262 free EC-Council 312-50v13 CEH v13 practice questions from the CertStash pack of 1,049, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 262 free here, all 1,049 in the pack, and each step includes the one before it.
Get all 1,049 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
In this form of encryption algorithm, every individual block contains 64-bit data, and three keys are used, where each key consists of 56 bits. Which is this encryption algorithm?
Show answer and explanation
Correct answer: B. Triple Data Encryption Standard
Triple Data Encryption Standard (3DES) is characterized by using three 56-bit keys and operating on 64-bit blocks of data. It applies the DES algorithm three times to each block, making it the only option that matches all specified criteria: three keys of 56 bits each and 64-bit data blocks.
Why the other options are wrong
- A. IDEA uses 128-bit keys and 64-bit blocks, not three 56-bit keys.
- C. AES uses 128, 192, or 256-bit keys and operates on 128-bit blocks, not 64-bit blocks.
- D. MD5 is a hash function, not a block cipher, and does not use keys in the traditional encryption sense.
Question 2
John, a professional hacker, performs a network attack on a renowned organization and gains unauthorized access to the target network. He remains in the network without being detected for a long time and obtains sensitive information without sabotaging the organization. Which of the following attack techniques is used by John?
Show answer and explanation
Correct answer: D. Advanced persistent threat
An Advanced Persistent Threat (APT) is characterized by an attacker gaining unauthorized access, remaining undetected for an extended period, and stealing sensitive information without disrupting operations. John's actions, stealthy long-term presence, information theft without sabotage, are hallmarks of an APT attack.
Why the other options are wrong
- A. An insider threat involves someone with legitimate access; John is described as unauthorized.
- B. Diversion theft is not a recognized attack classification in cybersecurity frameworks.
- C. Spear-phishing sites are initial access vectors, not methods for maintaining persistent undetected presence in a network.
Question 3
You are attempting to run an Nmap port scan on a web server. Which of the following commands would result in a scan of common ports with the least amount of noise in order to evade IDS?
Show answer and explanation
Correct answer: C. nmap -sT -O -T0
The command 'nmap -sT -O -T0' uses TCP connect scan (-sT), OS detection (-O), and timing template T0 (paranoid/slowest). The T0 timing is the slowest mode that sends one probe at a time with long delays, generating minimal network noise and traffic patterns that are least likely to trigger IDS detection compared to other options.
Why the other options are wrong
- A. -A is aggressive scan mode with maximum noise; -Pn skips ping but doesn't reduce IDS detection.
- B. -sP is ping scan; -p-65535 scans all ports generating high traffic; -T5 is the fastest timing template creating maximum noise.
- D. -A is aggressive; --host-timeout doesn't reduce IDS evasion; -T1 (sneaky) is slower than T0 but less effective than pure T0 with stealth-focused options.
Question 4
This wireless security protocol allows 192-bit minimum-strength security protocols and cryptographic tools to protect sensitive data, such as GCMP-256, HMAC-SHA384, and ECDSA using a 384-bit elliptic curve. Which is this wireless security protocol?
Show answer and explanation
Correct answer: B. WPA3-Enterprise
WPA3-Enterprise provides 192-bit minimum encryption strength and supports advanced cryptographic tools including GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption), HMAC-SHA384, and ECDSA with 384-bit elliptic curves. These are enterprise-grade security features designed for organizations requiring the highest protection standards.
Why the other options are wrong
- A. WPA3-Personal provides 128-bit security, not 192-bit minimum strength.
- C. WPA2-Enterprise does not support 192-bit protocols or GCMP-256/HMAC-SHA384; it predates these advanced specifications.
- D. WPA2-Personal is the consumer-grade WPA2 version with lower security standards than WPA3-Enterprise.
Question 5
What are common files on a web server that can be misconfigured and provide useful information for a hacker such as verbose error messages?
Show answer and explanation
Correct answer: C. php.ini
The php.ini file is a common web server configuration file that, when misconfigured, can expose verbose error messages and sensitive debugging information. Settings like 'display_errors=On' in php.ini cause detailed error messages to be displayed to users, revealing valuable information about the application structure and backend systems.
Why the other options are wrong
- A. httpd.conf controls Apache server behavior but is not typically the source of verbose error messages in the same way.
- B. administration.config is not a standard web server configuration file.
- D. idq.dll is an IIS component for indexing; while it can be exploited, it is not primarily misconfigured to show verbose error messages.
Question 6
Gerard, a disgruntled ex-employee of Sunglass IT Solutions, targets this organization to perform sophisticated attacks and bring down its reputation in the market. To launch the attacks process, he performed DNS footprinting to gather information about DNS servers and to identify the hosts connected in the target network. He used an automated tool that can retrieve information about DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois records. He further exploited this information to launch other sophisticated attacks. What is the tool employed by Gerard in the above scenario?
Show answer and explanation
Correct answer: D. Bluto
Bluto is an automated DNS reconnaissance tool designed to retrieve comprehensive DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois information. It is specifically built for DNS footprinting and enumeration attacks, matching Gerard's described actions perfectly.
Why the other options are wrong
- A. Towelroot is an Android rooting tool, not a DNS reconnaissance tool.
- B. Knative is a Kubernetes-based serverless platform, not related to DNS footprinting.
