Certified Ethical Hacker CEH (CEH) — Questions 526–600

Options A, B, and E are correct. CHPSET stands for Cracking passwords, Hiding files, Privilege escalation, Executing applications, Spying, and Erasing tracks.

The presence of a SameSite cookie set to Lax does not prevent CSRF for state-changing requests like password change if the attack uses a GET or POST from a top-level navigation. However, the primary missing mitigation is a CSRF token, which is a unique unpredictable value tied to the session and validated by the server.

Whitelisting allowed domains prevents requests to arbitrary targets. Disabling unused URL schemas (e.g., file://) reduces attack surface. Input validation alone is insufficient.

This is a DNS amplification attack, a type of volumetric DDoS where small queries generate large responses, amplified by the number of resolvers.

Log manipulation (clearing or altering logs) and using steganography (hiding data in plain sight) are common cover-tracks techniques. Deletion of logs is also common, but manipulation is more specific.

The filter 'host 10.0.0.5 and port 80' captures traffic to/from the host on port 80 only. It does not specify direction, so both inbound and outbound HTTP traffic (TCP port 80) from that host is captured.

Port 4444 is commonly associated with Metasploit's default reverse shell payload. The presence of 'cmd.exe /c' and an IP address indicates a backdoor that provides remote command execution, which is a Trojan backdoor or RAT.

The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Without authentication on MQTT, an attacker can publish malicious commands (e.g., change temperature) and subscribe to all topics to eavesdrop on sensor data.

SSRF allows the attacker to make requests from the server, potentially accessing internal services like metadata endpoints (e.g., http://169.254.169.254) that are not publicly accessible.

MAC flooding attacks fill the CAM table to force the switch into hub mode for sniffing.

A backdoor Trojan provides remote access to an attacker, often using encrypted C2 communications. The connections to a C2 domain on port 443 (HTTPS) are indicative of backdoor activity.

Reflected XSS is injected via the current request (e.g., URL parameter) and the script reflects immediately in the response. Stored XSS is saved on the server (e.g., in a database) and executed when other users view the affected page.

The string "cisco" indicates the community string is default or easily guessable. SNMP community strings are used as authentication; public/private defaults are a well-known vulnerability.

Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).

The VRFY command is an SMTP protocol feature (RFC 821) that allows a client to verify whether a specific email address exists on the server. Attackers use VRFY and EXPN to enumerate valid user accounts during the reconnaissance phase. Disabling these commands in the SMTP server configuration directly stops this enumeration technique without affecting legitimate mail delivery.

This is an XML External Entity (XXE) injection attack, where an external entity is defined to read local files.

Nessus is a dedicated vulnerability scanner that automates the process of identifying known vulnerabilities, misconfigurations, and missing patches across a target network. It uses a large plugin database (e.g., NASL scripts) to perform non-intrusive checks against services and operating systems, making it the best tool for a vulnerability scan. Unlike general-purpose tools, Nessus is specifically designed to correlate scan results with CVE entries and provide risk ratings, which is the core requirement of a vulnerability assessment.

A backdoor Trojan allows an attacker to remotely control the infected system. The outbound connections are likely command-and-control traffic over HTTPS to hide from network monitoring.

Ettercap is a well-known tool for ARP poisoning attacks. ARP spoofing involves sending fake ARP replies to associate the attacker's MAC with the gateway's IP.

The comment is stored on the server and executed when other users view the page, which is the definition of stored (persistent) XSS.

SHA-1 produces a 160-bit hash. MD5 produces 128 bits, SHA-256 produces 256 bits, and SHA-512 produces 512 bits.

AES is a symmetric block cipher with a block size of 128 bits and supports key sizes of 128, 192, and 256 bits. It is the most widely used symmetric encryption standard.

The correct tool for cracking a WPA2 PSK from a captured handshake is aircrack-ng, which performs dictionary attacks against the handshake file.

Without specifying a technique, SQLMap defaults to using in-band (UNION) and error-based techniques, which are all in-band.

