CEH Multiple Select — 20 Questions

Question 1

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

Accepted Answer

Hashcat. Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 2

Which TWO of the following are effective countermeasures against SNMP enumeration attacks? (Select 2)

Accepted Answer

Restrict SNMP access to trusted IP addresses using ACLs. Effective SNMP enumeration countermeasures include (A) restricting SNMP access to trusted IP addresses via ACLs, which prevents unauthorized hosts from querying SNMP agents, and (C) changing default community strings to strong, unique values, making it harder for attackers to guess them. Option B (disabling SNMP) is impractical in many environments because SNMP is needed for network monitoring. Option D (enabling SNMPv3 with default passwords) is ineffective because default passwords are easily guessed. Option E (using SNMPv1 with community string 'private') is the default and well-known, making enumeration trivial. Therefore, A and C are the correct choices.

Answer

Disable SNMP on all devices

Answer

Enable SNMPv3 with default passwords

Answer

Use SNMPv1 with community string 'private'

Question 3

Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)

Accepted Answer

Clearing event logs using wevtutil. A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.

Answer

Exploiting SUID binaries to gain root

Answer

Disabling Windows Defender via Group Policy

Question 4

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers periodically to prevent timeout. It exploits the server's connection handling at Layer 7, exhausting the connection pool without requiring high bandwidth.

Answer

SYN flood

Answer

Smurf attack

Answer

UDP flood

Question 5

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 6

Which TWO of the following are considered passive reconnaissance techniques? (Choose TWO.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

Answer

Ping sweep

Answer

Banner grabbing with Telnet

Answer

Port scanning

Question 7

Which TWO of the following are types of malware analysis? (Select two.)

Accepted Answer

Static analysis. Static analysis involves examining malware without executing it, such as inspecting file headers, strings, and disassembled code. Dynamic analysis executes the malware in a controlled sandbox to observe its runtime behavior, including network traffic, registry changes, and process creation. Both are fundamental malware analysis methodologies recognized in CEH.

Answer

Memory analysis

Answer

Signature analysis

Answer

Heuristic analysis

Question 8

Which TWO of the following are effective physical security controls to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and the system verifies that only one person enters before allowing the second door to open. This design directly prevents tailgating by trapping unauthorized individuals who attempt to follow an authorized person through the first door.

Answer

Biometric door lock

Answer

CCTV cameras

Answer

Security guard

Question 9

Which TWO of the following are valid enumeration techniques? (Select 2)

Accepted Answer

LDAP enumeration. LDAP enumeration is a valid enumeration technique because it involves querying a Lightweight Directory Access Protocol (LDAP) service to extract information about users, groups, computers, and other objects from a directory service like Microsoft Active Directory. Attackers use tools such as ldapsearch or ADExplorer to anonymously or authenticatedly browse the directory tree, revealing usernames, group memberships, and organizational units, which are critical for planning further attacks.

Answer

ARP poisoning

Answer

DNS cache poisoning

Answer

ICMP flooding

Question 10

Which TWO of the following are examples of amplification attacks used in DDoS?

Accepted Answer

DNS amplification. DNS amplification is a classic DDoS amplification attack where an attacker sends a small DNS query (e.g., an ANY or TXT record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a much larger response (up to 50x the query size), flooding the victim with traffic. This exploits the UDP protocol's lack of handshake and the resolver's willingness to respond to any source.

Answer

Slowloris

Answer

SYN flood

Answer

Ping of Death

Question 11

Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)

Accepted Answer

Configuring port security on switches. Configuring port security on switches is effective against ARP poisoning because it limits the number of MAC addresses allowed on a port, preventing an attacker from flooding the network with spoofed MAC addresses. By restricting the port to a single or limited set of MAC addresses, it stops unauthorized devices from injecting fake ARP replies. This is a Layer 2 security control that directly mitigates the ability to perform ARP cache poisoning at the access edge.

