CEH Cryptography and Malware Analysis — 20 Questions

Question 1

A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?

Accepted Answer

VirusTotal. VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.

Answer

Nmap

Answer

John the Ripper

Answer

Wireshark

Question 2

During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?

Accepted Answer

Lack of application-layer encryption. The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.

Answer

Weak TLS cipher suite

Answer

SSL stripping attack

Answer

Man-in-the-middle attack

Question 3

A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?

Accepted Answer

The CRL published by the online issuing CA. The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.

Answer

The CRL published by the certificate authority that signed the issuing CA's certificate

Answer

The CRL published by the intermediate CA, if any

Answer

The CRL published by the offline root CA

Question 4

A security analyst suspects that a user's machine is infected with a keylogger. Which of the following is the most effective method to detect a hardware keylogger?

Accepted Answer

Physically inspect the connection between the keyboard and the computer. A hardware keylogger is a physical device inserted between the keyboard and the computer, typically at the PS/2 or USB connector. Unlike software-based keyloggers, it operates independently of the operating system, so it cannot be detected by process lists, event logs, or antivirus scans. The only reliable detection method is a physical inspection of the keyboard cable and connection point for any unusual inline devices.

Answer

Check running processes for suspicious entries

Answer

Review USB device history in Event Viewer

Answer

Run an antivirus scan

Question 5

An ethical hacker is analyzing a piece of malware that uses a custom encryption algorithm. The malware sample contains a hardcoded key that is 16 bytes long. The analyst observes that the encrypted data is the same length as the plaintext. Which encryption mode is most likely being used?

Accepted Answer

ECB. ECB (Electronic Codebook) mode encrypts each block of plaintext independently using the same key, so the ciphertext length equals the plaintext length (assuming no padding is needed for exact block sizes). The hardcoded 16-byte key and identical input/output lengths strongly suggest ECB, as other modes typically add an IV or authentication tag, altering the output length.

Answer

GCM

Answer

CFB

Answer

CBC

Question 6

During a forensic investigation, an analyst finds that a malware sample uses a technique to detect if it is running in a sandbox by checking the number of CPU cores. The malware terminates execution if the core count is less than 2. Which anti-analysis technique is this?

Accepted Answer

Anti-VM / sandbox evasion. Option C is correct because checking the number of CPU cores is a classic anti-VM/sandbox evasion technique. Virtual machines and sandboxes often allocate minimal resources (e.g., a single core) to remain lightweight, so malware uses this check to detect an analysis environment and terminate execution to avoid detection.

Answer

Code obfuscation

Answer

Anti-debugging

Answer

Packing

Question 7

A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?

Accepted Answer

Sender's private key. Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).

Answer

Sender's public key

Answer

Recipient's private key

Answer

Recipient's public key

Question 8

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

Mutates its code to evade signature detection. Option B is correct because a polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.

Answer

Remains constant in code to ensure replication

Answer

Spreads via network shares

Answer

Resides in the boot sector of a hard drive

Question 9

Which THREE of the following are types of cryptanalytic attacks? (Choose three.)

Accepted Answer

Differential cryptanalysis. Differential cryptanalysis is a chosen-plaintext attack that analyzes how differences in plaintext pairs affect the resulting ciphertext differences, exploiting statistical biases to recover the encryption key. It is a fundamental cryptanalytic technique, particularly effective against block ciphers like DES.

Answer

Rainbow table attack

Answer

Replay attack

Question 10

You are a security analyst for a medium-sized company. The company uses a custom web application for internal project management. The application uses AES-256-CBC for encrypting sensitive data stored in the database. Recently, the company experienced a data breach where an attacker exfiltrated the entire database. Although the data was encrypted, the attacker was able to decrypt some records. Investigation reveals that the encryption key is stored in a configuration file on the same server, and the initialization vector (IV) is hardcoded in the application code. Additionally, the application uses the same key for all records. Which of the following is the most effective remediation to prevent future decryption of stolen encrypted data?

Accepted Answer

Implement per-record encryption keys derived from a master key combined with a unique salt. Option D is correct because using per-record encryption keys derived from a master key combined with a unique salt ensures that even if an attacker exfiltrates the entire database, each encrypted record requires a separate key derivation operation. Without the unique salt per record, the attacker cannot decrypt all records even if they compromise the master key. This approach mitigates the risk of a single key compromise leading to bulk decryption, which is the core vulnerability in the current setup where the same AES-256-CBC key and hardcoded IV are reused across all records.

Answer

Change the encryption mode from CBC to GCM to provide authentication

Answer

Store the encryption key in a hardware security module (HSM) and use the same key

Answer

Rotate the encryption key every 24 hours

Question 11

Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?

Accepted Answer

The file is authentic and has not been tampered with.. Option C is correct because the SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.

Answer

The file has been tampered with because the hash is from a different file.

Answer

The SHA256 hash is not reliable; the analyst should use MD5 instead.

Answer

The file is malicious because the hash is too long.

Question 12

During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?

Accepted Answer

Enforce HTTPS using TLS 1.2 or higher.. HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.

Answer

Implement password hashing with bcrypt on the server side.

Answer

Use digital signatures to sign the login request.

Answer

Encrypt the password field using AES-256 before sending via HTTP.

