CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst runs a vulnerability scan with Nessus and receives a report indicating that multiple hosts have the 'MS17-010' vulnerability. What is the MOST likely impact of this vulnerability if exploited?
⚠ Common exam trap
Candidates often confuse MS17-010 with a general network vulnerability, but the CEH exam specifically tests that it is a remote code execution flaw in Windows SMB, not a web or DNS attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote code execution on Windows systems
MS17-010 is a critical remote code execution vulnerability in the Microsoft Server Message Block (SMB) protocol. Exploitation allows an unauthenticated attacker to send specially crafted packets to an SMB server, enabling arbitrary code execution with system privileges. This is the same vulnerability leveraged by the EternalBlue exploit used in the WannaCry ransomware attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remote code execution on Windows systems
Why this is correct
Nessus scans are highly effective at identifying critical operating system vulnerabilities, such as the MS17-010 vulnerability, famously known as EternalBlue. This flaw in the Server Message Block (SMB) protocol allows unauthenticated remote code execution on vulnerable Windows systems. A successful scan would flag this specific vulnerability, indicating a severe risk of compromise and potential for widespread malware infection like WannaCry or NotPetya, making it the most relevant finding.
- ✗
SQL injection
Why it's wrong here
SQL injection is a common web application vulnerability where malicious SQL code is inserted into input fields to manipulate database queries. While Nessus can identify some web application vulnerabilities, its primary strength lies in network and operating system-level scanning, and SQL injection is fundamentally distinct from an SMB protocol flaw like MS17-010. This type of attack targets the application layer's interaction with a database, not the underlying OS services directly.
- ✗
Cross-site scripting
Why it's wrong here
Cross-site scripting (XSS) is a client-side code injection vulnerability typically found in web applications, allowing attackers to inject malicious scripts into web pages viewed by other users. These scripts execute within the victim's browser, often leading to session hijacking or defacement, but do not directly provide remote code execution on the underlying server's operating system. XSS is fundamentally different from a server-side SMB vulnerability that grants system-level access.
- ✗
DNS cache poisoning
Why it's wrong here
DNS cache poisoning involves injecting forged DNS data into a resolver's cache, redirecting users to malicious websites instead of legitimate ones. This network infrastructure attack manipulates name resolution services rather than exploiting vulnerabilities within an operating system's core services like SMB. Therefore, it is entirely unrelated to a remote code execution vulnerability on a Windows system, which directly targets the host's integrity.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.