CEH Practice Question: Malware, Social Engineering and Network Attacks
A penetration tester successfully predicts the TCP sequence numbers of a target and sends crafted packets to impersonate a trusted host. Which type of attack is this?
⚠ Common exam trap
Many exam-takers confuse the technique (TCP sequence prediction) with the full attack (TCP session hijacking), leading them to select option B instead of C, even though the question explicitly describes the complete act of impersonation and session takeover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP session hijacking
C is correct because the attacker predicts TCP sequence numbers to inject crafted packets, effectively impersonating a trusted host and taking over an established TCP session. This is the defining mechanism of TCP session hijacking, where the attacker spoofs the source IP and uses the predicted sequence numbers to insert malicious data or commands into the ongoing session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning involves sending forged Address Resolution Protocol (ARP) messages over a local area network. This attack manipulates the ARP tables of network devices, linking an attacker's MAC address to the IP address of a legitimate host or gateway. Its primary goal is to redirect traffic for eavesdropping or modification, but it does not directly involve predicting or manipulating TCP sequence numbers to compromise an active session.
- ✗
TCP sequence prediction attack
Why it's wrong here
A TCP sequence prediction attack specifically refers to the act of guessing or calculating the next valid sequence number in an ongoing TCP connection. While this is a critical prerequisite technique for injecting forged packets and is often a component of more complex attacks like session hijacking, it is not the complete attack itself. Merely predicting the sequence number does not equate to taking full control of an established session.
- ✓
TCP session hijacking
Why this is correct
TCP session hijacking is an attack where a malicious actor takes control of an already established TCP session between two legitimate communicating parties. By successfully predicting the next valid TCP sequence number, the attacker can inject their own packets into the data stream, impersonating one of the legitimate hosts. This allows the attacker to send commands, receive data, or terminate the session, effectively seizing control without needing to authenticate.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing, also known as DNS cache poisoning, involves an attacker injecting forged Domain Name System (DNS) records into a DNS resolver's cache. This causes the resolver to return an incorrect IP address for a domain name, typically redirecting users to a malicious website controlled by the attacker. This attack manipulates name resolution services and does not involve the prediction or manipulation of TCP sequence numbers to intercept or take over active network sessions.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.