CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are techniques used in session hijacking attacks? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse network-level attacks like ARP poisoning or DNS spoofing with session hijacking, which specifically requires taking over an authenticated session by manipulating TCP sequence numbers or stealing session tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP sequence prediction
TCP sequence prediction (A) is a classic session hijacking technique: the attacker sniffs or guesses the next expected TCP sequence and acknowledgment numbers of an established connection, then injects forged packets that the server accepts as belonging to the legitimate session. Cookie theft (C) is also a session hijacking technique because session cookies carry the session ID; if an attacker obtains them via XSS, sniffing, or malware, they can replay the cookie to impersonate the authenticated user without knowing credentials. MAC flooding (B) is a Layer 2 switch CAM-table overflow attack that can enable sniffing, but it is not itself a session hijacking technique. DNS spoofing (D) redirects name resolution to a rogue IP address, which supports phishing or man-in-the-middle but does not hijack an existing session. ARP poisoning (E) is a Layer 2 man-in-the-middle enabler that can facilitate session hijacking, but it is not itself classified as a session hijacking technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TCP sequence prediction
Why this is correct
TCP sequence prediction is a network-layer session hijacking technique where an attacker attempts to guess the next valid sequence number and acknowledgment number in an ongoing TCP connection. By successfully predicting these numbers, the attacker can inject spoofed packets into the session, impersonating one of the legitimate communicating parties. This allows them to take control of the established connection, send malicious commands, or terminate the session without authorization.
- ✗
MAC flooding
Why it's wrong here
MAC flooding is a Layer 2 attack that overwhelms a network switch's Content Addressable Memory (CAM) table with a large number of spoofed MAC addresses. This forces the switch to enter 'fail-open' mode, behaving like a hub by broadcasting all incoming traffic to all ports. While MAC flooding facilitates sniffing network traffic, it does not directly hijack an existing session; it merely changes the network's behavior to allow for passive eavesdropping.
- ✓
Cookie theft
Why this is correct
Cookie theft is an application-layer session hijacking technique where an attacker steals a user's session cookie, which typically contains a unique session ID. This session ID is used by the web server to identify the authenticated user and maintain their state across multiple requests. By obtaining the legitimate user's session cookie, the attacker can present it to the web server and effectively impersonate the user, gaining unauthorized access to their active session without needing their login credentials.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing, also known as DNS cache poisoning, involves an attacker injecting forged DNS records into a DNS resolver's cache or responding to DNS queries with false information. This redirects users attempting to access a legitimate website to an attacker-controlled malicious site. While it can lead to phishing or Man-in-the-Middle attacks, DNS spoofing itself does not directly hijack an already established session; instead, it manipulates the initial connection setup or subsequent connection attempts.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning is a Layer 2 attack where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. This associates the attacker's MAC address with the IP address of another host, such as the default gateway or another client, causing traffic intended for the legitimate host to be redirected through the attacker's machine. While ARP poisoning is a common prerequisite for Man-in-the-Middle (MITM) attacks, which can then facilitate session hijacking by sniffing credentials or cookies, it is not the session hijacking technique itself but rather a method for traffic interception.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Sniffing
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.