CEH Malware, Social Engineering and Network Attacks Practice Test 8 — 15 Questions

Question 1

A security analyst observes a gradual increase in network traffic from an internal host to an external IP address on port 443, with the host also connecting to a known command-and-control (C2) domain. Which type of malware is MOST likely responsible?

Accepted Answer

Backdoor Trojan. A backdoor Trojan provides remote access to an attacker, often using encrypted C2 communications. The connections to a C2 domain on port 443 (HTTPS) are indicative of backdoor activity.

Answer

Ransomware

Answer

Worm

Answer

Boot sector virus

Question 2

Which of the following tools is commonly used for dynamic malware analysis by executing the malware in an isolated environment and monitoring system changes?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is a popular open-source automated malware analysis system that runs samples in an isolated environment and reports behavior.

Answer

Strings

Answer

PEiD

Answer

VirusTotal

Question 3

An organization receives an email that appears to be from the CEO, urgently requesting that the recipient wire funds to a new vendor. The email contains the CEO's name and title but the sender address is slightly misspelled. Which type of social engineering attack is this?

Accepted Answer

Whaling. Whaling targets senior executives (like the CEO) with personalized phishing emails, often involving financial fraud.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 4

A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP echo requests to the network broadcast address with the victim's spoofed source IP, causing all hosts to reply to the victim, amplifying traffic.

Answer

UDP flood

Answer

SYN flood

Answer

Ping of Death

Question 5

Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?

Accepted Answer

Ettercap. Ettercap is a well-known tool for man-in-the-middle attacks, including ARP poisoning.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 6

A user reports that their system has become very slow and numerous pop-up ads appear even when browsing is not active. Which type of malware is MOST likely installed?

Accepted Answer

Adware. Adware displays unwanted advertisements and can cause system slowdowns.

Answer

Ransomware

Answer

Keylogger

Answer

Spyware

Question 7

An analyst captures network traffic and sees a large number of packets with source IP 10.0.0.1, destination IP 192.168.1.1, TCP SYN flag set, with sequence numbers that appear incremental. The destination responds with SYN-ACK but the source never completes the handshake. Which attack is MOST likely occurring?

Accepted Answer

SYN flood. In a TCP SYN flood, the attacker sends many SYN packets with spoofed IPs (or non-responsive IPs) and never completes the handshake, exhausting server resources.

Answer

ARP poisoning

Answer

ICMP flood

Answer

DNS amplification

Question 8

Which of the following is a form of social engineering where an attacker physically follows an authorized person into a restricted area without proper authentication?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area, bypassing authentication mechanisms such as badge readers, PIN pads, or biometric scanners. The attacker exploits the natural courtesy of the authorized person holding the door open, thereby gaining physical access without any credential validation.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 9

An attacker uses the Social Engineering Toolkit (SET) to clone a legitimate website and send a malicious link to employees. When an employee clicks the link, they are prompted to enter their credentials. Which attack is this?

Accepted Answer

Phishing. Phishing involves sending fraudulent communications that appear to come from a reputable source, often via email, to steal credentials. SET is commonly used for phishing campaigns.

Answer

SMiShing

Answer

Spear phishing

Answer

Vishing

Question 10

A penetration tester runs the following command: `macof -i eth0 -s 192.168.1.100 -d 10.0.0.1`. Which attack is being performed?

Accepted Answer

MAC flooding. Macof is a tool used for MAC flooding, which fills the switch's CAM table with fake MAC addresses, causing it to fail open and broadcast traffic to all ports.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

DHCP starvation

Question 11

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

Accepted Answer

Polymorphic virus. Polymorphic viruses change their code signature (using mutation engines) each replication to avoid detection.

Answer

Boot sector virus

Answer

Macro virus

Answer

Worm

Question 12

An organization wants to mitigate the impact of a DDoS attack by distributing incoming traffic across multiple servers in different geographic locations. Which technique is BEST suited?

Accepted Answer

Anycast. Anycast routing allows traffic to be directed to the nearest or best-performing server among multiple locations, helping absorb DDoS traffic.

Answer

Scrubbing center

Answer

Rate limiting

Answer

Load balancing

Question 13

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

Slowloris. Slowloris and HTTP flood are application-layer attacks targeting web servers.

Answer

SYN flood

Answer

Smurf attack

Answer

UDP flood

Question 14

Which THREE of the following are static malware analysis techniques? (Select 3)

Accepted Answer

Examining strings in the binary. Static analysis examines the malware without executing it. Strings, PEiD, and VirusTotal scan are static techniques.

Answer

Analyzing network traffic

Answer

Running the malware in a sandbox

Question 15

Which TWO of the following are examples of session hijacking attacks? (Select 2)

Accepted Answer

Cookie theft. TCP sequence prediction and cookie theft are methods to hijack a session.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning