CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are techniques used in session hijacking? (Choose 2)
⚠ Common exam trap
EC-CEH often tests the distinction between session hijacking (directly taking over an active session) and network-level attacks (like ARP poisoning or MAC flooding) that merely enable interception or sniffing, causing candidates to confuse enabling techniques with the hijacking technique itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cookie theft
Cookie theft is a session hijacking technique where an attacker captures a user's session cookie (e.g., via XSS, packet sniffing, or malware) and uses it to impersonate the user. Since HTTP is stateless, the server relies on the cookie to identify the session, so stealing it grants the attacker unauthorized access without needing credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cookie theft
Why this is correct
Stealing session cookies allows an attacker to impersonate a user.
- ✗
MAC flooding
Why it's wrong here
MAC flooding is for sniffing, not session hijacking.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning enables MITM but is not session hijacking itself.
- ✓
TCP sequence prediction
Why this is correct
Predicting sequence numbers allows an attacker to spoof packets and hijack a TCP session.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing redirects traffic but does not hijack an existing session.
Go deeper
Related to this question
Learn chapter
Malware Threats
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.