CEH Malware, Social Engineering and Network Attacks Practice Test 2 — 15 Questions

Question 1

An attacker sends an email that appears to come from the CEO, requesting that the recipient urgently transfer funds to a specified account. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. This is a whaling attack because the attacker impersonates a high-profile individual (the CEO) to manipulate the recipient into transferring funds. Whaling is a targeted phishing attack that either targets senior executives or uses their identity to deceive others. Here, the impersonation of the CEO characterizes it as whaling, as it leverages the authority of a top executive to bypass security protocols.

Answer

Whaling

Answer

Baiting

Answer

Phishing

Question 2

Which TWO of the following are effective mitigation techniques against DDoS attacks? (Select two)

Accepted Answer

Rate limiting. Rate limiting is a direct mitigation technique against DDoS attacks because it restricts the number of requests a server or network device will accept from a single source within a specific time window, preventing any single source from overwhelming resources. It operates at various layers (e.g., network, application) and can be implemented via iptables, mod_evasive, or cloud-based Web Application Firewalls (WAFs) to throttle traffic and maintain availability.

Scrubbing centers are specialized services, often provided by third-party vendors, that act as an intermediary for network traffic. During a DDoS attack, all incoming traffic is rerouted to the scrubbing center, where sophisticated filtering techniques are applied to identify and remove malicious DDoS traffic. Only clean, legitimate traffic is then forwarded to the target server or network, ensuring service availability and protecting infrastructure from the attack's full impact.

Answer

Port knocking

Answer

ARP poisoning

Answer

MAC filtering

Question 3

Which THREE of the following are indicators that a system may be infected with a backdoor Trojan? (Select three)

Accepted Answer

Unexpected network traffic on ports typically used for remote administration. A backdoor Trojan often opens a port on the infected system to allow remote access. Unexpected traffic on ports commonly used for remote administration (e.g., TCP 3389 for RDP, TCP 22 for SSH, or TCP 23 for Telnet) indicates that the Trojan may be listening for or communicating with an attacker, as legitimate use of these ports would be known and expected.

Answer

Persistent high CPU usage by a single process

Answer

Increased number of DNS queries to known legitimate sites

Question 4

During a penetration test, a security analyst captures network traffic and observes a series of ARP replies without corresponding ARP requests. An internal host's IP address is suddenly associated with two different MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP poisoning. D is correct because ARP poisoning (also known as ARP spoofing) involves sending forged ARP replies to associate a target IP address with an attacker's MAC address, allowing man-in-the-middle attacks. The observation of unsolicited ARP replies (gratuitous ARPs) that map one IP to two different MAC addresses is the classic signature of an ongoing ARP poisoning attack.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 5

Which THREE of the following are common indicators of a man-in-the-middle attack using ARP spoofing? (Choose three.)

Accepted Answer

Multiple MAC addresses associated with the same IP in the ARP cache. {"A":"Multiple MAC addresses associated with the same IP in the ARP cache is a primary indicator. ARP spoofing causes an IP address (e.g., the default gateway's IP) to be associated with the attacker's MAC address in the victim's ARP cache. Detection tools often look for an IP address being claimed by multiple MAC addresses or for frequent, unexpected changes in an IP's MAC mapping.","B":"Duplicate IP addresses in the ARP table is less precise. While ARP spoofing causes an IP to be associated with an incorrect MAC, an ARP table typically maintains a single entry per IP, updating the MAC address. The core issue is the *change* or *conflict* in MAC addresses for a single IP, which is better described by option A.","D":"Unusual ARP replies without corresponding requests is correct. Attackers send unsolicited (gratuitous) ARP replies to poison ARP caches without waiting for an ARP request.","E":"Increased network latency on the victim's connection is correct. Traffic routed through an attacker adds an extra hop and processing overhead, leading to noticeable latency."}

Answer

Duplicate IP addresses in the ARP table

Answer

A sudden spike in DNS traffic

Question 6

Which TWO of the following are techniques used in session hijacking attacks? (Choose two.)

Accepted Answer

TCP sequence prediction. TCP sequence prediction is a core technique in session hijacking where an attacker predicts or sniffs the TCP sequence numbers used by the client and server to inject forged packets and take over an established TCP session. By correctly guessing the next sequence number, the attacker can spoof the client's IP address and send malicious commands that the server accepts as legitimate traffic. Cookie theft is another common session hijacking technique, particularly at the application layer. An attacker steals a user's session cookie (e.g., through XSS, sniffing, or malware) and then uses it to impersonate the legitimate user, gaining unauthorized access to their authenticated session without needing their credentials.

Answer

MAC flooding

Answer

DNS spoofing

Answer

ARP poisoning

Question 7

An attacker uses the Social Engineering Toolkit (SET) to clone a legitimate website and send a malicious link to employees. When an employee clicks the link, they are prompted to enter their credentials. Which attack is this?

