Certified Ethical Hacker CEH (CEH) — Questions 1–75

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) is the correct choice because it provides Perfect Forward Secrecy (PFS) by generating unique, ephemeral session keys for each TLS handshake. This means that even if the server's long-term private key is compromised in the future, an attacker cannot decrypt previously recorded sessions. The ephemeral keys are derived using elliptic curve cryptography, offering strong security with smaller key sizes and faster computations compared to traditional Diffie-Hellman, making it ideal for web servers.

RSA is correctly classified as an asymmetric cryptographic algorithm because it utilizes a distinct public key for encryption and a corresponding private key for decryption. This fundamental separation of keys allows for secure communication without prior shared secrets, enabling functions like digital signatures and secure key exchange. Its security relies on the computational difficulty of factoring large prime numbers, making it suitable for establishing secure channels.

This option accurately describes the SSL/TLS Renegotiation DoS vulnerability, where an attacker initiates numerous partial TLS handshakes, specifically requesting renegotiation of the secure channel. Each renegotiation requires significant computational effort from the server, involving cryptographic operations like key exchanges and certificate validations. By repeatedly forcing these resource-intensive operations, an attacker can exhaust the server's CPU and memory, leading to a denial of service for legitimate users.

Google dorking, also known as Google Hacking, involves using advanced search operators (dorks) within search engines like Google to uncover publicly accessible, yet often unintendedly exposed, sensitive information. Operators such as `site:`, `filetype:`, `intitle:`, `inurl:`, and `cache:` allow testers to narrow down searches to specific domains, file types, page titles, URLs, or cached versions, effectively querying the search engine's index for misconfigurations or leaked data. This directly matches the scenario of a tester using a tool that queries via search engine operators.

Parameter tampering involves an attacker manipulating parameters exchanged between a client and server to alter application behavior or data. This can include modifying values in URL query strings, HTTP headers, cookies, or hidden form fields, such as changing a product's price from $100 to $10 before submission. The goal is to bypass authorization, gain unauthorized access, or manipulate transaction details by altering the data the application expects.

Manufacturers frequently ship IoT devices with easily guessable or hardcoded default usernames and passwords (e.g., "admin/admin," "root/password"). Users often fail to change these factory settings, leaving devices highly susceptible to automated brute-force attacks, dictionary attacks, or simple credential stuffing. This vulnerability grants unauthorized access, allowing attackers to control the device, exfiltrate data, or use it as a pivot point for further network compromise.

An amplification attack leverages vulnerable, open UDP services (like DNS, NTP, or Memcached) as reflectors to magnify traffic. Attackers send small, spoofed query packets to these services, with the source IP address set to the victim's IP. The reflector service then responds with a significantly larger response packet, directed at the unsuspecting victim, multiplying the attack traffic volume and overwhelming the target.

Ettercap is specifically designed for ARP poisoning and MITM attacks.

Active OS fingerprinting is the precise technique that involves sending specially crafted packets to a target system and analyzing the responses to infer its operating system. These crafted packets often include unusual TCP flags, specific IP options, or non-standard ICMP requests designed to exploit subtle differences in how various operating systems implement their TCP/IP stacks. The unique replies, or lack thereof, provide distinct clues about the target's OS and version.

The `site:` operator in search engines like Google restricts search results to a specific domain, including all its indexed subdomains. By querying `site:target.com`, an ethical hacker can leverage the vast indexing capabilities of search engines to passively discover publicly accessible subdomains that have been crawled and cataloged. This provides a quick and effective method for initial reconnaissance without directly interacting with the target's servers.

Cross-Site Request Forgery (CSRF) is an attack where an attacker crafts a malicious web page or link that, when clicked or loaded by a victim, forces their browser to send an unauthorized request to a trusted website. This attack leverages the victim's active authenticated session with the target site, causing the site to execute actions as if the user genuinely initiated them. The victim's browser automatically includes session cookies with the forged request, making it appear legitimate to the server, often resulting in state-changing operations like password changes or fund transfers.

