CCNA Ceh Malware Social Network Questions — Page 3 of 3

151

MCQhard

During a penetration test, you execute a command that sends a large number of spoofed ICMP echo request packets to a subnet's broadcast address. This results in a flood of replies to the target system. Which attack have you performed?

A.Ping of Death

B.Smurf attack

C.UDP flood

D.ICMP flood

AnswerB

Spoofed ICMP to broadcast address causing amplification.

Why this answer

The Smurf attack works by sending a large number of ICMP echo request packets with a spoofed source IP (the victim's address) to a subnet's broadcast address. All hosts on that subnet receive the request and reply to the spoofed source, overwhelming the victim with ICMP echo replies. This amplifies traffic because a single request triggers many responses, making it a classic amplification DDoS attack.

Exam trap

Candidates often confuse Smurf attack with a standard ICMP flood. The critical distinction is that a Smurf attack uses a subnet broadcast address and spoofs the victim's IP, causing all hosts in the subnet to reply to the victim, amplifying traffic. A simple ICMP flood sends many pings directly to the target without amplification.

In CEH, this amplification and spoofing is the key to recognizing the Smurf attack.

How to eliminate wrong answers

Option A is wrong because Ping of Death involves sending a malformed ICMP packet larger than 65,535 bytes to cause a buffer overflow, not spoofed broadcast traffic. Option C is wrong because a UDP flood uses UDP packets (often to random ports) to exhaust resources, not ICMP echo requests to a broadcast address. Option D is wrong because an ICMP flood typically sends a high volume of ICMP packets directly to a target without spoofing or broadcast amplification, whereas the Smurf attack specifically exploits the broadcast address for amplification.

Practice this question →

152

MCQmedium

A penetration tester uses a tool to perform a man-in-the-middle attack by sending forged DNS responses that redirect users to a malicious website. Which tool is MOST likely being used to perform DNS spoofing?

A.Nmap

B.Wireshark

C.Ettercap

D.tcpdump

AnswerC

Ettercap is a comprehensive and versatile suite specifically designed for Man-in-the-Middle attacks on switched LANs. It excels by implementing robust ARP spoofing to redirect traffic between two hosts through the attacker's machine, effectively placing itself in the middle. Beyond simple interception, Ettercap includes powerful plugins for active manipulation, such as DNS spoofing, content filtering, and packet injection, making it a primary tool for intercepting, analyzing, and altering network communications in real-time. Its integrated framework directly supports the actions needed for a successful MITM attack.

Why this answer

Ettercap is a comprehensive suite for man-in-the-middle attacks, including ARP poisoning and DNS spoofing. It can intercept DNS requests and forge fake responses to redirect victims to a malicious IP, making it the correct tool for DNS spoofing.

Exam trap

The trap here is that candidates often confuse packet capture tools (Wireshark, tcpdump) with active attack tools, forgetting that DNS spoofing requires injecting forged packets, not just passive observation.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanning and discovery tool, not designed to forge DNS responses or perform MITM attacks. Option B is wrong because Wireshark is a packet analyzer used for passive traffic capture and inspection, not for injecting forged DNS packets. Option D is wrong because tcpdump is a command-line packet capture tool that only captures and displays packets; it cannot actively spoof DNS responses.

Practice this question →

153

MCQmedium

A user receives a text message claiming their bank account is locked and requiring them to click a link to verify. This social engineering method is called:

A.Phishing

B.Whaling

C.Vishing

D.SMiShing

AnswerD

SMiShing is the precise term for a phishing attack conducted via Short Message Service (SMS) text messages. In this method, attackers send deceptive text messages, often containing malicious links or requests for personal information, to mobile phone users. The goal is to trick recipients into clicking links that install malware, redirect to fraudulent websites, or directly provide sensitive data, perfectly matching the described scenario of a text message claiming bank account issues.

Why this answer

SMiShing (SMS phishing) is the correct term because the attack vector is a text message (SMS) that tricks the user into clicking a malicious link. Unlike email-based phishing, SMiShing exploits the higher trust users often place in SMS messages and the limited security controls on mobile devices.

Exam trap

The CEH exam often tests the distinction between phishing (email), vishing (voice), and SMiShing (SMS) by presenting a scenario that clearly involves a text message, leading candidates to mistakenly choose 'Phishing' due to its broader familiarity.

How to eliminate wrong answers

Option A is wrong because phishing generally refers to email-based social engineering attacks, not SMS. Option B is wrong because whaling targets high-profile executives or individuals, not generic bank account users. Option C is wrong because vishing uses voice calls (VoIP or phone) to deceive victims, not text messages.

Practice this question →

154

MCQeasy

Which of the following is a type of malware that replicates itself by attaching to executable files and requires human action to spread, such as opening an infected attachment?

A.Worm

B.Ransomware

C.File virus

D.Trojan

AnswerC

A file virus is a classic form of malware that replicates by attaching its malicious code to legitimate executable files or scripts on a host system. When an infected program is executed, the virus code runs first, often infecting other uninfected files on the same system or accessible network drives. This direct modification and execution-based propagation mechanism is a fundamental characteristic of file viruses, making them a clear example of replicating malware.

Why this answer

A file virus (also known as a file infector) is a type of malware that replicates by inserting its code into executable files (e.g., .exe, .com, .dll). It requires human action to spread, such as opening an infected email attachment or running an infected program, because the virus code is only activated when the host executable is executed.

Exam trap

The trap here is that candidates often confuse a file virus with a worm because both can spread via email attachments, but the key differentiator is that a worm self-replicates without human interaction, while a file virus requires the user to execute the infected file.

