CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are techniques used in session hijacking? (Choose 2)
⚠ Common exam trap
EC-CEH often tests the distinction between session hijacking (directly taking over an active session) and network-level attacks (like ARP poisoning or MAC flooding) that merely enable interception or sniffing, causing candidates to confuse enabling techniques with the hijacking technique itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cookie theft
Cookie theft (A) is a session hijacking technique because an attacker who captures a valid session cookie — for example via XSS, sniffing an unencrypted HTTP session, or malware — can replay it to impersonate the authenticated user without knowing credentials. TCP sequence prediction (D) is also a session hijacking technique: the attacker guesses the next ISN/sequence and acknowledgment numbers to inject packets into an established TCP session, spoofing the victim's address and taking over the connection. MAC flooding (B) is a Layer 2 switch attack that overflows the CAM table to force hub-like flooding; it enables sniffing but is not itself session hijacking. ARP poisoning (C) is a man-in-the-middle technique that redirects traffic by falsifying IP-to-MAC mappings; it can facilitate hijacking but is not the hijacking technique itself. DNS spoofing (E) forges DNS responses to redirect name resolution to a malicious host, which is a redirection/phishing technique rather than session hijacking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cookie theft
Why this is correct
Cookie theft directly enables session hijacking by capturing the session identifier stored in a browser cookie, allowing an attacker to impersonate the authenticated user without credentials. This satisfies the stem's requirement for a session hijacking technique, as possession of a valid session token grants immediate access to the victim's active session.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overflows a switch's CAM table, forcing it to broadcast frames, which aids sniffing rather than hijacking an established session. It is tempting because it enables traffic capture. Session hijacking specifically involves stealing or predicting a valid session token, such as via session fixation or cross-site scripting.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning enables on-path interception by mapping an attacker's MAC to a victim's IP, but it is a network redirection technique, not session hijacking itself. It is tempting because it often precedes hijacking. Session hijacking techniques instead include session fixation, session sidejacking and cross-site scripting token theft.
- ✓
TCP sequence prediction
Why this is correct
TCP sequence prediction lets an attacker forge packets that appear to belong to an established connection by guessing the next sequence number, enabling takeover of a valid session without authentication. It directly satisfies the stem's requirement for a session hijacking technique, operating at the transport layer against TCP's trust in sequence numbers.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing redirects name resolution to a fraudulent IP address; it does not steal or reuse an established session identifier. It is a poisoning technique used for redirection or pharming, whereas session hijacking requires capturing or predicting a valid session token, as in TCP sequence prediction or session fixation.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Sniffing
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.