CEH Malware, Social Engineering and Network Attacks Practice Test 14 — 15 Questions

Question 1

A security analyst notices repeated TCP SYN packets sent to a server without corresponding SYN-ACK replies. The source IP addresses are spoofed and appear to be random. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. SYN flood attacks exploit the TCP three-way handshake by sending many SYN requests with spoofed IPs, exhausting the server's connection queue.

Answer

UDP flood

Answer

ICMP flood

Answer

Ping of Death

Question 2

A user receives an email claiming to be from their bank, asking them to click a link and verify their account credentials. The email contains spelling errors and the link points to a suspicious domain. What type of social engineering attack is this?

Accepted Answer

Phishing. Phishing is a social engineering technique where attackers send fraudulent emails that appear to come from legitimate sources to trick recipients into revealing sensitive information.

Answer

Vishing

Answer

Whaling

Answer

Spear phishing

Question 3

During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?

Accepted Answer

MAC flooding. MAC flooding attacks send many fake MAC addresses to overflow the switch's MAC table, forcing it into hub mode and allowing traffic sniffing.

Answer

DNS spoofing

Answer

Session hijacking

Answer

ARP poisoning

Question 4

An organization wants to mitigate the impact of a DDoS attack that uses large volumes of UDP traffic to exhaust bandwidth. Which of the following techniques would be MOST effective?

Accepted Answer

Deploying a scrubbing center. Scrubbing centers filter malicious traffic from legitimate traffic, effectively mitigating volumetric DDoS attacks.

Answer

Rate limiting on all ports

Answer

Blocking all UDP traffic

Answer

Implementing SYN cookies

Question 5

A security analyst receives an alert indicating that a workstation is sending outbound connections to a known malicious IP address. The analyst suspects a Trojan. Which tool is BEST for performing dynamic analysis of the suspicious binary?

Accepted Answer

Sandbox. Sandbox environments safely execute malware to observe behavior, making them ideal for dynamic analysis.

Answer

VirusTotal

Answer

String analysis

Answer

PEiD

Question 6

An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?

Accepted Answer

Session hijacking. TCP session hijacking relies on predicting or obtaining valid sequence numbers to impersonate one party in a TCP connection.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

Man-in-the-middle

Question 7

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It changes its code signature each time it infects a new file. Option A is correct because a polymorphic virus changes its decryption routine and code signature each time it infects a new file, making signature-based detection difficult. This mutation is achieved by using a polymorphic engine that generates varied decryption loops while preserving the malicious payload.

Answer

It spreads via email attachments

Answer

It remains dormant until a specific date or time

Answer

It can infect the Master Boot Record (MBR)

Question 8

Which TWO tools are commonly used for ARP poisoning attacks?

Accepted Answer

Cain & Abel. Ettercap and Cain & Abel are well-known tools for ARP poisoning, allowing attackers to intercept traffic on a LAN.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 9

Which THREE of the following are indicators of a slowloris DDoS attack?

Accepted Answer

Normal traffic volume but connections remain open for a long time. B is correct because a Slowloris DDoS attack works by opening many connections to a target web server and keeping them open for as long as possible, sending partial HTTP requests to tie up server resources. This results in normal traffic volume but with connections that remain open for extended periods, preventing legitimate users from connecting.

Answer

ICMP echo replies from random IPs

Answer

High volume of UDP packets

Question 10

Which TWO of the following are types of malware that specifically aim to demand payment from victims?

Accepted Answer

Scareware. Ransomware encrypts files and demands ransom; scareware tricks users into paying for fake threats.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 11

Which TWO of the following are examples of amplification attacks used in DDoS?

Accepted Answer

DNS amplification. Amplification attacks exploit protocols that respond with larger payloads than the request, magnifying traffic. NTP and DNS are common examples.

Answer

Slowloris

Answer

SYN flood

Answer

Ping of Death

Question 12

Which THREE of the following are techniques used in session hijacking?

Accepted Answer

Man-in-the-middle (MITM) interception. Man-in-the-middle (MITM) interception is a core session hijacking technique where the attacker positions themselves between the client and server to intercept and manipulate traffic. By capturing session tokens or credentials in transit, the attacker can impersonate the legitimate user without needing to predict sequence numbers or steal cookies directly.

Answer

DNS cache poisoning

Answer

MAC flooding

Question 13

Which TWO of the following are types of social engineering attacks that rely on impersonation?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker creates a fabricated scenario (pretext) to impersonate an authority figure, colleague, or trusted entity in order to extract sensitive information. It relies on impersonation because the attacker assumes a false identity, such as a help desk technician or law enforcement officer, to gain the victim's trust and compliance.

Answer

Baiting

Answer

Phishing

Answer

Quid pro quo

Question 14

Which THREE of the following are valid methods for DDoS mitigation?

Accepted Answer

Rate limiting. DDoS mitigation strategies include rate limiting, using scrubbing centers, and anycast routing to distribute traffic.

Answer

Increasing server timeout values

Answer

Disabling SYN cookies

Question 15

Which TWO of the following are features of a Remote Access Trojan (RAT)?

Accepted Answer

It often includes a backdoor to bypass authentication. A Remote Access Trojan (RAT) is designed to provide an attacker with covert remote control over an infected system, often including a backdoor to bypass standard authentication mechanisms. This allows the attacker to execute commands, exfiltrate data, or use the system as a pivot point, which directly aligns with options D and E.

Answer

It encrypts files and demands ransom

Answer

It infects the Master Boot Record

Answer

It replicates itself across the network autonomously