How to eliminate wrong answers

Option A is wrong because a worm is a self-replicating malware that spreads automatically over networks without requiring human action, exploiting vulnerabilities like open ports or weak credentials. Option B is wrong because ransomware is a type of malware that encrypts files or locks systems to demand a ransom, and it does not primarily replicate by attaching to executables; its spread often relies on other vectors like phishing or exploits. Option D is wrong because a Trojan is malware disguised as legitimate software that does not self-replicate; it relies on social engineering to trick users into installing it, but it does not attach to executable files to propagate.

Practice this question →

155

MCQmedium

A company wants to defend against DNS amplification attacks. Which mitigation technique would be MOST effective?

A.Disabling recursive queries on DNS servers

B.Implementing rate limiting on DNS servers

C.Deploying anycast routing

D.Using a scrubbing center

AnswerB

Rate limiting reduces the number of DNS responses to a single source, mitigating amplification.

Why this answer

B is correct because rate limiting restricts the number of DNS responses a server sends to a single source, reducing the volume of traffic that can be generated in an amplification attack. DNS amplification exploits open recursive resolvers to send small queries that yield large responses, and rate limiting directly curbs the attacker's ability to flood the victim with amplified traffic. This technique is specifically recommended in RFC 5358 and by industry best practices for mitigating reflection/amplification DDoS attacks.

Exam trap

EC-CEH often tests the misconception that disabling recursive queries fully prevents DNS amplification, but the trap here is that rate limiting is the most effective defense because it directly throttles the amplified response volume, whereas disabling recursion only prevents the server from being an open resolver but does not stop attacks using other resolvers or targeting the server itself.

How to eliminate wrong answers

Option A is wrong because disabling recursive queries only prevents the DNS server from being used as an open resolver, which stops it from being a source of amplification, but it does not mitigate attacks where the attacker uses other open resolvers or where the server itself is the target of the amplified response. Option C is wrong because anycast routing distributes DNS query load across multiple servers and improves availability, but it does not reduce the volume of amplified traffic sent to the victim; it only helps the DNS infrastructure survive the attack. Option D is wrong because a scrubbing center is a third-party service that filters malicious traffic after the attack reaches the network, which is a reactive measure and not the most effective proactive mitigation on the DNS server itself; it also incurs cost and latency.

Practice this question →

156

Multi-Selectmedium

Which TWO of the following are characteristics of a polymorphic virus?

Select 2 answers

A.It uses a decryption routine that varies

B.It uses a constant signature across all infections

C.It changes its code signature each time it replicates

D.It can only infect boot sectors

E.It always remains in memory

AnswersA, C

A polymorphic virus employs a sophisticated mutation engine that generates a unique decryption routine for each new infection instance. This varying decryption stub is prepended to the encrypted virus body, ensuring that the overall code signature changes every time the virus replicates. This constant alteration of the decryption mechanism is crucial for evading static signature-based antivirus detection, as the virus's executable form never presents the same byte pattern.

Why this answer

A polymorphic virus uses a decryption routine that varies with each infection, preventing signature-based detection. Option C is also correct because the changing decryption routine causes the virus's code signature to change each time it replicates, further evading signature matching.

Exam trap

The trap here is that candidates confuse 'polymorphic' with 'metamorphic' — polymorphic changes the decryption routine but keeps the payload constant, whereas metamorphic rewrites the entire code body, and the exam often tests this distinction by listing 'constant signature' as a distractor.

Practice this question →

157

MCQeasy

An attacker sends an email that appears to come from the CEO of the company, requesting an urgent wire transfer to a specific account. This is an example of which social engineering attack?

A.Whaling

B.Spear phishing

C.Phishing

D.Pretexting

AnswerA

Whaling is a highly specialized form of spear phishing that specifically targets high-profile individuals within an organization, such as CEOs, CFOs, or other senior executives. The attacker crafts extremely convincing emails, often spoofing the identity of a trusted internal or external party, to trick these 'big fish' into divulging sensitive information or authorizing fraudulent transactions. The objective is typically significant financial gain or access to critical corporate data, leveraging the executive's authority and perceived urgency.

Why this answer

Whaling is a targeted social engineering attack that specifically goes after high-profile individuals like the CEO or CFO. In this scenario, the attacker impersonates the CEO to trick an employee into authorizing a fraudulent wire transfer, which is the classic hallmark of whaling rather than generic phishing.

Exam trap

The trap here is that candidates confuse whaling with spear phishing because both are targeted, but whaling is specifically reserved for attacks against senior executives or high-value targets, not just any individual.

How to eliminate wrong answers

Option B (Spear phishing) is wrong because spear phishing targets a specific individual or group but does not necessarily focus on senior executives; the attack here is explicitly against the CEO's identity. Option C (Phishing) is wrong because phishing is a broad, untargeted attack sent to many users, not a personalized email impersonating a specific executive. Option D (Pretexting) is wrong because pretexting involves creating a fabricated scenario or pretext to obtain information, not directly requesting an action like a wire transfer via email impersonation.

Practice this question →

158

MCQmedium

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

A.Worm

B.Ransomware

C.Remote Access Trojan (RAT)

D.Polymorphic virus

AnswerC

A Remote Access Trojan (RAT) is a sophisticated form of malware specifically engineered to grant an attacker comprehensive, covert administrative control over an infected system. It establishes a persistent backdoor, enabling remote execution of commands, file manipulation, keystroke logging, screen capture, and even webcam/microphone activation. This direct, interactive control makes a RAT the definitive tool for remote system manipulation and surveillance.

Why this answer

The behavior described—downloading a file that, when executed, creates a hidden process that connects to a remote server and provides full remote control—is the classic definition of a Remote Access Trojan (RAT). A RAT is a type of malware that allows an attacker to remotely control the victim's system, often using a command-and-control (C2) channel over protocols like TCP or HTTP. The hidden process and outbound connection to a remote server are key indicators of a RAT, distinguishing it from other malware types that do not provide interactive remote control.

