CEH Malware, Social Engineering and Network Attacks Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are common indicators of a DNS spoofing attack? (Select 2)

Accepted Answer

The resolved IP address for a domain does not match the legitimate server. DNS spoofing (cache poisoning) involves an attacker injecting forged DNS records into a resolver's cache. When a user's system queries a domain, the resolver returns the attacker-controlled IP address instead of the legitimate server's IP, causing traffic to be misdirected.

Answer

High volume of DNS queries from a single source

Answer

ARP cache entries show unexpected MAC-IP mappings

Answer

The switch's CAM table is full

Question 2

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

Accepted Answer

Remote Access Trojan (RAT). The behavior described—downloading a file that, when executed, creates a hidden process that connects to a remote server and provides full remote control—is the classic definition of a Remote Access Trojan (RAT). A RAT is a type of malware that allows an attacker to remotely control the victim's system, often using a command-and-control (C2) channel over protocols like TCP or HTTP. The hidden process and outbound connection to a remote server are key indicators of a RAT, distinguishing it from other malware types that do not provide interactive remote control.

Answer

Worm

Answer

Ransomware

Answer

Polymorphic virus

Question 3

A penetration tester receives an email that appears to be from the company's CEO, urgently requesting that the tester click a link to review a document. The email contains several grammatical errors and the sender's address is slightly misspelled. Which type of social engineering attack is this MOST likely?

Accepted Answer

Spear phishing. This attack is spear phishing because the email is targeted at a specific individual (the penetration tester) and impersonates a trusted source (the CEO) to trick the recipient into clicking a malicious link. While whaling targets high-level executives, spear phishing targets any specific person, and here the recipient is not a senior executive. The grammatical errors and misspelled sender address are common indicators of phishing, but the targeted nature distinguishes it from generic phishing.

Answer

Whaling

Answer

Baiting

Answer

Vishing

Question 4

A network administrator notices that the ARP cache on several workstations contains entries mapping the default gateway IP to an unknown MAC address. Users report intermittent connectivity issues. Which tool is MOST likely being used to perform this attack?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs, including ARP cache poisoning. By sending forged ARP replies, it maps the default gateway IP to an attacker-controlled MAC address, causing traffic to be intercepted and resulting in intermittent connectivity. This directly matches the symptoms described.

Answer

Nmap

Answer

tcpdump

Answer

Wireshark

Question 5

Which of the following malware types is characterized by self-replication without requiring a host file or program, and spreading across networks automatically?

Accepted Answer

Worm. A worm is a standalone malware type that self-replicates and spreads across networks automatically without needing a host file or program. It exploits network vulnerabilities or uses social engineering to propagate, often consuming bandwidth and system resources.

Answer

Trojan horse

Answer

Virus

Answer

Ransomware

Question 6

During a penetration test, you execute a command that sends a large number of spoofed ICMP echo request packets to a subnet's broadcast address. This results in a flood of replies to the target system. Which attack have you performed?

Accepted Answer

Smurf attack. The Smurf attack works by sending a large number of ICMP echo request packets with a spoofed source IP (the victim's address) to a subnet's broadcast address. All hosts on that subnet receive the request and reply to the spoofed source, overwhelming the victim with ICMP echo replies. This amplifies traffic because a single request triggers many responses, making it a classic amplification DDoS attack.

Answer

Ping of Death

Answer

UDP flood

Answer

ICMP flood

Question 7

A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?

Accepted Answer

Slowloris attack. The Slowloris attack works by opening multiple HTTP connections to the target web server and sending partial HTTP headers, then keeping those connections alive by sending periodic small packets to prevent timeout. This exhausts the server's connection pool, leading to slow response times and denial of service for legitimate users, matching the described symptoms of incomplete requests and long-held connections.

Answer

HTTP flood

Answer

SYN flood

Answer

UDP flood

Question 8

Which of the following is a tool commonly used for MAC flooding attacks to force a switch into fail-open mode, allowing sniffing of all traffic on the network?

Accepted Answer

macof. macof is a tool specifically designed to perform MAC flooding attacks. It generates thousands of random MAC addresses, overwhelming the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode (hub mode), forwarding all frames out of all ports, which allows an attacker to sniff traffic that would normally be isolated.