SYN cookies are a highly effective defense against SYN flood attacks, which cause a high number of incomplete TCP connections. This mechanism encodes all necessary connection state information into the SYN-ACK sequence number, allowing the server to avoid allocating resources (like Transmission Control Blocks) until the client sends a valid final ACK. By deferring state allocation, the server prevents resource exhaustion from half-open connections, only committing resources for fully established sessions.

Configuring Nessus with a 'safe' scan policy is the most appropriate action because it specifically disables plugins known to be disruptive or potentially harmful to target systems. These plugins often include checks that perform denial-of-service tests, brute-force authentication attempts, or highly resource-intensive operations that could crash services or cause system instability. By avoiding these aggressive checks, the scan can identify vulnerabilities without negatively impacting the availability or performance of critical systems.

A defining characteristic of a polymorphic virus is its ability to alter its internal code structure and encryption key with every new infection. This constant mutation generates a unique code signature for each instance, making it extremely challenging for traditional signature-based antivirus software to detect and identify it consistently across different infected systems or files.

This option correctly interprets the standard SMTP response codes observed during enumeration. A VRFY command returning '252' indicates that the server recognizes the user (e.g., 'root') but cannot verify their status, often implying the account exists but is disabled or restricted. An EXPN command receiving a '250' response confirms the existence of a mailing list or alias (e.g., 'admin') and typically provides its expansion. Conversely, a RCPT TO command resulting in a '550' error explicitly signifies that the specified recipient (e.g., 'unknown@domain.com') does not exist on the server, providing clear non-existence confirmation.

Hashcat is widely recognized as the world's fastest and most versatile password recovery tool, offering extensive support for various attack modes, including highly effective hybrid and rule-based attacks. Its `-a 6` (hybrid wordlist + mask) and `-a 7` (hybrid mask + wordlist) modes directly address hybrid cracking scenarios, while the `-r` option enables sophisticated rule-based modifications to dictionary words. This comprehensive capability makes Hashcat the ideal choice for dynamic, advanced password cracking sessions.

Wi-Fi Protected Setup (WPS) is a feature designed for easy network setup but introduces a significant vulnerability. Its PIN-based authentication mechanism is susceptible to brute-force attacks due to its 8-digit PIN being validated in two halves, effectively reducing the search space. Disabling WPS eliminates this critical attack vector, preventing an attacker from easily discovering the WPA2 pre-shared key (PSK) by exploiting the WPS vulnerability.

Reflected Cross-Site Scripting occurs when a malicious script, typically injected via a URL parameter or form input, is immediately returned by the web server in the HTTP response without proper sanitization. The payload is not stored on the server; instead, it is executed client-side in the victim's browser only when they click a specially crafted link. This non-persistent nature means the attack targets individual users who interact with the malicious URL directly.

The observation of numerous distinct external IP addresses simultaneously establishing connections to a single server process on port 443 strongly indicates a Distributed Denial-of-Service (DDoS) attack. This type of attack aims to overwhelm the target server's resources, such as network bandwidth, CPU, or memory, by flooding it with a high volume of seemingly legitimate connection requests. The distributed nature, originating from multiple sources, makes it difficult to block individual malicious IPs and effectively exhausts the server's capacity to handle legitimate traffic.

Correct. The large responses and random subdomains indicate an amplification attack.

RST/ACK indicates the port is closed.

The -D <decoy1,decoy2,ME,...> flag initiates a decoy scan, which is a powerful evasion technique designed to obscure the true source of the Nmap scan. By sending packets from multiple spoofed IP addresses alongside the real scanner's IP, it makes it significantly harder for Intrusion Detection Systems (IDS) and firewalls to pinpoint the actual origin of the scan activity. This creates a smokescreen, distributing the apparent attack source across numerous hosts and complicating forensic analysis.

Stateful firewalls track connections; a SYN scan sends unsolicited SYN packets that may be dropped, while a connect scan completes the handshake and appears as a normal connection.

A logon.bat script is a specific executable file often configured to run automatically when a user logs onto a domain-joined machine. These scripts are frequently used to map network drives, configure printers, or execute other setup tasks, and unfortunately, they sometimes contain hardcoded usernames and passwords for network resources. An attacker gaining access to this script can directly read these embedded credentials, making it a prime target for credential harvesting and subsequent lateral movement within the network.