Exam trap

The trap here is that candidates often confuse a RAT with a worm or virus because they focus on the 'remote control' aspect, but fail to recognize that a RAT specifically provides interactive remote access, whereas worms and viruses have different primary behaviors like self-replication or code mutation.

How to eliminate wrong answers

Option A is wrong because a worm is a self-replicating malware that spreads across networks without requiring user interaction to execute a downloaded file, and it does not typically provide full remote control of a single system. Option B is wrong because ransomware encrypts files or locks the system to demand a ransom, and it does not create a hidden process for remote control or connect to a remote server for interactive access. Option D is wrong because a polymorphic virus changes its code signature to evade detection but does not inherently create a hidden process or establish a remote control channel; its primary behavior is infection and mutation, not remote access.

Practice this question →

159

MCQmedium

A network administrator notices an unusually high number of half-open TCP connections to the company's web server. The source IPs are spoofed. Which type of attack is MOST likely occurring?

A.Smurf attack

B.UDP flood

C.SYN flood

D.ICMP flood

AnswerC

A SYN flood is a classic denial-of-service attack that exploits the TCP three-way handshake. The attacker sends a large volume of TCP SYN (synchronize) requests to a target server but never completes the handshake by sending the final ACK (acknowledgment). This leaves numerous "half-open" connections in the server's memory, exhausting its connection table and preventing legitimate clients from establishing new connections, thus denying service.

Why this answer

A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to the target server. The server responds with SYN-ACK packets and allocates resources for each half-open connection, exhausting its connection queue and preventing legitimate connections. The description of half-open TCP connections with spoofed source IPs is the classic signature of a SYN flood.

Exam trap

The trap here is that candidates confuse a SYN flood with a Smurf attack because both use spoofed IPs, but Smurf attacks rely on ICMP broadcast amplification, not TCP half-open connections.

How to eliminate wrong answers

Option A is wrong because a Smurf attack uses ICMP echo requests sent to a network's broadcast address with a spoofed victim IP, causing all hosts to reply to the victim, not half-open TCP connections. Option B is wrong because a UDP flood sends large numbers of UDP packets to random ports, overwhelming the target's bandwidth or processing, but does not involve TCP handshake states or half-open connections. Option D is wrong because an ICMP flood overwhelms the target with ICMP packets (e.g., ping floods), consuming bandwidth or CPU, but does not create half-open TCP connections.

Practice this question →

160

MCQeasy

Which tool is specifically designed to create fake login pages for phishing campaigns and can be integrated with Metasploit?

A.Social Engineering Toolkit (SET)

B.Nmap

C.Wireshark

D.Ettercap

AnswerA

The Social Engineering Toolkit (SET) is explicitly designed for various social engineering attacks, including the creation of convincing fake login pages. Its "Web Attack Vectors" module, specifically the "Credential Harvester Attack," allows an attacker to clone legitimate websites, including their login forms. This cloned page then captures any credentials entered by unsuspecting victims, forwarding them to the attacker while often redirecting the user to the actual legitimate site to avoid suspicion.

Why this answer

The Social Engineering Toolkit (SET) is specifically designed to automate social engineering attacks, including the creation of fake login pages (credential harvesting) for phishing campaigns. It includes a built-in 'Website Attack Vectors' module that can clone legitimate sites and capture submitted credentials, and it offers direct integration with Metasploit to deliver payloads or establish reverse shells upon credential submission.

Exam trap

The CEH exam often tests the distinction between general-purpose tools (like Nmap or Wireshark) and specialized social engineering frameworks, leading candidates to confuse a network attack tool (Ettercap) with a phishing-specific tool like SET.

How to eliminate wrong answers

Option B is wrong because Nmap is a network scanning and reconnaissance tool used for port discovery and service enumeration, not for creating phishing pages or social engineering attacks. Option C is wrong because Wireshark is a network protocol analyzer used for packet capture and traffic inspection, not for generating fake login pages or integrating with Metasploit for phishing. Option D is wrong because Ettercap is a man-in-the-middle attack tool focused on ARP poisoning and packet sniffing on local networks, not for crafting phishing pages or credential harvesting via fake login forms.

Practice this question →

161

MCQhard

During a forensic investigation, an analyst retrieves a suspicious executable. Running 'strings' reveals no readable text, and VirusTotal shows zero detections. However, when executed in a sandbox, the binary connects to a remote IP and injects code into 'explorer.exe'. Which conclusion is MOST accurate?

A.The file is a worm because it connects to a remote IP

B.The file is likely a packed trojan that evades signature-based detection

C.The file is benign because static analysis found no indicators

D.The file is a false positive and the sandbox environment is compromised

AnswerB

The absence of discernible strings during static analysis and zero detections by antivirus engines strongly suggest the file is packed or heavily obfuscated to evade signature-based detection. Subsequent dynamic analysis in a sandbox environment, revealing malicious behaviors such as network connections to suspicious IPs or process injection, confirms its true malicious intent. These combined indicators are highly characteristic of a packed trojan designed to bypass initial security checks and execute its payload.

Why this answer

The absence of readable strings and zero VirusTotal detections strongly suggest the executable is packed or obfuscated, a common evasion technique used by trojans. The sandbox behavior—connecting to a remote IP and injecting code into explorer.exe—confirms malicious intent, specifically trojan-like remote access and process injection. This combination of static stealth and dynamic malicious activity indicates a packed trojan designed to bypass signature-based antivirus.

Exam trap

The trap here is that candidates assume 'no static indicators' means the file is benign, ignoring that packing is a deliberate evasion technique, and that dynamic analysis (sandbox execution) is essential to uncover hidden malicious behavior.

How to eliminate wrong answers

Option A is wrong because connecting to a remote IP alone does not define a worm; worms self-replicate and spread autonomously, whereas this file exhibits trojan behavior (remote access and code injection). Option C is wrong because static analysis (e.g., 'strings') is insufficient to declare a file benign; packed malware intentionally hides indicators, and dynamic analysis revealed malicious activity. Option D is wrong because the sandbox environment is not compromised; the binary's outbound connection and injection are consistent with malware behavior, not a false positive from a compromised sandbox.