- C. zANTI is a mobile penetration testing framework, not specifically a DNS zone transfer or footprinting tool.
Question 7
Tony is a penetration tester tasked with performing a penetration test. After gaining initial access to a target system, he finds a list of hashed passwords. Which of the following tools would not be useful for cracking the hashed passwords?
Show answer and explanation
Correct answer: D. netcat
Netcat is a network utility for reading and writing data across network connections; it is useful for network reconnaissance and communication but has no cryptographic functionality for cracking or verifying hashed passwords. Hashcat and John the Ripper are specialized password cracking tools, and THC-Hydra performs brute-force attacks.
Why the other options are wrong
- A. Hashcat is a GPU-accelerated password cracking tool specifically designed for hash cracking.
- B. John the Ripper is a widely-used password cracking tool that supports numerous hash formats.
- C. THC-Hydra performs brute-force password attacks and can be used against hashed password systems.
Question 8
Which of the following Google advanced search operators helps an attacker in gathering information about websites that are similar to a specified target URL?
Show answer and explanation
Correct answer: D. [related:]
The 'related:' operator displays websites similar to a specified target URL. An attacker can use this to find competing or similar websites that may share similar vulnerabilities, configurations, or security postures as the target organization.
Why the other options are wrong
- A. inurl: searches for keywords within URLs, not for similar websites.
- B. info: displays cached and link information about a specific URL, not similar sites.
- C. site: restricts search results to a specific domain, not for finding similar websites.
Question 9
You are a penetration tester working to test the user awareness of the employees of the client XYZ. You harvested two employees’ emails from some public sources and are creating a client-side backdoor to send it to the employees via email. Which stage of the cyber kill chain are you at?
Show answer and explanation
Correct answer: B. Weaponization
The scenario describes creating a client-side backdoor, which is a weaponization activity. Reconnaissance (stage 1) involves gathering information about targets. Weaponization (stage 2) involves creating malware and tools to exploit vulnerabilities. Command and Control (stage 4) involves establishing communication with compromised systems. Exploitation (stage 5) involves delivering and executing the weapon. Since the tester has already harvested emails (reconnaissance complete) and is now creating a backdoor to send, this is the weaponization stage where tools are being developed and prepared for delivery.
Why the other options are wrong
- A. Reconnaissance was already completed when emails were harvested from public sources.
- C. Command and Control occurs after successful exploitation when maintaining access to compromised systems.
- D. Exploitation is the delivery and execution phase, which comes after weaponization.
Question 10
A penetration tester is performing an enumeration on a client's network. The tester has acquired permission to perform enumeration activities. They have identified a remote inter-process communication (IPC) share and are trying to collect more information about it. The tester decides to use a common enumeration technique to collect the desired data. Which of the following techniques would be most appropriate for this scenario?
Show answer and explanation
Correct answer: A. Probe the IPC share by attempting to brute force admin credentials
When attempting to enumerate an IPC$ share during authorized penetration testing, the most appropriate technique is to attempt credential brute forcing against the identified share. IPC$ shares can be accessed with valid credentials, making credential enumeration the logical enumeration approach. Options B, C, and D are enumeration techniques but not appropriate for directly enumerating IPC share contents.
Why the other options are wrong
- B. Brute forcing Active Directory is a different enumeration target, not IPC share specific.
- C. Extracting usernames from email IDs is indirect and not the primary IPC enumeration method.
- D. DNS zone transfer targets DNS records, not IPC share enumeration.
What people say about the full 312-50v13 CEH v13 pack 4.8 from 24
Passed the exam. Good to know what to expect before going in. Recommended!
Worth it. Passed my exam today, most of the questions were from this dumps. Do not go to exam without preparing the dumps.
Honestly the best prep resource I found. Solid dump. Would buy again.
Question 11
An ethical hacker is hired to evaluate the defenses of an organization's database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system's signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?
Show answer and explanation
Correct answer: A. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing
Using the CHAR() encoding function to convert hexadecimal and decimal values into characters is an advanced SQL injection evasion technique that bypasses signature-based IDS systems. Since signature-based IDS looks for known attack patterns (like 'OR 1=1'), encoding the SQL commands into character representations allows the malicious SQL to pass through without matching known signatures while still executing properly in the SQL engine.
Why the other options are wrong
- B. While sophisticated query matches like "OR john'='john'" are evasion attempts, this is a basic logic-based bypass, not an advanced encoding technique.
- C. Manipulating whitespace bypasses simple signature patterns but is not as advanced as encoding functions and can still be detected by more sophisticated signatures.
- D. URL encoding operates at the HTTP protocol level; it's a transport layer encoding, not a SQL engine-level bypass technique for signature-based detection.
Question 12
An ethical hacker is preparing to scan a network to identify live systems. To increase the efficiency and accuracy of his scans, he is considering several different host discovery techniques. He expects several unused IP addresses at any given time, specifically within the private address range of the LAN, but he also anticipates the presence of restrictive firewalls that may conceal active devices. Which scanning method would be most effective in this situation?