The `wevtutil cl` command is the correct and primary method for clearing the contents of a designated Windows event log from the command line. When executed with a log name, such as `wevtutil cl System`, it effectively purges all recorded events from that specific log. This action is a common anti-forensics technique used by attackers to remove evidence of their activities and hinder incident response efforts.

DOM-based Cross-Site Scripting (XSS) arises when a web application's client-side script processes user-controllable data from the Document Object Model (DOM) unsafely, without sending it back to the server. The vulnerability occurs entirely within the browser, where malicious input directly modifies the DOM environment via JavaScript, leading to script execution. This typically involves a "source" like document.URL and a "sink" like eval() or innerHTML, making it a client-side vulnerability that doesn't necessarily involve server-side reflection.

The `netstat` output clearly displays multiple established connections to port 3389, which is the standard port for Remote Desktop Protocol (RDP). The presence of numerous distinct remote IP addresses successfully establishing connections to this service strongly indicates a successful RDP brute-force attack. Each established connection signifies a successful login session, suggesting that attackers have either found valid credentials for multiple accounts or repeatedly logged in with compromised credentials.

The `intitle:"index of"` Google dork specifically targets web server directory listings that lack proper configuration to prevent browsing. When combined with keywords like `(backup|bak|old|temp)` (implied by the context of sensitive files), it effectively filters for directories likely containing sensitive, unindexed files such as database backups, configuration files, or temporary data. This technique is a highly effective reconnaissance method for uncovering misconfigurations that expose critical information.

The VRFY (Verify) and EXPN (Expand) commands are specifically designed to query an SMTP server about the existence of a user or the members of a mailing list, respectively, often revealing valid account names. Additionally, the RCPT TO (Recipient To) command, while primarily for specifying a mail recipient, can be leveraged for enumeration by observing the server's response: a '250 OK' or similar success code indicates a valid user, whereas a '550 No such user' or '551 User not local' signifies an invalid one. These three commands collectively provide robust methods for identifying valid user accounts on an SMTP server.

Local File Inclusion (LFI) occurs when a web application incorporates a local file into its output or execution flow based on user-supplied input without adequate validation. An attacker can manipulate parameters to point to arbitrary files on the server's filesystem, such as `/etc/passwd` or application log files. This vulnerability allows for sensitive data disclosure, and in some cases, can be escalated to remote code execution by including log files poisoned with malicious code.

An attacker attempting an Insecure Direct Object Reference (IDOR) attack specifically targets applications that expose direct references to internal implementation objects. For instance, if a URL directly uses sequential database IDs like "/profile?id=123", an attacker can easily modify "id=123" to "id=124" to attempt access to another user's profile. This direct exposure provides the attacker with a clear pathway to manipulate object identifiers, which is a fundamental prerequisite for exploiting IDOR vulnerabilities.

SUID (Set User ID) bit abuse is a common Unix/Linux privilege escalation method. When the SUID bit is set on an executable file, it runs with the permissions of the file owner, rather than the user executing it. If a program owned by root has the SUID bit set and can be manipulated (e.g., through arguments or environment variables) to execute arbitrary commands, a low-privileged user can leverage this to execute commands as root, thereby escalating privileges.

The `dnsenum enum exampl` command, specifically utilizing the `enum` option, instructs the `dnsenum` tool to perform a comprehensive DNS reconnaissance. This process primarily involves attempting a zone transfer (AXFR) from the target DNS server, which, if successful due to misconfiguration, can reveal all DNS records for the domain. Following this, `dnsenum` proceeds to brute-force subdomains by iterating through a built-in or user-provided wordlist, querying for A records to discover additional hosts within the domain.

WPA3 with SAE (Simultaneous Authentication of Equals) is the most secure Wi-Fi standard, offering significant improvements over its predecessors. SAE provides a more robust key establishment protocol that protects against offline dictionary attacks and ensures forward secrecy, meaning past session keys cannot be compromised even if the master key is later discovered. Furthermore, WPA3 enhances security for public networks through Opportunistic Wireless Encryption (OWE), providing individualized data encryption.

macof is specifically designed for MAC flooding.