Accepted Answer

Phishing. The Social Engineering Toolkit (SET) is used to clone a legitimate website and capture credentials via a malicious link. This is a classic phishing attack because it involves sending a fraudulent communication (the link) that mimics a trusted entity to trick victims into revealing sensitive information. The attack does not rely on SMS (SMiShing), voice calls (Vishing), or targeted personalization (Spear phishing) beyond the generic employee group.

Answer

SMiShing

Answer

Spear phishing

Answer

Vishing

Question 8

Which THREE of the following are static malware analysis techniques? (Select 3)

Accepted Answer

Examining strings in the binary. Static malware analysis involves examining the binary without executing it. Option A is correct because extracting strings (e.g., using `strings` command) reveals embedded URLs, IPs, registry keys, or function names that indicate malicious intent. Option B is correct because PEiD identifies packers or compilers used to obfuscate the malware, a key static analysis step. Option C is correct because VirusTotal performs static hash-based and signature scanning against multiple antivirus engines without running the file.

Answer

Analyzing network traffic

Answer

Running the malware in a sandbox

Question 9

Which tool is commonly used to perform DNS spoofing on a local network by intercepting DNS requests and replying with forged responses?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on a local network. It can perform DNS spoofing by intercepting DNS requests (typically over UDP port 53) and replying with forged responses before the legitimate DNS server can respond, redirecting victims to malicious IP addresses.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 10

Which THREE of the following are effective DDoS mitigation techniques?

Accepted Answer

Scrubbing centers. Scrubbing centers are dedicated facilities that filter malicious traffic from legitimate traffic during a DDoS attack, using deep packet inspection and signature-based detection. Rate limiting restricts the number of requests a client can make over a period, preventing a single source or group of sources from overwhelming a service. Anycast routing distributes incoming traffic across multiple geographically dispersed servers, spreading the load and making it harder to overwhelm a single point of presence. All three are highly effective strategies for mitigating DDoS attacks.

Answer

IP blacklisting

Answer

Increasing server resources

Question 11

Which TWO of the following are examples of application-layer DDoS attacks?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that works by opening multiple HTTP connections to a target web server and keeping them alive indefinitely by sending partial HTTP headers at regular intervals. This exhausts the server's connection pool, preventing legitimate users from connecting. HTTP flood attacks involve sending a large volume of legitimate-looking HTTP requests (GET/POST) to a web server, overwhelming its resources and preventing it from responding to legitimate users. Both attacks specifically target the HTTP protocol at Layer 7, exploiting application-layer vulnerabilities rather than network or transport layer protocols.

Answer

ICMP flood

Answer

SYN flood

Answer

UDP flood

Question 12

A security analyst runs 'strings malware.exe' and finds several URLs and IP addresses. The analyst then uploads the file to VirusTotal and gets a detection ratio of 5/70. What type of analysis has been performed?

Accepted Answer

Static analysis. The analyst used the 'strings' command to extract readable text from the binary without executing it, and then uploaded the file to VirusTotal for signature-based scanning. Both actions examine the file's static properties (embedded strings, hash-based detection) without running the code, which defines static analysis. Dynamic analysis would require executing the malware in a sandbox to observe runtime behavior.

Answer

Memory analysis

Answer

Reverse engineering

Answer

Dynamic analysis

Question 13

A network administrator receives an alert that the switch's CAM table is full, causing the switch to flood frames out all ports. Which attack has likely occurred?

Accepted Answer

MAC flooding. MAC flooding (Option C) is the correct answer because it directly exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending a high volume of frames with unique, spoofed source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and flood all incoming frames out every port, effectively turning it into a hub. This allows the attacker to capture traffic that was not originally destined for their port.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

SYN flood

Question 14

Which TWO of the following are examples of protocol-based DoS attacks? (Choose two.)

Accepted Answer

Smurf attack. The Smurf attack is a protocol-based DoS attack that exploits ICMP echo requests (ping) sent to a network's broadcast address with a spoofed source IP of the victim. This causes all hosts on the network to reply to the victim, overwhelming it with ICMP replies. It relies on the ICMP protocol at the network layer, making it a classic protocol-level attack.

A SYN flood is also a protocol-based DoS attack that exploits the TCP three-way handshake. The attacker sends a flood of SYN requests to a server but never completes the handshake (doesn't send the final ACK). This leaves the server with many half-open connections, consuming its resources and preventing legitimate connections. It relies on the TCP protocol at the transport layer, making it a classic protocol-level attack.

Answer

HTTP flood

Answer

Slowloris

Answer

UDP flood

Question 15

A malware analyst wants to examine a suspicious executable without executing it. The goal is to extract strings, view the PE header, and check for known signatures. Which approach is the analyst using?

Accepted Answer

Static analysis. Static analysis involves examining a binary without executing it. The analyst extracts strings (e.g., using `strings`), views the PE header (e.g., with `pefile` or `dumpbin`), and checks for known signatures (e.g., YARA rules or antivirus hashes). This approach is safe and preserves the original state of the file.

Answer

Dynamic analysis

Answer

Heuristic analysis

Answer

Reverse engineering