Show answer and explanation
Correct answer: D. ARP Ping Scan
ARP Ping Scan is the most effective method for discovering live systems on a local LAN because ARP operates at Layer 2 (Data Link) and doesn't rely on IP routing or ICMP. It works regardless of firewall rules that block ICMP or TCP/UDP ports, and it's especially effective on private LANs where ARP requests will reach all devices on the local segment. The other options rely on ICMP (A, B) or TCP (C), all of which can be blocked by restrictive firewalls that the question specifically mentions.
Why the other options are wrong
- A. ICMP ECHO Ping Sweep can be easily blocked by firewalls, making it ineffective against restrictive security.
- B. ICMP Timestamp Ping also uses ICMP protocol and will be blocked by firewalls.
- C. TCP SYN Ping may be blocked by stateful firewalls that don't allow inbound SYN packets.
Question 13
As a cybersecurity analyst for a leading multinational company, you have unearthed evidence suggesting a breach. Analysis indicates that sophisticated steganography techniques are in play, allowing the hacker to exfiltrate data by cleverly embedding it within image files. Confronted with the deceptive nature of steganography and its potential implications, which course of action offers the best chance to detect and counteract this clandestine threat?
Show answer and explanation
Correct answer: C. Engage a specialized steganalysis tool to scrutinize questionable files, decode the obscured data, and reveal the hacker’s exfiltration methodology.
To detect and counter steganography-based data exfiltration, a specialized steganalysis tool is required. Steganalysis examines files to detect hidden data patterns, decode embedded information, and reveal the steganographic methodology used by the attacker. This is a specialized forensic technique that goes beyond general security tools, a firewall and IPS cannot detect data hidden within images, and a general network analyzer lacks the sophistication to identify steganographic patterns.
Why the other options are wrong
- A. A firewall intercepts traffic but cannot detect or analyze data embedded within image files.
- B. An IPS detects unauthorized activities but cannot decode hidden data within seemingly legitimate image transfers.
- D. Network traffic analyzers see outbound image files but lack the capability to detect or decode embedded steganographic content.
Question 14
Don, a student, came across a gaming app in a third-party app store and installed it. Subsequently, all the legitimate apps in his smartphone were replaced by deceptive applications that appeared legitimate. He also received many advertisements on his smartphone after installing the app. What is the attack performed on Don in the above scenario?
Show answer and explanation
Correct answer: D. Agent Smith attack
The Agent Smith attack is a sophisticated mobile malware that replaces legitimate applications with malicious ones that appear legitimate. It also displays aggressive advertising and can spread to other devices. This matches the scenario where legitimate apps were replaced by deceptive applications with excessive advertisements.
Why the other options are wrong
- A. SIM card attacks involve compromising the SIM card itself, not app replacement.
- B. Clickjacking tricks users into clicking elements they don't intend; it doesn't replace apps.
- C. SMS phishing sends deceptive text messages but doesn't replace installed applications.
Question 15
Alex, a cloud security engineer working in Eyecloud Inc. is tasked with isolating applications from the underlying infrastructure and stimulating communication via well-defined channels. For this purpose, he used an open-source technology that helped him in developing, packaging, and running applications; further, the technology provides PaaS through OS-level virtualization, delivers containerized software packages, and promotes fast software delivery. What is the cloud technology employed by Alex in the above scenario?
Show answer and explanation
Correct answer: B. Docker
Docker is an open-source containerization platform that enables developers to package, deploy, and run applications in isolated containers. It provides OS-level virtualization through containers, delivers containerized software packages, and facilitates fast software delivery by isolating applications from the underlying infrastructure. Docker uses well-defined channels (APIs and networking) for inter-container communication and has become the standard for containerized application deployment.
Why the other options are wrong
- A. Virtual machines provide hardware-level virtualization, not OS-level containerization, and are heavier than containers.
- C. Zero trust network is a security framework, not a containerization or packaging technology.
- D. Serverless computing is an execution model where infrastructure is managed by providers; it doesn't involve packaging and running applications in containers.
Question 16
You are a cybersecurity trainer and are planning a course on ethical hacking for some newcomers in your organization. While creating the content, you recall from the CEH vl2 study material that there are different types of penetration tests. Which of the following best describes a black box penetration test?
Show answer and explanation
Correct answer: B. The tester has no prior knowledge of the system to be tested.
A black box penetration test is defined by the tester having zero prior knowledge of the target system, mimicking an external attacker with no insider information. The tester has no credentials, system architecture details, or any other information about the system being tested, making this a true blind assessment of the system's security posture.
Why the other options are wrong
- A. This describes a gray box test where the tester has partial knowledge.
- C. This describes a testing methodology approach, not a black box characterization.
- D. This describes a white box test where the tester has complete system knowledge.
Question 17
During an ethical hacking engagement, you have been assigned to evaluate the security of a large organization's network. While examining the network traffic, you notice numerous incoming requests on various ports from different locations that show a pattern of an orchestrated attack. Based on your analysis, you deduce that the requests are likely to be automated scripts being run by unskilled hackers. What type of hacker classification does this scenario most likely represent?
Show answer and explanation
Correct answer: A. Script Kiddies trying to compromise the system using pre-made scripts.
Script Kiddies are characterized by using pre-made tools and scripts without deep technical knowledge. The scenario describes automated scripts running from various locations in an orchestrated pattern, which is typical of script kiddies who lack the skill to create custom exploits. The mention of 'unskilled hackers' and 'automated scripts' directly aligns with the definition of script kiddies.
