CEH Practice Question: Malware, Social Engineering and Network Attacks
Which tool would an ethical hacker use to automatically generate a malicious USB drive that, when plugged in, executes a payload and connects back to the attacker?
⚠ Common exam trap
Test-takers frequently confuse Metasploit as the tool for generating the USB drive itself, but Metasploit is used to create the payload, while the USB Rubber Ducky is the specific hardware tool that automates the injection process when the drive is plugged in.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
USB Rubber Ducky
The USB Rubber Ducky is a keystroke injection tool that appears as a keyboard to the host computer. When plugged in, it automatically types a pre-programmed payload at high speed, which can download and execute a reverse shell or other malware, establishing a connection back to the attacker. This makes it the correct choice for automatically generating a malicious USB drive that executes a payload upon insertion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful network protocol analyzer used for capturing and inspecting network traffic in real-time. Its primary function involves passive analysis, allowing ethical hackers to understand network communications, troubleshoot issues, or identify vulnerabilities by examining packets. However, it is not designed to generate or execute active USB-based attacks, nor does it emulate USB devices for payload injection.
- ✗
Ettercap
Why it's wrong here
Ettercap is a comprehensive suite for man-in-the-middle (MITM) attacks, primarily operating at the network layer to intercept and manipulate traffic between hosts. It excels at ARP spoofing, DNS spoofing, and session hijacking over a network connection. While effective for network-based exploitation, Ettercap lacks the functionality to directly interact with or emulate USB devices for automated physical attacks.
- ✓
USB Rubber Ducky
Why this is correct
The USB Rubber Ducky is a specialized keystroke injection tool that emulates a standard human interface device (HID), specifically a keyboard, when plugged into a target system. This allows it to automatically and rapidly inject pre-programmed keystrokes and commands, bypassing many traditional security controls like antivirus software and firewalls. Its ability to deliver complex payloads at 'typing speed' makes it highly effective for automated USB-based attacks.
- ✗
Metasploit
Why it's wrong here
Metasploit is an extensive penetration testing framework that provides a vast collection of exploits, payloads, and post-exploitation modules for various operating systems and applications. While it can generate payloads that might be delivered via a USB drive (e.g., embedded in an executable file), Metasploit itself does not directly function as a USB device emulator to automatically inject commands upon insertion. Its strength lies in exploit development and network-based attack orchestration, rather than direct USB hardware interaction for automated injection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.