CEH Malware, Social Engineering and Network Attacks Practice Test 4 — 15 Questions

Question 1

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts the victim's files using symmetric encryption (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. Unlike other malware types, its primary purpose is data hostage for financial extortion, often leveraging asymmetric encryption (e.g., RSA) to secure the symmetric key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 2

During a penetration test, you capture the following output: 'HTTP/1.1 200 OK ... Set-Cookie: sessionid=abc123; path=/'. You then send a request with a modified cookie value 'sessionid=abc124' and receive a valid session. Which type of vulnerability has been exploited?

Accepted Answer

Session hijacking via cookie prediction. The attacker successfully predicted or guessed a valid session identifier (sessionid=abc124) after observing the pattern of the original session cookie (sessionid=abc123). This is a classic session hijacking via cookie prediction attack, where weak or sequential session IDs allow an attacker to impersonate another user's session without needing to intercept traffic or inject code.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 3

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature on each infection.. A polymorphic virus mutates its code signature with each infection, using a mutation engine to generate new decryption routines or code patterns while preserving the core payload. This signature change evades signature-based detection by antivirus software, as the virus appears different in every infected file.

Answer

It spreads without user interaction.

Answer

It attaches to a host file and does not change.

Answer

It only infects the boot sector.

Question 4

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Rate limiting. Rate limiting is effective because it restricts the number of requests a server will accept from a single IP address or session within a given time window, typically enforced via token bucket or leaky bucket algorithms. This prevents a single attacker or botnet node from overwhelming server resources, though it must be carefully tuned to avoid blocking legitimate users.

Answer

Blackholing all traffic to the target

Answer

IP spoofing

Question 5

A security analyst receives an alert indicating that a host on the internal network is sending a high volume of ICMP echo requests to multiple external IP addresses. The analyst notices that the source IP address is spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

Ping flood. The attack described is a Ping flood (option D). A Ping flood involves sending a high volume of ICMP echo requests (pings) directly to multiple target IP addresses, often with a spoofed source IP to hide the attacker's identity. This overwhelms the targets' network resources. Unlike a Smurf attack, which uses a network broadcast address to amplify traffic, this scenario shows direct flooding of multiple external IPs, characteristic of a Ping flood.

Answer

Fraggle attack

Answer

ICMP flood

Answer

Smurf attack

Question 6

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

Accepted Answer

Ettercap. Ettercap is specifically designed for ARP poisoning and man-in-the-middle (MITM) attacks on a local network. It exploits the Address Resolution Protocol (ARP) by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, thereby intercepting traffic between two hosts on the same subnet.

Answer

Nmap

Answer

Wireshark

Answer

Metasploit

Question 7

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

Accepted Answer

Backdoor Trojan. The outbound traffic on port 4444, a common port for the Metasploit Meterpreter reverse shell, combined with the 'strings' output showing 'cmd.exe /c' (a command shell invocation) and an IP address, indicates a backdoor Trojan. This malware type establishes a covert reverse connection to an attacker's command-and-control server, allowing remote shell access without a legitimate service on the target port.

Answer

Worm

Answer

Keylogger

Answer

Ransomware

Question 8

An organization wants to test its employees' susceptibility to social engineering by sending fake emails that appear to come from the IT department, requesting password resets. Which tool would be MOST effective for conducting this test?

Accepted Answer

Social Engineering Toolkit (SET). The Social Engineering Toolkit (SET) is specifically designed for social engineering attacks, including crafting convincing phishing emails that mimic internal departments like IT. It automates the creation of fake login pages and email templates, making it the most effective tool for testing employee susceptibility to password reset requests.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 9

A security team observes that a switch's MAC address table is full, and the switch has started flooding unicast traffic to all ports. Which attack has MOST likely been performed?

Accepted Answer

MAC flooding. MAC flooding attacks exploit the limited size of a switch's CAM (Content Addressable Memory) table. By sending thousands of frames with random source MAC addresses, the attacker fills the table to capacity. Once full, the switch enters a fail-open state and begins flooding all unknown unicast traffic out every port, effectively turning it into a hub and allowing the attacker to capture traffic not destined for them.

Answer

ARP poisoning

Answer

MAC spoofing

Answer

DHCP starvation

Question 10

Which type of malware spreads by replicating itself across a network without requiring a host file to attach to?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself across a network without needing a host file, exploiting vulnerabilities or using network protocols like SMB, RDP, or email to spread autonomously. Unlike viruses, worms do not attach to a host program; they self-propagate via network connections, often consuming bandwidth and system resources.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 11

An analyst uses the following command to capture traffic: tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80. After generating traffic from a web server at 10.0.0.5, the analyst examines the pcap with Wireshark. What type of traffic will appear in the capture?

Accepted Answer

HTTP traffic to and from 10.0.0.5. The command `tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80` captures only packets that match both conditions: the IP address is 10.0.0.5 (source or destination) and the port is 80 (source or destination). Since port 80 is the default HTTP port, this filter captures HTTP traffic to and from the web server at 10.0.0.5. The `host` keyword includes both directions, so the capture is not limited to traffic originating from the server.

Answer

All HTTP traffic on the network

Answer

Only HTTP traffic originating from 10.0.0.5

Answer

All traffic from 10.0.0.5 on any port

Question 12

Which type of social engineering attack involves a malicious actor impersonating a legitimate organization in a voicemail message to trick the victim into revealing sensitive information?

Accepted Answer

Vishing. Vishing (voice phishing) is the correct answer because it specifically involves using voice communication—such as a phone call or voicemail—to impersonate a legitimate organization and trick the victim into revealing sensitive information like passwords or credit card numbers. Unlike other social engineering attacks, vishing exploits the trust associated with voice interactions and often uses caller ID spoofing to appear as a trusted entity.

Answer

SMiShing

Answer

Pharming

Answer

Baiting

Question 13

A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?

Accepted Answer

Implement rate limiting and connection timeout. Slowloris works by opening many HTTP connections and keeping them alive by sending partial requests, never completing them, which exhausts the server's connection pool. Rate limiting restricts the number of connections from a single IP, and connection timeouts force idle connections to close, directly countering Slowloris's behavior. This combination prevents the attacker from holding connections open indefinitely.

Answer

Use anycast routing

Answer

Increase the maximum number of simultaneous connections

Answer

Enable SYN cookies

Question 14

An employee receives an email that appears to be from the CEO, requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ceo@cornpany.com instead of ceo@company.com). This is an example of which type of attack?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or organization, using personalized information to increase credibility. In this scenario, the attacker spoofs the CEO's identity and uses a misspelled domain (typosquatting) to trick the employee into performing a wire transfer, which is a classic spear phishing technique. Unlike generic phishing, spear phishing tailors the message to the victim's role and context, making it more effective.

Answer

Whaling

Answer

Phishing

Answer

Pretexting

Question 15

Which THREE of the following are techniques used in static malware analysis? (Select 3)

Accepted Answer

Inspecting file metadata and properties. Inspecting file metadata and properties (Option A) is a static analysis technique because it examines the file's embedded information—such as author, creation date, file version, and digital signatures—without executing the binary. This metadata can reveal the origin, compilation timestamp, or whether the file is signed by a known legitimate publisher, helping to identify suspicious characteristics before runtime.

Answer

Capturing network traffic in a sandbox

Answer

Monitoring registry changes during execution