Why the other options are wrong
- B. Gray Hats conduct authorized testing with vendor cooperation and wouldn't launch uncontrolled attacks across multiple ports and locations.
- C. White Hats perform authorized penetration testing for organizations and operate within defined scopes and rules of engagement.
- D. While Black Hats may use automated attacks, the emphasis on 'unskilled hackers' and 'pre-made scripts' specifically distinguishes script kiddies rather than sophisticated black hats.
Question 18
Henry is a penetration tester who works for XYZ organization. While performing enumeration on a client organization, he queries the DNS server for a specific cached DNS record. Further, by using this cached record, he determines the sites recently visited by the organization's user. What is the enumeration technique used by Henry on the organization?
Show answer and explanation
Correct answer: B. DNS cache snooping
DNS cache snooping is an enumeration technique that queries a DNS resolver to retrieve cached DNS records and determine recently visited sites by an organization's users. An attacker queries the DNS server for specific cached records, which reveals the websites that have been accessed and cached by the resolver. This passive information gathering technique doesn't modify the cache but simply reads previously cached DNS responses.
Why the other options are wrong
- A. DNS zone walking involves transferring entire DNS zones through zone transfer attacks, not querying cached records.
- C. DNS cache poisoning involves injecting false records into a cache, not querying existing cached records to determine visited sites.
- D. DNSSEC zone walking is a more advanced technique involving DNSSEC-signed zones, not simple cache record enumeration.
Question 19
Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network. Which of the following host discovery techniques must he use to perform the given task?
Show answer and explanation
Correct answer: C. ACK flag probe scan
The ACK flag probe scan is used for firewall evasion and host discovery because it sends ACK packets that can bypass stateless firewall filters. Since standard ping and SYN scans are often blocked, ACK probes can still elicit responses from active hosts hidden behind restrictive firewalls.
Why the other options are wrong
- A. UDP scan is primarily a port scanning technique and less effective for discovering hosts behind restrictive firewalls.
- B. ARP ping scan works only on local network segments (same subnet) and cannot traverse firewalls to scan remote IPv4 ranges.
- D. TCP Maimon scan is a port scanning technique used to identify open/closed ports, not specifically for host discovery behind firewalls.
Question 20
A large organization has recently performed a vulnerability assessment using Nessus Professional, and the security team is now preparing the final report. They have identified a high-risk vulnerability, named XYZ, which could potentially allow unauthorized access to the network. In preparing the report, which of the following elements would NOT be typically included in the detailed documentation for this specific vulnerability?
Show answer and explanation
Correct answer: B. The total number of high, medium, and low-risk vulnerabilities detected throughout the network.
A detailed vulnerability report for a specific vulnerability (XYZ) would include the PoC, affected systems, and CVE mapping, but would NOT typically include aggregate statistics like total counts of high/medium/low vulnerabilities across the entire network. That aggregate data belongs in the executive summary or overview section of the full assessment report, not in the detailed documentation for a specific vulnerability.
Why the other options are wrong
- A. PoC is typically included in detailed vulnerability documentation to demonstrate impact.
- C. Affected systems list is essential for a specific vulnerability's detailed documentation.
- D. CVE ID and mapping are standard components of vulnerability-specific documentation.
Question 21
Which file is a rich target to discover the structure of a website during web-server footprinting?
Show answer and explanation
Correct answer: B. Robots.txt
Robots.txt is a critical file for discovering website structure as it contains directives indicating which paths should not be crawled by search engines, thereby revealing the sensitive or important directories and files on the web server that the administrator wants to hide.
Why the other options are wrong
- A. domain.txt is not a standard web server file used for structure discovery.
- C. Document root is a directory location, not a discoverable file for footprinting.
- D. index.html is the default page but doesn't reveal overall website structure like robots.txt does.
Question 22
During a red team engagement, an ethical hacker is tasked with testing the security measures of an organization's wireless network. The hacker needs to select an appropriate tool to carry out a session hijacking attack. Which of the following tools should the hacker use to effectively perform session hijacking and subsequent security analysis, given that the target wireless network has the Wi-Fi Protected Access-pre-shared key (WPA-PSK) security protocol in place?
Show answer and explanation
Correct answer: B. bettercap
Bettercap is a comprehensive network attack and reconnaissance tool designed for network penetration testing, including session hijacking capabilities on wireless networks. It can perform ARP spoofing, MITM attacks, and session hijacking on WPA-PSK networks after gaining access. It's specifically designed for advanced wireless security testing and red team engagements.
Why the other options are wrong
- A. Hetty is a HTTP request manipulation and testing tool, not a session hijacking or wireless network tool.
- C. DroidSheep is a mobile-specific tool for Android session hijacking; not suitable for wireless network testing infrastructure.
- D. FaceNiff is also a mobile tool (Android) for session hijacking on mobile platforms, not for wireless network infrastructure testing.
Question 23
A red team operator is assessing the resilience of a corporate network’s authentication infrastructure. They input valid usernames with specifically structured guesses based on prior intel about naming conventions, such as birthdates or favorite sports teams. The guesses are tailored and automated with logic-based iterations. Which technique best describes this targeted approach?
Show answer and explanation
Correct answer: A. Strategic pattern-based input using known logic.
