CEH Malware, Social Engineering and Network Attacks — Timed 15 Questions

Question 1

A security analyst notices a high volume of ICMP Echo Reply packets on the network. The source IPs are varied, but the destination IP is the same. Which type of attack is MOST likely occurring?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP Echo Request packets to a network broadcast address with a spoofed source IP (the target). All hosts on the network reply to the target, flooding it with ICMP Echo Replies.

Answer

UDP flood

Answer

Ping of Death

Answer

ICMP flood

Question 2

A user receives a phone call from someone claiming to be from IT support, asking for their password to troubleshoot an issue. Which social engineering technique is being used?

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario (pretext) to obtain information. Here the attacker pretends to be IT support to trick the user into revealing their password.

Answer

Phishing

Answer

Baiting

Answer

Vishing

Question 3

Which tool would a penetration tester MOST likely use to perform ARP poisoning and conduct a man-in-the-middle attack on a local network?

Accepted Answer

Ettercap. Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning, DNS spoofing, and packet sniffing.

Answer

Wireshark

Answer

Nmap

Answer

tcpdump

Question 4

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

Accepted Answer

An attacker is performing TCP sequence prediction to hijack the session.. The sequence numbers (100, 300) suggest the attacker correctly guessed the TCP sequence numbers to spoof a connection. The three-way handshake completes (SYN, SYN-ACK, ACK), then the attacker sends a RST to close. This is indicative of TCP sequence prediction attack (session hijacking attempt).

Answer

A normal TCP connection establishment followed by an immediate termination.

Answer

A man-in-the-middle attack using ARP spoofing.

Answer

A TCP SYN flood attack is in progress.

Question 5

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

Accepted Answer

Static analysis using strings and PEiD. Static analysis (e.g., examining strings, digital signatures, PE headers) is the first step because it is safe and can quickly identify suspicious indicators without executing the file.

Answer

Upload to VirusTotal

Answer

Dynamic analysis in a sandbox

Answer

Run the file on a production system to observe behavior

Question 6

An organization is experiencing repeated DDoS attacks that consume all available bandwidth. Which mitigation technique is MOST effective for handling such volumetric attacks?

Accepted Answer

Scrubbing centers. Scrubbing centers filter malicious traffic and forward clean traffic to the target, handling high-volume attacks effectively.

Answer

Blackholing all traffic to the target IP

Answer

Anycast network distribution

Answer

Rate limiting on the firewall

Question 7

Which type of malware is characterized by self-replication and spreading across networks without needing a host file?

Accepted Answer

Worm. Worms are standalone programs that replicate and spread independently, often exploiting network vulnerabilities.

Answer

Trojan

Answer

Ransomware

Answer

Virus

Question 8

A penetration tester uses the Social Engineering Toolkit (SET) to create a malicious USB drive that autoruns when inserted. Which social engineering technique is being employed?

Accepted Answer

Baiting. Baiting involves leaving a physical device (e.g., USB drive) in a location where the victim will find and use it, often with enticing labels.

Answer

Tailgating

Answer

Pretexting

Answer

Phishing

Question 9

An IDS alerts on a large number of outbound DNS queries from an internal host to a suspicious domain. The queries have random subdomains and the response size is large. Which attack is MOST likely in progress?

Accepted Answer

DNS amplification attack. A DNS amplification attack uses open DNS resolvers to send large responses to a spoofed victim IP. The random subdomains are used to generate large responses, and the outbound queries are from the internal host acting as reflector.

Answer

Slowloris attack

Answer

UDP flood

Answer

DNS tunneling

Question 10

Which type of malware encrypts the victim's files and demands payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is designed to encrypt files and demand ransom for the decryption key.

Answer

Keylogger

Answer

Spyware

Answer

Adware

Question 11

A network administrator notices that the switch's CAM table is full, causing the switch to flood all incoming traffic out of all ports. Which attack is MOST likely occurring?

Accepted Answer

MAC flooding. MAC flooding sends many Ethernet frames with different source MAC addresses to fill the switch's CAM table, forcing it into hub mode (flooding all traffic).

Answer

ARP poisoning

Answer

DHCP starvation

Answer

DNS spoofing

Question 12

During a penetration test, you capture the following output: 'HTTP/1.1 200 OK ... Set-Cookie: sessionid=abc123; path=/'. You then send a request with a modified cookie value 'sessionid=abc124' and receive a valid session. Which type of vulnerability has been exploited?

Accepted Answer

Session hijacking via cookie prediction. Session hijacking via cookie theft/prediction. The attacker guessed or brute-forced a valid session ID (abc124) after seeing the pattern (abc123).

Answer

Cross-site scripting

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 13

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Accepted Answer

It changes its code signature on each infection.. Polymorphic viruses change their code signature each time they replicate, making detection difficult. They often use encryption to hide malicious code.

Answer

It spreads without user interaction.

Answer

It attaches to a host file and does not change.

Answer

It only infects the boot sector.

Question 14

Which THREE of the following are effective DDoS mitigation techniques? (Select 3)

Accepted Answer

Rate limiting. Scrubbing centers filter malicious traffic, rate limiting reduces impact, and anycast distribution spreads traffic across multiple servers. Blackholing drops all traffic (including legitimate), and IP spoofing is an attack technique.

Answer

Blackholing all traffic to the target

Answer

IP spoofing

Question 15

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

HTTP flood. Slowloris holds connections open, and HTTP floods send many HTTP requests. SYN flood and ICMP flood are network-layer attacks.

Answer

UDP flood

Answer

ICMP flood

Answer

SYN flood