CEH Timed Practice Test 3 — 10 Questions

Question 1

During a passive reconnaissance phase, a penetration tester uses a tool to gather email addresses, subdomains, and employee names associated with a target domain without directly interacting with the target's systems. Which tool is BEST suited for this purpose?

10 minute time limit — choose an answer to begin.

Accepted Answer

theHarvester. theHarvester is specifically designed for passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API to collect email addresses, subdomains, and employee names without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement of gathering OSINT data without direct interaction.

Answer

Nmap

Answer

Netcat

Answer

Wireshark

Question 2

An ethical hacker is analyzing a suspicious file using static analysis. Which of the following actions is part of static malware analysis?

Accepted Answer

Examining the file's strings and metadata without executing it. Static malware analysis involves examining the file without executing it. Option C is correct because analyzing strings and metadata (e.g., file headers, embedded URLs, IP addresses, or suspicious function calls) is a core static analysis technique, often performed using tools like `strings`, `binwalk`, or `PEview`. This approach avoids the risks of execution and helps identify indicators of compromise (IOCs) before dynamic analysis.

Answer

Running the file in a sandboxed environment and monitoring its behavior

Answer

Uploading the file to VirusTotal for scanning

Answer

Using Wireshark to capture packets sent by the file

Question 3

A security analyst observes that an Nmap SYN scan against a target network returns all ports as 'filtered'. The analyst suspects an IDS/IPS is dropping inbound SYN packets. Which Nmap technique would MOST likely bypass this detection while still identifying open ports?

Accepted Answer

Enable IP fragmentation with the -f flag. When an IDS/IPS drops inbound SYN packets, a standard SYN scan (-sS) is detected because the probe packets are easily recognized. Enabling IP fragmentation with the -f flag splits the TCP header across multiple fragments, making it harder for the IDS/IPS to reassemble and inspect the full packet, thus potentially bypassing the filter while still allowing Nmap to determine open ports based on responses.

Answer

Use the -sU flag for UDP scanning

Answer

Use the -sT flag for a TCP connect scan

Answer

Increase scanning speed with -T5

Question 4

A penetration tester wants to enumerate users and groups from a Windows domain controller via LDAP without logging in. Which of the following tools is MOST appropriate for anonymous LDAP enumeration?

Accepted Answer

ldapsearch. ldapsearch is the correct tool because it can perform anonymous LDAP queries against a Windows domain controller's LDAP service (port 389) without requiring authentication. By default, many Windows DCs allow anonymous binds to retrieve directory information such as user and group objects, making ldapsearch the most direct and appropriate choice for this task.

Answer

smbclient

Answer

snmpwalk

Answer

enum4linux

Question 5

Which of the following tools is PRIMARILY used for passive OSINT gathering and can query multiple search engines, social media platforms, and public databases to collect information about a target?

Accepted Answer

Maltego. Maltego is primarily used for passive OSINT gathering because it leverages open-source intelligence feeds, search engines, social media platforms, and public databases to collect and correlate information about a target without directly interacting with the target's systems. Its transform-based architecture allows it to query multiple data sources simultaneously, making it the correct choice for passive reconnaissance.

Answer

Nmap

Answer

Wireshark

Answer

theHarvester

Question 6

During a vulnerability assessment, which of the following tools is a comprehensive vulnerability scanner that uses a plugin architecture to detect thousands of vulnerabilities?

Accepted Answer

Nessus. Nessus is a comprehensive vulnerability scanner that uses a plugin-based architecture to detect thousands of vulnerabilities across a wide range of systems and services. Each plugin corresponds to a specific vulnerability check, and the Nessus engine executes them in sequence or in parallel against the target, making it highly extensible and up-to-date with the latest CVEs.

Answer

Wireshark

Answer

OpenVAS

Answer

Nmap

Question 7

During a penetration test, you discover an LDAP server on port 389 that allows anonymous binds. Which of the following enumeration techniques would provide the MOST comprehensive information about the directory structure?

Accepted Answer

Use ldapsearch to query the directory for all attributes. `ldapsearch` with anonymous bind allows querying the LDAP directory for all attributes and entries, providing comprehensive information about the directory structure, including user accounts, groups, organizational units, and other objects. LDAP servers on port 389 often expose the entire directory tree when anonymous binds are permitted, making `ldapsearch` the most effective enumeration technique.

Answer

Run nmap with the smb-enum-shares script

Answer

Perform a DNS zone transfer

Answer

Use net view to list domain resources

Question 8

Which of the following is a passive OS fingerprinting technique?

Accepted Answer

Capturing packets and analyzing TTL values. Passive OS fingerprinting involves observing network traffic without actively sending packets to the target. Option D is correct because capturing packets and analyzing TTL (Time to Live) values allows an attacker to infer the operating system, as different OSes use default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255). This technique does not generate any probe traffic, making it passive.

Answer

Using nmap -O

Answer

Performing a ping sweep

Answer

Sending SYN packets and analyzing responses

Question 9

A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?

Accepted Answer

Masscan can scan a large number of hosts and ports at very high speed. Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.

Answer

Masscan provides more detailed service version detection than Nmap

Answer

Masscan is stealthier than Nmap and less likely to be detected

Answer

Masscan can scan all 65535 ports faster than Nmap

Question 10

A security engineer needs to configure a web server to support Perfect Forward Secrecy (PFS) for HTTPS connections. Which of the following key exchange methods should be prioritized?

Accepted Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE). ECDHE is prioritized for Perfect Forward Secrecy because it generates a unique, ephemeral session key for each TLS handshake using elliptic curve cryptography, ensuring that if the server's long-term private key is compromised, past session keys remain secure. Unlike static Diffie-Hellman, ECDHE does not reuse key material, and it offers stronger security per bit compared to traditional DH, making it the recommended choice for PFS in modern HTTPS configurations.

Answer

Diffie-Hellman (DH) key exchange

Answer

Pre-Shared Key (PSK)

Answer

RSA key exchange