The Nmap scan output shows port 3389 in a 'filtered' state, which means Nmap received no response or an ICMP unreachable error from the target. This typically indicates a firewall is blocking the probes, preventing Nmap from determining whether the port is actually open or closed. A filtered state does not confirm the port is open or closed, only that access is being obstructed.

Ettercap is a comprehensive tool for ARP poisoning, MITM attacks, session hijacking, and sniffing.

AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.

A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.

Option C is correct because regular security awareness training directly addresses the human factor in phishing attacks. Employees learn to identify suspicious emails, avoid clicking malicious links, and report incidents promptly, which is critical since technical controls alone cannot prevent all phishing attempts. This training reinforces behaviors like verifying sender addresses and not bypassing security protocols, reducing the likelihood of successful social engineering.

Pretexting involves creating a fabricated scenario (pretext) to obtain sensitive information, such as a password. The caller pretends to be IT support to trick the victim.

The command uses Ettercap with ARP poisoning (arp:remote) to perform a man-in-the-middle attack between the gateway (192.168.1.1) and a target host (192.168.1.100). This allows interception and modification of traffic.

LDAP enumeration retrieves directory information, such as user accounts, groups, and other objects from an LDAP server.

Option A is correct because a polymorphic virus changes its decryption routine and code signature each time it infects a new file, making signature-based detection difficult. This mutation is achieved by using a polymorphic engine that generates varied decryption loops while preserving the malicious payload.

Reaver is used to brute force the WPS PIN, recovering the PIN and ultimately the WPA2 PSK.

CSRF tokens are unique, unpredictable values embedded in forms or requests that validate the request originated from the legitimate application, preventing cross-site request forgery attacks.

Disabling the Indexes option in the Directory directive prevents Apache from listing directory contents when no index file exists.

In a TCP SYN flood, the attacker sends many SYN packets with spoofed IPs (or non-responsive IPs) and never completes the handshake, exhausting server resources.

Masscan is designed for high-speed scanning and can send ICMP echo requests across a /16 range (65,536 IPs) in seconds, far faster than Nmap or hping3, while its --ping mode minimizes network load by using stateless packet transmission. This makes it the optimal choice for quickly identifying live hosts on a large private network without overwhelming the network.

Remote File Inclusion (RFI) allows an attacker to include a remote file, often leading to arbitrary code execution if the included file contains PHP or other executable code. The 'file' parameter is used to include a remote resource.

RainbowCrack is the tool specifically designed for generating and using rainbow tables, which are precomputed hash chains used to reverse cryptographic hash functions. The question explicitly asks for the tool most appropriate for generating and using rainbow tables, and RainbowCrack directly supports both creating rainbow tables (with rtgen) and performing lookups (with rcsort and rcrack).

Out-of-band SQLi (option A) is correct because it uses a different channel (e.g., DNS or HTTP requests) to exfiltrate data when the attacker cannot receive direct responses from the database. This technique is effective when the database server can initiate outbound network connections, allowing data to be sent to an attacker-controlled server via DNS queries or HTTP requests.

A worm is a standalone malware that self-replicates and spreads across networks, unlike viruses that require a host file.

The log shows a request attempting to traverse directories using '../' to access a sensitive system file (/etc/passwd), which is directory traversal.

Stored XSS involves malicious script being permanently stored on the server and executed whenever the stored content is accessed. It does not require a crafted link, and it can affect multiple users.

These are standard well-known port assignments as defined by IANA.

Modifying file timestamps (A) is a common anti-forensic technique used to hide the evidence of file creation, modification, or access. Attackers use tools like `touch` on Linux or `SetFileTime` on Windows to alter the MAC (Modify, Access, Change) timestamps, making malicious files appear as legitimate system files. This prevents forensic investigators from identifying when the compromise occurred or which files were altered.

The VRFY command asks the server to verify a username. Attackers can use it to enumerate valid accounts.

A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.

Google hacking (dorking) is a passive reconnaissance technique because it involves using advanced search operators in Google to discover publicly indexed information about a target, such as exposed configuration files or login pages, without sending any packets directly to the target's systems. It relies entirely on the search engine's pre-existing index, making it undetectable and non-intrusive. This aligns with the CEH definition of passive reconnaissance, where no direct interaction with the target occurs.