Practice this question →

162

MCQmedium

Which of the following tools is specifically designed to perform MAC flooding to force a switch into fail-open mode, allowing packet sniffing?

A.Ettercap

B.Wireshark

C.Nmap

D.macof

AnswerD

macof, a tool within the dsniff suite, is specifically engineered to execute MAC flooding attacks against network switches. It operates by rapidly generating and transmitting a massive number of Ethernet frames, each containing a unique, randomly generated source MAC address. This malicious activity aims to exhaust the switch's Content Addressable Memory (CAM) table, forcing the switch to enter a "fail-open" or "hub mode" state. In this state, the switch broadcasts all incoming traffic to every connected port, thereby allowing an attacker to passively sniff all network communications.

Why this answer

The macof tool (part of the dsniff suite) is specifically designed to perform MAC flooding attacks. It floods a switch with thousands of random MAC addresses, exhausting the Content Addressable Memory (CAM) table. When the CAM table is full, the switch enters fail-open mode and begins flooding all frames out all ports, effectively turning it into a hub and allowing an attacker to sniff traffic that was not originally destined for their port.

Exam trap

The trap here is that candidates often confuse MAC flooding with ARP poisoning, and mistakenly choose Ettercap (which is famous for ARP spoofing) instead of recognizing that macof is the dedicated tool for CAM table overflow attacks.

How to eliminate wrong answers

Option A is wrong because Ettercap is a comprehensive man-in-the-middle (MITM) attack toolkit that supports ARP poisoning, DNS spoofing, and other interception techniques, but it does not perform MAC flooding as its primary or designed function. Option B is wrong because Wireshark is a network protocol analyzer used for capturing and inspecting packets; it has no capability to generate traffic or perform MAC flooding. Option C is wrong because Nmap is a network scanning and reconnaissance tool used for port scanning, service detection, and OS fingerprinting; it is not designed to flood a switch's CAM table.

Practice this question →

163

Multi-Selectmedium

Which TWO of the following are examples of application layer (Layer 7) DDoS attacks? (Select 2)

Select 2 answers

A.HTTP flood

B.Smurf attack

C.SYN flood

D.UDP flood

E.Slowloris

AnswersA, E

An HTTP flood is a Layer 7 (Application Layer) Distributed Denial of Service (DDoS) attack that overwhelms a web server by sending a massive volume of legitimate-looking HTTP GET or POST requests. These requests consume the server's CPU, memory, and bandwidth resources, making it unable to respond to legitimate user traffic. Unlike lower-layer attacks, it targets the specific application protocol, mimicking normal user behavior to evade simple network-level defenses.

Why this answer

HTTP flood is a Layer 7 DDoS attack because it targets the application layer by sending seemingly legitimate HTTP GET or POST requests to overwhelm a web server's resources. Unlike network-layer attacks, HTTP flood exploits the server's ability to process requests, often mimicking normal user behavior to bypass basic rate limiting. Slowloris is also a Layer 7 attack that works by opening multiple HTTP connections and keeping them open with partial requests, exhausting the server's connection pool without completing the handshake.

Exam trap

The trap here is that candidates often confuse SYN flood (Layer 4) with application-layer attacks because both involve flooding, but SYN flood targets the TCP handshake at the transport layer, not the HTTP protocol at Layer 7.

Practice this question →

164

MCQhard

An analyst observes the following output from Wireshark: a TCP packet with the SYN flag set, followed by a SYN-ACK, then an ACK, and then a RST. The sequence numbers show a pattern: initial seq=100, ack=300, then seq=300, ack=101. What is the MOST likely interpretation?

A.An attacker is performing TCP sequence prediction to hijack the session.

B.A normal TCP connection establishment followed by an immediate termination.

C.A man-in-the-middle attack using ARP spoofing.

D.A TCP SYN flood attack is in progress.

AnswerA

Correct. The sequence numbers show successful prediction, and the RST may be used to reset the connection after hijacking.

Why this answer

The observed sequence numbers (initial seq=100, ack=300, then seq=300, ack=101) indicate that the ACK packet acknowledges a sequence number that was never sent by the original sender, which is a classic sign of TCP sequence number prediction. An attacker who predicts the next expected sequence number can inject a spoofed packet to hijack the session, and the subsequent RST is often used by the attacker to tear down the legitimate connection or cover their tracks.

Exam trap

In the EC-CEH exam, candidates often mistake the SYN, SYN-ACK, ACK, RST pattern for a normal connection termination (FIN sequence) or a simple reset, failing to recognize that the sequence number mismatch in the ACK reveals the attack.

How to eliminate wrong answers

Option B is wrong because a normal TCP connection establishment (three-way handshake) consists of SYN, SYN-ACK, ACK, and then data exchange, not an immediate RST; the RST here is anomalous and indicates malicious activity. Option C is wrong because ARP spoofing is a layer-2 attack that manipulates MAC-to-IP mappings to intercept traffic, but the given Wireshark output shows only TCP flags and sequence numbers, with no evidence of ARP packets or MAC address manipulation. Option D is wrong because a TCP SYN flood attack involves sending many SYN packets without completing the handshake, overwhelming the server's connection queue; the output shows a complete handshake (SYN, SYN-ACK, ACK) followed by a RST, not a flood of incomplete connections.

Practice this question →

165

MCQmedium

A company wants to protect its network from MAC flooding attacks. Which of the following countermeasures is MOST effective?

