CEH Malware, Social Engineering and Network Attacks Practice Test 2 — 15 Questions

Question 1

A security analyst receives an alert indicating that a host on the internal network is sending a high volume of ICMP echo requests to multiple external IP addresses. The analyst notices that the source IP address is spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. A Smurf attack uses spoofed ICMP echo requests sent to a broadcast address, causing all hosts on the network to reply to the victim. However, the scenario describes sending to multiple external IPs, which is more characteristic of a DDoS amplification attack using ICMP. But given the options, Smurf is the closest match because it involves ICMP and spoofed source. Ping flood is a simpler flood without spoofing necessarily, and Fraggle uses UDP. Therefore, Smurf is correct.

Answer

Fraggle attack

Answer

ICMP flood

Answer

Ping flood

Question 2

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN, featuring ARP poisoning capabilities. Wireshark is a packet analyzer, Nmap is a network scanner, and Metasploit is an exploitation framework.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 3

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

Accepted Answer

Backdoor Trojan. Port 4444 is commonly associated with Metasploit's default reverse shell payload. The presence of 'cmd.exe /c' and an IP address indicates a backdoor that provides remote command execution, which is a Trojan backdoor or RAT.

Answer

Worm

Answer

Keylogger

Answer

Ransomware

Question 4

An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is a dedicated framework for social engineering attacks, including phishing campaigns. PhishMe and KnowBe4 are commercial platforms, but SET is the well-known open-source tool for this purpose.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 5

A security team observes that a switch's MAC address table is full, and the switch has started flooding unicast traffic to all ports. Which attack has MOST likely been performed?

Accepted Answer

MAC flooding. MAC flooding attacks fill the switch's CAM table, causing it to fail open and flood frames, enabling sniffing. MAC spoofing is about impersonating, ARP poisoning manipulates ARP caches, and DHCP starvation exhausts IP addresses.

Answer

ARP poisoning

Answer

MAC spoofing

Answer

DHCP starvation

Question 6

Which type of malware spreads by replicating itself across a network without requiring a host file to attach to?

Accepted Answer

Worm. Worms are standalone malware that self-replicate and spread across networks. Viruses require a host file, Trojans disguise as legitimate software, and ransomware focuses on encryption.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 7

An analyst uses the following command to capture traffic: tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80. After generating traffic from a web server at 10.0.0.5, the analyst examines the pcap with Wireshark. What type of traffic will appear in the capture?

Accepted Answer

HTTP traffic to and from 10.0.0.5. The filter 'host 10.0.0.5 and port 80' captures traffic to/from the host on port 80 only. It does not specify direction, so both inbound and outbound HTTP traffic (TCP port 80) from that host is captured.

Answer

All HTTP traffic on the network

Answer

Only HTTP traffic originating from 10.0.0.5

Answer

All traffic from 10.0.0.5 on any port

Question 8

A security analyst detects a file named 'invoice.pdf.exe' in an email attachment. When the file is submitted to VirusTotal, multiple engines detect it as a Trojan. The analyst wants to perform dynamic analysis to observe its behavior. Which approach is BEST?

Accepted Answer

Execute the file in a sandboxed environment and monitor system calls. Dynamic analysis involves executing the malware in a controlled environment (sandbox) and monitoring its actions. Static analysis (strings, PEiD) examines the binary without execution. Submitting to VirusTotal is static, and disassembly is also static.

Answer

Disassemble the file using IDA Pro to understand its code

Answer

Run 'strings' on the file and analyze the output

Answer

Submit the file again to VirusTotal for a second opinion

Question 9

Which type of social engineering attack involves a malicious actor impersonating a legitimate organization in a voicemail message to trick the victim into revealing sensitive information?

Accepted Answer

Vishing. Vishing (voice phishing) uses phone calls or voicemail to deceive victims. SMiShing uses SMS, pharming redirects websites, and baiting offers something enticing.

Answer

SMiShing

Answer

Pharming

Answer

Baiting

Question 10

A penetration tester is performing a session hijacking attack. After capturing packets, the tester successfully predicts the TCP sequence numbers and injects packets to take over the session. Which type of attack is this?

Accepted Answer

TCP session hijacking. TCP sequence prediction is a classic method for session hijacking, where the attacker guesses the sequence numbers to spoof the server's IP and inject packets. ARP poisoning and MAC flooding are local network attacks, and cookie theft is application-level.

Answer

MAC flooding

Answer

Cookie theft

Answer

ARP poisoning

Question 11

A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?

Accepted Answer

Implement rate limiting and connection timeout. Slowloris sends partial HTTP requests to keep connections open. Increasing the maximum number of connections per IP may help, but rate limiting and connection timeout are more effective. However, the most direct mitigation is to limit the time a connection can remain open while idle, i.e., increasing the request timeout or reducing the connection timeout. Among options, configuring a reverse proxy to limit concurrent connections is effective.

Answer

Use anycast routing

Answer

Increase the maximum number of simultaneous connections

Answer

Enable SYN cookies

Question 12

An employee receives an email that appears to be from the CEO, requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ceo@cornpany.com instead of ceo@company.com). This is an example of which type of attack?

Accepted Answer

Spear phishing. Spear phishing targets a specific individual with a tailored message, often impersonating a trusted figure. Whaling targets high-profile individuals but is a subset of spear phishing. Pretexting involves creating a fabricated scenario, but here the impersonation is through email. The attack is spear phishing because it targets a specific employee with a custom lure.

Answer

Whaling

Answer

Phishing

Answer

Pretexting

Question 13

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. HTTP flood is an application-layer DDoS attack because it targets the HTTP protocol (Layer 7) by overwhelming a web server with seemingly legitimate GET or POST requests. Unlike network-layer attacks, HTTP flood exploits the server's processing of application-layer requests, often mimicking normal user behavior to bypass basic rate limiting. This forces the server to allocate resources for each request, eventually exhausting connection pools or CPU cycles.

Answer

ICMP flood

Answer

SYN flood

Answer

UDP flood

Question 14

Which THREE of the following are techniques used in static malware analysis? (Select 3)

Accepted Answer

Inspecting file metadata and properties. Static analysis examines the binary without execution. Inspecting file metadata, searching for suspicious strings, and analyzing the file's structure (e.g., using PEiD) are static techniques. Monitoring registry changes and network connections require execution (dynamic analysis).

Answer

Capturing network traffic in a sandbox

Answer

Monitoring registry changes during execution

Question 15

Which TWO of the following are common indicators of a DNS spoofing attack? (Select 2)

Accepted Answer

The resolved IP address for a domain does not match the legitimate server. Unexpected redirections to malicious sites and mismatches between domain names and resolved IPs are signs of DNS spoofing. A full switch CAM table indicates MAC flooding, ARP cache poisoning is separate, and high DNS query volumes could indicate an amplification attack.

Answer

High volume of DNS queries from a single source

Answer

ARP cache entries show unexpected MAC-IP mappings

Answer

The switch's CAM table is full