CEH Wireless, IoT and Cloud Security — Timed 10 Questions

Question 1

A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?

Accepted Answer

Configure egress filtering on the firewall to block outbound connections to known malicious domains.. Option C is correct because egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.

Answer

Install a host-based firewall on the IoT device to restrict outbound traffic.

Answer

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Answer

Disable DNS resolution on the IoT device to prevent any external communication.

Question 2

A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?

Accepted Answer

Anyone on the internet can read objects in the bucket if they know the object URL.. The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.

Answer

The data is encrypted at rest, so no exposure risk exists.

Answer

The bucket policy is misconfigured but only affects objects with server-side encryption.

Answer

Only authenticated AWS users can access the bucket, so the risk is limited.

Question 3

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Question 4

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

Accepted Answer

LoRaWAN. LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.

Answer

4G LTE

Answer

Wi-Fi 6

Answer

Bluetooth 5

Question 5

A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?

Accepted Answer

Disable password authentication and use SSH key-based authentication.. Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.

Answer

Install fail2ban to automatically block IPs after failures.

Answer

Implement rate-limiting on SSH connections per IP.

Answer

Change the SSH port to a non-standard port.

Question 6

During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?

Accepted Answer

Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.. In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.

Answer

Decrypt the traffic using the captured handshake to get the credentials.

Answer

WPS PIN brute-force to recover the PSK.

Answer

PMKID attack to crack the pre-shared key.

Question 7

A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?

Accepted Answer

Enable multi-factor authentication (MFA) for all users.. Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.

Answer

Enforce complex password policies.

Answer

Implement CAPTCHA on the login page.

Answer

Enable account lockout after 3 failed attempts.

Question 8

An organization deploys a fleet of IoT cameras that communicate with a central server over the internet. The cameras use HTTP to send video streams. What is the most critical security improvement to protect the video data in transit?

Accepted Answer

Implement TLS/SSL encryption for all camera communications.. The most critical security improvement is to implement TLS/SSL encryption (HTTPS) for all camera communications. HTTP transmits video data in plaintext, allowing any attacker on the network path to capture and view the video stream. TLS/SSL provides encryption, integrity, and authentication, directly protecting the confidentiality of the video data in transit.

Answer

Require strong passwords on the camera web interface.

Answer

Use a site-to-site VPN between the cameras and the server.

Answer

Use certificate pinning to prevent man-in-the-middle attacks.

Question 9

Which TWO of the following are effective countermeasures against rogue access point attacks on a corporate wireless network?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) continuously monitors the radio frequency spectrum to detect, locate, and block rogue access points. It can automatically classify devices based on their behavior and signatures, and when a rogue AP is identified, the WIPS can launch a de-authentication attack against the rogue device or its clients, effectively neutralizing the threat. This makes WIPS the most direct and proactive countermeasure against rogue APs.

Answer

Use WPA2-PSK with a strong passphrase.

Answer

Implement MAC address filtering on the access points.

Answer

Disable SSID broadcast on the corporate network.

Question 10

Which THREE of the following are common security risks associated with cloud computing?

Accepted Answer

Misconfigured cloud storage leading to data exposure.. Option B is correct because misconfigured cloud storage, such as an Amazon S3 bucket with overly permissive ACLs or a publicly accessible Azure Blob container, is one of the most common cloud security risks. This misconfiguration can expose sensitive data to the internet without authentication, leading to data breaches. The Cloud Security Alliance (CSA) consistently lists misconfiguration as a top cloud threat.

Answer

Physical theft of servers from the data center.

Answer

Hypervisor compromise due to unpatched vulnerabilities.