CEH Timed Practice Test 3 — 10 Questions

Question 1

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

10 minute time limit — choose an answer to begin.

Accepted Answer

Use ldapsearch to query the directory for all attributes. `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Answer

Run nmap with the smb-enum-shares script

Answer

Perform a DNS zone transfer

Answer

Use net view to list domain resources

Question 2

Which THREE of the following are valid techniques in the system hacking methodology (CHPSET)? (Choose three.)

Accepted Answer

Privilege escalation. In the CEH system hacking methodology (often summarized as CHPSET: Cracking passwords, Hiding files, Privilege escalation, Executing applications, Covering tracks/erasing tracks, and Creating backdoors), privilege escalation (A) is a core step because after gaining initial access the attacker elevates from a low-privileged account to root/SYSTEM or administrator rights to fully control the target. Erasing tracks (C) is also a core step, covering log tampering, clearing event logs, disabling auditing, and removing artifacts so the intrusion is not detected or attributed. Cracking passwords (E) is the first phase of CHPSET, where techniques such as dictionary, brute-force, rainbow-table, and hybrid attacks recover or bypass credentials to obtain valid access. Social engineering (B) is not part of the system hacking methodology; it belongs to the earlier footprinting/scanning or social-engineering phase of the CEH attack lifecycle. Network sniffing (D) is likewise a separate CEH domain (sniffing), used for capturing traffic, not a step in the CHPSET system hacking sequence.

Answer

Social engineering

Answer

Network sniffing

Question 3

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 4

A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?

Accepted Answer

Masscan can scan a large number of hosts and ports at very high speed. Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.

Answer

Masscan provides more detailed service version detection than Nmap

Answer

Masscan is stealthier than Nmap and less likely to be detected

Answer

Masscan can scan all 65535 ports faster than Nmap

Question 5

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). ECDHE is prioritized for Perfect Forward Secrecy because it generates a unique, ephemeral session key for each TLS handshake using elliptic curve cryptography, ensuring that if the server's long-term private key is compromised, past session keys remain secure. Unlike static Diffie-Hellman, ECDHE does not reuse key material, and it offers stronger security per bit compared to traditional DH, making it the recommended choice for PFS in modern HTTPS configurations.

Answer

Diffie-Hellman (DH) key exchange

Answer

Pre-Shared Key (PSK)

Answer

RSA key exchange

Question 6

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

Accepted Answer

UDP flood. A UDP flood attack works by overwhelming a target server with a high volume of UDP packets sent to random high-numbered ports. The server checks each port for a listening application, and when none is found, it responds with ICMP Destination Unreachable messages, consuming CPU and bandwidth until the server becomes unresponsive. The use of spoofed source IP addresses makes it difficult to filter the attack traffic based on source alone.

Answer

ICMP flood

Answer

SYN flood

Answer

Smurf attack

Question 7

Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?

Accepted Answer

Distributed denial-of-service (DDoS) attack. Multiple ESTABLISHED connections on port 443 (HTTPS) from different external IPs to the same process ID indicate a distributed denial-of-service (DDoS) attack. In a DDoS, many compromised hosts (botnet) simultaneously establish legitimate TCP handshakes and maintain connections to exhaust server resources, such as connection slots or memory, at the application layer. The key clue is the diversity of source IPs targeting a single process, which is characteristic of a coordinated flood from many distinct sources.

Answer

SSL/TLS renegotiation DoS

Answer

Slowloris attack

Answer

Man-in-the-middle attack

Question 8

During a penetration test, a tester uses Nmap with the command: nmap -sS -D RND:10 192.168.1.100. After the scan, the IDS logs show multiple SYN packets from different source IPs hitting the target. However, the tester's true IP is not among them. Which of the following techniques is being used?

Accepted Answer

Decoy scan. The command `nmap -sS -D RND:10` performs a SYN stealth scan with 10 randomly generated decoy IP addresses. The IDS logs show multiple SYN packets from different source IPs, but the tester's true IP is not among them because Nmap sends the decoy packets with spoofed source addresses while the real scan packet is interleaved among them. This is the definition of a decoy scan, which aims to obscure the attacker's true origin by blending it with fake sources.

Answer

Idle scan

Answer

SYN flood

Answer

Fragmentation attack

Question 9

Which of the following tools is specifically designed to perform password cracking using rainbow tables?

Accepted Answer

RainbowCrack. RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.

Answer

John the Ripper

Answer

Ophcrack

Answer

Hashcat

Question 10

Which tool is specifically designed to crack Windows LM and NTLM password hashes using rainbow tables?

Accepted Answer

Ophcrack. Ophcrack is specifically designed to crack Windows LM and NTLM password hashes using precomputed rainbow tables. It leverages the time-memory trade-off technique to rapidly reverse these hashes without brute-forcing each password individually, making it the correct choice for this targeted task.

Answer

Hashcat

Answer

RainbowCrack

Answer

John the Ripper