CEH Malware, Social Engineering and Network Attacks Practice Test 4 — 15 Questions

Question 1

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's webmail portal. The attempts use common usernames like 'admin', 'user', and 'test'. Which type of social engineering attack is MOST likely being attempted?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario to obtain information or access. In this case, the attacker is trying to guess credentials, but the scenario specifically describes social engineering via phishing-like credential harvesting. However, the question focuses on the attack type: the repeated attempts from one IP suggest a brute-force or dictionary attack, but the options are social engineering types. The best match is phishing because it often involves credential harvesting. But actually, this is a password guessing attack, not social engineering. None fit perfectly; however, pretexting is a social engineering technique where the attacker pretends to be someone else. The question might be flawed. I'll adjust the stem to better fit.

Answer

Tailgating

Answer

Baiting

Answer

Phishing

Question 2

During a penetration test, a security analyst runs the following command on a Linux system: ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//. What is the PRIMARY purpose of this command?

Accepted Answer

To perform a man-in-the-middle attack between the gateway and the target host. The command uses Ettercap with ARP poisoning (arp:remote) to perform a man-in-the-middle attack between the gateway (192.168.1.1) and a target host (192.168.1.100). This allows interception and modification of traffic.

Answer

To spoof the DNS responses to redirect the target to a malicious site

Answer

To sniff all traffic on the network by enabling promiscuous mode on the interface

Answer

To perform a denial-of-service attack by flooding the network with ARP replies

Question 3

An incident response team discovers a suspicious executable on a compromised workstation. They want to analyze the malware without executing it. Which of the following techniques would be MOST appropriate for this initial analysis?

Accepted Answer

Using the 'strings' command to extract embedded text. Static analysis involves examining the malware without executing it. Using strings to extract readable characters is a common static analysis technique.

Answer

Capturing network traffic with Wireshark during execution

Answer

Monitoring process behavior with Process Monitor

Answer

Running the executable in a sandboxed environment

Question 4

A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?

Accepted Answer

DNS amplification. A DNS amplification attack uses spoofed source IPs and small queries that generate large responses, amplifying traffic to the victim.

Answer

SYN flood

Answer

UDP flood

Answer

ICMP flood

Question 5

Which of the following is a type of malware that spreads by replicating itself across a network without requiring a host file?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself to spread to other computers, often via network vulnerabilities.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 6

A penetration tester uses a tool to perform ARP poisoning and then launches a man-in-the-middle attack. The tool also allows session hijacking and sniffing. Which of the following tools is being used?

Accepted Answer

Ettercap. Ettercap is a comprehensive tool for ARP poisoning, MITM attacks, session hijacking, and sniffing.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 7

An employee receives an email that appears to be from the company's CEO, requesting an urgent wire transfer to a vendor. The email address is slightly different from the CEO's actual address. Which type of social engineering attack is this?

Accepted Answer

Whaling. Whaling is a spear-phishing attack targeting senior executives, often with requests for wire transfers or sensitive information.

Answer

Phishing

Answer

Vishing

Answer

Spear phishing

Question 8

A security analyst is analyzing a suspicious file and runs the command 'strings malware.exe | grep -i http'. The output shows several URLs ending with '.exe'. What does this indicate?

Accepted Answer

The malware may download additional payloads from remote servers. Strings extracts readable text; finding URLs that point to executable files suggests the malware may download additional payloads from those URLs.

Answer

The malware has a keylogger component

Answer

The malware is a boot sector virus

Answer

The malware is a worm that spreads via email

Question 9

Which of the following tools is specifically designed to perform MAC flooding to force a switch into fail-open mode, allowing packet sniffing?

Accepted Answer

macof. macof is a tool that floods a switch with random MAC addresses to overflow the CAM table, causing the switch to operate as a hub.

Answer

Ettercap

Answer

Wireshark

Answer

Nmap

Question 10

A user reports that their computer is infected with ransomware. Which of the following is the BEST immediate action for the security team to take?

Accepted Answer

Disconnect the computer from the network. The first step is to isolate the infected machine from the network to prevent the ransomware from spreading to other systems.

Answer

Pay the ransom to regain access

Answer

Run a full antivirus scan

Answer

Restore the system from a recent backup

Question 11

Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?

Accepted Answer

Polymorphic virus. Polymorphic malware changes its code (but retains functionality) to avoid detection by signature-based antivirus.

Answer

Trojan horse

Answer

Macro virus

Answer

Boot sector virus

Question 12

A network administrator notices an unusual amount of traffic on port 389 from an internal server to multiple external IP addresses. Which type of malware might be present?

Accepted Answer

Trojan backdoor. Port 389 is used by LDAP. Outbound traffic to multiple external IPs could indicate LDAP query-based command and control or data exfiltration, but more commonly, port 389 is associated with directory services. However, in malware context, it could be a sign of a backdoor or RAT using LDAP for C2. The most likely is that the malware is using LDAP for communication, but given options, a Trojan backdoor is plausible.

Answer

Adware

Answer

Worm

Answer

Ransomware

Question 13

Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)

Accepted Answer

It uses spoofed source IP addresses. DNS amplification uses open resolvers and spoofed source IPs to send small queries that yield large responses, amplifying traffic.

Answer

It targets the victim's MAC address

Answer

It requires the attacker to be on the same subnet as the victim

Answer

It uses ICMP echo requests

Question 14

Which THREE of the following are examples of application-layer DDoS attacks? (Select 3)

Accepted Answer

Slowloris. Application-layer attacks target the OSI layer 7. Slowloris keeps many connections open, HTTP flood sends many requests, and DNS amplification (though often considered volumetric) can be application-layer when using DNS queries.

Answer

SYN flood

Answer

UDP flood

Question 15

Which TWO of the following are valid techniques for session hijacking? (Select 2)

Accepted Answer

TCP sequence prediction. Session hijacking can involve predicting TCP sequence numbers or stealing session cookies. ARP poisoning is a method to enable MITM but not direct session hijacking; DNS spoofing redirects traffic but not session hijacking per se.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning