user. Since HTTP is stateless, the server relies on the cookie to identify the session, so stealing it grants the attacker unauthorized access without needing credentials.

Answer

MAC flooding

Answer

ARP poisoning

Answer

DNS spoofing

Question 5

A security analyst notices repeated TCP SYN packets sent to a server without corresponding SYN-ACK replies. The source IP addresses are spoofed and appear to be random. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses to a target server. The server responds with SYN-ACK packets to the spoofed addresses, which never complete the handshake, causing the server to exhaust its memory and CPU resources by maintaining half-open connections. This matches the described behavior of repeated SYN packets without corresponding SYN-ACK replies.

Answer

UDP flood

Answer

ICMP flood

Answer

Ping of Death

Question 6

A user receives an email claiming to be from their bank, asking them to click a link and verify their account credentials. The email contains spelling errors and the link points to a suspicious domain. What type of social engineering attack is this?

Accepted Answer

Phishing. This scenario describes a mass, unsolicited email with generic content and a suspicious link, which is the classic definition of phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information, such as credentials, by impersonating a trusted entity. The presence of spelling errors and a suspicious domain are common indicators of a phishing attempt, not a targeted attack.

Answer

Vishing

Answer

Whaling

Answer

Spear phishing

Question 7

During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?

Accepted Answer

MAC flooding. MAC flooding. When a switch's MAC address table is full, it can no longer learn new MAC addresses and enters a fail-open state, flooding all incoming frames out every port except the ingress port. This allows the tester to capture traffic destined for other hosts on the same VLAN by placing their NIC in promiscuous mode and using Wireshark, effectively performing a MAC flooding attack to turn the switch into a hub-like device.

Answer

DNS spoofing

Answer

Session hijacking

Answer

ARP poisoning

Question 8

An organization wants to mitigate the impact of a DDoS attack that uses large volumes of UDP traffic to exhaust bandwidth. Which of the following techniques would be MOST effective?

Accepted Answer

Deploying a scrubbing center. A scrubbing center is the most effective technique because it filters out malicious UDP traffic from legitimate traffic by analyzing packet characteristics, such as source IP reputation and payload patterns, before forwarding clean traffic to the target network. This approach preserves legitimate UDP services (e.g., DNS, VoIP) while absorbing volumetric attacks, unlike simpler methods that may block all UDP or fail to scale.

Answer

Rate limiting on all ports

Answer

Blocking all UDP traffic

Answer

Implementing SYN cookies

Question 9

A security analyst receives an alert indicating that a workstation is sending outbound connections to a known malicious IP address. The analyst suspects a Trojan. Which tool is BEST for performing dynamic analysis of the suspicious binary?

Accepted Answer

Sandbox. Dynamic analysis involves executing the suspicious binary in a controlled environment to observe its runtime behavior, such as outbound connections, registry changes, and file system modifications. A sandbox provides an isolated environment specifically designed for this purpose, allowing the analyst to safely monitor the Trojan's actions without risking the production network. This makes it the best choice for analyzing the workstation's outbound connections to a known malicious IP address.

Answer

VirusTotal

Answer

String analysis

Answer

PEiD

Question 10

An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?

Accepted Answer

Session hijacking. The attacker is actively intercepting a TCP session, predicting sequence numbers, and injecting malicious packets, which is the definition of TCP session hijacking. This attack exploits the lack of authentication in TCP connections, where the attacker can take over an established session by correctly guessing or obtaining the next sequence number.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

Man-in-the-middle

Question 11

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It changes its code signature each time it infects a new file. A polymorphic virus changes its decryption routine and code signature each time it infects a new file, making signature-based detection difficult. This mutation is achieved by using a polymorphic engine that generates varied decryption loops while preserving the malicious payload.

Answer

It spreads via email attachments

Answer

It remains dormant until a specific date or time

Answer

It can infect the Master Boot Record (MBR)

Question 12

Which TWO tools are commonly used for ARP poisoning attacks?

Accepted Answer

Cain & Abel. Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 13

Which THREE of the following are indicators of a slowloris DDoS attack?

Accepted Answer

Normal traffic volume but connections remain open for a long time. B is correct because a Slowloris DDoS attack works by opening many connections to a target web server and keeping them open for as long as possible, sending partial HTTP requests to tie up server resources. This results in normal traffic volume but with connections that remain open for extended periods, preventing legitimate users from connecting.

Answer

ICMP echo replies from random IPs

Answer

High volume of UDP packets

Question 14

Which TWO of the following are types of malware that specifically aim to demand payment from victims?

Accepted Answer

Scareware. Scareware is a type of malware that displays fake security alerts or warnings to trick users into believing their system is infected, then demands payment to remove the nonexistent threat. Ransomware encrypts the victim's files or locks the system and demands a ransom payment for decryption or restoration. Both specifically aim to extort money from victims.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 15

Which TWO of the following are examples of amplification attacks used in DDoS?

Accepted Answer

DNS amplification. DNS amplification is a classic DDoS amplification attack where an attacker sends a small DNS query (e.g., an ANY or TXT record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a much larger response (up to 50x the query size), flooding the victim with traffic. This exploits the UDP protocol's lack of handshake and the resolver's willingness to respond to any source.

Answer

Slowloris

Answer

SYN flood

Answer

Ping of Death