A.Use Wireshark to monitor for floods

B.Disable CAM table learning

C.Enable port security on switches

D.Implement ARP spoofing detection

AnswerC

Enabling port security on switches is the most effective defense against MAC flooding attacks. This feature allows administrators to configure a maximum number of MAC addresses permitted to be learned on a specific switch port. When the configured limit is exceeded, the switch can be configured to take action, such as shutting down the port, restricting further MAC address learning, or generating an alert, thereby preventing the attacker from overflowing the CAM table.

Why this answer

Enabling port security on switches directly limits the number of MAC addresses that can be learned on a switch port, preventing an attacker from flooding the CAM table with fake MAC addresses. When the configured limit is exceeded, the switch can either drop traffic, shut down the port, or send an alert, effectively stopping the MAC flooding attack at the access layer.

Exam trap

The CEH exam often tests the distinction between passive monitoring tools (like Wireshark) and active security controls (like port security), and the trap here is that candidates confuse detection with prevention, or confuse MAC flooding with ARP spoofing attacks.

How to eliminate wrong answers

Option A is wrong because Wireshark is a passive packet analyzer that can detect a MAC flooding attack in progress but cannot prevent or stop it; it provides no active countermeasure. Option B is wrong because disabling CAM table learning would break normal switch operation, as the switch would be unable to build its forwarding table and would flood all frames out all ports, effectively turning the switch into a hub and causing network disruption. Option D is wrong because ARP spoofing detection addresses ARP cache poisoning attacks, not MAC flooding attacks; MAC flooding targets the switch's CAM table by exhausting its memory with fake MAC addresses, while ARP spoofing manipulates IP-to-MAC mappings on hosts.

Practice this question →

166

MCQhard

During a forensic investigation, an analyst finds a suspicious file that changes its code signature each time it replicates. The file uses encryption and polymorphism to evade signature-based detection. Which type of virus is this?

A.Macro virus

B.File infector virus

C.Boot sector virus

D.Polymorphic virus

AnswerD

Polymorphic viruses are a sophisticated type of malware designed to evade signature-based detection by constantly changing their executable code while retaining their original functionality. They achieve this through a 'mutation engine' that encrypts the virus body with a different key and decryption routine for each new infection. This process ensures that every new instance of the virus has a unique signature, making it extremely challenging for traditional antivirus software to identify based on static patterns.

Why this answer

D is correct because a polymorphic virus is specifically designed to change its code signature each time it replicates, using encryption and mutation engines to evade signature-based detection. The description of altering the signature with each replication while maintaining the same core functionality is the defining characteristic of a polymorphic virus.

Exam trap

CEH often tests the distinction between a polymorphic virus and a metamorphic virus; the trap here is that candidates may confuse 'polymorphic' (which changes the decryption routine but keeps the body encrypted) with 'metamorphic' (which rewrites its entire code without encryption), but the question explicitly mentions encryption, confirming polymorphism.

How to eliminate wrong answers

Option A is wrong because a macro virus infects documents or spreadsheets by embedding malicious macros in scripting languages like VBA, and while it can replicate, it does not inherently change its code signature through encryption and polymorphism. Option B is wrong because a file infector virus attaches itself to executable files and activates when the host program runs, but it typically does not alter its signature with each replication unless it incorporates polymorphic techniques, which is not its defining feature. Option C is wrong because a boot sector virus infects the master boot record or boot sector of a storage device, loading before the OS, and it does not routinely change its code signature via encryption and polymorphism as a primary evasion method.

Practice this question →

167

Multi-Selectmedium

Which TWO of the following are characteristics of a DNS amplification attack? (Select 2)

Select 2 answers

A.It targets the victim's MAC address

B.It uses spoofed source IP addresses

C.It exploits open DNS resolvers

D.It requires the attacker to be on the same subnet as the victim

E.It uses ICMP echo requests

AnswersB, C

This is a critical characteristic of DNS amplification. The attacker sends small DNS queries to numerous open DNS resolvers, but crafts these queries to appear as if they originated from the victim's IP address. This IP spoofing ensures that when the resolvers send their much larger responses, they are directed to the legitimate victim's network, effectively overwhelming their bandwidth and causing a denial of service. Without spoofing, the responses would return to the attacker, nullifying the amplification effect.

Why this answer

DNS amplification attacks rely on sending DNS queries with a spoofed source IP address that matches the victim's IP. The attacker sends small queries to open DNS resolvers, which then send large responses to the victim, overwhelming their bandwidth. This spoofing ensures the amplified traffic is directed at the victim, not the attacker.

Exam trap

The trap here is that candidates often confuse DNS amplification with other reflection attacks like Smurf (which uses ICMP) or think the attacker must be local, but the key differentiator is the use of spoofed source IPs and open DNS resolvers over UDP.

Practice this question →

168

MCQeasy

Which type of malware is characterized by self-replication and spreading across networks without needing a host file?

A.Trojan

B.Worm

C.Ransomware

D.Virus

AnswerB

A worm is a standalone malicious program designed to self-replicate and propagate across computer networks without requiring a host program or user intervention. Worms exploit vulnerabilities in operating systems or applications to spread autonomously, often scanning for vulnerable systems and then infecting them to continue their replication cycle. This independent self-replication and network-based propagation are their defining characteristics, allowing them to consume network bandwidth and system resources rapidly.

Why this answer

A worm is a standalone malware program that replicates itself to spread to other computers over a network, exploiting vulnerabilities or using social engineering, without requiring a host file or user intervention. Unlike viruses, worms do not need to attach to an existing program; they operate independently, often using network protocols like SMB, HTTP, or email to propagate.

Exam trap

EC-CEH often tests the distinction between a virus and a worm by emphasizing that a virus requires a host file to attach to, while a worm is self-contained and spreads independently over networks, leading candidates to mistakenly choose 'Virus' when they see 'self-replication' without noting the 'no host file' condition.

