CEH Malware, Social Engineering and Network Attacks Practice Test 8 — 15 Questions

Question 1

A security analyst notices that the ARP cache on a workstation contains multiple entries for the same IP address with different MAC addresses. Which attack is likely occurring?

Accepted Answer

ARP poisoning. ARP poisoning (also called ARP spoofing) occurs when an attacker sends forged ARP replies to a network, associating their own MAC address with the IP address of a legitimate host (e.g., the default gateway). The workstation's ARP cache then stores multiple MAC addresses for the same IP, as the cache is updated with each fraudulent reply. This allows the attacker to intercept, modify, or block traffic intended for that IP, enabling man-in-the-middle attacks.

Answer

Session hijacking

Answer

DNS spoofing

Answer

MAC flooding

Question 2

An attacker wants to perform a man-in-the-middle attack on a local network. Which two tools from the following list would be most effective? (Select the best answer from the options below; note: this is a multiple choice, not multi-select) A) Wireshark B) Ettercap C) Nmap D) Metasploit E) Aircrack-ng

Accepted Answer

Ettercap and Wireshark. Ettercap is a dedicated man-in-the-middle (MITM) tool that performs ARP spoofing to intercept traffic between hosts on a switched LAN. Wireshark captures and analyzes the intercepted packets, allowing the attacker to view unencrypted data. Together, they form the classic ARP poisoning attack chain: Ettercap redirects traffic, Wireshark inspects it.

Answer

Nmap and Metasploit

Answer

Aircrack-ng and Wireshark

Answer

Ettercap and Nmap

Question 3

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files on the victim's system using a symmetric encryption algorithm (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This distinguishes it from other malware types that do not perform file encryption for extortion.

Answer

Spyware

Answer

Adware

Answer

Keylogger

Question 4

Which TWO of the following are examples of social engineering attacks? (Select two)

Accepted Answer

Pretexting. Pretexting is a social engineering attack where the attacker creates a fabricated scenario (pretext) to trick a target into divulging sensitive information or performing an action. It relies on impersonation and psychological manipulation rather than technical exploitation, making it a classic example of human-based social engineering.

Answer

Pharming

Answer

SYN flood

Answer

Brute force attack

Question 5

A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?

Accepted Answer

A DNS tunneling tool used for data exfiltration. DNS tunneling encapsulates non-DNS traffic (e.g., data exfiltration) within DNS queries and responses, typically using UDP port 53. Since the host is not a DNS server, the outbound spike on port 53 indicates it is likely tunneling data to an external command-and-control server, making option C correct.

Answer

A worm that spreads via email attachments

Answer

A polymorphic virus

Answer

A keylogger that sends captured keystrokes via HTTP

Question 6

Which tool would an ethical hacker use to automatically generate a malicious USB drive that, when plugged in, executes a payload and connects back to the attacker?

Accepted Answer

USB Rubber Ducky. The USB Rubber Ducky is a keystroke injection tool that appears as a keyboard to the host computer. When plugged in, it automatically types a pre-programmed payload at high speed, which can download and execute a reverse shell or other malware, establishing a connection back to the attacker. This makes it the correct choice for automatically generating a malicious USB drive that executes a payload upon insertion.

Answer

Wireshark

Answer

Ettercap

Answer

Metasploit

Question 7

A penetration tester wants to perform a stealth scan without completing the TCP three-way handshake. The target is a web server on port 80. The tester uses Nmap with the -sS flag. What is the expected behavior if the port is open?

Accepted Answer

The tester receives a SYN/ACK and sends an RST to tear down the connection.. The -sS flag in Nmap performs a SYN stealth scan, which sends a SYN packet to the target port. If the port is open, the target responds with a SYN/ACK, and the tester's operating system kernel automatically sends an RST to tear down the connection before the three-way handshake completes. This avoids establishing a full TCP connection, making the scan less detectable by some intrusion detection systems.

Answer

The tester receives an RST, indicating the port is closed.

Answer

The tester receives no response, indicating a filtered port.

Answer

The tester receives a SYN/ACK and sends an ACK to establish the connection.

Question 8

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is specifically designed to encrypt files on a victim's system using strong cryptographic algorithms (e.g., AES-256 for symmetric encryption, often paired with RSA-2048 for key exchange). After encryption, the malware displays a ransom note demanding payment (typically in cryptocurrency like Bitcoin) in exchange for the decryption key. This matches the description exactly, making option A correct.

Answer

Trojan

Answer

Spyware

Answer

Adware

Question 9

A security analyst reviews logs and notices that an attacker crafted a packet with a source IP address matching the target's IP address, and sent it to a network's broadcast address. Which type of attack does this describe?

Accepted Answer

Smurf attack. The Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets. The attacker spoofs the source IP address to be the target's IP and sends these packets to a network's broadcast address. All hosts on that network then reply to the target, overwhelming it with ICMP echo replies.

Answer

UDP flood

Answer

Ping of Death

Answer

SYN flood

Question 10

Which of the following is a characteristic of a polymorphic virus?

Accepted Answer

It changes its code pattern every time it infects a new file or system.. A polymorphic virus is designed to evade signature-based detection by mutating its code—typically using an encryption engine and a mutation engine—so that each infection generates a functionally identical but byte-wise different payload. This constant change in the virus's signature pattern prevents antivirus software from recognizing it through static file hashes or fixed byte sequences.

Answer

It spreads through network shares without requiring user interaction.

Answer

It remains dormant until a specific date or time.

Answer

It infects the master boot record of a hard drive.

Question 11

An organization experiences a DDoS attack where the attacker sends many incomplete HTTP requests that keep connections open, exhausting the server's connection pool. Which attack technique is being used?

Accepted Answer

Slowloris. Slowloris is a DDoS attack that works by opening multiple connections to the target server and sending partial HTTP requests, never completing them. The server keeps these connections open waiting for the rest of the request, eventually exhausting the connection pool and denying service to legitimate users. This matches the description of incomplete HTTP requests keeping connections open.

Answer

UDP flood

Answer

HTTP flood

Answer

SYN flood

Question 12

During a social engineering engagement, an attacker calls an employee pretending to be from IT support and asks for their password to perform a system update. Which social engineering technique is being employed?

Accepted Answer

Pretexting. Pretexting is the correct answer because the attacker fabricates a scenario (pretext) by impersonating IT support to create a false sense of authority and urgency, thereby manipulating the employee into revealing their password. This technique relies on a fabricated story rather than a technical exploit, distinguishing it from other social engineering methods.

Answer

Phishing

Answer

Quid pro quo

Answer

Vishing

Question 13

Which type of malware is characterized by its ability to spread without requiring a host file and can replicate across networks automatically?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself across networks without requiring a host file or user intervention. It exploits network vulnerabilities, such as unpatched services or weak credentials, to propagate automatically, often using protocols like SMB, RDP, or email transport mechanisms.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 14

A company wants to defend against DNS amplification attacks. Which mitigation technique would be MOST effective?

Accepted Answer

Implementing rate limiting on DNS servers. B is correct because rate limiting restricts the number of DNS responses a server sends to a single source, reducing the volume of traffic that can be generated in an amplification attack. DNS amplification exploits open recursive resolvers to send small queries that yield large responses, and rate limiting directly curbs the attacker's ability to flood the victim with amplified traffic. This technique is specifically recommended in RFC 5358 and by industry best practices for mitigating reflection/amplification DDoS attacks.

Answer

Disabling recursive queries on DNS servers

Answer

Deploying anycast routing

Answer

Using a scrubbing center

Question 15

An ethical hacker is analyzing a suspicious file using static analysis. Which of the following actions is part of static malware analysis?

Accepted Answer

Examining the file's strings and metadata without executing it. Static malware analysis involves examining the file without executing it. Option C is correct because analyzing strings and metadata (e.g., file headers, embedded URLs, IP addresses, or suspicious function calls) is a core static analysis technique, often performed using tools like `strings`, `binwalk`, or `PEview`. This approach avoids the risks of execution and helps identify indicators of compromise (IOCs) before dynamic analysis.

Answer

Running the file in a sandboxed environment and monitoring its behavior

Answer

Uploading the file to VirusTotal for scanning

Answer

Using Wireshark to capture packets sent by the file