The scenario describes a targeted guessing attack using logic-based iterations informed by known patterns (birthdates, sports teams, naming conventions). This is strategic pattern-based input using known logic, distinguishing it from purely random attacks. The attacker leverages intelligence about likely password patterns rather than exhaustive character testing or simple list combinations.
Why the other options are wrong
- B. Combining fragments from two lists lacks the structured logic and prior intelligence about naming conventions described in the scenario.
- C. Exhaustive character testing without context describes brute force, not the targeted pattern-based approach using known logic.
- D. Watching users type in public places describes shoulder surfing or physical observation, not an automated password guessing technique.
Question 24
During a cybersecurity operation, a CEH professional discovered an unknown Bluetooth Low Energy (BLE) device actively transmitting pairing signals. The professional decided to breach the BLE device using a crackle. The device was seen pairing and exchanging keys, leading to the establishment of a secure connection. However, the professional only managed to capture LL_ENC_REQ and LL_ENC_RSP packets, but not the Long-Term Key (LTK). Which of the following best describes the professional’s next course of action?
Show answer and explanation
Correct answer: D. The operation cannot continue without the LTK.
Without capturing the Long-Term Key (LTK), decrypting the BLE connection and continuing the attack is cryptographically impossible. The LTK is the fundamental security credential needed to establish encrypted communication in BLE pairing. While LL_ENC_REQ and LL_ENC_RSP packets were captured, these only initiate encryption negotiation; the actual LTK is required for decryption. Btlejacking requires an active connection after pairing, hcitool provides device information but not encryption keys, and decryption without the LTK is not feasible.
Why the other options are wrong
- A. Btlejacking requires the ability to decrypt and inject packets, which is impossible without the LTK.
- B. The pcap data cannot be decrypted without the LTK; the -o option does not substitute for missing cryptographic material.
- C. Hcitool inq provides device discovery information but does not help decrypt the connection or recover the missing LTK.
Question 25
A Certified Ethical Hacker (CEH) is investigating a recent attack on a company’s web server. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server’s document root directory, which stores critical HTML files, is named “certroot” and is stored in the directory /admin/web. The server root, which stores the server’s configuration, error, executable, and log files, is also identified. The CEH also notes that the server uses a virtual document tree for additional storage. The server was compromised via a DNS server hijacking attack where the attacker redirected all requests coming towards the target web server to their own malicious server. Given this scenario which of the following actions would most likely prevent such an attack in the future?
Show answer and explanation
Correct answer: D. Implementing DNSSEC on the DNS server
DNSSEC (Domain Name System Security Extensions) directly addresses DNS hijacking attacks by digitally signing DNS responses and validating their authenticity, preventing attackers from redirecting traffic through fraudulent DNS responses. While other measures like patching and changing IP addresses provide general security benefits, they do not specifically prevent DNS server hijacking. The described attack involved the attacker redirecting DNS requests to their own server, which DNSSEC would prevent by ensuring DNS response integrity and authenticity.
Why the other options are wrong
- A. Using LAMP architecture does not address DNS hijacking vulnerabilities at the DNS level.
- B. While important for overall security, patching doesn't specifically prevent DNS hijacking attacks.
- C. Changing IP addresses doesn't prevent DNS hijacking since attackers can re-hijack the DNS pointing to the new IP.
Question 26
While performing a vulnerability assessment for XYZ Corporation, you discover that several key systems are regularly interacting with unidentified external entities. These interactions often involve data transfers, both incoming and outgoing. While some of these might be legitimate, the nature and volume of this unmonitored traffic raise concerns about potential data exfiltration or malware introduction. Given the ambiguous nature of these interactions and the high stakes involved, which strategy would most directly identify and mitigate the vulnerabilities associated with these unsanctioned exchanges?
Show answer and explanation
Correct answer: A. Prioritize a behavioral analytics solution that profiles normal system behaviors and alerts on deviations, focusing on the interaction patterns of the identified systems.
Behavioral analytics that profiles normal system behavior and alerts on deviations is the most effective strategy for identifying and mitigating vulnerabilities in systems with ambiguous external interactions. This approach directly identifies which connections are anomalous versus baseline, distinguishes legitimate from potentially malicious traffic, and enables targeted investigation and remediation of confirmed threats without disrupting legitimate operations.
Why the other options are wrong
- B. Employee training addresses social engineering but does nothing to identify technical vulnerabilities, malware, or unauthorized automated system communications.
- C. Aggressive zero-trust cutting off all external interactions is operationally disruptive and impractical; it lacks granularity to distinguish legitimate from malicious interactions.
- D. Forensic analysis on identified systems is valuable but reactive; behavioral analytics proactively detects ongoing anomalies and is more direct for identifying and mitigating current vulnerabilities.
Question 27
As a cybersecurity analyst for SecureNet, you are performing a security assessment of a new mobile payment application. One of your primary concerns is the secure storage of customer data on the device. The application stores sensitive information such as credit card details and personal identification numbers (PINs) on the device. Which of the following measures would best ensure the security of this data?
Show answer and explanation
Correct answer: C. Encrypt all sensitive data stored on the device.
Encrypting all sensitive data stored on the device is the best measure to ensure security of credit card details and PINs. Encryption protects data at rest on the device, preventing unauthorized access even if the device is compromised or lost. This is a fundamental security practice for protecting stored sensitive information and is the most direct mitigation for data breach risk.
