CEH Network and Web Application Attacks — All Questions With Answers

Question 1

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Accepted Answer

Query string parameters. SQL injection attacks commonly target both query string parameters and request body (POST data) because user input in these locations is often directly concatenated into SQL queries without proper sanitization. A WAF configured to inspect and filter these parameters can block malicious SQL payloads before they reach the database server, as these are primary vectors for such attacks.

Answer

Cookie headers

Answer

User-Agent header

Question 2

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) is a common web application vulnerability that allows an attacker to inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. This occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling the attacker to execute arbitrary code in the victim's browser within the context of the trusted site. SQL Injection is another critical web application vulnerability where an attacker can inject malicious SQL code into input fields, which is then executed by the application's database. This can lead to unauthorized access to, modification of, or deletion of data, or even full control over the database server.

Answer

Brute Force

Answer

Path Traversal

Answer

Cross-Site Request Forgery (CSRF)

Question 3

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

Accepted Answer

Restrict recursive queries to trusted sources. Restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning. Implementing DNSSEC provides cryptographic authentication of DNS data, ensuring that resolvers can verify the authenticity and integrity of responses, thereby preventing the acceptance of forged records. A split DNS architecture separates internal and external DNS views, making it more difficult for external attackers to poison internal records or gain information about the internal network, and vice-versa, by ensuring that different sets of information are provided based on the query's origin.

Answer

Use a single DNS server for all queries

Answer

Disable DNS caching

Question 4

A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?

Accepted Answer

The server returns a 500 Internal Server Error. A successful SQL injection attack is most directly confirmed when the application's response includes database error messages or unexpected data (Option C), indicating that injected SQL was processed by the database. A 500 Internal Server Error (Option B) is also a strong indicator in SQL injection traffic, especially for error-based injection, because the malformed or injected query causes the application or database to return a server error, often with backend details. A 200 OK alone is normal for legitimate requests and does not confirm an attack.

Answer

The server redirects to a login page (302)

Answer

The server returns a 200 OK status code

Answer

The client receives no response (timeout)

Question 5

Drag and drop the steps to recover a forgotten Windows administrator password using a bootable Linux USB into the correct order.

Answer

Boot from Linux USB, mount Windows partition, navigate to System32\config, replace sethc.exe with cmd.exe, reboot into Windows and press Shift five times.

Answer

Mount Windows partition, boot from Linux USB, navigate to System32\config, replace sethc.exe with cmd.exe, reboot into Windows and press Shift five times.

Answer

Boot from Linux USB, navigate to System32\config, mount Windows partition, replace sethc.exe with cmd.exe, reboot into Windows and press Shift five times.

Answer

Boot from Linux USB, mount Windows partition, navigate to System32\config, reboot into Windows and press Shift five times, replace sethc.exe with cmd.exe.

Question 6

A web server log shows the following request from a single IP: GET /images/../../../../etc/passwd HTTP/1.1. Which vulnerability is being exploited?

Accepted Answer

Directory traversal. Directory traversal attacks involve manipulating file paths to access files and directories outside the intended web root. A web server log showing requests from a single IP with sequences like `../` or `..%2f` in the URL path or parameters (e.g., `GET /images/../../../../etc/passwd HTTP/1.1`) is a clear indicator of an attempted directory traversal exploitation. Other vulnerabilities like XSS, RFI, or SQL injection would manifest with different patterns in the request parameters or URL.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion (RFI)

Answer

SQL injection

Question 7

Refer to the exhibit. A user visits a malicious site that returns this HTML. Which attack is being executed?

Accepted Answer

Cross-site request forgery (CSRF). The provided HTML demonstrates a Cross-Site Request Forgery (CSRF) attack. When a user visits the malicious site, their browser automatically attempts to load the images specified in the `src` attributes. If the user is simultaneously logged into 'www.example.com' in the same browser, their session cookies will be sent along with these requests. The `<img>` tags are used to silently force the user's browser to send requests to 'www.example.com' to perform actions like logging out, deleting an account, or changing a password, without the user's knowledge or consent. The `style="display:none;"` attribute hides these requests from the user. This is the core mechanism of CSRF: an attacker tricks a victim's browser into sending a forged request to a trusted site where the victim is authenticated.

