CCNA Network and Web Application Attacks Questions

MCQhard

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

A.Directory traversal

B.Parameter tampering

C.Cross-Site Scripting (XSS)

D.Cross-Site Request Forgery (CSRF)

AnswerB

Parameter tampering involves an attacker manipulating parameters exchanged between a client and server to alter application behavior or data. This can include modifying values in URL query strings, HTTP headers, cookies, or hidden form fields, such as changing a product's price from $100 to $10 before submission. The goal is to bypass authorization, gain unauthorized access, or manipulate transaction details by altering the data the application expects.

Why this answer

Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.

Exam trap

The trap here is that candidates often confuse parameter tampering with CSRF, but CSRF does not allow modifying the request body; it only reuses existing parameters from a forged request, whereas parameter tampering directly alters the parameter value.

How to eliminate wrong answers

Option A is wrong because directory traversal targets file system paths (e.g., ../../../etc/passwd) to access unauthorized files, not form field values. Option C is wrong because Cross-Site Scripting (XSS) injects malicious scripts into web pages to steal cookies or execute client-side code, not to modify form data during submission. Option D is wrong because Cross-Site Request Forgery (CSRF) forces a user to perform unintended actions on a trusted site using their session, but it does not allow the attacker to directly alter the price value in the request; it only replays existing parameters.

Practice this question →

MCQhard

Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?

A.Distributed denial-of-service (DDoS) attack

B.SSL/TLS renegotiation DoS

C.Slowloris attack

D.Man-in-the-middle attack

AnswerA

The observation of numerous distinct external IP addresses simultaneously establishing connections to a single server process on port 443 strongly indicates a Distributed Denial-of-Service (DDoS) attack. This type of attack aims to overwhelm the target server's resources, such as network bandwidth, CPU, or memory, by flooding it with a high volume of seemingly legitimate connection requests. The distributed nature, originating from multiple sources, makes it difficult to block individual malicious IPs and effectively exhausts the server's capacity to handle legitimate traffic.

Why this answer

Multiple ESTABLISHED connections on port 443 (HTTPS) from different external IPs to the same process ID indicate a distributed denial-of-service (DDoS) attack. In a DDoS, many compromised hosts (botnet) simultaneously establish legitimate TCP handshakes and maintain connections to exhaust server resources, such as connection slots or memory, at the application layer. The key clue is the diversity of source IPs targeting a single process, which is characteristic of a coordinated flood from many distinct sources.

Exam trap

In EC-CEH, the distinction between a DDoS (multiple source IPs) and a DoS (single source IP) is critical. Candidates may confuse a DDoS with a Slowloris attack because both involve many connections, but Slowloris uses incomplete requests from few sources, not fully ESTABLISHED connections from many IPs.

How to eliminate wrong answers

Option B is wrong because an SSL/TLS renegotiation DoS attack exploits repeated renegotiation of SSL/TLS handshakes within a single connection, not multiple ESTABLISHED connections from different IPs; it would show high CPU usage on the server with few connections. Option C is wrong because a Slowloris attack sends partial HTTP headers slowly to keep many connections open, but it typically uses a single source IP (or few IPs) and targets HTTP (port 80) or HTTPS (port 443) with incomplete requests, not fully ESTABLISHED TCP connections. Option D is wrong because a man-in-the-middle attack intercepts and potentially modifies traffic between two parties, but it does not inherently cause multiple ESTABLISHED connections from different external IPs to the same process; it would involve a single interposed connection or ARP spoofing, not a flood of distinct sources.

Practice this question →

MCQhard

Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?

A.SQL injection in SOAP service

B.XML External Entity (XXE) injection

C.Cross-site scripting (XSS)

D.Command injection

AnswerA

The exhibit demonstrates SQL injection in a SOAP service, as the `userId` parameter in the request contains the payload '1 OR 1=1'. This classic SQL injection technique manipulates the backend SQL query, causing the `WHERE` clause to always evaluate to true. Consequently, the application returns all user records, bypassing intended access controls and confirming the vulnerability.

Why this answer

The SOAP service returns multiple user records in response to a crafted request, indicating that the input is being interpolated into a database query without proper sanitization. This is classic SQL injection (SQLi) in a SOAP XML context, where an attacker can embed SQL payloads within XML elements (e.g., <username>admin' OR '1'='1</username>) to manipulate the backend SQL query and retrieve all records.

Exam trap

EC-Council exams often test the distinction between XML-specific attacks (XXE) and injection attacks that target the underlying data layer (SQLi), so candidates mistakenly choose XXE when they see XML input, even though the symptom (multiple records returned) points to database manipulation, not file disclosure.

