CEH Vulnerability Analysis and System Hacking — All Questions With Answers

Question 1

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Accepted Answer

Craft a request with a local file inclusion parameter pointing to /etc/passwd. This approach uses a local file inclusion (LFI) parameter to safely test for file inclusion vulnerabilities without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include local files. While this directly confirms LFI, a successful LFI often indicates underlying input validation flaws that could also lead to RFI, making it a common and non-destructive first step to assess for file inclusion vulnerabilities in general, including the potential for RFI.

Answer

Use SQLMap to test for SQL injection

Answer

Scan the server with Nikto to detect known RFI signatures

Answer

Attempt to include a remote URL containing a web shell

Question 2

Which TWO of the following are valid techniques for password cracking?

Accepted Answer

Brute-force attack. A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. A rainbow table attack is also a valid password cracking technique that uses pre-computed hashes to reverse cryptographic hash functions, often for passwords. Both directly aim to discover the plaintext password.

Answer

Phishing

Answer

Man-in-the-middle attack

Answer

Keylogging

Question 3

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Accepted Answer

Apache Tomcat 8.5.5. Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.

Answer

MAC Address 00:1A:2B:3C:4D:5E

Answer

Apache httpd 2.4.18

Answer

OpenSSH 7.2p2

Question 4

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Accepted Answer

MySQL (3306) - exploit CVE-2016-6662. The explanation incorrectly states that CVE-2016-6662 is a 'critical remote code execution vulnerability... without requiring authentication' for initial access. CVE-2016-6662 is a local privilege escalation vulnerability in MySQL/MariaDB's mysqld_safe script, requiring local file write access to exploit, not remote initial access. Therefore, it does not justify option D as the 'highest chance of success' for initial remote access. The question also cannot be properly evaluated without the 'exhibit' mentioned in the stem, which would provide crucial context about the services and their versions.

Answer

HTTP (80) - exploit Apache vulnerability

Answer

SSH (22) - brute force user credentials

Answer

Proxy (8080) - exploit Squid vulnerability

Question 5

A security auditor reviews password hashes for three users: admin uses SHA-512 (hash prefix $6$...), root uses SHA-512 (hash prefix $6$...), and user uses MD5 (hash prefix $1$...). Which user has the weakest password hash?

Accepted Answer

user. The user hash prefix $1$ indicates MD5, which is cryptographically broken and much faster to attack than SHA-512 ($6$). The admin and root hashes use SHA-512, which is significantly stronger. Therefore, user has the weakest password hash.

Answer

admin

Answer

root

Answer

All are equally strong

Question 6

An attacker wants to exploit a known vulnerability. Which service is most likely vulnerable to CVE-2019-0215?

Accepted Answer

Apache httpd 2.4.18. CVE-2019-0215 affects Apache HTTP Server versions 2.4.17 to 2.4.38. Apache HTTP Server 2.4.18 is within the vulnerable range.

Answer

OpenSSH 7.2p2

Answer

Linux kernel

Answer

Squid http proxy 3.5.12

Question 7

Refer to the exhibit. An auditor discovers that 'SupportUser' is a member of the Administrators group. What is the most likely security concern?

Accepted Answer

SupportUser should be a standard user, not an administrator, to minimize attack surface.. The most significant security concern when a 'SupportUser' is a member of the 'Administrators' group is the violation of the principle of least privilege. This principle states that users should only be granted the minimum permissions necessary to perform their job functions. A support user typically does not require full administrative privileges. Granting excessive privileges significantly increases the attack surface; if the 'SupportUser' account is compromised, an attacker would gain administrative control, leading to a much greater potential impact than if the account had only standard user privileges. Options B, C, and D describe other potential issues, but they are either not directly inferable from the given information (C), or are operational/administrative issues rather than the primary security concern related to excessive privileges (B, D).

Answer

The group membership is not replicated to domain controllers.

Answer

The account has a weak password.

Answer

The account name is misspelled.

Question 8

A security analyst observes the following SSH logs:

sshd[1234]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1235]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1236]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1237]: Failed password for root from 203.0.113.7 port 22 ssh2
sshd[1238]: Failed password for root from 203.0.113.7 port 22 ssh2

Which attack technique is being used?

Accepted Answer

Brute force attack against the root account. The logs show repeated failed SSH authentication attempts against the same privileged account (root) from a single source. This pattern indicates a brute force attack against the root account, where an attacker systematically tries many passwords for one target account.

Answer

Denial of Service (DoS) attack

Answer

Dictionary attack on SSH service

Answer

Port scanning of the SSH server

Question 9

During a vulnerability assessment, a tester reviews a web.xml file that specifies a session timeout of 60 minutes. Which of the following is a potential security weakness?

