CEH Wireless, IoT and Cloud Security — Timed 10 Questions

Question 1

Which TWO of the following are effective countermeasures against rogue access point attacks on a corporate wireless network?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) continuously monitors the radio frequency spectrum to detect, locate, and block rogue access points. It can automatically classify devices based on their behavior and signatures, and when a rogue AP is identified, the WIPS can launch a de-authentication attack against the rogue device or its clients, effectively neutralizing the threat. This makes WIPS a direct and proactive countermeasure against rogue APs.

802.1X authentication, when implemented on wired switch ports, acts as a crucial countermeasure. It ensures that only authenticated devices (e.g., legitimate corporate computers or authorized access points) can gain access to the corporate wired network. If an unauthorized device, such as a rogue access point, is plugged into a port protected by 802.1X, it will be denied network access, effectively preventing it from becoming a functional rogue AP connected to the internal network.

Answer

Use WPA2-PSK with a strong passphrase.

Answer

Implement MAC address filtering on the access points.

Answer

Disable SSID broadcast on the corporate network.

Question 2

Which THREE of the following are common security risks associated with cloud computing?

Accepted Answer

Misconfigured cloud storage leading to data exposure.. Misconfigured cloud storage, such as overly permissive access controls on data buckets, is a leading cause of data breaches. Shared technology vulnerabilities, inherent in multi-tenant cloud environments, can allow an attacker to impact multiple customers if the underlying infrastructure (e.g., hypervisor, shared libraries) is compromised. Insecure application programming interfaces (APIs) provide a critical attack surface, as cloud services are heavily managed and accessed via APIs, making their security paramount. These three risks are consistently identified by organizations like the Cloud Security Alliance (CSA) and NIST as among the most prevalent cloud security threats.

Answer

Physical theft of servers from the data center.

Answer

Hypervisor compromise due to unpatched vulnerabilities.

Question 3

Which TWO of the following are characteristics of a Bluetooth Low Energy (BLE) IoT device that make it suitable for a battery-powered sensor?

Accepted Answer

Low energy consumption.. BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.

Answer

High data throughput.

Answer

Long range (up to 1 km).

Answer

Operates in unlicensed spectrum like Wi-Fi.

Question 4

Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?

Accepted Answer

The action was performed by the AWS root account, which should be avoided for routine tasks.. The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.

Answer

The AMI ID (ami-0abcdef1234567890) is from a trusted source.

Answer

The source IP address (203.0.113.5) is suspicious.

Answer

The instance type is t2.micro, which may be vulnerable.

Question 5

Which TWO of the following are common security risks associated with bring-your-own-device (BYOD) policies in a corporate environment?

Accepted Answer

Lack of visibility into device security posture. BYOD devices are personally owned and not under direct corporate management, leading to a lack of visibility into their security posture. Without a Mobile Device Management (MDM) or Unified Endpoint Management (UEM) solution, the organization cannot assess patch levels, antivirus status, or jailbreak/root status, leaving the network exposed to compromised devices. Additionally, the presence of personal applications on BYOD devices creates a significant risk of data leakage. Users might inadvertently or maliciously transfer sensitive corporate data from managed corporate applications to unmanaged personal applications (e.g., copying text from a corporate email to a personal messaging app or cloud storage service), bypassing corporate data loss prevention (DLP) controls.

Answer

Enhanced network segmentation

Answer

Stronger encryption of corporate data

Answer

Increased control over device configurations

Question 6

A security analyst discovers that an IoT device in a smart building is periodically sending small DNS queries to an external domain known for command-and-control activity. Which security control should be implemented to detect and block such traffic without disrupting legitimate operations?

Accepted Answer

Configure egress filtering on the firewall to block outbound connections to known malicious domains.. Egress filtering on the firewall can block outbound DNS queries to known malicious domains by using a blocklist or threat intelligence feed, preventing command-and-control (C2) communication without affecting legitimate traffic to other domains. This control operates at the network perimeter, inspecting DNS requests against a reputation database and dropping matches, which is the most effective way to stop C2 traffic while allowing normal operations.

Answer

Install a host-based firewall on the IoT device to restrict outbound traffic.

Answer

Deploy an intrusion detection system (IDS) on the network to alert on suspicious DNS queries.

Answer

Disable DNS resolution on the IoT device to prevent any external communication.

Question 7

A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?

Accepted Answer

Anyone on the internet can read objects in the bucket if they know the object URL.. The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.

Answer

The data is encrypted at rest, so no exposure risk exists.

Answer

The bucket policy is misconfigured but only affects objects with server-side encryption.

Answer

Only authenticated AWS users can access the bucket, so the risk is limited.

Question 8

During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?

Accepted Answer

Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.. WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.

Answer

Perform a PMKID attack on the WPA3 client to capture the handshake.

Answer

Use a WPS PIN brute-force attack against the WPA3 client.

Answer

Send deauthentication packets to the WPA3 client and capture the reconnection handshake.

Question 9

A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?

Accepted Answer

LoRaWAN. LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.

Answer

4G LTE

Answer

Wi-Fi 6

Answer

Bluetooth 5

Question 10

A security analyst detects multiple failed authentication attempts on a cloud-based SSH server from a single IP address. The analyst implements a rule to block that IP. However, the attacks continue from different IPs. Which additional control should be implemented to reduce the attack surface?

Accepted Answer

Disable password authentication and use SSH key-based authentication.. Disabling password authentication and enforcing SSH key-based authentication eliminates the attack vector of brute-forcing passwords entirely. Since the attacker is using multiple IPs to perform credential stuffing, blocking individual IPs (as done initially) or using tools like fail2ban only treats the symptom, not the root cause. Key-based authentication uses asymmetric cryptography (RSA/ECDSA/Ed25519) and is not susceptible to online guessing attacks, thus permanently reducing the attack surface.

Answer

Install fail2ban to automatically block IPs after failures.

Answer

Implement rate-limiting on SSH connections per IP.

Answer

Change the SSH port to a non-standard port.