How to eliminate wrong answers

Option B (XXE) is wrong because XXE exploits XML parser behavior to read local files or perform SSRF, not to manipulate database queries to return multiple user records. Option C (XSS) is wrong because XSS injects client-side scripts into web pages viewed by other users, not into server-side SOAP processing to alter database results. Option D (Command injection) is wrong because it involves injecting OS commands into server-side functions (e.g., via system() calls), not manipulating SQL queries through SOAP XML payloads.

Practice this question →

MCQeasy

You are a security analyst for a medium-sized e-commerce company. The company hosts its web application on a single server running Apache on Ubuntu. Recently, the operations team noticed that the server's CPU usage spikes to 100% every few minutes, causing the website to become unresponsive. They have ruled out hardware issues. The web server logs show repeated requests to the same URL with varying parameters, such as /product?id=1, /product?id=2, etc., all originating from a single IP address. Each request returns a 200 OK response, but the server takes several seconds to generate the page. The application uses a relational database backend with an ORM. You suspect an attack is occurring. What is the most likely attack and the best immediate course of action?

A.Implement rate limiting on the /product endpoint

B.Block the IP address of the attacker at the firewall

C.Install a web application firewall (WAF) to detect and block malicious requests

D.Apply input validation to ensure product IDs are positive integers

AnswerB

Blocking the attacker's IP address directly at the firewall provides the most immediate and effective containment for an ongoing resource exhaustion attack originating from a single source. A firewall operates at the network layer, allowing it to drop all packets from the specified IP address before they even reach the web server or application. This action instantly severs the attacker's connection and prevents any further malicious requests from impacting the application's availability, making it the optimal immediate response.

Why this answer

The attack is a resource exhaustion or application-layer DoS attack, where repeated requests to a database-backed endpoint (e.g., /product?id=1, /product?id=2) cause high CPU usage due to expensive ORM queries. The immediate best course is to block the single attacking IP at the firewall, as it stops the malicious traffic at the network perimeter with minimal overhead, preserving server resources for legitimate users.

Exam trap

EC-Council often tests the distinction between immediate containment (blocking the IP) and long-term hardening (WAF, rate limiting, input validation), and the trap here is that candidates choose a more 'secure' but slower solution like a WAF or input validation, missing the urgency of stopping the active attack first.

How to eliminate wrong answers

Option A is wrong because rate limiting on the /product endpoint would still allow the attacker to consume resources before being throttled, and it does not address the immediate CPU spike; it is a longer-term mitigation. Option C is wrong because installing a WAF is a proactive measure that requires configuration and tuning, not an immediate action to stop an ongoing attack; it also may not block a simple repeated-request pattern without specific rules. Option D is wrong because input validation to ensure product IDs are positive integers would not prevent the attack—the requests already use valid positive integers (1, 2, etc.)—and the issue is the volume of requests, not the parameter values.

Practice this question →

MCQhard

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

A.Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.

B.Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.

C.Increase the number of application servers to handle the load.

D.Run a SQL injection scanner on the application.

AnswerB

Analyzing reverse proxy logs (e.g., NGINX, HAProxy) is crucial because they capture detailed information about incoming HTTP/HTTPS requests, including source IPs, user agents, request methods, and target URLs/API endpoints. Identifying a sudden, high volume of requests directed at a specific API endpoint, especially with diverse source IPs or suspicious user agents, strongly indicates a Layer 7 (application-layer) DDoS attack. This diagnostic step directly confirms the attack type and pinpoints the targeted service, enabling highly focused and effective countermeasures.

Why this answer

The symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.

Exam trap

The trap here is that candidates often jump to blocking IPs (Option A) or scaling horizontally (Option C) as immediate fixes, but the CEH exam emphasizes first confirming the attack vector through log analysis rather than taking reactive or misdirected actions.

How to eliminate wrong answers

Option A is wrong because blocking IPs from logs without analyzing request patterns may block legitimate users behind NAT or proxies, and it does not confirm the attack type—it's a reactive measure that could worsen outages. Option C is wrong because increasing servers treats the symptom (high CPU) without confirming the attack; it may be ineffective if the attack is a slow-rate DDoS or application-layer flaw, and it doesn't help identify the root cause. Option D is wrong because SQL injection scanners test for injection vulnerabilities, but the symptoms (503 errors, high CPU, no code changes) point to a volumetric or resource-exhaustion attack, not a database injection.

Practice this question →

MCQmedium

A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?

A.SNMP

B.FTP

C.HTTPS

D.HTTP

AnswerC

Hypertext Transfer Protocol Secure (HTTPS) is the secure version of HTTP, utilizing Transport Layer Security (TLS), or its deprecated predecessor SSL, to encrypt communication between a web browser and a server. This encryption protects the confidentiality and integrity of data exchanged, including sensitive information like login credentials, financial transactions, and personal data, by preventing unauthorized eavesdropping and tampering. HTTPS ensures that an attacker cannot easily intercept and read the web traffic, thereby securing user interactions and preventing data compromise.