Answer

Ettercap

Answer

Nmap

Answer

Wireshark

Question 9

A penetration tester uses the following command to scan a target: nmap -sU -sV -p 53,161,162 10.0.0.1. Which of the following BEST describes what this scan will accomplish?

Accepted Answer

UDP scan on three ports with service version detection. The `-sU` flag initiates a UDP scan, `-p 53,161,162` limits the scan to those three specific ports, and `-sV` enables service version detection. This combination performs a UDP scan on only the specified ports and attempts to identify the versions of services running on them.

Answer

Full port scan of all 65535 UDP ports

Answer

Ping sweep and OS detection on the target

Answer

TCP SYN scan on ports 53, 161, 162 with version detection

Question 10

An attacker calls a company's help desk, pretending to be a new employee who forgot his username and password. The attacker provides some employee details gleaned from social media and convinces the help desk to reset the password. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where the attacker fabricates a scenario (pretext) to manipulate the target into performing an action. In this case, the attacker pretends to be a new employee, using details from social media to establish credibility, and convinces the help desk to reset credentials. This is a classic example of pretexting because the entire interaction is based on a false identity and fabricated story.

Answer

Tailgating

Answer

Quid pro quo

Answer

Baiting

Question 11

Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)

Accepted Answer

Spoofs the source IP address of the victim. In a DNS amplification DDoS attack, the attacker spoofs the source IP address of the victim in DNS queries sent to open resolvers. This causes the resolvers to send their large responses to the victim, not the attacker, thereby directing the amplified traffic at the target. Without IP spoofing, the attack would not be able to flood the victim with responses.

Answer

Exploits the TCP handshake process

Answer

Floods the target with small ICMP packets

Question 12

During a penetration test, a security analyst runs the following command on a Linux system: ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//. What is the PRIMARY purpose of this command?

Accepted Answer

To perform a man-in-the-middle attack between the gateway and the target host. The command `ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//` uses ARP poisoning in remote mode to intercept traffic between the gateway (192.168.1.1) and the target host (192.168.1.100). By sending forged ARP replies to both devices, the attacker's machine becomes a man-in-the-middle, allowing it to capture, modify, or relay packets between them. The `-M arp:remote` flag specifically enables ARP poisoning for a MITM attack, not for DNS spoofing, promiscuous mode, or flooding.

Answer

To spoof the DNS responses to redirect the target to a malicious site

Answer

To sniff all traffic on the network by enabling promiscuous mode on the interface

Answer

To perform a denial-of-service attack by flooding the network with ARP replies

Question 13

An incident response team discovers a suspicious executable on a compromised workstation. They want to analyze the malware without executing it. Which of the following techniques would be MOST appropriate for this initial analysis?

Accepted Answer

Using the 'strings' command to extract embedded text. The 'strings' command extracts human-readable text from a binary file without executing it, making it ideal for static analysis. This technique can reveal indicators such as IP addresses, domain names, file paths, registry keys, or embedded commands that help classify the malware's purpose and capabilities without triggering its payload.

Answer

Capturing network traffic with Wireshark during execution

Answer

Monitoring process behavior with Process Monitor

Answer

Running the executable in a sandboxed environment

Question 14

A security analyst observes a sudden surge in incoming UDP traffic to the company's DNS servers from multiple external IP addresses. The packets appear to be DNS queries with spoofed source IPs. Which type of DDoS attack is MOST likely occurring?

Accepted Answer

DNS amplification. The attack described involves DNS queries with spoofed source IPs sent to a DNS server, which then responds with large replies to the victim (the spoofed IP). This is a classic DNS amplification attack, a type of reflection-based DDoS that exploits the large response-to-query ratio (e.g., an ANY query can yield a response up to 70x larger) to overwhelm the target. The surge in incoming UDP traffic to the DNS server is the attacker's queries, while the amplified responses are directed at the spoofed victim.

Answer

SYN flood

Answer

UDP flood

Answer

ICMP flood

Question 15

Which of the following is a type of malware that spreads by replicating itself across a network without requiring a host file?

Accepted Answer

Worm. A worm is a standalone malware that replicates itself across a network by exploiting vulnerabilities or using network protocols (e.g., SMB, RDP, or email) without needing a host file. Unlike viruses, worms do not attach to existing programs; they self-propagate via network connections, often consuming bandwidth and creating backdoors.

Answer

Trojan

Answer

Ransomware

Answer

Virus