CEH Malware, Social Engineering and Network Attacks Practice Test 9 — 15 Questions

Question 1

Which TWO of the following are examples of application-layer DDoS attacks? (Choose two.)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that works by opening multiple HTTP connections to a target web server and keeping them alive indefinitely by sending partial HTTP requests. This exhausts the server's connection pool, preventing legitimate users from connecting. It specifically targets the HTTP protocol at Layer 7, making it an application-layer attack.

Answer

UDP flood

Answer

SYN flood

Answer

Smurf attack

Question 2

A security analyst observes a gradual increase in network traffic from an internal host to an external IP address on port 443, with the host also connecting to a known command-and-control (C2) domain. Which type of malware is MOST likely responsible?

Accepted Answer

Backdoor Trojan. The gradual increase in traffic to an external IP on port 443 (HTTPS) combined with connections to a known C2 domain indicates a backdoor Trojan. Backdoor Trojans establish stealthy, encrypted command-and-control channels to exfiltrate data or receive instructions, often mimicking legitimate HTTPS traffic to evade detection. This behavior aligns with a backdoor Trojan's purpose of providing unauthorized remote access while blending into normal network activity.

Answer

Ransomware

Answer

Worm

Answer

Boot sector virus

Question 3

Which of the following tools is commonly used for dynamic malware analysis by executing the malware in an isolated environment and monitoring system changes?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files in an isolated, virtualized environment (e.g., VirtualBox, KVM) and monitors system changes such as file system modifications, registry changes, network connections, and process behavior in real time, providing a detailed report of the malware's runtime activities.

Answer

Strings

Answer

PEiD

Answer

VirusTotal

Question 4

An organization receives an email that appears to be from the CEO, urgently requesting that the recipient wire funds to a new vendor. The email contains the CEO's name and title but the sender address is slightly misspelled. Which type of social engineering attack is this?

Accepted Answer

Whaling. This is a whaling attack because the attacker impersonates a high-profile executive (the CEO) to deceive the recipient into transferring funds. Whaling is a subtype of spear phishing that specifically targets individuals with authority or financial access, often by spoofing a senior executive's email address. In this scenario, the CEO's identity is used to exploit trust and urgency, making it a whaling attack.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 5

A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?

Accepted Answer

Smurf attack. A Smurf attack exploits IP broadcast addressing and ICMP echo requests. The attacker sends ICMP echo request packets with a spoofed source IP (the victim's IP) to the network's broadcast address, causing every host on that network to reply to the victim, overwhelming it with ICMP echo replies. This amplification effect makes the attack highly effective, as a single request generates many responses.

Answer

UDP flood

Answer

SYN flood

Answer

Ping of Death

Question 6

Which tool can be used to perform ARP poisoning to intercept traffic between a victim and the default gateway?

Accepted Answer

Ettercap. Ettercap is a dedicated man-in-the-middle (MITM) attack tool that natively supports ARP poisoning. It sends forged ARP replies to both the victim and the default gateway, mapping the attacker's MAC address to the IP addresses of the other party. This allows the attacker to intercept, inspect, and modify traffic between the victim and the gateway.

Answer

Wireshark

Answer

tcpdump

Answer

Nmap

Question 7

A user reports that their system has become very slow and numerous pop-up ads appear even when browsing is not active. Which type of malware is MOST likely installed?

Accepted Answer

Adware. Adware is designed to automatically deliver advertisements, often generating pop-up ads even when the browser is not active, and it consumes system resources, causing slowdowns. The user's symptoms—persistent pop-ups and performance degradation—are classic indicators of adware infection, as adware typically runs background processes to fetch and display ads.

Answer

Ransomware

Answer

Keylogger

Answer

Spyware

Question 8

An analyst captures network traffic and sees a large number of packets with source IP 10.0.0.1, destination IP 192.168.1.1, TCP SYN flag set, with sequence numbers that appear incremental. The destination responds with SYN-ACK but the source never completes the handshake. Which attack is MOST likely occurring?