Hashcat leverages GPU for high-speed cracking of NTLM hashes.

Shodan functions as a specialized search engine that continuously scans the entire internet, indexing information derived from service banners, metadata, and open ports of various internet-connected devices. Unlike traditional web search engines, Shodan focuses on machine-readable data, enabling users to discover a vast array of devices, including industrial control systems, webcams, routers, and IoT devices, based on specific criteria like manufacturer, location, or exposed service. This unique capability makes it an indispensable tool for security researchers and penetration testers to identify vulnerable or misconfigured systems globally.

The command `smbclient -L 192.168.1.30 -N` explicitly attempts to perform a null session enumeration, meaning it tries to list shares without providing any credentials. If this command successfully returns a list of shares, it confirms that the target system permits unauthenticated access for information gathering. This vulnerability allows an attacker to discover available network resources, user accounts, and group information, which is crucial for subsequent attack phases.

The -f flag is the primary Nmap option used for IP fragmentation. When enabled, Nmap splits the IP header and the TCP/UDP header into several smaller IP packets, typically into 8-byte fragments. This technique can be highly effective in bypassing stateless firewalls or intrusion detection systems (IDS) that are not configured to reassemble fragmented packets before inspection, as they may only see the initial fragment and miss critical information in subsequent ones.

The scenario explicitly states the use of "default credentials," which are easily guessable or publicly known, allowing unauthorized access to the IoT device or its MQTT broker. Furthermore, the absence of any mention of TLS/SSL for the MQTT protocol implies that communication occurs in "cleartext." This means all transmitted data, including sensitive information and authentication tokens, is unencrypted and can be easily intercepted and read by an attacker using packet sniffing tools.

WPA3 (Wi-Fi Protected Access 3) is the latest and most robust security standard for wireless networks, offering significant enhancements over its predecessors. It introduces Simultaneous Authentication of Equals (SAE) as a more secure key exchange protocol, replacing the vulnerable Pre-Shared Key (PSK) exchange in WPA2 and providing stronger protection against dictionary attacks. WPA3 also enhances privacy in open networks with Opportunistic Wireless Encryption (OWE) and ensures forward secrecy, making it the recommended choice for maximum security and resilience against evolving threats.

TTL can indicate OS type passively.

Worms are self-propagating malware that actively seek out and infect new hosts across a network without user interaction. Their propagation mechanisms frequently involve scanning IP ranges or performing numerous DNS lookups to discover vulnerable machines or services. High-volume DNS queries, especially for non-existent domains, are a classic indicator of a worm actively attempting to resolve hostnames or discover new targets during its infection cycle.

Spear phishing involves crafting highly personalized email attacks directed at a specific individual, group, or role within an organization, leveraging known information about the target to increase credibility. The attacker often impersonates a trusted entity, such as a CEO, to manipulate the recipient into performing a desired action, like clicking a malicious link. In this case, the email is specifically tailored and sent to a penetration tester, impersonating the CEO, which precisely fits the definition of a spear phishing attempt due to its targeted nature and social engineering tactics.

SNMPwalk is the quintessential utility for performing SNMP enumeration by systematically querying a target device's Management Information Base (MIB) tree. It operates by sending a sequence of SNMP GETNEXT requests, effectively 'walking' through the MIB and retrieving all available object identifiers (OIDs) and their corresponding values. This process allows security professionals to gather extensive system information, network interface details, and running process data from SNMP-enabled devices, making it the correct tool for this specific task.

The smbclient -L command, when executed without explicit credentials, attempts to establish an anonymous or "null" session with the target SMB server. Modern Windows operating systems, starting with Windows XP SP2, disable null sessions by default as a security measure. Consequently, if null sessions are disabled, the server will reject this unauthenticated connection attempt, preventing the enumeration of shares and resulting in an empty or access denied response from smbclient.

Credential stuffing is a highly effective attack where attackers take large lists of username and password pairs, typically obtained from data breaches on one web service, and automatically attempt to use these same credentials to log into other, unrelated web applications. This attack exploits the widespread user practice of reusing the same login credentials across multiple online platforms. Success hinges on the assumption that users will recycle their compromised passwords on new targets.