Why this answer

HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.

Exam trap

The trap here is that candidates often confuse encryption with authentication or assume that any protocol with 'secure' in its name (like SNMPv3) is suitable for web traffic, when the question specifically requires a protocol that encrypts client-to-web-server communication — only HTTPS directly fulfills that role.

How to eliminate wrong answers

Option A is wrong because SNMP (Simple Network Management Protocol) is used for managing and monitoring network devices, not for encrypting web traffic; its default versions (v1/v2c) send community strings in plaintext, and even SNMPv3 with encryption is irrelevant to client-server web communication. Option B is wrong because FTP (File Transfer Protocol) transmits data and credentials in cleartext, making it vulnerable to sniffing; it does not encrypt web traffic and is designed for file transfers, not web browsing. Option D is wrong because HTTP transmits data in plaintext, allowing any network sniffer to capture the entire request/response payload, including sensitive information like passwords and session tokens.

Practice this question →

MCQmedium

Refer to the exhibit. A penetration tester observes that the DNS server returns both internal (10.0.0.0/8) and external (203.0.113.5) IP addresses for the same domain. What is this technique called?

A.DNS cache poisoning

B.Split DNS misconfiguration

C.DNS rebinding

D.DNS zone transfer

AnswerB

Split DNS, or Split-Horizon DNS, is designed to provide different DNS responses based on the client's network location, typically serving internal IP addresses to internal users and external IP addresses to external users for the same hostname. A misconfiguration occurs when the DNS server fails to properly differentiate client origins, or is configured to return both internal and external records simultaneously in a single response, thereby exposing internal network topology or causing connectivity issues.

Practice this question →

MCQmedium

Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?

A.Cross-Site Request Forgery (CSRF)

B.SQL Injection

C.Reflected Cross-Site Scripting (XSS)

D.Directory Traversal

AnswerC

Reflected Cross-Site Scripting (XSS) occurs when a malicious script, often embedded within a URL parameter or form input, is immediately and unsafely echoed back in the web server's HTTP response. The victim's browser then interprets and executes this injected script as part of the legitimate webpage content. The exhibit clearly shows user input containing script tags being directly reflected into the HTML response without proper sanitization, leading to client-side script execution, which is the hallmark of a reflected XSS vulnerability.

Why this answer

The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=<script>alert('XSS')</script>` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.

Exam trap

EC-Council often tests the distinction between reflected XSS and stored XSS, but the trap here is confusing reflected XSS with CSRF because both involve crafted URLs, but CSRF does not execute JavaScript in the response—it forges a state-changing request using the victim's session.

How to eliminate wrong answers

Option A is wrong because Cross-Site Request Forgery (CSRF) requires a forged request that changes state (e.g., a POST to transfer funds) and relies on the victim's authenticated session, not on reflected script execution in the response body. Option B is wrong because SQL Injection involves manipulating SQL queries via input fields (e.g., `' OR 1=1--`), but the exhibited payload is a JavaScript alert, not a SQL syntax-breaking string, and the response shows no database error or data leakage. Option D is wrong because Directory Traversal exploits path traversal sequences (e.g., `../etc/passwd`) to access files outside the web root, but the request parameter is `search` and the response contains HTML with the injected script, not file contents or directory listings.

Practice this question →

MCQhard

Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?

A.The attacker extracted hashed passwords that can be cracked offline

B.The attacker successfully performed a blind SQL injection to enumerate the database structure

C.The attacker caused a denial of service by sending an invalid query

D.The attacker modified the database records to update user passwords

AnswerA

The exhibit clearly shows the successful execution of a UNION SELECT SQL injection query, resulting in the direct retrieval of sensitive user data, specifically username and corresponding password hash pairs. These extracted hashes, likely MD5 given their typical format in such vulnerabilities, are highly susceptible to offline cracking techniques like dictionary attacks or rainbow tables. Once cracked, these plaintext passwords can then be used for further unauthorized access or credential stuffing attacks against other services.

Why this answer

The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.

Exam trap

EC-Council often tests the distinction between in-band (error-based/UNION) SQL injection, which returns data directly, and blind SQL injection, which does not return visible data; candidates mistakenly choose blind when the response clearly shows extracted values.

How to eliminate wrong answers

Option B is wrong because blind SQL injection does not return visible data in the response; it relies on true/false or time-based inferences, whereas the exhibit shows actual hash values. Option C is wrong because a denial of service would result in an error, timeout, or empty response, not a structured output containing hashes. Option D is wrong because modifying database records (e.g., UPDATE statements) would not return the existing password hashes in the response; the attacker would see confirmation of modification or no data at all.

Practice this question →

MCQmedium

During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?