Why the other options are wrong
- A. GPS tracking helps locate devices but doesn't protect stored sensitive data from access.
- B. Regular app updates improve security generally but don't specifically address secure storage of existing data.
- D. Biometric authentication controls access to the app but doesn't protect data if the device is physically compromised.
Question 28
Miley, a professional hacker, decided to attack a target organization's network. To perform the attack, she used a tool to send fake ARP messages over the target network to link her MAC address with the target system's IP address. By performing this, Miley received messages directed to the victim's MAC address and further used the tool to intercept steal, modify, and block sensitive communication to the target system. What is the tool employed by Miley to perform the above attack?
Show answer and explanation
Correct answer: B. BetterCAP
BetterCAP is a comprehensive network attack toolkit that performs ARP spoofing to link an attacker's MAC address with a target system's IP address. It enables man-in-the-middle attacks to intercept, steal, modify, and block communications. Wireshark is a passive packet analyzer, DerpNSpoof is not a widely recognized tool, and Gobbler is not associated with ARP spoofing attacks.
Why the other options are wrong
- A. Wireshark is a passive network packet analyzer and sniffer, not a tool for performing active ARP spoofing attacks.
- C. DerpNSpoof is not a recognized or standard tool for ARP spoofing or network attacks.
- D. Gobbler is not a known tool for performing ARP spoofing or man-in-the-middle attacks.
Question 29
Mike, a security engineer, was recently hired by BigFox Ltd. The company recently experienced disastrous DoS attacks. The management had instructed Mike to build defensive strategies for the company's IT infrastructure to thwart DoS/DDoS attacks. Mike deployed some countermeasures to handle jamming and scrambling attacks. What is the countermeasure Mike applied to defend against jamming and scrambling attacks?
Show answer and explanation
Correct answer: D. Implement cognitive radios in the physical layer
Cognitive radios are an advanced countermeasure for jamming and scrambling attacks at the physical layer. They dynamically detect and adapt to radio frequency interference and jamming attempts by switching frequencies or modulation schemes. This is a sophisticated defense mechanism specifically designed to protect against spectrum-based attacks like jamming and scrambling.
Why the other options are wrong
- A. Allowing all addressed packets at ISP level increases vulnerability to DoS attacks rather than defending against them.
- B. Disabling TCP SYN cookie protection removes a critical DoS defense mechanism, making systems more vulnerable.
- C. Functions like gets and strcpy are associated with buffer overflow vulnerabilities, not DoS/DDoS mitigation strategies.
Question 30
Samuel, a security administrator, is assessing the configuration of a web server. He noticed that the server permits SSLv2 connections, and the same private key certificate is used on a different server that allows SSLv2 connections. This vulnerability makes the web server vulnerable to attacks as the SSLv2 server can leak key information. Which of the following attacks can be performed by exploiting the above vulnerability?
Show answer and explanation
Correct answer: B. DROWN attack
DROWN (Decrypting RSA Using Obsolete and Weakened eNcryption) is an attack that exploits the presence of SSLv2 on a server sharing the same RSA private key with other servers. SSLv2 has critical weaknesses that allow attackers to decrypt TLS connections on other servers using the same key. This precisely matches the vulnerability described in the scenario.
Why the other options are wrong
- A. A generic padding oracle is not the named attack here; DROWN is the specific cross-protocol Bleichenbacher padding oracle that uses SSLv2.
- C. DUHKabuses the ANSI X9.31 pseudorandom generator used with a hard-coded seed key.
- D. Side-channel attacks exploit implementation details; DROWN is specifically about SSLv2 protocol weakness.
Question 31
Working as an Information Security Analyst at a technology firm, you’ve been asked to design training material for employees about the potential dangers of session hijacking. As part of the training, you want to explain how attackers could use side jacking to compromise their accounts. Which of the following scenarios would most accurately describe a side jacking attack?
Show answer and explanation
Correct answer: C. An attacker intercepts network traffic, captures unencrypted session cookies, and uses these to impersonate the user.
Side jacking specifically involves intercepting unencrypted session cookies from network traffic and using them to impersonate the legitimate user. This attack exploits HTTP traffic that lacks HTTPS encryption. Option A describes cross-site scripting (XSS), option B describes firewall exploitation, and option D describes social engineering, none of these match the side jacking technique which requires capturing session identifiers from the network.
Why the other options are wrong
- A. This describes a cross-site scripting (XSS) attack, not side jacking.
- B. This describes direct network compromise, not session hijacking.
- D. This describes social engineering-based credential theft, not session hijacking.
Question 32
A penetration tester performs a vulnerability scan on a company’s web server and identifies several medium-risk vulnerabilities related to misconfigured settings. What should the tester do to verify the vulnerabilities?
Show answer and explanation
Correct answer: D. Use publicly available tools to exploit the vulnerabilities and confirm their impact
To verify vulnerabilities discovered during a scan, a penetration tester should use publicly available tools to exploit them in a controlled manner and confirm their actual impact. This validates that the vulnerabilities are real and exploitable within the authorized scope of the engagement, rather than false positives.