Smurf uses ICMP echo requests to broadcast address with spoofed source, causing amplification.

Ettercap supports ARP poisoning, DNS spoofing, and other MITM techniques.

Directory traversal, also known as path traversal, is an attack that exploits insufficient security validation of user-supplied file paths. By injecting special sequences like `../` (dot-dot-slash) or its URL-encoded equivalent, an attacker can navigate outside the intended directory structure, allowing them to access or read arbitrary files and directories on the server's file system that would otherwise be restricted.

A mantrap is a highly effective physical security control consisting of a small vestibule with two interlocking doors. It is designed to ensure that only one person can pass through at a time; the first door must close and lock before the second door can open. This sequential operation physically prevents tailgating by isolating individuals and enforcing single-person occupancy per access cycle.

Anti-CSRF tokens are unique, unpredictable, and secret values generated by the server and embedded into forms or request headers. When a user submits a form or makes an AJAX request, the browser sends this token along with the request. The server then validates this token against the one stored in the user's session. If the tokens do not match, the request is rejected, effectively ensuring that the request originated from the legitimate application and not from a malicious third-party site.

Directory listing, when enabled, exposes the file and directory structure of the web server, allowing an attacker to browse its contents. If an attacker has successfully uploaded a web shell through a separate vulnerability (e.g., insecure file upload), directory listing allows them to precisely locate the shell's path and filename. Once the shell's URL is known, the attacker can directly access it via a web browser, enabling remote execution of arbitrary commands on the compromised server, thus achieving remote code execution.

An application that includes a parameter, such as 'url=' or 'resource=', which the server then uses to fetch content from a user-supplied remote address, is a classic indicator of a Server-Side Request Forgery (SSRF) vulnerability. This allows an attacker to manipulate the server into making requests to arbitrary internal or external network resources on their behalf. Such a mechanism enables the server to act as a proxy, potentially accessing internal systems, cloud metadata APIs, or bypassing firewall rules that would otherwise block direct access from the attacker.

The -sI flag correctly specifies an idle scan, which is a highly stealthy port scanning technique. This method leverages a "zombie" host's predictable IP ID sequence to infer open ports on a target without sending any packets directly from the attacker's machine to the target. By observing changes in the zombie's IP ID after it receives a forged packet from the target, the attacker can deduce the target's port status, effectively making the zombie perform the scan indirectly.

Burp Suite is a comprehensive, integrated platform specifically designed for performing security testing of web applications. It functions as an intercepting proxy, allowing testers to capture, analyze, and manipulate all HTTP/S traffic between a browser and a web server. Beyond proxying, it includes a powerful scanner for automated vulnerability detection, an intruder for custom brute-forcing and fuzzing, and a repeater for manual request modification and re-sending, making it indispensable for both automated and manual web application penetration testing.

aircrack-ng is designed to crack WEP and WPA/WPA2 PSK from captured handshake files.

Masscan is explicitly designed as an internet-scale port scanner, capable of scanning the entire internet in under six minutes. Its unparalleled speed stems from its asynchronous, stateless design, which sends SYN packets at an extremely high rate without maintaining a full TCP connection state for each probe. By prioritizing raw packet transmission speed over traditional connection establishment, Masscan can efficiently scan all 65535 TCP ports on a target network significantly faster than other tools, making it ideal for rapid, broad-spectrum port discovery.

Using Google dorking involves leveraging advanced search operators to query Google's pre-existing index for publicly available information about a target, such as exposed documents or misconfigured servers. The interaction occurs solely with Google's search engine, not directly with the target's systems. This method is passive because it relies on information already indexed by a third party, leaving no direct trace on the target's network.

The ability to upload a file with a filename containing path traversal sequences (e.g., `../../`) directly exploits a directory traversal vulnerability, allowing the attacker to write the file to an arbitrary location outside the intended upload directory. Concurrently, the successful upload of a PHP file, which is a server-side script, indicates an unrestricted file upload vulnerability. This means the application lacks proper validation to prevent dangerous file types from being uploaded, enabling potential remote code execution.