Accepted Answer

The session timeout is set to 60 minutes, which might be too long.. Assuming the web.xml exhibit shows a session timeout of 60 minutes, this is a potential security weakness. A long session timeout increases the window of opportunity for session hijacking or fixation attacks if a user leaves their session unattended. While an outdated web-app version (Option A) can indicate broader security risks (e.g., unpatched server, lack of modern security features), the version number itself is an indicator rather than a direct, exploitable vulnerability. A long session timeout (Option C) is a more direct and immediately exploitable configuration vulnerability. Options B and D are not security weaknesses; configuring error pages is a best practice to prevent information disclosure, and exposing servlet class names is fundamental to how Java web applications function and not inherently a vulnerability.

Answer

The web-app version is 2.4, which is outdated.

Answer

The error page location is configurable.

Answer

The servlet class name is exposed.

Question 10

Refer to the exhibit. An analyst performs reconnaissance on a Windows 10 system. Which of the following findings is most critical from a security perspective?

Accepted Answer

The registry key LocalAccountTokenFilterPolicy is set to 1, which may allow remote UAC bypass.. The LocalAccountTokenFilterPolicy registry key, when set to 1, disables remote User Account Control (UAC) filtering for local accounts. This means that local administrator accounts connecting remotely (e.g., via network shares or Windows Management Instrumentation - WMI) will receive a full administrative token, bypassing the UAC elevation prompt. This is a significant security misconfiguration that allows for a remote UAC bypass, making it easier for attackers to perform lateral movement or privilege escalation if they compromise local administrator credentials. Options A and C are standard reconnaissance findings, not critical vulnerabilities themselves. Option B indicates a potential vulnerability (missing patches), which can be critical, but D describes a definite, active misconfiguration with a direct and immediate security impact, making it the most critical finding among the choices.

Answer

The system is running Windows 10 Pro version 19041.

Answer

The last installed hotfix is from April 2021, indicating the system may be missing newer patches.

Answer

The system type is x64-based, but no additional security concerns are noted.

Question 11

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Accepted Answer

enum4linux. enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.

Answer

Nikto

Answer

Hydra

Answer

Nmap

Question 12

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Accepted Answer

Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell. When a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.

Answer

Exploit a kernel vulnerability using a local exploit

Answer

Use the find command with -exec to execute a shell

Answer

Check for world-writable scripts in cron jobs

Question 13

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

Accepted Answer

Update Log4j to version 2.17.1 or later. CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.

Answer

Remove the JndiLookup class from the Log4j jar

Answer

Disable JDBC appender in Log4j configuration

Answer

Block outbound traffic from the server to the internet

Question 14

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Accepted Answer

Session hijacking via cross-site scripting (XSS). The absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Clickjacking

Question 15

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 16

You are a penetration tester hired by a medium-sized financial company. The company has a network consisting of 50 Windows workstations (Windows 10 Pro) and 5 Windows Server 2019 servers (domain controller, file server, web server, database server, and mail server). The network is segmented into three VLANs: User VLAN (192.168.1.0/24), Server VLAN (192.168.2.0/24), and DMZ (192.168.3.0/24). The web server is in the DMZ and hosts a public-facing e-commerce application built on ASP.NET with a SQL Server backend. The database server is in the Server VLAN and is not directly accessible from the internet. You are given a standard user account on a workstation in the User VLAN. After initial reconnaissance, you discover that the web server is running an outdated version of IIS (7.5) and is vulnerable to a known privilege escalation vulnerability (CVE-2020-0613) that allows local privilege escalation if an attacker has already gained initial access. You also find that the web application has a SQL injection vulnerability in the login page. You successfully exploit the SQL injection to extract the password hash of the web application's service account, which is 'web_svc'. You crack the hash offline and obtain the plaintext password. The 'web_svc' account has local administrative privileges on the web server. Using these credentials, you authenticate to the web server via RDP. From there, you want to pivot to the database server to extract credit card information stored in the database. The database server only allows connections from the web server on port 1433 (SQL Server). Using the 'web_svc' account, you are able to connect to the database server using SQL Server Management Studio. However, you find that the 'web_svc' account has only 'public' and 'guest' database roles, which do not allow reading any sensitive tables. You need to escalate privileges on the database server. What is the most effective next step?

Accepted Answer

Exploit the privilege escalation vulnerability on the web server to gain SYSTEM access, then dump the SQL Server service account credentials (e.g., from the SQL Server error logs or registry) and use them to log into the database server with sysadmin privileges. The web_svc account lacks sufficient database privileges, but by exploiting the privilege escalation vulnerability (CVE-2020-0613) on the web server to gain SYSTEM access, you can extract the SQL Server service account credentials (e.g., from SQL Server error logs or registry). The SQL Server service account typically runs with sysadmin privileges, allowing you to connect to the database server with full administrative rights and access the credit card data.

Answer

Use the web_svc account to create a new SQL Server login with sysadmin privileges via the SQL Server Management Studio

Answer

Perform a brute-force attack against the 'sa' account on the database server using a wordlist

Answer

Try to use the web_svc account to directly query the credit card table using a SQL injection payload on the web application

Question 17

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Accepted Answer

Create a Volume Shadow Copy to access SAM file. On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.

