CEH Multiple Select — 60 Questions

Question 1

A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?

Accepted Answer

The response contains database error messages or unexpected data. Option C is correct because a successful SQL injection often results in the database returning error messages or unexpected data directly in the HTTP response, confirming that the attacker's injected SQL statements were executed and returned results. This is a direct indicator of a successful attack, as the server processes the malicious input and includes database output in the response body.

Answer

The server redirects to a login page (302)

Answer

The server returns a 500 Internal Server Error

Answer

The client receives no response (timeout)

Question 2

An organization is implementing a social engineering defense program. Which TWO measures are most effective in reducing the risk of phishing attacks? (Choose two.)

Accepted Answer

Conduct regular security awareness training for all employees.. Option C is correct because regular security awareness training directly addresses the human factor in phishing attacks. Employees learn to identify suspicious emails, avoid clicking malicious links, and report incidents promptly, which is critical since technical controls alone cannot prevent all phishing attempts. This training reinforces behaviors like verifying sender addresses and not bypassing security protocols, reducing the likelihood of successful social engineering.

Answer

Implement strong password policies with multi-factor authentication.

Answer

Enforce regular software updates and patch management.

Answer

Deploy network segmentation and access control lists.

Question 3

Which TWO of the following are effective physical security controls to prevent tailgating?

Accepted Answer

Mantrap. A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and the system verifies that only one person enters before allowing the second door to open. This design directly prevents tailgating by trapping unauthorized individuals who attempt to follow an authorized person through the first door.

Answer

Biometric door lock

Answer

CCTV cameras

Answer

Security guard

Question 4

Which TWO of the following are examples of passive footprinting techniques? (Select exactly 2.)

Accepted Answer

Using Google dorking to find exposed documents. Option C is correct because Google dorking involves using advanced search operators (e.g., filetype:, intitle:) to discover publicly accessible information without directly interacting with the target's systems. This is a passive footprinting technique as it relies on publicly indexed data from search engines, not on sending packets to the target's network.

Answer

Performing a ping sweep on the target network

Answer

Conducting a port scan with Nmap

Answer

Brute forcing subdomains via DNS queries

Question 5

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Accepted Answer

List of running processes. SNMP enumeration with the default 'public' community string (read-only access) allows querying MIB objects that expose system information. The 'hostResources' MIB (RFC 2790) includes the 'hrSWRunTable', which lists running processes, and the 'ipRouteTable' (RFC 1213) provides routing table entries. These are standard read-only OIDs accessible without authentication.

Answer

Captured network packets

Answer

User account passwords

Answer

Modify network interface settings

Question 6

Which TWO of the following are characteristics of a Bluetooth Low Energy (BLE) IoT device that make it suitable for a battery-powered sensor?

Accepted Answer

Low energy consumption.. Option C is correct because BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.

Answer

High data throughput.

Answer

Long range (up to 1 km).

Answer

Operates in unlicensed spectrum like Wi-Fi.

Question 7

Which TWO vulnerabilities are associated with buffer overflow attacks?

Accepted Answer

Arbitrary code execution. Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.

Answer

Authentication bypass via SQL injection

Answer

Cross-site scripting (XSS)

Answer

Race condition

Question 8

Which TWO of the following Nmap scan types are typically used to evade firewalls and IDS systems by sending fragmented packets?

Accepted Answer

Fragment scan (-f). The Fragment scan (-f) is correct because it splits TCP headers into multiple small IP fragments, making it harder for firewalls and IDS systems to reassemble and inspect the full packet. This evasion technique exploits the fact that many filtering devices only check the first fragment and pass subsequent fragments without scrutiny, allowing the scan to bypass detection.

Answer

SYN scan (-sS)

Answer

ACK scan (-sA)

Answer

Xmas scan (-sX)

Question 9

A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)

Accepted Answer

Enable Zigbee security suite (AES-128 encryption) on all sensor devices.. Option A is correct because Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.

Answer

Disable encryption on MQTT to reduce latency and improve performance.

Answer

Implement device authentication using pre-shared keys only for Zigbee devices.

Answer

Segment the IoT devices into a separate VLAN and restrict access with ACLs.

Question 10

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 11

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Accepted Answer

volatility -f memory.dmp netscan. The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

Answer

volatility -f memory.dmp procdump

Answer

volatility -f memory.dmp svcscan

Answer

volatility -f memory.dmp malfind

Question 12

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 13

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. It is computationally intensive but guaranteed to succeed given enough time, making it a fundamental method in password auditing and recovery.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 14

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

Accepted Answer

Restrict recursive queries to trusted sources. Option B is correct because restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning.

Answer

Use a single DNS server for all queries

Answer

Disable DNS caching

Question 15

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) is a common web application vulnerability that allows an attacker to inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. This occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling the attacker to execute arbitrary code in the victim's browser within the context of the trusted site.

Answer

Brute Force

Answer

Path Traversal

Answer

Cross-Site Request Forgery (CSRF)

Question 16

Which THREE Nmap options are commonly used to evade firewall detection during a scan? (Choose three.)

Accepted Answer

-f (fragment packets). Option A is correct because the -f flag fragments the IP packets into smaller pieces (typically 8-byte fragments) to bypass simple packet-filtering firewalls and intrusion detection systems that do not reassemble fragmented packets before applying filtering rules. This technique exploits the fact that many stateless firewalls only inspect the first fragment and allow subsequent fragments through unchecked, enabling the scan to reach the target.

Answer

-sT (TCP connect scan)

Answer

-sV (version detection)

Question 17

Which THREE of the following are common security risks associated with cloud computing?

Accepted Answer

Misconfigured cloud storage leading to data exposure.. Option B is correct because misconfigured cloud storage, such as an Amazon S3 bucket with overly permissive ACLs or a publicly accessible Azure Blob container, is one of the most common cloud security risks. This misconfiguration can expose sensitive data to the internet without authentication, leading to data breaches. The Cloud Security Alliance (CSA) consistently lists misconfiguration as a top cloud threat.

Answer

Physical theft of servers from the data center.

Answer

Hypervisor compromise due to unpatched vulnerabilities.

Question 18

Which TWO of the following are effective methods to prevent dumpster diving attacks? (Choose two.)

Accepted Answer

Shredding sensitive documents before disposal. Shredding sensitive documents before disposal (Option B) is effective because it physically destroys the information, making it impossible to reconstruct from discarded paper. This directly counters dumpster diving, where attackers retrieve documents to extract confidential data like passwords or network diagrams.

Answer

Storing all data on encrypted digital media only

Answer

Placing documents in recycling bins

Answer

Burning all discarded paper documents

Question 19

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Accepted Answer

Mutates its code to evade signature detection. Option B is correct because a polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.

Answer

Remains constant in code to ensure replication

Answer

Spreads via network shares

Answer

Resides in the boot sector of a hard drive

Question 20

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

Accepted Answer

The communication creates a sense of urgency. Option C is correct because social engineers frequently fabricate a sense of urgency to bypass the victim's rational decision-making. By claiming an immediate deadline or threat (e.g., 'Your account will be locked in 24 hours'), the attacker pressures the target into acting without verifying the request, a tactic rooted in the psychological principle of scarcity.

Answer

The communication includes verifiable contact information

Answer

The sender uses a generic greeting like 'Dear Customer'