How to eliminate wrong answers

Option A is wrong because a Trojan disguises itself as legitimate software but does not self-replicate; it relies on user execution and lacks autonomous network propagation. Option C is wrong because ransomware encrypts files or locks systems for ransom but does not self-replicate or spread across networks without user action; its primary behavior is extortion, not autonomous replication. Option D is wrong because a virus requires a host file (e.g., an executable or document) to attach to and replicate, and it typically spreads via file sharing or removable media, not autonomously across networks without a host.

Practice this question →

169

MCQhard

A security team suspects a session hijacking attack. The analyst examines network traffic and sees packets with sequence numbers that increment by predictable values. Which attack is MOST likely occurring?

A.TCP sequence prediction

B.ARP poisoning

C.DNS spoofing

D.MAC flooding

AnswerA

TCP sequence prediction involves an attacker guessing the next valid sequence number in a TCP connection. If the sequence numbers are predictable, the attacker can inject crafted packets into an established session, effectively hijacking it. By successfully predicting and sending packets with the correct sequence and acknowledgment numbers, the attacker can impersonate one of the legitimate communication parties, taking control of the session without needing to intercept initial authentication. This allows for unauthorized command execution or data manipulation within the active session.

Why this answer

TCP sequence prediction attacks exploit the ability to guess the next sequence number in a TCP connection, allowing an attacker to inject forged packets and hijack the session. The analyst observed packets with sequence numbers incrementing by predictable values, which is the hallmark of weak or static sequence number generation in older TCP implementations.

Exam trap

The trap here is that candidates confuse session hijacking with ARP poisoning or DNS spoofing, but the key clue is 'predictable sequence numbers,' which directly points to TCP sequence prediction, not Layer 2 or DNS manipulation.

How to eliminate wrong answers

Option B (ARP poisoning) is wrong because it involves manipulating ARP tables to intercept traffic at Layer 2, not predicting TCP sequence numbers. Option C (DNS spoofing) is wrong because it corrupts DNS responses to redirect traffic, not targeting TCP sequence numbers. Option D (MAC flooding) is wrong because it overwhelms a switch's CAM table to force it into hub mode, enabling packet sniffing, not sequence number prediction.

Practice this question →

170

MCQmedium

During a social engineering assessment, an attacker calls a help desk impersonating a new employee and requests a password reset due to a 'locked account'. The help desk complies. Which social engineering technique is being used?

A.Phishing

B.Vishing

C.Pretexting

D.Quid pro quo

AnswerC

Pretexting is a sophisticated form of social engineering where an attacker invents a believable, fabricated scenario (a "pretext") to manipulate a target into divulging information or performing an action. This often involves extensive research to create a credible backstory, a false identity, and a plausible reason for the interaction, making the target believe they are interacting with someone authorized or legitimate. The scenario's description of an attacker calling and using a fabricated scenario directly aligns with the definition of pretexting.

Why this answer

Pretexting is the correct answer because the attacker fabricates a scenario (the pretext of being a new employee with a locked account) to manipulate the help desk into performing a password reset. This technique relies on a crafted story to gain trust and bypass security procedures, rather than using technical exploits or direct requests for information.

Exam trap

The trap here is that candidates confuse the medium (phone call) with the technique, incorrectly selecting vishing (Option B) instead of recognizing that the core deception is the fabricated pretext, not the voice channel itself.

How to eliminate wrong answers

Option A is wrong because phishing typically involves sending fraudulent emails or messages that mimic legitimate entities to trick victims into revealing sensitive information or clicking malicious links, not a direct phone call impersonation. Option B is wrong because vishing (voice phishing) uses phone calls to extract sensitive data like credit card numbers or credentials, but the core technique here is the fabricated identity and story, not the medium alone. Option D is wrong because quid pro quo involves offering a service or benefit in exchange for information or access (e.g., 'I'll fix your computer if you give me your password'), whereas this scenario uses a false identity to request a routine action without any reciprocal offer.

Practice this question →

171

MCQmedium

A security analyst receives an alert indicating that a host on the internal network is sending a high volume of ICMP echo requests to multiple external IP addresses. The analyst notices that the source IP address is spoofed. Which type of attack is MOST likely occurring?

A.Fraggle attack

B.ICMP flood

C.Smurf attack

D.Ping flood

AnswerD

Correct. Ping flood sends high volumes of ICMP echo requests directly to targets, often with spoofed source IPs, matching the alert.

Why this answer

The attack described is a Ping flood (option D). A Ping flood involves sending a high volume of ICMP echo requests (pings) directly to multiple target IP addresses, often with a spoofed source IP to hide the attacker's identity. This overwhelms the targets' network resources.

Unlike a Smurf attack, which uses a network broadcast address to amplify traffic, this scenario shows direct flooding of multiple external IPs, characteristic of a Ping flood.

Exam trap

In EC-CEH, candidates often confuse Smurf and Ping flood attacks. The key difference is that Smurf uses a broadcast address for amplification, while Ping flood sends traffic directly to targets. Since the scenario mentions spoofed ICMP echo requests to multiple external IPs without broadcast, it is a Ping flood.

How to eliminate wrong answers

Option A (Fraggle attack) is wrong because it uses UDP echo packets to a broadcast address, not ICMP echo requests. Option B (ICMP flood) is wrong because it typically does not involve IP spoofing or amplification; it simply overwhelms a target with ICMP packets from a real source. Option D (Ping flood) is wrong because it is a basic DoS attack that sends many ICMP echo requests from a real IP, not a spoofed one, and lacks the amplification mechanism of a Smurf attack.

Practice this question →

172

Multi-Selectmedium

Which TWO of the following are examples of application-layer DDoS attacks? (Select 2)

Select 2 answers

A.Slowloris

B.SYN flood

C.Smurf attack

D.UDP flood

E.HTTP flood

AnswersA, E

Slowloris keeps many connections open slowly to exhaust server resources.