The `find` command has a `-exec` option that can execute arbitrary commands. With sudo access, the tester can run `sudo find . -exec /bin/sh \;` to obtain a root shell.

Public read access to the bucket and objects is the direct cause. Blocking public access would prevent this.

Whitelisting allowed domains and IP addresses is the most effective SSRF mitigation because it restricts the server from making requests to arbitrary external or internal resources.

The attacker manipulates the X-Forwarded-For header to spoof the client IP, which can lead to SSRF or IP-based access control bypass.

Pretexting and vishing are social engineering. Brute force and SYN flood are technical attacks. Pharming is a DNS attack.

Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning.

AES and 3DES are symmetric algorithms; RSA and ECC are asymmetric; MD5 is a hash function.

enum4linux is a wrapper tool that leverages SMB/CIFS operations (via smbclient, rpcclient, and net) to enumerate user lists, share listings, OS information, and password policies from Windows and Samba targets. It directly queries the SMB protocol (port 445/139) and is a standard tool for SMB enumeration in penetration testing.

Research, craft pretext, choose channel, execute, document.

Option C is correct because outbound traffic on port 4444 from an internal server to a known malicious IP is a classic indicator of a reverse shell connection. A reverse shell is a common post-exploitation technique where an attacker forces the victim server to connect back to their listener, often on high ports like 4444, bypassing inbound firewall rules. The timing after a vulnerability scan strongly suggests that a discovered vulnerability (e.g., command injection, RCE) was exploited to establish this shell.

IPsec setup: Phase 1, Phase 2, traffic selectors, apply policies, test.

The command `enum4linux -a` enumerates SMB shares, users, and password policies from a Windows target. Discovering that the 'backup' account has a blank password directly identifies a weak or missing credential, which falls under the 'Cracking passwords' phase of the CHPSET methodology. This phase involves identifying and exploiting weak, default, or blank passwords to gain unauthorized access.

dnsrecon is a dedicated DNS enumeration tool that performs multiple types of DNS queries (e.g., SRV, MX, SOA, zone transfer attempts) and supports brute-force subdomain discovery. It is specifically designed to gather DNS records and identify misconfigurations, making it a primary tool for DNS enumeration.

Polymorphic viruses mutate their code with each infection to evade signature-based detection, while often keeping the original functionality intact.

Steganography detection often involves statistical analysis of image files to identify anomalies. Advanced persistent threat (APT) detection systems may use machine learning to detect steganographic content.

The correct tool is aircrack-ng, which is specifically designed to crack WPA/WPA2 PSK by performing dictionary attacks on captured handshakes. It is part of the aircrack-ng suite widely used for wireless security auditing.

Option D is correct because the immediate priority is to contain the threat by isolating the compromised server from the network (disconnecting the cable) and blocking the command-and-control IP at the firewall. This stops the ongoing outbound communication on TCP port 8443 and prevents further payload downloads or data exfiltration. Initiating incident response procedures ensures proper forensic collection and analysis, which is critical before any remediation steps like reimaging or deleting artifacts.

Container escape often involves breaking out of the container's isolation by exploiting misconfigurations or vulnerabilities. These indicators are common.

A backdoor Trojan often persists by adding itself to startup registry keys to maintain access. The other options are incorrect: logic bombs activate under specific conditions, adware displays ads, and ransomware typically demands payment.

theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.

S3 bucket public read access, overly permissive IAM roles, and container escape are all cloud misconfiguration exploitation vectors. SQL injection is a web app vulnerability, not cloud-specific. DDoS is an attack type, not a misconfiguration.

The TCP three-way handshake involves SYN, SYN-ACK, ACK. Seeing only SYN packets without ACK responses indicates a SYN flood attack, where the attacker sends many SYN packets without completing the handshake to exhaust server resources.

ScoutSuite is an open-source security auditing tool for cloud environments, including AWS. It checks for misconfigurations across multiple services and provides a detailed report.