CEH Wireless, IoT and Cloud Security Practice Test 1 — 15 Questions

Question 1

A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?

Accepted Answer

Configure egress filtering on the firewall to block outbound connections to known malicious domains.. Option C is correct because egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.

Answer

Install a host-based firewall on the IoT device to restrict outbound traffic.

Answer

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Answer

Disable DNS resolution on the IoT device to prevent any external communication.

Question 2

A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?

Accepted Answer

Anyone on the internet can read objects in the bucket if they know the object URL.. The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.

Answer

The data is encrypted at rest, so no exposure risk exists.

Answer

The bucket policy is misconfigured but only affects objects with server-side encryption.

Answer

Only authenticated AWS users can access the bucket, so the risk is limited.

Question 3

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Question 4

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

Accepted Answer

LoRaWAN. LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.

Answer

4G LTE

Answer

Wi-Fi 6

Answer

Bluetooth 5

Question 5

A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?

Accepted Answer

Disable password authentication and use SSH key-based authentication.. Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.

Answer

Install fail2ban to automatically block IPs after failures.

Answer

Implement rate-limiting on SSH connections per IP.

Answer

Change the SSH port to a non-standard port.

Question 6

During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?

Accepted Answer

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.. In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.

Answer

Decrypt the traffic using the captured handshake to get the credentials.

Answer

WPS PIN brute-force to recover the PSK.

Answer

PMKID attack to crack the pre-shared key.

Question 7

A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?

Accepted Answer

Enable multi-factor authentication (MFA) for all users.. Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.

Answer

Enforce complex password policies.

Answer

Implement CAPTCHA on the login page.

Answer

Enable account lockout after 3 failed attempts.

Question 8

An organization deploys a fleet of IoT cameras that communicate with a central server over the internet. The cameras use HTTP to send video streams. What is the most critical security improvement to protect the video data in transit?

Accepted Answer

Implement TLS/SSL encryption for all camera communications.. The most critical security improvement is to implement TLS/SSL encryption (HTTPS) for all camera communications. HTTP transmits video data in plaintext, allowing any attacker on the network path to capture and view the video stream. TLS/SSL provides encryption, integrity, and authentication, directly protecting the confidentiality of the video data in transit.

Answer

Require strong passwords on the camera web interface.

Answer

Use a site-to-site VPN between the cameras and the server.

Answer

Use certificate pinning to prevent man-in-the-middle attacks.

Question 9

Which TWO of the following are effective countermeasures against rogue access point attacks on a corporate wireless network?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) continuously monitors the radio frequency spectrum to detect, locate, and block rogue access points. It can automatically classify devices based on their behavior and signatures, and when a rogue AP is identified, the WIPS can launch a de-authentication attack against the rogue device or its clients, effectively neutralizing the threat. This makes WIPS the most direct and proactive countermeasure against rogue APs.

Answer

Use WPA2-PSK with a strong passphrase.

Answer

Implement MAC address filtering on the access points.

Answer

Disable SSID broadcast on the corporate network.

Question 10

Which THREE of the following are common security risks associated with cloud computing?

Accepted Answer

Misconfigured cloud storage leading to data exposure.. Option B is correct because misconfigured cloud storage, such as an Amazon S3 bucket with overly permissive ACLs or a publicly accessible Azure Blob container, is one of the most common cloud security risks. This misconfiguration can expose sensitive data to the internet without authentication, leading to data breaches. The Cloud Security Alliance (CSA) consistently lists misconfiguration as a top cloud threat.

Answer

Physical theft of servers from the data center.

Answer

Hypervisor compromise due to unpatched vulnerabilities.

Question 11

Which TWO of the following are characteristics of a Bluetooth Low Energy (BLE) IoT device that make it suitable for a battery-powered sensor?

Accepted Answer

Low energy consumption.. Option C is correct because BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.

Answer

High data throughput.

Answer

Long range (up to 1 km).

Answer

Operates in unlicensed spectrum like Wi-Fi.

Question 12

Which THREE of the following are best practices for securing IoT devices in a home automation network?

Accepted Answer

Segment IoT devices on a separate VLAN or subnet.. Segmenting IoT devices on a separate VLAN or subnet (Option B) is a best practice because it isolates potentially insecure IoT devices from the main trusted network. If an IoT device is compromised, the attacker cannot easily pivot to other devices on the primary LAN. This leverages Layer 2 or Layer 3 segmentation to enforce network access controls, reducing the attack surface in a home automation environment.

Answer

Enable Universal Plug and Play (UPnP) for easy integration.

Answer

Ensure all devices are connected directly to the internet for remote access.

Question 13

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

Accepted Answer

The group cipher is TKIP, which is deprecated and vulnerable.. Option D is correct because TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.

Answer

The pairwise cipher is CCMP, which is outdated.

Answer

The network uses WPA2-PSK, which is easily cracked.

Answer

The beacon frame reveals the BSSID, which is a security risk.

Question 14

Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?

Accepted Answer

The action was performed by the AWS root account, which should be avoided for routine tasks.. The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.

Answer

The AMI ID (ami-0abcdef1234567890) is from a trusted source.

Answer

The source IP address (203.0.113.5) is suspicious.

Answer

The instance type is t2.micro, which may be vulnerable.

Question 15

A security analyst notices unusual traffic from a smart thermostat to an external IP address. The thermostat is on a separate IoT VLAN. Which action should the analyst take to investigate and mitigate the threat?

Accepted Answer

Create a firewall rule to block traffic from the thermostat's MAC address to the external IP.. Option D is correct because creating a firewall rule to block traffic from the thermostat's MAC address to the specific external IP is a targeted, least-disruptive mitigation. It preserves the IoT VLAN's functionality for other devices while stopping the suspicious communication. This approach allows the analyst to investigate further without losing visibility into the threat, as the thermostat remains on the network for forensic analysis.

Answer

Disconnect the thermostat from the network.

Answer

Block all outbound traffic from the IoT VLAN.

Answer

Uninstall the companion app from the user's smartphone.