CEH Practice Question: Malware, Social Engineering and Network Attacks
Which TWO of the following are valid techniques for session hijacking? (Select 2)
⚠ Common exam trap
In the CEH exam, it's important to distinguish between direct session hijacking techniques (like TCP sequence prediction and cookie theft) and network-level attacks that enable interception but not direct hijacking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TCP sequence prediction
TCP sequence prediction (C) is a valid session hijacking technique because an attacker who can guess or infer the next expected TCP sequence and acknowledgment numbers can inject forged packets into an established TCP session, impersonating the legitimate client without ever seeing the authentication exchange. Cookie theft (D) is also valid because session cookies often serve as the bearer token for an authenticated HTTP session, so stealing a cookie (via XSS, sniffing, or malware) lets the attacker replay it and take over the victim's session. DNS spoofing (A), MAC flooding (B), and ARP poisoning (E) are not session hijacking techniques themselves: DNS spoofing redirects name resolution, MAC flooding overflows a switch's CAM table to force hub-like flooding, and ARP poisoning enables man-in-the-middle traffic interception — each may facilitate an attack, but none directly hijacks an existing session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS spoofing
Why it's wrong here
DNS spoofing redirects name resolution to a fraudulent server, which can capture credentials but does not hijack an already-authenticated session. It is tempting because it enables man-in-the-middle positioning, yet session hijacking specifically requires theft or prediction of a valid session token or cookie.
- ✗
MAC flooding
Why it's wrong here
MAC flooding overflows a switch's CAM table, forcing it to broadcast frames so a sniffer can capture traffic; it does not itself take over an established session. It is tempting because it is a genuine layer-2 attack, but session hijacking requires stealing or predicting a valid session token or cookie.
- ✓
TCP sequence prediction
Why this is correct
TCP sequence prediction lets an attacker forge packets by guessing the next sequence number, hijacking an established session without seeing the traffic. It exploits predictable initial sequence numbers, making it a valid session hijacking technique.
- ✓
Cookie theft
Why this is correct
Cookie theft captures the session identifier stored in the browser's cookie, letting an attacker replay it to impersonate the authenticated user. This directly satisfies the session hijacking scenario by exploiting a valid, active session token rather than cracking credentials.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning is a network interception technique that positions an attacker to capture traffic, but it does not itself hijack a session; it enables sniffing. Session hijacking requires stealing or predicting the session token, then injecting it. ARP poisoning is a precursor, not a hijacking method.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Malware Threats
Key term
Session Hijacking
Session hijacking is an attack where a cybercriminal steals or takes over a user's active session with a web application, allowing the attacker to pretend to be that user without needing their password.
Key term
Cross Site Scripting XSS
Cross Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into web pages viewed by other users, enabling theft of data or session hijacking.
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.