Why this answer

Slowloris is an application-layer DDoS attack that targets web servers by opening multiple HTTP connections and keeping them alive with partial requests, sending headers periodically to prevent timeout. It exploits the server's connection handling at Layer 7, exhausting the connection pool without requiring high bandwidth.

Exam trap

The trap here is that candidates often confuse layer-based attacks, assuming any flood (like SYN or UDP) is application-layer, but CEH expects you to distinguish Layer 7 attacks (HTTP flood, Slowloris) from transport/network-layer attacks (SYN flood, UDP flood, Smurf).

Practice this question →

173

MCQhard

An attacker wants to perform a man-in-the-middle attack on a local network. Which two tools from the following list would be most effective? (Select the best answer from the options below; note: this is a multiple choice, not multi-select) A) Wireshark B) Ettercap C) Nmap D) Metasploit E) Aircrack-ng

A.Nmap and Metasploit

B.Aircrack-ng and Wireshark

C.Ettercap and Nmap

D.Ettercap and Wireshark

AnswerD

Ettercap is a highly effective tool for executing Man-in-the-Middle attacks by performing ARP poisoning, which redirects network traffic through the attacker's machine. Wireshark then perfectly complements Ettercap by passively capturing and analyzing all the intercepted traffic that is now flowing through the attacker. This combination allows for both the successful interception of communications and the detailed examination of the data, making it ideal for a comprehensive MITM attack.

Why this answer

Ettercap is a dedicated man-in-the-middle (MITM) tool that performs ARP spoofing to intercept traffic between hosts on a switched LAN. Wireshark captures and analyzes the intercepted packets, allowing the attacker to view unencrypted data. Together, they form the classic ARP poisoning attack chain: Ettercap redirects traffic, Wireshark inspects it.

Exam trap

Candidates often confuse Nmap (a scanning tool) or Metasploit (an exploitation framework) as suitable for MITM attacks, but the classic MITM attack on a LAN uses ARP spoofing with Ettercap and packet capture with Wireshark.

How to eliminate wrong answers

Option A is wrong because Nmap is a network scanner used for host discovery and port enumeration, not for intercepting live traffic; Metasploit is an exploitation framework that delivers payloads but does not natively perform ARP spoofing or packet capture for MITM. Option B is wrong because Aircrack-ng is a suite for wireless LAN attacks (e.g., WEP/WPA cracking) and is ineffective on a wired local network; Wireshark alone cannot redirect traffic without a spoofing tool. Option C is wrong because Nmap does not perform MITM attacks; it only maps the network, leaving the interception step incomplete without a capture tool like Wireshark.

Practice this question →

174

MCQhard

A security engineer is configuring DDoS protection for a web server. The goal is to mitigate a Slowloris attack. Which mitigation technique is MOST effective?

A.Use anycast routing

B.Implement rate limiting and connection timeout

C.Increase the maximum number of simultaneous connections

D.Enable SYN cookies

AnswerB

Slowloris attacks aim to exhaust server resources by maintaining numerous open, incomplete HTTP connections. Implementing a strict connection timeout for idle or slow-sending connections will effectively terminate these malicious sessions before they can consume all available server sockets indefinitely. Additionally, rate limiting the number of new connections or requests from a single source IP can prevent an attacker from establishing a sufficient volume of connections to overwhelm the server's capacity, thus mitigating the attack.

Why this answer

Slowloris works by opening many HTTP connections and keeping them alive by sending partial requests, never completing them, which exhausts the server's connection pool. Rate limiting restricts the number of connections from a single IP, and connection timeouts force idle connections to close, directly countering Slowloris's behavior. This combination prevents the attacker from holding connections open indefinitely.

Exam trap

The trap here is that candidates confuse Slowloris with a SYN flood and choose SYN cookies (Option D), but Slowloris operates at the application layer after the TCP handshake completes, so SYN cookies are ineffective.

How to eliminate wrong answers

Option A is wrong because anycast routing distributes traffic across multiple data centers, which helps with volumetric DDoS attacks but does not prevent a single low-bandwidth connection from exhausting server resources, as Slowloris does. Option C is wrong because increasing the maximum number of simultaneous connections only gives the attacker more room to open additional connections, making the attack worse. Option D is wrong because SYN cookies protect against SYN flood attacks by deferring resource allocation until the handshake completes, but Slowloris completes the TCP handshake and then sends partial HTTP requests, so SYN cookies do not mitigate it.

Practice this question →

175

MCQmedium

A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?

A.MAC flooding

B.ARP poisoning

C.STP attack

D.DNS spoofing

AnswerA

MAC flooding involves overwhelming a switch's Content Addressable Memory (CAM) table (also known as MAC address table) with a multitude of forged source MAC addresses. When the CAM table becomes full, the switch can no longer store new legitimate MAC-to-port mappings. Consequently, for any new incoming frames destined for an unknown MAC address, the switch resorts to broadcasting the frames out of all ports, effectively degrading its functionality to that of a network hub. This allows an attacker to capture traffic intended for other hosts on the segment.

Why this answer

MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.

Exam trap

EC-Council often tests the distinction between MAC flooding (layer 2 CAM table exhaustion) and ARP poisoning (layer 2/3 cache manipulation), so candidates mistakenly choose ARP poisoning because both involve MAC addresses, but only MAC flooding causes the switch to broadcast traffic like a hub.

How to eliminate wrong answers

Option B (ARP poisoning) is wrong because it manipulates the ARP cache of hosts to associate the attacker's MAC address with the IP address of a legitimate device, enabling man-in-the-middle attacks; it does not flood the switch's CAM table. Option C (STP attack) is wrong because it targets the Spanning Tree Protocol by sending forged Bridge Protocol Data Units (BPDUs) to cause topology changes or denial of service, not by exhausting CAM table entries. Option D (DNS spoofing) is wrong because it corrupts DNS resolver caches to redirect domain name lookups to malicious IP addresses, which is a layer-7 attack unrelated to switch MAC address tables.