Why the other options are wrong
- A. Conducting a DoS attack is destructive and goes beyond verification; it's an offensive attack that may violate the scope of authorization.
- B. Ignoring medium-risk vulnerabilities fails to properly assess and validate security posture.
- C. Brute-force attacks on login pages are not appropriate for verifying misconfiguration vulnerabilities and may cause service disruption.
Question 33
An attacker utilizes a Wi-Fi Pineapple to run an access point with a legitimate-looking SSID for a nearby business in order to capture the wireless password. What kind of attack is this?
Show answer and explanation
Correct answer: D. Evil-twin attack
An evil-twin attack occurs when an attacker sets up a fake wireless access point with a legitimate-looking SSID to deceive users into connecting. The Wi-Fi Pineapple tool is commonly used for this purpose. Once users connect, attackers can capture credentials, passwords, and sensitive data transmitted over the fake network.
Why the other options are wrong
- A. MAC spoofing changes MAC addresses but doesn't create a fake legitimate-looking access point.
- B. War driving involves driving around to discover wireless networks, not creating fake ones.
- C. Phishing uses social engineering through emails or messages, not fake wireless networks.
Question 34
A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS), firewalls, and honeypots, to protect its network from malicious activities. Despite these measures, the security team has noticed suspicious traffic patterns indicating potential attempts to evade detection and breach the network perimeter. The team is tasked with identifying advanced evasion techniques and strengthening the defense mechanisms to mitigate emerging threats effectively. Given the scenario described, which sophisticated evasion technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the integrity of the cybersecurity firm’s network?
Show answer and explanation
Correct answer: D. Covert Channel Communication Exploiting Unused IP Header Fields to Conceal Malicious Traffic and Evade Detection by Security Devices
Covert channel communication exploiting unused IP header fields is the most challenging to detect and mitigate because it operates below traditional monitoring layers. This technique conceals malicious traffic within legitimate-looking packets by using unused or rarely monitored fields, making it extremely difficult for IDS, firewalls, and honeypots to identify the actual malicious payload.
Why the other options are wrong
- A. Packet fragmentation is detectable by stateful inspection engines that reassemble fragments before analysis.
- B. Polymorphic malware variants can be detected through behavioral analysis, heuristics, and sandboxing despite signature bypassing.
- C. Honeypot spoofing is relatively straightforward to detect through network fingerprinting and behavioral analysis techniques.
Question 35
A penetration tester is conducting a security assessment for a client and needs to capture sensitive information transmitted across multiple VLANs without being detected by the organization's security monitoring systems. The network employs strict VLAN segmentation and port security measures to restrict unauthorized access. Which advanced sniffing technique should the tester use to discreetly intercept and analyze traffic across all VLANs?
Show answer and explanation
Correct answer: C. Exploit a VLAN hopping vulnerability to access multiple VLANs
VLAN hopping exploits vulnerabilities in VLAN configuration to allow an attacker to access traffic and systems on VLANs they should not have access to. This technique enables the attacker to bypass VLAN segmentation controls and intercept traffic across multiple VLANs without being detected by standard port security measures, making it the most effective method for discreetly accessing traffic across multiple VLANs.
Why the other options are wrong
- A. A rogue DHCP server affects IP allocation but does not inherently provide cross-VLAN traffic interception.
- B. ARP poisoning works within a single VLAN/subnet and does not bypass VLAN segmentation to access multiple VLANs.
- D. Switch port mirroring requires administrative access to configure and would be immediately detected by security monitoring.
Question 36
A large media-streaming company begins receiving complaints from users that their web application is timing out or failing to load. The security team observes that the web server is overwhelmed with a high number of open HTTP connections, most of which appear to be legitimate but are transmitting data at an abnormally slow rate. These connections are never fully completed, causing the server’s resources to remain occupied and unable to process new incoming client requests. The incident response team rules out bandwidth exhaustion and malformed packet-based attacks and suspects an application-layer DoS technique is responsible. Given the scenario, which specific type of attack is most likely being executed on the company’s web application?
Show answer and explanation
Correct answer: C. The attacker uses a Slowloris attack to keep many open connections alive, slowly exhausting the server’s connection pool.
Slowloris is a low-bandwidth, application-layer attack in which the attacker opens many HTTP connections and sends partial headers very slowly, periodically adding a few bytes to keep each socket alive without ever completing the request. The web server holds every connection open waiting for the request to finish, its connection pool or worker threads are exhausted, and legitimate users get timeouts, which matches the slow, never-completed but seemingly valid connections described.
Why the other options are wrong
- A. A random-port UDP flood is a volumetric bandwidth attack, and bandwidth exhaustion was explicitly ruled out.
- B. Overlapping fragment offsets constitute a malformed-packet (teardrop-style) attack, which the team also ruled out.
- D. An ICMP echo request flood is a network-layer volumetric attack and would not produce thousands of half-finished HTTP sessions.
Question 37
You are the lead cybersecurity analyst at a multinational corporation that uses a hybrid encryption system to secure inter-departmental communications. The system uses RSA encryption for key exchange and AES for data encryption, taking advantage of the strengths of both asymmetric and symmetric encryption. Each RSA key pair has a size of 'n' bits, with larger keys providing more security at the cost of slower performance. The time complexity of generating an RSA key pair is O(n^2), and AES encryption has a time complexity of O(n). An attacker has developed a quantum algorithm with time complexity O((log n)^2) to crack RSA encryption. Given 'n=4000' and variable 'AES key size', which scenario is likely to provide the best balance of security and performance?
