Certified Ethical Hacker CEH practice test

A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?

Trap 1: The server redirects to a login page (302)

A redirect to login usually occurs after a failed authentication, not a successful SQL injection.

Trap 2: The server returns a 500 Internal Server Error

500 error typically indicates a syntax or runtime error, which may mean the injection failed or caused an error.

Trap 3: The client receives no response (timeout)

No response often indicates the injection caused a crash or infinite loop, not success.

A
The server redirects to a login page (302)
Why wrong: A redirect to login usually occurs after a failed authentication, not a successful SQL injection.
B
The server returns a 500 Internal Server Error
Why wrong: 500 error typically indicates a syntax or runtime error, which may mean the injection failed or caused an error.
C
The response contains database error messages or unexpected data
Database error messages or extra data in the response are strong indicators of successful injection.
D
The server returns a 200 OK status code
200 OK often indicates the injected query executed successfully and returned data.
E
The client receives no response (timeout)
Why wrong: No response often indicates the injection caused a crash or infinite loop, not success.

Question 2easymultiple choice

You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?

Trap 1: Enable RDS Enhanced Monitoring and log all connections to the…

Logging does not block the open port.

Trap 2: Enable deletion protection on the RDS instance to prevent…

Deletion protection does not affect network access.

Trap 3: Enable encryption at rest for the RDS instance using AWS KMS.

Encryption protects data if accessed, but the port remains open.

A
Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.
This restricts access to only authorized sources, closing the exposure.
B
Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.
Why wrong: Logging does not block the open port.
C
Enable deletion protection on the RDS instance to prevent accidental removal.
Why wrong: Deletion protection does not affect network access.
D
Enable encryption at rest for the RDS instance using AWS KMS.
Why wrong: Encryption protects data if accessed, but the port remains open.

Question 3mediummulti select

An organization is implementing a social engineering defense program. Which TWO measures are most effective in reducing the risk of phishing attacks? (Choose two.)

Trap 1: Implement strong password policies with multi-factor authentication.

Passwords do not prevent users from clicking malicious links.

Trap 2: Enforce regular software updates and patch management.

Patching addresses technical vulnerabilities, not social engineering.

Trap 3: Deploy network segmentation and access control lists.

Segmentation limits damage but does not prevent phishing.

A
Implement strong password policies with multi-factor authentication.
Why wrong: Passwords do not prevent users from clicking malicious links.
B
Enforce regular software updates and patch management.
Why wrong: Patching addresses technical vulnerabilities, not social engineering.
C
Conduct regular security awareness training for all employees.
Training helps users identify and report phishing attempts.
D
Deploy network segmentation and access control lists.
Why wrong: Segmentation limits damage but does not prevent phishing.
E
Install advanced email filtering and anti-malware solutions.
Filters block many phishing emails before reaching users.

Question 4mediummultiple choice

An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?

Trap 1: Use SQLMap to test for SQL injection

SQLMap tests for SQLi, not RFI.

Trap 2: Scan the server with Nikto to detect known RFI signatures

Nikto can detect potential RFI, but manual verification is needed.

Trap 3: Attempt to include a remote URL containing a web shell

This could compromise the server and is not a safe test.

A
Craft a request with a local file inclusion parameter pointing to /etc/passwd
This safely confirms RFI by reading a local file, proving the vulnerability.
B
Use SQLMap to test for SQL injection
Why wrong: SQLMap tests for SQLi, not RFI.
C
Scan the server with Nikto to detect known RFI signatures
Why wrong: Nikto can detect potential RFI, but manual verification is needed.
D
Attempt to include a remote URL containing a web shell
Why wrong: This could compromise the server and is not a safe test.

Question 5easymultiple choice

A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?

Trap 1: Nikto

Nikto is a web vulnerability scanner, not for SMB.

Trap 2: Hydra

Hydra is for password brute-forcing, not enumeration.

Trap 3: Nmap

Nmap scans ports but does not perform detailed SMB enumeration.

A
Nikto
Why wrong: Nikto is a web vulnerability scanner, not for SMB.
B
Hydra
Why wrong: Hydra is for password brute-forcing, not enumeration.
C
Nmap
Why wrong: Nmap scans ports but does not perform detailed SMB enumeration.
D
enum4linux
Correct: enum4linux extracts SMB information like users, shares, and OS details.

Question 6hardmulti select

Which TWO of the following are effective physical security controls to prevent tailgating?

Trap 1: Biometric door lock

Biometric lock authenticates but does not prevent someone from following.

Trap 2: CCTV cameras

CCTV detects but does not prevent tailgating.

Trap 3: Security guard

Security guard is a personnel control, not a physical control device.

A
Biometric door lock
Why wrong: Biometric lock authenticates but does not prevent someone from following.
B
Mantrap
Mantrap requires one person to pass through and door to close before next opens, preventing tailgating.
C
CCTV cameras
Why wrong: CCTV detects but does not prevent tailgating.
D
Security guard
Why wrong: Security guard is a personnel control, not a physical control device.
E
Turnstile with one-way access
Turnstile physically restricts entry to one person per credential.