A.SQL Injection

B.Cross-Site Request Forgery (CSRF)

C.Cross-Site Scripting (XSS)

D.Command Injection

AnswerC

Cross-Site Scripting (XSS) occurs when a web application incorporates untrusted data into a web page without proper validation or encoding, allowing attackers to inject client-side scripts. In the case of reflected XSS, the malicious script is immediately returned by the web server in its response and executed by the user's browser, directly impacting the content displayed to the user. This vulnerability directly manifests as unsanitized input being rendered in the browser.

Why this answer

The scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.

Exam trap

EC-Council often tests the distinction between reflected XSS and stored XSS; the trap here is that candidates may assume any unsanitized input is SQL injection, but the key clue is direct display in the browser without server-side processing like database queries or command execution.

How to eliminate wrong answers

Option A is wrong because SQL Injection requires the user input to be included in a database query, not simply displayed in the browser; the scenario does not mention any database interaction. Option B is wrong because Cross-Site Request Forgery (CSRF) exploits the trust a site has in a user's browser to perform unauthorized actions, but it does not involve displaying unsanitized user input directly; it requires a forged request, not reflected output. Option D is wrong because Command Injection requires the input to be passed to a system shell or command interpreter, not merely rendered in HTML; the scenario lacks any indication of server-side command execution.

Practice this question →

MCQhard

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

A.UDP flood

B.SYN flood

C.ARP spoofing

D.ICMP flood

AnswerB

SYN flood sends many SYN packets without completing handshake.

Why this answer

A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.

Exam trap

EC-Council often tests the distinction between a SYN flood and a UDP flood, where candidates mistakenly choose UDP flood because they associate 'flood' with any high-volume attack, but the key clue is the incomplete TCP three-way handshake, which is specific to SYN floods.

How to eliminate wrong answers

Option A (UDP flood) is wrong because a UDP flood targets UDP ports with a high volume of datagrams, not TCP handshake packets, and would not produce incomplete TCP three-way handshakes. Option C (ARP spoofing) is wrong because ARP spoofing operates at Layer 2 by poisoning ARP caches to intercept traffic on a local network, not by sending incomplete TCP handshakes from an external IP. Option D (ICMP flood) is wrong because an ICMP flood uses ICMP echo request packets (pings) to overwhelm a target, not TCP SYN packets, and would not result in incomplete TCP handshakes.

Practice this question →

MCQmedium

Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?

A.CVE-2021-41773 (Apache Path Traversal)

B.CVE-2017-5638 (Struts2 RCE)

C.CVE-2014-0160 (Heartbleed)

D.CVE-2020-1472 (Zerologon)

AnswerA

This is the correct vulnerability because Apache HTTP Server version 2.4.49, as implied by the Nmap scan, is specifically susceptible to CVE-2021-41773. This critical path traversal vulnerability allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure or, under certain configurations (e.g., if mod_cgi is enabled), remote code execution. The Nmap scan likely identified the precise Apache version, directly correlating it to this known flaw.

Why this answer

The exhibit shows Apache HTTP Server on port 80, which is vulnerable to CVE-2021-41773, a path traversal and file disclosure flaw in Apache HTTP Server 2.4.49. This vulnerability allows an attacker to use a specially crafted URL to traverse directories outside the document root, potentially reading sensitive files like /etc/passwd or executing arbitrary code if CGI scripts are enabled. The presence of Apache on port 80 directly aligns with this vulnerability, making it the most likely to be successfully exploited.

Exam trap

EC-CEH often tests the ability to match a specific service (e.g., Apache HTTP on port 80) with its corresponding CVE, rather than assuming a generic web vulnerability, so candidates may incorrectly choose Heartbleed (port 443) or Struts2 (Java framework) without verifying the service type.

How to eliminate wrong answers

Option B is wrong because CVE-2017-5638 (Struts2 RCE) targets Apache Struts2, a Java-based web application framework, not the Apache HTTP Server shown on port 80; the exhibit shows no evidence of Struts2 services. Option C is wrong because CVE-2014-0160 (Heartbleed) is a vulnerability in OpenSSL versions 1.0.1 through 1.0.1f, affecting HTTPS services on port 443, but the exhibit only lists port 80 (HTTP) with no SSL/TLS service. Option D is wrong because CVE-2020-1472 (Zerologon) is a privilege escalation vulnerability in Microsoft Netlogon Remote Protocol (MS-NRPC) used in Active Directory domain controllers, which is unrelated to the Apache HTTP service on port 80.

Practice this question →

Matchingmedium

Match each encryption algorithm to its type.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Symmetric encryption

Asymmetric encryption

Hash function (broken)

Hash function (secure)

Symmetric encryption (deprecated)

Why these pairings

AES and 3DES are symmetric algorithms, while RSA and ECC are asymmetric. The distractors swap these types.

Practice this question →