Answer

Cross-site scripting (XSS)

Answer

Session hijacking

Answer

Phishing attack

Question 8

During a penetration test, a tester runs netstat and tasklist on a Windows web server. The netstat output shows hundreds of TCP connections from remote host 192.168.1.50 to local port 80, all in ESTABLISHED state and transferring only a few bytes. The tasklist output shows the web server process (e.g., w3wp.exe) with an unusually high number of threads and high memory usage. What type of attack is likely being performed by the remote host 192.168.1.50?

Accepted Answer

Slowloris attack. Slowloris is a denial-of-service attack that opens many connections to a web server and sends partial HTTP requests, keeping those connections open for as long as possible. The netstat output is characteristic: many ESTABLISHED connections from a single IP to port 80 with little data transferred, while the web server process consumes many threads and memory. This is not ARP spoofing (which poisons ARP caches), DNS amplification (which uses spoofed DNS queries to reflect traffic), or SYN flood (which would show many half-open SYN_RECEIVED connections rather than established HTTP sessions).

Answer

ARP spoofing attack

Answer

DNS amplification attack

Answer

SYN flood attack

Question 9

Refer to the exhibit. A security analyst intercepts this HTTP request and response.

--- Request --- GET /search?q=%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1 Host: example.com

--- Response --- HTTP/1.1 200 OK Content-Type: text/html

<html><body>Search results for: <script>alert(1)</script></body></html>

Which type of vulnerability is present?

Accepted Answer

Reflected XSS. The application reflects user input from the request parameter directly into the HTTP response without proper sanitization or encoding. When a victim clicks a crafted link containing the malicious script, the script executes in their browser, making it reflected (non-persistent) XSS rather than stored or DOM-based XSS.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

SQL injection

Question 10

A security auditor reviews an Nginx configuration that permits all IP addresses but requires HTTP Basic authentication using a valid .htpasswd file. The access log shows a request from 192.168.2.10 to a protected resource with username 'admin' was rejected with 401. Why was the request rejected?

Accepted Answer

The user 'admin' provided incorrect credentials.

Answer

The IP address 192.168.2.10 is not in the allowed subnet.

Answer

The 'deny all' directive overrides the 'allow' directive.

Answer

The .htpasswd file is missing or misconfigured.

Question 11

Refer to the exhibit. A penetration tester inputs a UNION-based SQL injection payload. Based on the output, how many columns does the original 'users' table have?

Accepted Answer

3 columns. Missing

Answer

1 column

Answer

2 columns

Answer

4 columns

Question 12

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

Accepted Answer

Cross-Site Scripting (XSS). The scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.

Answer

SQL Injection

Answer

Cross-Site Request Forgery (CSRF)

Answer

Command Injection

Question 13

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

Answer

UDP flood

Answer

ARP spoofing

Answer

ICMP flood

Question 14

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Accepted Answer

Parameter tampering. Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Answer

Directory traversal

Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Request Forgery (CSRF)

Question 15

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Accepted Answer

HTTPS. HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Answer

SNMP

Answer

FTP

Answer

HTTP

Question 16

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

Accepted Answer

Reflected Cross-Site Scripting (XSS). The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Directory Traversal

Question 17

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

Accepted Answer

Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.. The symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

Answer

Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.

Answer

Increase the number of application servers to handle the load.

Answer

Run a SQL injection scanner on the application.

