CEH Network and Web Application Attacks Practice Question
Exhibit
nmap -sV -p 80,443,3306 192.168.1.100 Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-20 10:30 Nmap scan report for 192.168.1.100 Host is up (0.0012s latency). PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.49 443/tcp open ssl/http Apache httpd 2.4.49 3306/tcp open mysql MySQL 5.7.35
Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?
⚠ Common exam trap
EC-CEH often tests the ability to match a specific service (e.g., Apache HTTP on port 80) with its corresponding CVE, rather than assuming a generic web vulnerability, so candidates may incorrectly choose Heartbleed (port 443) or Struts2 (Java framework) without verifying the service type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CVE-2021-41773 (Apache Path Traversal)
The exhibit shows Apache HTTP Server on port 80, which is vulnerable to CVE-2021-41773, a path traversal and file disclosure flaw in Apache HTTP Server 2.4.49. This vulnerability allows an attacker to use a specially crafted URL to traverse directories outside the document root, potentially reading sensitive files like /etc/passwd or executing arbitrary code if CGI scripts are enabled. The presence of Apache on port 80 directly aligns with this vulnerability, making it the most likely to be successfully exploited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CVE-2021-41773 (Apache Path Traversal)
Why this is correct
This is the correct vulnerability because Apache HTTP Server version 2.4.49, as implied by the Nmap scan, is specifically susceptible to CVE-2021-41773. This critical path traversal vulnerability allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure or, under certain configurations (e.g., if mod_cgi is enabled), remote code execution. The Nmap scan likely identified the precise Apache version, directly correlating it to this known flaw.
- ✗
CVE-2017-5638 (Struts2 RCE)
Why it's wrong here
CVE-2017-5638 is an Apache Struts2 vulnerability, which is a web application framework primarily used for developing Java-based web applications. The Nmap scan results, indicating "Apache" (presumably Apache HTTP Server), do not inherently suggest the presence of an Apache Struts2 application. These are distinct software components; the HTTP server serves content, while Struts2 runs within a Java application server like Tomcat, making this vulnerability irrelevant to a standalone Apache HTTPD instance.
- ✗
CVE-2014-0160 (Heartbleed)
Why it's wrong here
Heartbleed (CVE-2014-0160) is a critical vulnerability found in specific versions of the OpenSSL cryptographic library (1.0.1 through 1.0.1f), not directly in the Apache HTTP Server application itself. While Apache often utilizes OpenSSL for TLS/SSL encryption, the Nmap scan identifying Apache version 2.4.49 does not automatically confirm a vulnerable OpenSSL version. The vulnerability allows for information disclosure from server memory, but its presence depends on the OpenSSL version linked, not solely the web server.
- ✗
CVE-2020-1472 (Zerologon)
Why it's wrong here
Zerologon (CVE-2020-1472) is a severe privilege escalation vulnerability affecting the Netlogon Remote Protocol on Microsoft Windows Server domain controllers. This flaw allows an unauthenticated attacker to gain full administrative control over a domain controller by exploiting a cryptographic vulnerability in the Netlogon protocol. It is entirely unrelated to web servers like Apache HTTPD or database systems like MySQL, which operate on different platforms and protocols.
Go deeper
Related to this question
Learn chapter
Vulnerability Analysis
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.