CEH Malware, Social Engineering and Network Attacks Practice Test 7 — 15 Questions

Question 1

A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?

Accepted Answer

A DNS tunneling tool used for data exfiltration. A DNS tunneling tool uses DNS queries to exfiltrate data, which would cause an increase in UDP port 53 traffic. The other options are less likely to generate such traffic.

Answer

A worm that spreads via email attachments

Answer

A polymorphic virus

Answer

A keylogger that sends captured keystrokes via HTTP

Question 2

Which tool would an ethical hacker use to automatically generate a malicious USB drive that, when plugged in, executes a payload and connects back to the attacker?

Accepted Answer

USB Rubber Ducky. The USB Rubber Ducky is a device that acts as a keyboard and can execute keystroke injection attacks. The other tools are not specifically designed for this purpose.

Answer

Wireshark

Answer

Ettercap

Answer

Metasploit

Question 3

During a penetration test, a security analyst captures network traffic and observes a series of ARP replies without corresponding ARP requests. An internal host's IP address is suddenly associated with two different MAC addresses. Which attack is MOST likely occurring?

Accepted Answer

ARP poisoning. ARP poisoning (also known as ARP spoofing) involves sending forged ARP replies to associate an IP with a different MAC, enabling MITM attacks. The other options do not fit the ARP reply pattern.

Answer

Session hijacking

Answer

MAC flooding

Answer

DNS spoofing

Question 4

A penetration tester wants to perform a stealth scan without completing the TCP three-way handshake. The target is a web server on port 80. The tester uses Nmap with the -sS flag. What is the expected behavior if the port is open?

Accepted Answer

The tester receives a SYN/ACK and sends an RST to tear down the connection.. A SYN scan sends a SYN packet; if the port is open, the target responds with SYN/ACK, and the tester sends an RST to tear down the connection without completing the handshake.

Answer

The tester receives an RST, indicating the port is closed.

Answer

The tester receives no response, indicating a filtered port.

Answer

The tester receives a SYN/ACK and sends an ACK to establish the connection.

Question 5

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is specifically designed to encrypt files and demand ransom. The other options do not typically encrypt files for ransom.

Answer

Trojan

Answer

Spyware

Answer

Adware

Question 6

A security analyst reviews logs and notices that an attacker crafted a packet with a source IP address matching the target's IP address, and sent it to a network's broadcast address. Which type of attack does this describe?

Accepted Answer

Smurf attack. A Smurf attack sends a spoofed ICMP echo request to the broadcast address with the victim's IP as the source, causing all hosts to reply to the victim. The other options do not fit this description.

Answer

UDP flood

Answer

Ping of Death

Answer

SYN flood

Question 7

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern every time it infects a new file or system.. Polymorphic viruses mutate their code with each infection to evade signature-based detection, while often keeping the original functionality intact.

Answer

It spreads through network shares without requiring user interaction.

Answer

It remains dormant until a specific date or time.

Answer

It infects the master boot record of a hard drive.

Question 8

An organization experiences a DDoS attack where the attacker sends many incomplete HTTP requests that keep connections open, exhausting the server's connection pool. Which attack technique is being used?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep many connections open, eventually exhausting the server's resources.

Answer

UDP flood

Answer

HTTP flood

Answer

SYN flood

Question 9

During a social engineering engagement, an attacker calls an employee pretending to be from IT support and asks for their password to perform a system update. Which social engineering technique is being employed?

Accepted Answer

Pretexting. Pretexting involves fabricating a scenario (pretext) to obtain information, such as pretending to be from IT support. The other choices refer to different techniques.

Answer

Phishing

Answer

Quid pro quo

Answer

Vishing

Question 10

Which type of malware is characterized by its ability to spread without requiring a host file and can replicate across networks automatically?

Accepted Answer

Worm. A worm is a standalone malware that self-replicates and spreads across networks, unlike viruses that require a host file.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 11

A company wants to defend against DNS amplification attacks. Which mitigation technique would be MOST effective?

Accepted Answer

Implementing rate limiting on DNS servers. Rate limiting on DNS servers limits the number of responses per source, reducing the impact of amplification. Scrubbing centers and anycast help with volumetric attacks, but rate limiting directly addresses amplification.

Answer

Disabling recursive queries on DNS servers

Answer

Deploying anycast routing

Answer

Using a scrubbing center

Question 12

An ethical hacker is analyzing a suspicious file using static analysis. Which of the following actions is part of static malware analysis?

Accepted Answer

Examining the file's strings and metadata without executing it. Static analysis involves examining the file without executing it, including checking strings, file properties, and metadata. Dynamic analysis involves running the file in a sandbox.

Answer

Running the file in a sandboxed environment and monitoring its behavior

Answer

Uploading the file to VirusTotal for scanning

Answer

Using Wireshark to capture packets sent by the file

Question 13

Which TWO of the following are examples of application-layer DDoS attacks? (Choose two.)

Accepted Answer

Slowloris. Slowloris and HTTP flood are application-layer attacks. SYN flood is a protocol attack, UDP flood is volumetric, and Smurf is also a protocol attack.

Answer

UDP flood

Answer

SYN flood

Answer

Smurf attack

Question 14

Which THREE of the following are common indicators of a man-in-the-middle attack using ARP spoofing? (Choose three.)

Accepted Answer

Duplicate IP addresses in the ARP table. ARP spoofing often causes duplicate IP addresses in ARP tables, unusual ARP traffic, and increased latency due to packet interception. A sudden spike in DNS traffic is not directly related to ARP spoofing.

Answer

Multiple MAC addresses associated with the same IP in the ARP cache

Answer

A sudden spike in DNS traffic

Question 15

Which TWO of the following are techniques used in session hijacking attacks? (Choose two.)

Accepted Answer

TCP sequence prediction. TCP sequence prediction is a core technique in session hijacking where an attacker predicts or sniffs the TCP sequence numbers used by the client and server to inject forged packets and take over an established TCP session. By correctly guessing the next sequence number, the attacker can spoof the client's IP address and send malicious commands that the server accepts as legitimate traffic.

Answer

MAC flooding

Answer

DNS spoofing

Answer

ARP poisoning