Question 18

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Accepted Answer

The attacker extracted hashed passwords that can be cracked offline. The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Answer

The attacker successfully performed a blind SQL injection to enumerate the database structure

Answer

The attacker caused a denial of service by sending an invalid query

Answer

The attacker modified the database records to update user passwords

Question 19

You are a security analyst for a medium-sized e-commerce company. The company hosts its web application on a single server running Apache on Ubuntu. Recently, the operations team noticed that the server's CPU usage spikes to 100% every few minutes, causing the website to become unresponsive. They have ruled out hardware issues. The web server logs show repeated requests to the same URL with varying parameters, such as /product?id=1, /product?id=2, etc., all originating from a single IP address. Each request returns a 200 OK response, but the server takes several seconds to generate the page. The application uses a relational database backend with an ORM. You suspect an attack is occurring. What is the most likely attack and the best immediate course of action?

Accepted Answer

Block the IP address of the attacker at the firewall. The attack is a resource exhaustion or application-layer DoS attack, where repeated requests to a database-backed endpoint (e.g., /product?id=1, /product?id=2) cause high CPU usage due to expensive ORM queries. The immediate best course is to block the single attacking IP at the firewall, as it stops the malicious traffic at the network perimeter with minimal overhead, preserving server resources for legitimate users.

Answer

Implement rate limiting on the /product endpoint

Answer

Install a web application firewall (WAF) to detect and block malicious requests

Answer

Apply input validation to ensure product IDs are positive integers

Question 20

Match each encryption algorithm to its type.

Accepted Answer

AES: Symmetric encryption. AES and 3DES are symmetric algorithms, while RSA and ECC are asymmetric. The distractors swap these types.

Answer

AES: Asymmetric encryption

Answer

RSA: Symmetric encryption

CEH Network and Web Application Attacks — All Questions With Answers

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?

Drag and drop the steps to recover a forgotten Windows administrator password using a bootable Linux USB into the correct order.

A web server log shows the following request from a single IP: GET /images/../../../../etc/passwd HTTP/1.1. Which vulnerability is being exploited?

Exhibit

Refer to the exhibit. A user visits a malicious site that returns this HTML. Which attack is being executed?

Exhibit

Exhibit

Exhibit

A security auditor reviews an Nginx configuration that permits all IP addresses but requires HTTP Basic authentication using a valid .htpasswd file. The access log shows a request from 192.168.2.10 to a protected resource with username 'admin' was rejected with 401. Why was the request rejected?

Exhibit

Refer to the exhibit. A penetration tester inputs a UNION-based SQL injection payload. Based on the output, how many columns does the original 'users' table have?

Exhibit

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

Exhibit

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Exhibit

Match each encryption algorithm to its type.

Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?

Exhibit

Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?

Exhibit

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

Exhibit

Refer to the exhibit. A penetration tester observes that the DNS server returns both internal (10.0.0.0/8) and external (203.0.113.5) IP addresses for the same domain. What is this technique called?

Exhibit

CEH Network and Web Application Attacks — All Questions With Answers

A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?

Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?

Drag and drop the steps to recover a forgotten Windows administrator password using a bootable Linux USB into the correct order.

A web server log shows the following request from a single IP: GET /images/../../../../etc/passwd HTTP/1.1. Which vulnerability is being exploited?

Exhibit

Refer to the exhibit. A user visits a malicious site that returns this HTML. Which attack is being executed?

Exhibit

Exhibit

Exhibit

A security auditor reviews an Nginx configuration that permits all IP addresses but requires HTTP Basic authentication using a valid .htpasswd file. The access log shows a request from 192.168.2.10 to a protected resource with username 'admin' was rejected with 401. Why was the request rejected?

Exhibit

Refer to the exhibit. A penetration tester inputs a UNION-based SQL injection payload. Based on the output, how many columns does the original 'users' table have?

Exhibit

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

Exhibit

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

Exhibit

Match each encryption algorithm to its type.

Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?

Exhibit

Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?

Exhibit

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

Exhibit

Refer to the exhibit. A penetration tester observes that the DNS server returns both internal (10.0.0.0/8) and external (203.0.113.5) IP addresses for the same domain. What is this technique called?

Exhibit