Answer

Enabling DHCP snooping

Answer

Disabling STP on all ports

Question 12

Which TWO of the following are common techniques used to cover tracks after compromising a system? (Choose TWO.)

Accepted Answer

Installing a rootkit. Installing a rootkit (Option C) is a common technique used to cover tracks because rootkits are designed to hide the attacker's presence by subverting the operating system's normal behavior, such as hiding processes, files, and registry keys from system utilities. Clearing event logs (Option E) directly removes forensic evidence of the attacker's activities, such as login attempts, privilege escalations, or file access, making it harder for incident responders to reconstruct the attack timeline.

Answer

Running a vulnerability scanner

Answer

Enabling firewall rules

Answer

Creating new user accounts

Question 13

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 14

Which TWO of the following are types of malware analysis? (Select 2)

Accepted Answer

Static analysis. Static analysis examines malware without executing it, focusing on file structure, strings, and code signatures to identify malicious indicators. Dynamic analysis runs the malware in a controlled sandbox environment to observe runtime behavior, such as registry changes, network connections, and process injections. Both are fundamental malware analysis methodologies recognized by the CEH exam.

Answer

Penetration testing

Answer

Network analysis

Answer

Code review

Question 15

Which TWO of the following are valid methods for enumerating SMB shares on a target system? (Select 2)

Accepted Answer

smbclient -L //target -U ''. `smbclient -L //target -U ''` attempts to list SMB shares on the target by connecting with a null session (empty username). This is a classic enumeration technique that exploits default or weak SMB configurations, allowing an attacker to retrieve share names without authentication.

Answer

snmpwalk -v2c -c public target

Answer

nmap -sU -p 445 target

Answer

nbtstat -A target

Question 16

During a penetration test, the tester successfully cracks a password hash using a hybrid attack. Which THREE characteristics describe a hybrid attack? (Select three.)

Accepted Answer

Applies mutations like appending numbers or symbols. A hybrid attack applies mutations such as appending numbers or symbols to dictionary words, which is a core characteristic of this attack type. This technique combines the efficiency of a wordlist with the flexibility of brute-force modifications, making it effective against passwords that follow common patterns like 'password123'.

Answer

Tries every possible combination of characters

Answer

Relies on precomputed hash chains

Question 17

Which THREE of the following are valid defenses against WPA2 attacks? (Select three)

Accepted Answer

Disable WPS. Using a strong passphrase makes dictionary attacks harder. 802.1X/EAP provides enterprise authentication. Disabling WPS removes PIN brute-force vector. WPA2-Mixed mode still allows TKIP clients, reducing security.

Answer

Use WEP instead of WPA2

Answer

Enable WPA2-Mixed mode

Question 18

A web application is vulnerable to SQL injection. Which THREE of the following techniques can be used to extract data from the database using blind SQL injection?

Accepted Answer

Time-based. Boolean-based, time-based, and out-of-band are all types of blind SQL injection. Error-based and union-based are in-band techniques, not blind.

Answer

Error-based

Answer

Union-based

Question 19

Which TWO of the following are effective defenses against Cross-Site Request Forgery (CSRF) attacks? (Select 2)

Accepted Answer

Using anti-CSRF tokens. CSRF tokens are unique per request and validated server-side. SameSite cookies restrict cookie sending to same-site requests.

Answer

Enabling HTTP Strict Transport Security (HSTS)

Answer

Implementing input validation on all user inputs

Answer

Using Content Security Policy (CSP) headers

Question 20

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

Accepted Answer

Using SameSite cookies. SameSite cookies (option A) are effective against CSRF because they restrict the browser from sending cookies on cross-origin requests, preventing forged requests from carrying authentication credentials. CSRF tokens (option E) are also effective because they require a unique token in each request that the attacker cannot predict. Option C (anti-CSRF tokens) is essentially the same technique as option E, so it is not considered a distinct mitigation; thus, only options A and E are correct.

Answer

Input validation

Answer

Using anti-CSRF tokens

Answer

Using HTTPOnly cookies