CEH Malware, Social Engineering and Network Attacks Practice Test 5 — 15 Questions

Question 1

A security analyst discovers a file named invoice.exe in an email attachment. Static analysis with PEiD indicates the file is packed with UPX. What is the BEST next step in analyzing this malware?

Accepted Answer

Unpack the file with UPX and then perform static analysis. UPX packers require unpacking to reveal the original code. Dynamic analysis in a sandbox can observe behavior after unpacking.

Answer

Execute the packed file on a production server

Answer

Submit the packed file directly to VirusTotal

Answer

Delete the file immediately

Question 2

A network administrator notices an unusually high number of half-open TCP connections to the company's web server. The source IPs are spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets without completing the handshake, exhausting server resources.

Answer

Smurf attack

Answer

UDP flood

Answer

ICMP flood

Question 3

During a penetration test, an analyst uses a tool that sends forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This technique allows the attacker to intercept traffic. Which tool is commonly used for this purpose?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 4

A security analyst receives an alert about a workstation repeatedly sending large volumes of ICMP echo request packets to a broadcast address. Which type of attack is this indicative of?

Accepted Answer

Smurf attack. A Smurf attack uses ICMP echo requests to a broadcast address, causing all hosts to reply and flood the victim.

Answer

Ping of Death

Answer

SYN flood

Answer

Slowloris

Question 5

A user receives a phone call from someone claiming to be from IT support, asking for their password to perform a system update. This is an example of which social engineering technique?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario to obtain information. The caller pretends to be IT support.

Answer

Baiting

Answer

Phishing

Answer

Vishing

Question 6

A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing malware in a controlled environment to observe behavior.

Answer

Static analysis

Answer

Network analysis

Answer

Code analysis

Question 7

Which type of malware is designed to replicate itself across networks without requiring a host file, often exploiting vulnerabilities to spread?

Accepted Answer

Worm. Worms are standalone malware that self-replicate and spread over networks.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 8

An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?

Accepted Answer

Implement DNSSEC. DNSSEC adds cryptographic signatures to DNS data, preventing spoofed responses.

Answer

Use IPsec

Answer

Use a firewall

Answer

Disable DNS recursion

Question 9

A security team suspects a session hijacking attack. The analyst examines network traffic and sees packets with sequence numbers that increment by predictable values. Which attack is MOST likely occurring?

Accepted Answer

TCP sequence prediction. TCP session hijacking relies on predicting sequence numbers to inject packets.

Answer

ARP poisoning

Answer

DNS spoofing

Answer

MAC flooding

Question 10

Which tool is specifically designed to create and manage phishing campaigns for security awareness testing?

Accepted Answer

SET. The Social Engineering Toolkit (SET) is a framework for social engineering attacks, including phishing.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 11

A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?

Accepted Answer

MAC flooding. MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.

Answer

ARP poisoning

Answer

STP attack

Answer

DNS spoofing

Question 12

Which DoS attack exploits the HTTP protocol by sending partial HTTP requests to keep connections open, exhausting server resources?

Accepted Answer

Slowloris. Slowloris sends partial HTTP headers to keep many connections open, consuming server threads.

Answer

SYN flood

Answer

Ping of Death

Answer

UDP flood

Question 13

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature each time it replicates. Polymorphic viruses change their code with each infection to evade signature detection, and they use encryption or mutation engines.

Answer

It spreads via email attachments only

Answer

It requires a host file to attach

Answer

It self-replicates without user interaction

Question 14

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Anycast network distribution. Rate limiting restricts traffic volume, scrubbing centers filter malicious traffic, and anycast distributes traffic across multiple servers.

Answer

Disabling TCP SYN cookies

Answer

Using a single server with high bandwidth

Question 15

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines code without execution; dynamic analysis observes behavior in a sandbox.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review