Answer

Run the tool as Administrator

Answer

Use reg.exe save to export SAM hive

Answer

Enable SeDebugPrivilege for the current process

Question 18

Which TWO vulnerabilities are associated with buffer overflow attacks?

Accepted Answer

Arbitrary code execution. Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.

Answer

Authentication bypass via SQL injection

Answer

Cross-site scripting (XSS)

Answer

Race condition

Question 19

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.

Accepted Answer

Check current rules, add drop rule for SSH, verify the new rule, save the rules, test connectivity. The correct sequence for configuring an iptables rule to block incoming SSH is to first check the current rules (e.g., with `iptables -L`) to avoid conflicts, then add the drop rule for SSH (e.g., `iptables -A INPUT -p tcp --dport 22 -j DROP`), next verify that the rule is in place (`iptables -L`), then save the rules permanently (e.g., `iptables-save`), and finally test the block by attempting an SSH connection from an external host.

Answer

Add drop rule for SSH, check current rules, verify the new rule, test connectivity, save the rules

Answer

Check current rules, add drop rule for SSH, test connectivity, verify the new rule, save the rules

Answer

Save the rules, check current rules, add drop rule for SSH, verify the new rule, test connectivity

Question 20

Match each type of attack to its description.

Accepted Answer

Phishing: A broad term for social engineering attacks that use fraudulent emails or websites to trick individuals into revealing sensitive information.. The correct matches are Phishing with its broad definition, Spear Phishing with targeted definition, and Whaling with high-profile target definition. Common confusions: Vishing is voice-based, Smishing is SMS-based; also targeted phishing is spear phishing.

Answer

Vishing: A targeted form of phishing directed at a specific individual.

Answer

Smishing: Voice phishing using phone calls.

CEH Vulnerability Analysis and System Hacking — All Questions With Answers

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Which TWO of the following are valid techniques for password cracking?

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Exhibit

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Exhibit

A security auditor reviews password hashes for three users: admin uses SHA-512 (hash prefix $6$...), root uses SHA-512 (hash prefix $6$...), and user uses MD5 (hash prefix $1$...). Which user has the weakest password hash?

Exhibit

An attacker wants to exploit a known vulnerability. Which service is most likely vulnerable to CVE-2019-0215?

Exhibit

Refer to the exhibit. An auditor discovers that 'SupportUser' is a member of the Administrators group. What is the most likely security concern?

Exhibit

Exhibit

During a vulnerability assessment, a tester reviews a web.xml file that specifies a session timeout of 60 minutes. Which of the following is a potential security weakness?

Exhibit

Refer to the exhibit. An analyst performs reconnaissance on a Windows 10 system. Which of the following findings is most critical from a security perspective?

Exhibit

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Which THREE of the following are common indicators of a buffer overflow vulnerability?

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Which TWO vulnerabilities are associated with buffer overflow attacks?

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.

Match each type of attack to its description.

Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?

Exhibit

Refer to the exhibit. A penetration tester runs hashcat to crack NTLM hashes. Which hash mode (-m) would be correct for NTLM?

Exhibit

Refer to the exhibit. A security analyst checks for missing patches. Which vulnerability is this system likely exposed to?

Exhibit

Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?

Exhibit

CEH Vulnerability Analysis and System Hacking — All Questions With Answers

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Which TWO of the following are valid techniques for password cracking?

Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?

Exhibit

Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?

Exhibit

A security auditor reviews password hashes for three users: admin uses SHA-512 (hash prefix $6$...), root uses SHA-512 (hash prefix $6$...), and user uses MD5 (hash prefix $1$...). Which user has the weakest password hash?

Exhibit

An attacker wants to exploit a known vulnerability. Which service is most likely vulnerable to CVE-2019-0215?

Exhibit

Refer to the exhibit. An auditor discovers that 'SupportUser' is a member of the Administrators group. What is the most likely security concern?

Exhibit

Exhibit

During a vulnerability assessment, a tester reviews a web.xml file that specifies a session timeout of 60 minutes. Which of the following is a potential security weakness?

Exhibit

Refer to the exhibit. An analyst performs reconnaissance on a Windows 10 system. Which of the following findings is most critical from a security perspective?

Exhibit

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?

An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?

Which THREE of the following are common indicators of a buffer overflow vulnerability?

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Which TWO vulnerabilities are associated with buffer overflow attacks?

Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.

Match each type of attack to its description.

Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?

Exhibit

Refer to the exhibit. A penetration tester runs hashcat to crack NTLM hashes. Which hash mode (-m) would be correct for NTLM?

Exhibit

Refer to the exhibit. A security analyst checks for missing patches. Which vulnerability is this system likely exposed to?

Exhibit

Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?

Exhibit