CEH Malware, Social Engineering and Network Attacks Practice Test 9 — 15 Questions

Question 1

A security analyst receives an email that appears to be from the CEO, urgently requesting a wire transfer. The email address is slightly misspelled (ceo@cornpany.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack aimed at a specific individual or organization, often using personalized information to appear legitimate. This email targets the analyst specifically and uses a spoofed domain, making it spear phishing, not generic phishing or whaling (which targets high-level executives, though the CEO is impersonated, the recipient is the analyst).

Answer

Vishing

Answer

Whaling

Answer

Phishing

Question 2

During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?

Accepted Answer

Ettercap. Ettercap is a well-known tool for ARP poisoning (spoofing) to perform man-in-the-middle attacks. It is specifically designed for this purpose.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 3

A security analyst runs the following command: 'python macof -i eth0 -n 1000'. Shortly after, the switch begins flooding traffic to all ports. What is the analyst trying to achieve?

Accepted Answer

MAC flooding to force the switch into hub mode for sniffing. Macof is a tool used to perform MAC flooding, which fills the switch's CAM table with fake MAC addresses, causing the switch to fail open and flood frames out all ports, enabling packet sniffing.

Answer

DHCP starvation to exhaust IP addresses

Answer

STP manipulation to cause network loops

Answer

ARP cache poisoning to redirect traffic

Question 4

A user reports that their system has become sluggish and they see pop-up advertisements even when no browser is open. Additionally, unknown processes are running in Task Manager. Which type of malware is most likely responsible?

Accepted Answer

Adware. Adware displays unwanted advertisements and often comes bundled with other software, causing system slowdowns and pop-ups. Spyware may also cause ads but focuses on data theft. Ransomware encrypts files, and a worm spreads without user interaction.

Answer

Worm

Answer

Ransomware

Answer

Spyware

Question 5

A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?

Accepted Answer

DNS amplification. A DNS amplification attack uses open DNS resolvers to send large responses to a spoofed victim IP, amplifying traffic. The characteristics include UDP, port 53, spoofed source, and many sources (amplifiers).

Answer

UDP flood

Answer

SYN flood

Answer

ICMP flood

Question 6

After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?

Accepted Answer

Static analysis. Static analysis involves examining the malware without executing it, using techniques like strings extraction and hash lookup on services like VirusTotal. Dynamic analysis would require executing the file in a sandbox.

Answer

Behavioral analysis

Answer

Code analysis

Answer

Dynamic analysis

Question 7

A penetration tester successfully predicts the TCP sequence numbers of a target and sends crafted packets to impersonate a trusted host. Which type of attack is this?

Accepted Answer

TCP session hijacking. TCP session hijacking involves predicting sequence numbers to inject packets and take over a session. It allows the attacker to impersonate one of the communicating parties.

Answer

ARP poisoning

Answer

TCP sequence prediction attack

Answer

DNS spoofing

Question 8

Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?

Accepted Answer

File virus. A file virus infects executable files and spreads when the infected file is executed. Worms spread without human action; Trojans disguise as legitimate software; ransomware encrypts files.

Answer

Worm

Answer

Ransomware

Answer

Trojan

Question 9

A security analyst notices that a web server is responding very slowly to legitimate requests. The server logs show many incomplete HTTP GET requests that never complete, each opened slowly over time from many different IP addresses. Which attack is most likely occurring?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that holds connections open by sending partial HTTP requests, exhausting server connection pools. It uses many sources and slow sending.

Answer

Ping of Death

Answer

HTTP flood

Answer

SYN flood

Question 10

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

Accepted Answer

Tailgating. Tailgating is when an unauthorized person follows an authorized individual into a restricted area without consent. It is a physical security breach.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 11

Which tool is commonly used to perform DNS spoofing on a local network by intercepting DNS requests and replying with forged responses?

Accepted Answer

Ettercap. Ettercap has a DNS spoofing plugin that can redirect DNS queries to malicious IPs. Other tools like dnsspoof also exist, but Ettercap is a common multipurpose MITM tool.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 12

A system administrator receives a phone call from someone claiming to be from IT support, asking for the administrator's password to 'fix a server issue'. This is an example of which social engineering attack?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain sensitive information, such as a password. The caller pretends to be IT support to trick the victim.

Answer

Vishing

Answer

Baiting

Answer

Phishing

Question 13

Which TWO of the following are characteristics of a polymorphic virus?

Accepted Answer

It uses a decryption routine that varies. A polymorphic virus changes its code signature (using encryption/decryption) each time it replicates to evade signature-based detection, while retaining its functionality.

Answer

It uses a constant signature across all infections

Answer

It can only infect boot sectors

Answer

It always remains in memory

Question 14

Which THREE of the following are effective DDoS mitigation techniques?

Accepted Answer

Scrubbing centers. Rate limiting restricts traffic volume, scrubbing centers filter malicious traffic, and anycast distributes traffic across multiple servers to absorb attacks. IP blacklisting alone is insufficient for large-scale DDoS.

Answer

IP blacklisting

Answer

Increasing server resources

Question 15

Which TWO of the following are examples of application-layer DDoS attacks?

Accepted Answer

Slowloris. Slowloris and HTTP flood are application-layer attacks targeting the web server's ability to handle requests. SYN flood and UDP flood are lower-layer attacks (transport and network).

Answer

ICMP flood

Answer

SYN flood

Answer

UDP flood