Question 13

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). ECDHE is prioritized for Perfect Forward Secrecy because it generates a unique, ephemeral session key for each TLS handshake using elliptic curve cryptography, ensuring that if the server's long-term private key is compromised, past session keys remain secure. Unlike static Diffie-Hellman, ECDHE does not reuse key material, and it offers stronger security per bit compared to traditional DH, making it the recommended choice for PFS in modern HTTPS configurations.

Answer

Diffie-Hellman (DH) key exchange

Answer

Pre-Shared Key (PSK)

Answer

RSA key exchange

Question 14

A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?

Accepted Answer

Persistence mechanism. The malware adds a startup entry in the Windows registry (e.g., Run or RunOnce keys), which ensures the executable is automatically launched each time the user logs in. This is a classic persistence mechanism, as defined by MITRE ATT&CK technique T1547.003, because it maintains the malware's presence across system reboots.

Answer

Keylogging

Answer

Fileless execution

Answer

Privilege escalation

Question 15

You are a security analyst at a financial institution. The SOC has detected anomalous outbound traffic from a server in the DMZ to an unknown IP address on TCP port 8443. The server runs a custom application that normally communicates with internal databases on port 1433. The server's OS is Windows Server 2019. Preliminary analysis shows that a new service named 'UpdateSvc' was installed three days ago, set to start automatically, and runs under the LocalSystem account. The service binary is located at C:\Windows\System32\svchost.exe (the legitimate one). However, the service's 'ImagePath' registry key points to 'C:\Windows\System32\svchost.exe -k UpdateSvc'. Additionally, a scheduled task named 'HealthCheck' runs every hour and executes 'powershell.exe -EncodedCommand <base64>'. The encoded command decodes to a script that downloads a payload from the same unknown IP on port 8443 and executes it in memory. The server has antivirus installed that detected nothing. As the analyst, which of the following is the BEST immediate course of action?

Accepted Answer

Isolate the server from the network by disconnecting the network cable and blocking the IP at the firewall, then initiate incident response procedures.. Option D is correct because the immediate priority is to contain the threat by isolating the compromised server from the network (disconnecting the cable) and blocking the command-and-control IP at the firewall. This stops the ongoing outbound communication on TCP port 8443 and prevents further payload downloads or data exfiltration. Initiating incident response procedures ensures proper forensic collection and analysis, which is critical before any remediation steps like reimaging or deleting artifacts.

Answer

Reimage the server immediately to ensure the malware is completely removed.

Answer

Uninstall the current antivirus and install a different endpoint protection solution, then perform a full scan.

Answer

Delete the 'UpdateSvc' service and the 'HealthCheck' scheduled task, then run a full antivirus scan.

Question 16

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Accepted Answer

volatility -f memory.dmp netscan. The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

Answer

volatility -f memory.dmp procdump

Answer

volatility -f memory.dmp svcscan

Answer

volatility -f memory.dmp malfind

Question 17

Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?

Accepted Answer

explorer.exe (PID 1234). Option B is correct because netstat output showing a suspicious external connection (e.g., to an unknown IP on port 4444) associated with PID 1234, which is identified as explorer.exe, indicates that the Windows shell process has been hijacked or injected with malicious code. Explorer.exe is not a typical network-listening process; its involvement in outbound connections to a non-standard port strongly suggests malware has injected a reverse shell or beacon into this legitimate system process to evade detection.

Answer

The process with PID 1234 is not identified

Answer

svchost.exe (PID 5678)

Answer

The process with PID 5678 is not identified

Question 18

You are a security analyst for a financial institution. The company has deployed a network of 500 Windows 10 workstations and 50 servers running Windows Server 2019. All systems are protected by a next-generation firewall and an endpoint detection and response (EDR) solution. Recently, several employees reported that their workstations are running slowly and exhibiting unusual pop-up messages demanding a ransom note in Bitcoin. The EDR alerts show that a file named 'invoice.docm' was downloaded from an email attachment and executed on multiple workstations. The EDR also indicates that the file dropped a PowerShell script that connected to an external IP address and downloaded additional payloads. After the initial infection, the EDR detected that the ransomware binary 'encryptor.exe' was executed, which began encrypting files. However, the encryption process was stopped by the EDR before all files were encrypted. The incident response team needs to determine the source of the infection and prevent future occurrences. Which of the following is the most effective first step to identify the initial infection vector?

Accepted Answer

Enable macro security settings in Microsoft Office to block macros from running without explicit user consent, and enforce via Group Policy.. Option C is correct because enabling macro security settings in Microsoft Office and enforcing them via Group Policy directly addresses the initial infection vector: the 'invoice.docm' file, which is a macro-enabled document. Macros are the most common mechanism for delivering initial payloads in phishing attacks, and blocking them from running without explicit consent prevents the PowerShell script from being executed, stopping the attack chain at its source.

Answer

Reimage all affected workstations to remove the ransomware and then review email logs for the original phishing email.

Answer

Block the external IP address at the firewall to prevent further communication with the C2 server.

Answer

Disable PowerShell across all workstations via Group Policy to prevent script execution.

Question 19

Drag and drop the steps to configure a wireless network with WPA2-Enterprise authentication on a Cisco AP into the correct order.

Question 20

Match each vulnerability assessment tool to its function.