Practice this question →

176

MCQeasy

A security analyst receives an email from what appears to be the company's CEO requesting an urgent wire transfer. The email address is slightly misspelled (e.g., ce0@company.com instead of ceo@company.com). Which type of social engineering attack is this?

A.Vishing

B.Phishing

C.Whaling

D.Spear phishing

AnswerD

Spear phishing is a highly targeted form of email-based social engineering where attackers craft personalized messages for a specific individual, such as a security analyst. These emails often leverage specific knowledge about the target, their role, or their organization, making the lure appear highly credible and increasing the likelihood of the recipient falling victim. The goal is typically to trick the individual into revealing sensitive information, clicking a malicious link, or downloading an infected attachment, directly aligning with the scenario described.

Why this answer

Spear phishing is a targeted phishing attack aimed at a specific individual or group. In this scenario, the attacker sends an email impersonating the CEO to a specific security analyst, making it a spear phishing attempt. The target is the analyst, not the CEO, so it is not whaling, which targets senior executives directly.

Exam trap

The trap is confusing whaling with spear phishing. Whaling targets senior executives; this attack targets a security analyst by impersonating the CEO, so it is spear phishing.

How to eliminate wrong answers

Option A is wrong because vishing (voice phishing) uses phone calls or voice messages, not email. Option B is wrong because phishing is a broad term for mass, untargeted attacks, whereas this scenario targets a specific high-level executive. Option D is wrong because spear phishing targets a specific individual or group but does not necessarily focus on senior executives; whaling is a subset of spear phishing aimed at 'big fish' like the CEO.

Practice this question →

177

Multi-Selectmedium

Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)

Select 2 answers

A.It requires user interaction to activate

B.It uses encryption to hide its payload

C.It infects only the boot sector

D.It spreads via email attachments only

E.It changes its code signature each time it replicates

AnswersB, E

A fundamental characteristic of polymorphic viruses is their sophisticated use of encryption to conceal their malicious payload. This encryption renders the core malicious code unreadable to static analysis tools, making it difficult to identify based on fixed patterns. Crucially, the virus dynamically generates a new, unique decryption routine with each replication, ensuring that even the decryption stub constantly changes, further evading signature-based detection.

Why this answer

Polymorphic viruses use encryption to hide their payload from signature-based detection. Each time the virus replicates, it generates a new encryption key and a corresponding decryption routine, making the encrypted payload appear different while the underlying malicious code remains the same.

Exam trap

The trap here is that candidates often confuse 'polymorphic' with 'metamorphic' viruses, where metamorphic viruses rewrite their entire code without encryption, while polymorphic viruses rely on encryption and a changing decryption routine.

Practice this question →

178

MCQhard

After a security incident, an analyst retrieves a suspicious file. To determine if it is malicious without executing it, the analyst runs the 'strings' command and uploads the file to VirusTotal. Which type of malware analysis is being performed?

A.Static analysis

B.Behavioral analysis

C.Code analysis

D.Dynamic analysis

AnswerA

Static analysis involves examining a file's properties and contents without executing it. Running the `strings` command extracts printable character sequences, providing clues about embedded text, URLs, or file paths. Uploading to VirusTotal leverages a multitude of static analysis engines and reputation databases to identify known malware signatures and indicators of compromise, all performed on the file at rest.

Why this answer

The analyst is performing static analysis because they are examining the file without executing it. Running the 'strings' command extracts readable text from the binary, and uploading to VirusTotal checks the file's hash against known malware signatures — both are non-behavioral, non-runtime techniques. Static analysis focuses on file properties, code structure, and metadata without triggering the malware's execution.

Exam trap

Common confusion: Static analysis does not execute the file, while dynamic analysis runs it in a sandbox. Uploading to VirusTotal is a form of static analysis based on signatures.

How to eliminate wrong answers

Option B is wrong because behavioral analysis requires executing the malware in a controlled environment (e.g., sandbox) to observe runtime actions like registry changes or network connections, which did not occur here. Option C is wrong because code analysis typically involves disassembly or decompilation (e.g., using IDA Pro or Ghidra) to examine the actual instructions, not just running 'strings' or checking hashes. Option D is wrong because dynamic analysis involves running the file and monitoring its behavior in real time, which was explicitly avoided by the analyst.

Practice this question →

179

MCQhard

An ethical hacker is analyzing a suspicious file using static analysis. Which of the following actions is part of static malware analysis?

A.Running the file in a sandboxed environment and monitoring its behavior

B.Uploading the file to VirusTotal for scanning

C.Examining the file's strings and metadata without executing it

D.Using Wireshark to capture packets sent by the file

AnswerC

Static analysis examines the file's binary, strings, and metadata without execution.

Why this answer

Static malware analysis involves examining the file without executing it. Option C is correct because analyzing strings and metadata (e.g., file headers, embedded URLs, IP addresses, or suspicious function calls) is a core static analysis technique, often performed using tools like `strings`, `binwalk`, or `PEview`. This approach avoids the risks of execution and helps identify indicators of compromise (IOCs) before dynamic analysis.

Exam trap

The trap here is that candidates confuse 'static analysis' with 'dynamic analysis' or 'online scanning,' leading them to select options that involve execution (A, D) or third-party aggregation (B) instead of direct file inspection without execution.

How to eliminate wrong answers

Option A is wrong because running the file in a sandboxed environment and monitoring its behavior is dynamic analysis, not static analysis. Option B is wrong because uploading to VirusTotal is a form of automated online scanning that may involve both static and dynamic checks, but it is not a pure static analysis action performed by the analyst directly on the file. Option D is wrong because using Wireshark to capture packets sent by the file requires execution of the file, which falls under dynamic or network-based analysis, not static analysis.

Practice this question →