CEH Timed Practice Test 3 — 10 Questions

Question 1

Which TWO of the following Nmap scan types are typically used to evade firewalls and IDS systems by sending fragmented packets?

Accepted Answer

Fragment scan (-f). The Fragment scan (-f) is correct because it splits TCP headers into multiple small IP fragments, making it harder for firewalls and IDS systems to reassemble and inspect the full packet. This evasion technique exploits the fact that many filtering devices only check the first fragment and pass subsequent fragments without scrutiny, allowing the scan to bypass detection.

Answer

SYN scan (-sS)

Answer

ACK scan (-sA)

Answer

Xmas scan (-sX)

Question 2

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Accepted Answer

Use Google dorking to find publicly exposed email lists. Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.

Answer

Perform a WHOIS lookup on the domain

Answer

Attempt a DNS zone transfer

Answer

Run an nmap scan against the mail server

Question 3

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process

Question 4

A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)

Accepted Answer

Enable Zigbee security suite (AES-128 encryption) on all sensor devices.. Option A is correct because Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.

Answer

Disable encryption on MQTT to reduce latency and improve performance.

Answer

Implement device authentication using pre-shared keys only for Zigbee devices.

Answer

Segment the IoT devices into a separate VLAN and restrict access with ACLs.

Question 5

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 6

A security analyst reviews the iptables firewall configuration on a Linux server acting as a gateway for a small office. The server has two interfaces: eth0 (external) and eth1 (internal, 192.168.1.0/24). Based on the exhibit, which of the following is a valid security concern?

Accepted Answer

All traffic to the loopback interface is accepted, which could allow local attacks to bypass firewall rules.. Option A is correct because the iptables rules show that all traffic to the loopback interface (lo) is accepted in the INPUT chain. This means any process on the local host can send packets to 127.0.0.1 without being filtered, potentially allowing local privilege escalation or local attacks to bypass firewall restrictions. In a gateway configuration, this can be exploited if an attacker gains local access and uses the loopback to communicate with services that should be protected.

Answer

The OUTPUT chain policy is set to ACCEPT, which allows any outbound traffic.

Answer

The FORWARD chain only allows traffic from 192.168.1.0/24 to any destination, which is too permissive.

Answer

UDP port 53 is allowed, which could permit DNS tunneling attacks.

Question 7

Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?

Accepted Answer

explorer.exe (PID 1234). Option B is correct because netstat output showing a suspicious external connection (e.g., to an unknown IP on port 4444) associated with PID 1234, which is identified as explorer.exe, indicates that the Windows shell process has been hijacked or injected with malicious code. Explorer.exe is not a typical network-listening process; its involvement in outbound connections to a non-standard port strongly suggests malware has injected a reverse shell or beacon into this legitimate system process to evade detection.

Answer

The process with PID 1234 is not identified

Answer

svchost.exe (PID 5678)

Answer

The process with PID 5678 is not identified

Question 8

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Accepted Answer

volatility -f memory.dmp netscan. The `netscan` plugin in Volatility scans the memory dump for network connections and sockets, including TCP and UDP endpoints, which directly reveals outbound connections to the malicious IP. The `pslist` plugin lists all running processes by walking the process list in the kernel, allowing the analyst to identify the suspicious process by name or PID. Together, these two commands provide the process identity and its network activity, which is exactly what the scenario requires.

Answer

volatility -f memory.dmp procdump

Answer

volatility -f memory.dmp svcscan

Answer

volatility -f memory.dmp malfind

Question 9

Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?

Accepted Answer

Tailgating. The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.

Answer

Phishing

Answer

Vishing

Answer

Baiting

Question 10

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting