CEH Malware, Social Engineering and Network Attacks Practice Test 6 — 15 Questions

Question 1

A penetration tester uses a tool to perform ARP poisoning and then launches a man-in-the-middle attack. The tool also allows session hijacking and sniffing. Which of the following tools is being used?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LANs, featuring built-in ARP poisoning, session hijacking, and sniffing capabilities. It actively intercepts traffic by spoofing ARP replies to redirect packets through the attacker's machine, enabling real-time manipulation of sessions. This matches the question's description of a tool that performs ARP poisoning, MITM attacks, session hijacking, and sniffing.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 2

An employee receives an email that appears to be from the company's CEO, requesting an urgent wire transfer to a vendor. The email address is slightly different from the CEO's actual address. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted social engineering attack aimed at a specific individual or organization. In this scenario, the email is personalized to appear from the CEO but targets an employee, making it spear phishing. Unlike whaling, which targets high-profile executives, spear phishing can target any individual. The slightly spoofed email address and urgent request for a wire transfer are common spear phishing tactics, exploiting trust and authority to trick the victim.

Answer

Phishing

Answer

Vishing

Answer

Whaling

Question 3

A security analyst is analyzing a suspicious file and runs the command 'strings malware.exe | grep -i http'. The output shows several URLs ending with '.exe'. What does this indicate?

Accepted Answer

The malware may download additional payloads from remote servers. The `strings` command extracts printable strings from a binary file, and `grep -i http` filters for HTTP-related content. The presence of URLs ending with `.exe` indicates that the malware contains embedded references to executable files hosted on remote servers, which is a common technique for downloading additional payloads or updates. This strongly suggests the malware has a downloader or dropper component that fetches further malicious code from those URLs.

Answer

The malware has a keylogger component

Answer

The malware is a boot sector virus

Answer

The malware is a worm that spreads via email

Question 4

Which of the following tools is specifically designed to perform MAC flooding to force a switch into fail-open mode, allowing packet sniffing?

Accepted Answer

macof. The macof tool (part of the dsniff suite) is specifically designed to perform MAC flooding attacks. It floods a switch with thousands of random MAC addresses, exhausting the Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode and begins flooding all frames out all ports, effectively turning it into a hub and allowing an attacker to sniff traffic that was not originally destined for their port.

Answer

Ettercap

Answer

Wireshark

Answer

Nmap

Question 5

A user reports that their computer is infected with ransomware. Which of the following is the BEST immediate action for the security team to take?

Accepted Answer

Disconnect the computer from the network. Disconnecting the computer from the network is the best immediate action because it isolates the ransomware, preventing it from spreading laterally to other systems via SMB, RDP, or mapped drives. This containment step stops the encryption of additional network shares and halts any command-and-control (C2) communication the ransomware might be using to exfiltrate data or receive encryption keys.

Answer

Pay the ransom to regain access

Answer

Run a full antivirus scan

Answer

Restore the system from a recent backup

Question 6

Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?

Accepted Answer

Polymorphic virus. A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.

Answer

Trojan horse

Answer

Macro virus

Answer

Boot sector virus

Question 7

A network administrator notices an unusual amount of traffic on port 389 from an internal server to multiple external IP addresses. Which type of malware might be present?

Accepted Answer

Trojan backdoor. Port 389 is used by LDAP. Outbound traffic to multiple external IPs could indicate LDAP query-based command and control or data exfiltration, but more commonly, port 389 is associated with directory services. However, in malware context, it could be a sign of a backdoor or RAT using LDAP for C2. The most likely is that the malware is using LDAP for communication, but given options, a Trojan backdoor is plausible.

Answer

Adware

Answer

Worm

Answer

Ransomware

Question 8

Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)

Accepted Answer

It uses spoofed source IP addresses. DNS amplification attacks rely on sending DNS queries with a spoofed source IP address that matches the victim's IP. The attacker sends small queries to open DNS resolvers, which then send large responses to the victim, overwhelming their bandwidth. This spoofing ensures the amplified traffic is directed at the victim, not the attacker.

Answer

It targets the victim's MAC address

Answer

It requires the attacker to be on the same subnet as the victim

Answer

It uses ICMP echo requests

Question 9

Which THREE of the following are examples of application-layer DDoS attacks? (Select 3)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers slowly to exhaust the server's connection pool. It exploits the HTTP protocol's design where servers wait for complete requests before releasing resources, making it a classic Layer 7 attack.

Answer

SYN flood

Answer

UDP flood

Question 10

A security analyst discovers a file named invoice.exe in an email attachment. Static analysis with PEiD indicates the file is packed with UPX. What is the BEST next step in analyzing this malware?

Accepted Answer

Unpack the file with UPX and then perform static analysis. B is correct because UPX-packed executables cannot be properly analyzed statically; the code is compressed and obfuscated. Unpacking with the UPX tool restores the original binary, enabling accurate static analysis of imports, strings, and structure. This step is essential before any dynamic analysis or submission to sandboxes.

Answer

Execute the packed file on a production server

Answer

Submit the packed file directly to VirusTotal

Answer

Delete the file immediately

Question 11

A network administrator notices an unusually high number of half-open TCP connections to the company's web server. The source IPs are spoofed. Which type of attack is MOST likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to the target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, exhausting its connection queue and preventing legitimate connections. The description of half-open TCP connections with spoofed source IPs is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

UDP flood

Answer

ICMP flood

Question 12

During a penetration test, an analyst uses a tool that sends forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This technique allows the attacker to intercept traffic. Which tool is commonly used for this purpose?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks on LAN. It supports ARP poisoning, where it sends forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This causes the target's traffic destined for the gateway to be sent to the attacker, allowing interception and modification of packets.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 13

A security analyst receives an alert about a workstation repeatedly sending large volumes of ICMP echo request packets to a broadcast address. Which type of attack is this indicative of?

Accepted Answer

Smurf attack. A Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets sent to a network broadcast address. The source IP is spoofed to be the victim's address, causing all hosts on the broadcast network to reply to the victim, overwhelming it with ICMP echo replies. This matches the alert description of large volumes of ICMP echo requests to a broadcast address.

Answer

Ping of Death

Answer

SYN flood

Answer

Slowloris

Question 14

A user receives a phone call from someone claiming to be from IT support, asking for their password to perform a system update. This is an example of which social engineering technique?

Accepted Answer

Pretexting. Pretexting is a social engineering technique where an attacker fabricates a scenario (pretext) to manipulate a target into divulging sensitive information. In this case, the caller creates a false identity (IT support) and a false reason (system update) to trick the user into revealing their password. This differs from other techniques because it relies on a constructed narrative rather than malicious software or direct impersonation via email or phone alone.

Answer

Baiting

Answer

Phishing

Answer

Vishing

Question 15

A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing the malware in a controlled environment (sandbox) to observe its runtime behavior, such as contacting a C2 server and downloading additional payloads. This contrasts with static analysis, which examines the code without execution. The scenario explicitly describes observing behavior during execution, confirming dynamic analysis.

Answer

Static analysis

Answer

Network analysis

Answer

Code analysis