CEH Timed Hard Questions — 25 Difficult Questions

Question 1

Which TWO of the following are effective physical security controls to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and the system verifies that only one person enters before allowing the second door to open. This design directly prevents tailgating by trapping unauthorized individuals who attempt to follow an authorized person through the first door.

Answer

Biometric door lock

Answer

CCTV cameras

Answer

Security guard

Question 2

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 3

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

Accepted Answer

The group cipher is TKIP, which is deprecated and vulnerable.. Option D is correct because TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.

Answer

The pairwise cipher is CCMP, which is outdated.

Answer

The network uses WPA2-PSK, which is easily cracked.

Answer

The beacon frame reveals the BSSID, which is a security risk.

Question 4

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Accepted Answer

Use Google dorking to find publicly exposed email lists. Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.

Answer

Perform a WHOIS lookup on the domain

Answer

Attempt a DNS zone transfer

Answer

Run an nmap scan against the mail server

Question 5

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process

Question 6

A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)

Accepted Answer

Enable Zigbee security suite (AES-128 encryption) on all sensor devices.. Option A is correct because Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.

Answer

Disable encryption on MQTT to reduce latency and improve performance.

Answer

Implement device authentication using pre-shared keys only for Zigbee devices.

Answer

Segment the IoT devices into a separate VLAN and restrict access with ACLs.

Question 7

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Accepted Answer

volatility -f memory.dmp netscan. The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

Answer

volatility -f memory.dmp procdump

Answer

volatility -f memory.dmp svcscan

Answer

volatility -f memory.dmp malfind

Question 8

Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?

Accepted Answer

Tailgating. The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 9

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting

Question 10

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. Option B is correct because when a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 11

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. It is computationally intensive but guaranteed to succeed given enough time, making it a fundamental method in password auditing and recovery.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 12

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

Accepted Answer

Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.. Option B is correct because the symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

Answer

Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.

Answer

Increase the number of application servers to handle the load.

Answer

Run a SQL injection scanner on the application.

Question 13

During a penetration test, an ethical hacker captures a WPA2 handshake and successfully cracks the PSK. Which additional action must be taken to decrypt previously captured traffic?

Accepted Answer

Compute the Pairwise Master Key Identifier (PMKID) from the PSK and AP MAC.. Option A is correct because after cracking the WPA2 Pre-Shared Key (PSK), the Pairwise Master Key (PMK) is derived from the PSK, SSID, and hashing iterations (PBKDF2). To decrypt previously captured traffic, you need the Pairwise Transient Key (PTK), which is computed from the PMK, the client nonce (SNonce), the AP nonce (ANonce), and both MAC addresses. However, the nonces are exchanged during the 4-way handshake and are present in the captured handshake; the missing piece is the PMKID, which is derived from the PMK, AP MAC, and STA MAC. Computing the PMKID from the cracked PSK and AP MAC allows tools like aircrack-ng to verify the correct PMK and then derive the PTK to decrypt the traffic.

Answer

Capture the nonce values from the access point.

Answer

Use the PSK directly to compute the Michael Integrity Check (MIC).

Answer

Obtain the Group Temporal Key (GTK) from the access point.

Question 14

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Accepted Answer

Parameter tampering. Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer

Directory traversal

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 15

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

Accepted Answer

Restrict recursive queries to trusted sources. Option B is correct because restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning.

Answer

Use a single DNS server for all queries

Answer

Disable DNS caching

Question 16

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. Option B is correct because a 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 17

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

Answer

UDP flood

Answer

ARP spoofing

Answer

ICMP flood

Question 18

During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?

Accepted Answer

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.. In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.

Answer

Decrypt the traffic using the captured handshake to get the credentials.

Answer

WPS PIN brute-force to recover the PSK.

Answer

PMKID attack to crack the pre-shared key.

Question 19

Which THREE of the following are common security risks associated with cloud computing?

Accepted Answer

Misconfigured cloud storage leading to data exposure.. Option B is correct because misconfigured cloud storage, such as an Amazon S3 bucket with overly permissive ACLs or a publicly accessible Azure Blob container, is one of the most common cloud security risks. This misconfiguration can expose sensitive data to the internet without authentication, leading to data breaches. The Cloud Security Alliance (CSA) consistently lists misconfiguration as a top cloud threat.

Answer

Physical theft of servers from the data center.

Answer

Hypervisor compromise due to unpatched vulnerabilities.

Question 20

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

Accepted Answer

The communication creates a sense of urgency. Option C is correct because social engineers frequently fabricate a sense of urgency to bypass the victim's rational decision-making. By claiming an immediate deadline or threat (e.g., 'Your account will be locked in 24 hours'), the attacker pressures the target into acting without verifying the request, a tactic rooted in the psychological principle of scarcity.

Answer

The communication includes verifiable contact information

Answer

The sender uses a generic greeting like 'Dear Customer'