CEH Malware, Social Engineering and Network Attacks Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are characteristics of a SYN flood attack? (Select 2)

Accepted Answer

It exploits the TCP three-way handshake. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses to a target server. The server responds with SYN-ACK packets to each spoofed source and waits for the final ACK, which never arrives, causing the server to allocate resources for half-open connections. This exhausts the server's connection queue, preventing legitimate users from establishing new TCP connections.

Answer

It uses UDP amplification

Answer

It sends a large number of ICMP echo requests

Answer

It requires the attacker to have a botnet

Question 2

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is a type of malware that encrypts files on the victim's system using a symmetric encryption algorithm (e.g., AES) and then demands payment, typically in cryptocurrency, for the decryption key. This matches the description of encrypting files and demanding payment for the decryption key, which is the defining characteristic of ransomware.

Answer

Spyware

Answer

Keylogger

Answer

Adware

Question 3

A security analyst notices that users receive emails from a known vendor requesting urgent payment to a new bank account. The email domain is misspelled (e.g., vvendorfake.com). Which type of social engineering is this?

Accepted Answer

Spear phishing. This is spear phishing because the attack is specifically targeted at users of a known vendor, using a misspelled domain (vvendorfake.com) to impersonate that vendor. Unlike generic phishing, spear phishing involves personalized context (e.g., referencing a known vendor and urgent payment) to increase credibility. The misspelled domain exploits users' trust in the legitimate vendor's name, making it a targeted social engineering technique.

Answer

Whaling

Answer

Phishing

Answer

Vishing

Question 4

Which THREE of the following are techniques used in session hijacking?

Accepted Answer

Man-in-the-middle (MITM) interception. Session hijacking involves an attacker taking control of a legitimate user's active session. Man-in-the-middle (MITM) interception allows an attacker to position themselves between the client and server, intercepting and manipulating traffic, including session tokens, to impersonate the user. Cookie theft and replay is another direct method where an attacker steals a valid session cookie and uses it to authenticate as the legitimate user. TCP sequence number prediction, while less common now, was a technique where an attacker could guess the next sequence number in a TCP session to inject packets and take control of the communication.

Answer

DNS cache poisoning

Answer

MAC flooding

Question 5

Which TWO of the following are types of social engineering attacks that rely on impersonation?

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker creates a fabricated scenario (pretext) to impersonate an authority figure, colleague, or trusted entity in order to extract sensitive information. It relies on impersonation because the attacker assumes a false identity, such as a help desk technician or law enforcement officer, to gain the victim's trust and compliance.

Tailgating (or Piggybacking) is gaining unauthorized access to a restricted area by following closely behind an authorized person. This often relies on implicit impersonation, where the attacker pretends to be an authorized individual (e.g., an employee who forgot their badge, a delivery person, or someone simply 'belonging') to avoid suspicion and gain entry without proper authentication.

Answer

Baiting

Answer

Phishing

Answer

Quid pro quo

Question 6

A security analyst reviews a sandbox report for a suspicious executable. The report shows that the executable modified the Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to add a new entry pointing to itself. This action is characteristic of which type of malware?

Accepted Answer

Backdoor Trojan. The registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run is a standard autostart location used by Windows to launch programs at system boot. A backdoor Trojan commonly adds itself to this key to achieve persistence, ensuring it runs every time the system starts, which allows an attacker to maintain remote access. This behavior is a hallmark of backdoor Trojans, not other malware types.

Answer

Logic bomb

Answer

Ransomware

Answer

Adware

Question 7

During a forensic investigation, you find a file named 'svch0st.exe' in the startup folder. The file has a suspicious icon and was downloaded from an untrusted source. Analysis shows it opens a backdoor on port 4444 and sends system information to a remote server. Which THREE best describe this malware and its characteristics?

Accepted Answer

It functions as a remote access Trojan (RAT). The malware opens a backdoor on port 4444 and allows remote control, which is the defining behavior of a Remote Access Trojan (RAT). The file's deceptive name ('svch0st.exe') and origin from an untrusted source, combined with its malicious payload, classify it as a Trojan horse. It also sends system information to a remote server, confirming its ability to exfiltrate data and provide unauthorized remote access to the attacker.