Accepted Answer

SYN flood. This behavior describes a classic SYN flood attack. The source (10.0.0.1) sends a high volume of TCP SYN packets with incremental sequence numbers to the target (192.168.1.1). The target responds with SYN-ACK packets, but the source never sends the final ACK to complete the three-way handshake. This leaves the target with half-open connections that exhaust its connection table, denying service to legitimate traffic.

Answer

ARP poisoning

Answer

ICMP flood

Answer

DNS amplification

Question 9

Which of the following is a form of social engineering where an attacker physically follows an authorized person into a restricted area without proper authentication?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area, bypassing authentication mechanisms such as badge readers, PIN pads, or biometric scanners. The attacker exploits the natural courtesy of the authorized person holding the door open, thereby gaining physical access without any credential validation.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 10

A penetration tester runs the following command: `macof -i eth0 -s 192.168.1.100 -d 10.0.0.1`. Which attack is being performed?

Accepted Answer

MAC flooding. The `macof` tool is designed to flood a switch with packets containing random source MAC addresses, overwhelming the Content Addressable Memory (CAM) table. Once the CAM table is full, the switch enters a fail-open state and broadcasts all frames, allowing the attacker to sniff traffic that would normally be isolated to specific ports. This is a classic MAC flooding attack, not ARP poisoning or DHCP starvation.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

DHCP starvation

Question 11

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

Accepted Answer

Polymorphic virus. Polymorphic virus is correct because it mutates its code signature each time it replicates, using a mutation engine to generate new decryption routines while keeping the payload intact. This allows it to evade signature-based detection, as each copy appears different to antivirus software that relies on static signatures.

Answer

Boot sector virus

Answer

Macro virus

Answer

Worm

Question 12

An organization wants to mitigate the impact of a DDoS attack by distributing incoming traffic across multiple servers in different geographic locations. Which technique is BEST suited?

Accepted Answer

Anycast. Anycast routing allows the same IP address to be advertised from multiple geographically dispersed servers. When a DDoS attack occurs, traffic is naturally distributed to the nearest or least congested anycast node, effectively absorbing and dispersing the attack load across the global infrastructure. This technique is specifically designed to mitigate volumetric DDoS attacks by leveraging BGP to route traffic to the closest available server, preventing any single server from being overwhelmed.

Answer

Scrubbing center

Answer

Rate limiting

Answer

Load balancing

Question 13

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers periodically to prevent timeout. It exploits the server's connection handling at Layer 7, exhausting the connection pool without requiring high bandwidth.

Answer

SYN flood

Answer

Smurf attack

Answer

UDP flood

Question 14

Which TWO of the following are examples of session hijacking attacks? (Select 2)

Accepted Answer

Cookie theft. Both cookie theft and TCP sequence prediction are session hijacking attacks. Cookie theft involves stealing a session identifier (e.g., via XSS or sniffing) to impersonate the victim's authenticated web session. TCP sequence prediction targets the transport layer: an attacker predicts the sequence numbers used in a TCP connection to inject forged packets and hijack the session, taking over an established TCP connection. These attacks directly take over an authenticated session, distinguishing them from other network attacks like ARP poisoning or DNS spoofing.

Answer

DNS spoofing

Answer

MAC flooding

Answer

ARP poisoning

Question 15

A security analyst receives an email that appears to be from the CEO, urgently requesting a wire transfer. The email address is slightly misspelled (ceo@cornpany.com instead of ceo@company.com). Which type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted social engineering attack where the attacker customizes the message for a specific individual or organization, often using a spoofed or lookalike domain. In this scenario, the email is directed at a security analyst, impersonates the CEO, and uses a slightly misspelled domain (ceo@cornpany.com) to deceive the recipient, which is a classic spear phishing technique because it targets a specific role within the company.

Answer

Vishing

Answer

Whaling

Answer

Phishing