CEH Malware, Social Engineering and Network Attacks Practice Test 3 — 15 Questions

Question 1

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

Accepted Answer

Remote Access Trojan (RAT). A RAT (Remote Access Trojan) allows an attacker to remotely control the infected system. The description of a hidden process connecting to a remote server for full control is characteristic of a RAT.

Answer

Worm

Answer

Ransomware

Answer

Polymorphic virus

Question 2

A penetration tester receives an email that appears to be from the company's CEO, urgently requesting that the tester click a link to review a document. The email contains several grammatical errors and the sender's address is slightly misspelled. Which type of social engineering attack is this MOST likely?

Accepted Answer

Whaling. Whaling targets high-level executives (like the CEO) with personalized phishing emails. The urgency and impersonation of a CEO are classic whaling indicators.

Answer

Baiting

Answer

Vishing

Answer

Spear phishing

Question 3

An organization's security team observes a surge in outgoing DNS queries to external servers from a single internal host, with each query returning unusually large responses (e.g., 4000 bytes). The host is not configured as a DNS resolver. Which attack is MOST likely occurring?

Accepted Answer

DNS amplification DDoS attack. DNS amplification attack uses small queries to generate large responses, overwhelming the victim. The large response sizes and unusual outgoing queries from a single host indicate the host is being used as an amplifier in a DDoS attack.

Answer

DNS cache poisoning

Answer

DNS zone transfer

Answer

DNS tunneling

Question 4

A security analyst is investigating a suspicious file and wants to quickly determine whether it is known malware without executing it. Which approach should the analyst use FIRST?

Accepted Answer

Submit the file to VirusTotal for hash lookup. Static analysis via VirusTotal checks file hashes against known malware databases without execution. This is the fastest, safest first step.

Answer

Disassemble the file with IDA Pro

Answer

Check for strings in the binary

Answer

Run the file in a sandbox environment

Question 5

A network administrator notices that the ARP cache on several workstations contains entries mapping the default gateway IP to an unknown MAC address. Users report intermittent connectivity issues. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a comprehensive MITM tool that performs ARP poisoning. The symptom of incorrect ARP entries for the gateway is classic ARP cache poisoning.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 6

Which of the following malware types is characterized by self-replication without requiring a host file or program, and spreading across networks automatically?

Accepted Answer

Worm. Worms are standalone self-replicating malware that spread across networks without needing to attach to host files.

Answer

Trojan horse

Answer

Virus

Answer

Ransomware

Question 7

During a penetration test, you execute a command that sends a large number of spoofed ICMP echo request packets to a subnet's broadcast address. This results in a flood of replies to the target system. Which attack have you performed?

Accepted Answer

Smurf attack. Smurf attack sends ICMP echo requests to a broadcast address with the source IP spoofed as the victim, causing all hosts on the subnet to reply to the victim.

Answer

Ping of Death

Answer

UDP flood

Answer

ICMP flood

Question 8

A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?

Accepted Answer

Slowloris attack. Slowloris is a low-bandwidth application-layer DoS attack that keeps many connections open by sending partial HTTP requests, exhausting server resources.

Answer

HTTP flood

Answer

SYN flood

Answer

UDP flood

Question 9

A company's security team wants to deploy a DDoS mitigation technique that distributes incoming traffic across multiple servers in different geographic locations, making it harder for an attacker to overwhelm a single target. Which technique BEST fits this description?

Accepted Answer

Anycast network. Anycast routing allows multiple servers to share the same IP address; traffic flows to the nearest server, distributing the load and absorbing DDoS attacks.

Answer

Rate limiting

Answer

Load balancer

Answer

Scrubbing center

Question 10

Which of the following is a tool commonly used for MAC flooding attacks to force a switch into fail-open mode, allowing sniffing of all traffic on the network?

Accepted Answer

macof. macof (part of the dsniff suite) floods a switch with many fake MAC addresses, exhausting the CAM table and causing the switch to flood traffic out all ports.

Answer

Ettercap

Answer

Nmap

Answer

Wireshark

Question 11

A penetration tester uses the following command to scan a target: nmap -sU -sV -p 53,161,162 10.0.0.1. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

UDP scan on three ports with service version detection. -sU performs a UDP scan, -sV attempts service version detection on the specified UDP ports (53=DNS, 161=SNMP, 162=SNMP trap).

Answer

Full port scan of all 65535 UDP ports

Answer

Ping sweep and OS detection on the target

Answer

TCP SYN scan on ports 53, 161, 162 with version detection

Question 12

An attacker calls a company's help desk, pretending to be a new employee who forgot his username and password. The attacker provides some employee details gleaned from social media and convinces the help desk to reset the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain information. The attacker invents a story (new employee) to manipulate the help desk.

Answer

Tailgating

Answer

Quid pro quo

Answer

Baiting

Question 13

Which TWO types of malware typically require user interaction (e.g., opening a file or clicking a link) to activate? (Select two.)

Accepted Answer

Ransomware. Trojans typically require user interaction to execute, and ransomware often requires user action (clicking a link or opening an attachment) to trigger. Worms and polymorphic viruses can spread without user interaction, though viruses generally need a host file.

Answer

Macro virus

Answer

Polymorphic virus

Answer

Worm

Question 14

Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)

Accepted Answer

Spoofs the source IP address of the victim. DNS amplification uses open DNS resolvers, spoofs the victim's IP, and exploits small queries to generate large responses, thereby amplifying traffic.

Answer

Exploits the TCP handshake process

Answer

Floods the target with small ICMP packets

Question 15

Which TWO of the following are examples of static malware analysis techniques? (Select two.)

Accepted Answer

Checking file hash on VirusTotal. Static analysis examines the malware without executing it. String analysis looks for embedded strings, and VirusTotal checks hashes against known signatures. Sandboxing and process monitoring are dynamic analysis.

Answer

Running the malware in a sandbox

Answer

Capturing network traffic during execution

Answer

Monitoring process behavior with Process Monitor