CEH Exam Simulation — 100 Questions

Question 1

A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?

Accepted Answer

The response contains database error messages or unexpected data. Option C is correct because a successful SQL injection often results in the database returning error messages or unexpected data directly in the HTTP response, confirming that the attacker's injected SQL statements were executed and returned results. This is a direct indicator of a successful attack, as the server processes the malicious input and includes database output in the response body.

Answer

The server redirects to a login page (302)

Answer

The server returns a 500 Internal Server Error

Answer

The client receives no response (timeout)

Question 2

You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?

Accepted Answer

Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.. The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.

Answer

Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.

Answer

Enable deletion protection on the RDS instance to prevent accidental removal.

Answer

Enable encryption at rest for the RDS instance using AWS KMS.

Question 3

An organization is implementing a social engineering defense program. Which TWO measures are most effective in reducing the risk of phishing attacks? (Choose two.)

Accepted Answer

Conduct regular security awareness training for all employees.. Option C is correct because regular security awareness training directly addresses the human factor in phishing attacks. Employees learn to identify suspicious emails, avoid clicking malicious links, and report incidents promptly, which is critical since technical controls alone cannot prevent all phishing attempts. This training reinforces behaviors like verifying sender addresses and not bypassing security protocols, reducing the likelihood of successful social engineering.

Answer

Implement strong password policies with multi-factor authentication.

Answer

Enforce regular software updates and patch management.

Answer

Deploy network segmentation and access control lists.

Question 4

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Accepted Answer

Craft a request with a local file inclusion parameter pointing to /etc/passwd. Option A is correct because it uses a local file inclusion (LFI) parameter to test for file inclusion without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include files, which is a direct indicator of an RFI vulnerability if the server returns the file contents. This approach is safe and non-destructive, as it only reads a standard system file.

Answer

Use SQLMap to test for SQL injection

Answer

Scan the server with Nikto to detect known RFI signatures

Answer

Attempt to include a remote URL containing a web shell

Question 5

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.

Answer

Nikto

Answer

Hydra

Answer

Nmap

Question 6

Which TWO of the following are effective physical security controls to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and the system verifies that only one person enters before allowing the second door to open. This design directly prevents tailgating by trapping unauthorized individuals who attempt to follow an authorized person through the first door.

Answer

Biometric door lock

Answer

CCTV cameras

Answer

Security guard

Question 7

Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?

Accepted Answer

logon.bat script. Option C is correct because logon.bat scripts are commonly used in Windows environments to map network drives or perform startup tasks, and administrators often embed plaintext credentials in such scripts for automation. An attacker who compromises the workstation can read this batch file to extract stored passwords, making it a high-value target for credential theft.

Answer

User profile (C:\Users\jdoe)

Answer

Home directory on \fileserver\home\jdoe

Answer

Active Directory database (NTDS.dit)

Question 8

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Accepted Answer

Using Google dorking to find exposed documents. Option C is correct because Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Answer

Performing a ping sweep on the target network

Answer

Conducting a port scan with Nmap

Answer

Brute forcing subdomains via DNS queries

Question 9

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 10

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

Accepted Answer

The domain has two mail exchange servers. The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Answer

The DNS server is configured to block zone transfers

Answer

Mail is automatically forwarded to a backup server

Answer

The domain has an SPF record configured

Question 11

Which TWO of the following are characteristics of a Bluetooth Low Energy (BLE) IoT device that make it suitable for a battery-powered sensor?

Accepted Answer

Low energy consumption.. Option C is correct because BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.

Answer

High data throughput.

Answer

Long range (up to 1 km).

Answer

Operates in unlicensed spectrum like Wi-Fi.

Question 12

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

Accepted Answer

The group cipher is TKIP, which is deprecated and vulnerable.. Option D is correct because TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.

Answer

The pairwise cipher is CCMP, which is outdated.

Answer

The network uses WPA2-PSK, which is easily cracked.

Answer

The beacon frame reveals the BSSID, which is a security risk.

Question 13

Drag and drop the steps to perform a buffer overflow exploit in a controlled lab environment into the correct order.

Question 14

Drag and drop the steps to perform a SQL injection attack manually into the correct order.

Question 15

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Question 16

Drag and drop the steps to configure a wireless network with WPA2-Enterprise authentication on a Cisco AP into the correct order.

Question 17

Drag and drop the steps to set up a VPN using IPsec in tunnel mode into the correct order.

Question 18

Drag and drop the steps to perform a successful social engineering attack in a penetration test into the correct order.

Question 19

Which TWO vulnerabilities are associated with buffer overflow attacks?

Accepted Answer

Arbitrary code execution. Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.

Answer

Authentication bypass via SQL injection

Answer

Cross-site scripting (XSS)

Answer

Race condition

Question 20

Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?

Accepted Answer

Mail server addresses and priority. The nslookup command with the -type=MX query returns mail exchange (MX) records for the domain. The output shows mail server hostnames and their associated priority values (e.g., 10, 20), which indicate the order in which mail servers should be used. This directly reveals the mail server addresses and their priority, making option A correct.

Answer

Name server records

Answer

IP addresses of the web server

Answer

SPF records for email authentication