This option is correct because Insecure Direct Object Reference (IDOR) vulnerabilities occur when an application exposes a direct reference to an internal object, such as a user_id parameter, and fails to implement proper authorization checks. By simply changing the value of the user_id parameter in the request, the attacker can directly access another user's profile without explicit authorization, exploiting the application's trust in the provided identifier without verifying the user's permissions for that specific resource. This directly matches the scenario.

A Slowloris attack is a sophisticated application-layer denial-of-service (DoS) technique that targets web servers by holding open as many connections as possible for as long as possible. It achieves this by sending partial HTTP requests, such as incomplete headers, and then periodically sending small, non-essential data to keep the connection alive. This strategy exhausts the server's limited connection pool, preventing new, legitimate connections from being established and effectively denying service to other users.

A worm is a standalone malicious program specifically designed to self-replicate and spread across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to propagate autonomously, often consuming network bandwidth or system resources. Their defining characteristic is their ability to duplicate themselves and spread independently to other systems, making them highly effective at rapid dissemination.

A backdoor is specifically designed to bypass normal authentication and security mechanisms, providing an attacker with covert and persistent remote access to a compromised system. This unauthorized access allows for full control, including command execution, file manipulation, and further exploitation, directly enabling the attacker to 'gain access' and maintain control over the system.

Reflected XSS, also known as Non-Persistent XSS, occurs when a malicious script, typically embedded within a URL parameter or form input, is immediately processed and "reflected" back in the server's HTTP response to the user's browser without proper sanitization. This attack requires the victim to click a specially crafted link containing the payload, which then executes in their browser for that single request. The payload is not persistently stored on the server, making it a one-time execution per interaction.

Reflected XSS occurs when a malicious script embedded in an HTTP request (e.g., a URL parameter or form field) is immediately echoed back in the server's HTTP response without proper sanitization. The victim's browser then executes this script upon rendering the page, but the payload itself is not stored on the server for future use or delivery to other users. This type of attack typically requires an attacker to trick a victim into clicking a specially crafted malicious link that contains the payload.

An evil twin attack specifically involves an attacker setting up a rogue wireless access point that mimics the SSID and often the MAC address of a legitimate, trusted network. The objective is to trick unsuspecting users into connecting to this malicious AP, allowing the attacker to intercept all their network traffic, perform man-in-the-middle attacks, or phish credentials. This direct impersonation of a legitimate Wi-Fi network by creating a fake AP with the same SSID is precisely what the question describes.

Slowloris sends slow partial HTTP headers to keep connections open.

Without TLS encryption, all MQTT communications are transmitted in plaintext over the network. By subscribing to the '#' wildcard topic, an attacker can receive every message published to the broker, effectively eavesdropping on all traffic. This allows the interception of sensitive data, operational commands, and device states, as the unencrypted protocol provides no confidentiality protection against network sniffers or malicious subscribers.

A fundamental characteristic of a polymorphic virus is its ability to alter its executable code, or "signature," with each new infection or replication. This constant mutation makes it extremely difficult for traditional signature-based antivirus software to detect and identify the virus, as its binary pattern is never the same. The core malicious functionality remains intact, but its outward appearance changes, effectively evading static detection methods.

Correct. The PTK used to decrypt unicast WPA2 traffic is derived from the PMK, the AP/client MAC addresses, and the ANonce and SNonce. These nonce values are obtained from the captured handshake.

SET is the Social Engineering Toolkit, designed for automating social engineering attacks.

A rogue access point (AP) can be configured to mimic the legitimate network's SSID but broadcast a weaker security protocol like WPA2. Many WPA3-capable clients are configured to prefer WPA3 but will fall back to WPA2 if WPA3 is unavailable or if a stronger WPA2 signal appears more legitimate. By deauthenticating the client from the real WPA3 AP, the rogue WPA2 AP can entice the client to connect, effectively downgrading its security and allowing for WPA2-specific attacks.

Correct. A SYN flood sends many SYN packets with no final ACK, overwhelming the target.