Answer

It is a polymorphic virus that changes its signature each time it runs

Answer

It is a worm that replicates across the network automatically

Question 8

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP by sending a large number of ICMP Echo Request packets with a spoofed source IP (the victim's IP) to a network's broadcast address. All devices on that network then respond with ICMP Echo Reply packets to the victim, overwhelming it. The scenario describes varied source IPs (the responding devices) and a single destination IP (the victim), which is the hallmark of a Smurf attack.

Answer

UDP flood

Answer

Ping of Death

Answer

ICMP flood

Question 9

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where the attacker creates a fabricated scenario (pretext) to trick the victim into divulging sensitive information. In this case, the caller impersonates IT support to establish a false sense of authority and urgency, directly asking for the password. This differs from vishing, which is voice-based phishing but typically involves a generic, automated or scripted request rather than a crafted, interactive pretext.

Answer

Phishing

Answer

Baiting

Answer

Vishing

Question 10

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Accepted Answer

Ettercap. Ettercap is a dedicated suite for man-in-the-middle attacks on LANs, with built-in support for ARP poisoning. It actively sends forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host, allowing interception of traffic between two hosts. This makes it the most direct and purpose-built tool for the task described.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 11

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

Accepted Answer

An attacker is performing TCP sequence prediction to hijack the session.. The observed sequence numbers (initial seq=100, ack=300, then seq=300, ack=101) indicate that the ACK packet acknowledges a sequence number that was never sent by the original sender, which is a classic sign of TCP sequence number prediction. An attacker who predicts the next expected sequence number can inject a spoofed packet to hijack the session, and the subsequent RST is often used by the attacker to tear down the legitimate connection or cover their tracks.

Answer

A normal TCP connection establishment followed by an immediate termination.

Answer

A man-in-the-middle attack using ARP spoofing.

Answer

A TCP SYN flood attack is in progress.

Question 12

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Accepted Answer

Static analysis using strings and PEiD. Static analysis using tools like strings and PEiD should be performed first to quickly inspect the file's metadata, embedded strings, and packer information without executing it. Since the digital signature validation fails despite claiming to be from Microsoft, static analysis can reveal anomalies such as unusual section names, suspicious imports, or packed code that indicate tampering. This non-execution approach is safe and efficient for initial triage, avoiding the risks of dynamic analysis or running the file.

Answer

Upload to VirusTotal

Answer

Dynamic analysis in a sandbox

Answer

Run the file on a production system to observe behavior

Question 13

Which type of malware is characterized by self-replication and spreading across networks without needing a host file?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself to spread to other computers over a network, exploiting vulnerabilities or using social engineering, without requiring a host file or user intervention. Unlike viruses, worms do not need to attach to an existing program; they operate independently, often using network protocols like SMB, HTTP, or email to propagate.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 14

A penetration tester uses the Social Engineering Toolkit (SET) to create a malicious USB drive that autoruns when inserted. Which social engineering technique is being employed?

Accepted Answer

Baiting. Baiting is the correct answer because the penetration tester is using a physical device (USB drive) to exploit human curiosity or greed, enticing the target to insert it into a system. The Social Engineering Toolkit (SET) can create an autorun.inf file that triggers a payload upon insertion, which is a classic baiting attack that relies on the victim's action to compromise the system.

Answer

Tailgating

Answer

Pretexting

Answer

Phishing

Question 15

An IDS alerts on a large number of outbound DNS queries from an internal host to a suspicious domain. The queries have random subdomains and the response size is large. Which attack is MOST likely in progress?

Accepted Answer

DNS amplification attack. The described behavior—large numbers of outbound DNS queries with random subdomains and large response sizes—is the hallmark of a DNS amplification attack. In this attack, the attacker spoofs the victim's IP address and sends queries with random subdomains to open DNS resolvers, which then send large responses (often 10x to 50x larger than the query) to the victim, overwhelming their bandwidth. The IDS alerts on the outbound queries from the internal host because that host is the victim receiving the amplified responses, not the attacker.

Answer

Slowloris attack

Answer

UDP flood

Answer

DNS tunneling