Show answer and explanation
Correct answer: C. AES key size=192 bits: This configuration is a balance between options A and B, providing moderate security and performance.
AES-192 bits provides the best balance for this scenario. With n=4000, RSA key generation takes O(4000²)=16,000,000 operations, which is already substantial. Since the AES key size is independent of RSA key generation time, we should prioritize security in the symmetric component. AES-192 provides strong security (significantly better than 128-bit) while avoiding the performance penalty of AES-256 when combined with the already slow RSA key generation. This middle ground optimizes the overall system performance while maintaining robust security.
Why the other options are wrong
- A. AES-128 provides insufficient security for a corporation handling sensitive data.
- B. While secure, AES-256 adds unnecessary performance burden given the already slow RSA generation.
- D. AES-512 is not a standard AES key size and would impose severe performance penalties.
Question 38
As a cybersecurity professional in a growing organization, you are tasked with conducting comprehensive reconnaissance of your own company’s digital presence. In addition to using tools like WHOIS, DNS analysis, and search engines, you are also considering investigating the Deep Web. Which of the following justifications best supports your idea to explore the Deep Web for potential risks related to your organization’s information?
Show answer and explanation
Correct answer: D. Search engines don’t index the Deep Web, and there could be non-indexed company information lying there.
The Deep Web contains non-indexed content that standard search engines cannot reach, potentially including sensitive company information that has been leaked, posted to forums, or stored on private networks without proper access controls. This legitimate reconnaissance benefit allows security professionals to identify what sensitive organizational data may be publicly available or accessible through non-indexed channels. Option A confuses the Deep Web with malicious intent, option B is factually incorrect (location cannot be determined from Deep Web content), and option C overstates the Deep Web's relevance for insider threat detection.
Why the other options are wrong
- A. While hackers use the Deep Web, understanding hacking techniques does not justify Deep Web exploration specifically.
- B. The Deep Web does not contain reliable physical location data of attackers.
- C. The Deep Web is not a primary source for detecting insider threats; internal audit logs and employee monitoring are more effective.
Question 39
A penetration tester evaluates the security of an iOS mobile application that handles sensitive user information. The tester discovers that the application is vulnerable to insecure data transmission. What is the most effective method to exploit this vulnerability?
Show answer and explanation
Correct answer: A. Perform a man-in-the-middle attack to intercept unencrypted data transmitted over the network
A man-in-the-middle (MITM) attack is the most direct exploitation method for insecure data transmission. When data is transmitted unencrypted over the network, an attacker positioned between the client and server can intercept, read, and modify the data in transit. This vulnerability specifically results from lack of encryption/TLS protection, which MITM attacks exploit.
Why the other options are wrong
- B. CSRF attacks target state-changing actions using session tokens but don't directly exploit insecure transmission vulnerabilities.
- C. SQL injection targets backend server logic and databases, not client-side data transmission insecurity.
- D. Brute-force attacks target authentication mechanisms, not the insecure transmission of already-authenticated data.
Question 40
Attacker Lauren has gained the credentials of an organization’s internal server system, and she was often logging in during irregular times to monitor the network activities. The organization was skeptical about the login times and appointed security professional Robert to determine the issue. Robert analyzed the compromised device to find incident details such as the type of attack, its severity, target, impact, method of propagation, and vulnerabilities exploited. What is the incident handling and response (IH&R) phase, in which Robert has determined these issues?
Show answer and explanation
Correct answer: A. Incident triage
Incident triage is the IH&R phase where security professionals analyze and categorize a security incident by determining its type, severity, target, impact, method of propagation, and vulnerabilities exploited. This phase occurs early in the incident response process to understand the scope and nature of the breach discovered by monitoring irregular login times.
Why the other options are wrong
- B. Preparation involves establishing incident response procedures and tools before an incident occurs.
- C. Incident recording and assignment documents the incident and assigns it to a team, occurring after triage.
- D. Eradication is the phase where malware and unauthorized access are removed after the incident has been analyzed.
Question 41
Jude, a pen tester working in Keiltech Ltd., performs sophisticated security testing on his company's network infrastructure to identify security loopholes. In this process, he started to circumvent the network protection tools and firewalls used in the company. He employed a technique that can create forged TCP sessions by carrying out multiple SYN, ACK, and RST or FIN packets. Further, this process allowed Jude to execute DDoS attacks that can exhaust the network resources. What is the attack technique used by Jude for finding loopholes in the above scenario?
Show answer and explanation
Correct answer: A. Spoofed session flood attack
A spoofed session flood attack involves forging TCP sessions by sending multiple SYN, ACK, and RST or FIN packets to circumvent firewalls and network protection tools. This creates legitimate-looking traffic while exhausting network resources through DDoS, matching Jude's attack methodology.
Why the other options are wrong
- B. UDP flood attacks use UDP packets, not TCP SYN/ACK/RST packets as described.
- C. Peer-to-peer attacks involve compromising P2P networks, not forging TCP sessions.
- D. Ping-of-death attacks send oversized ICMP packets, not TCP SYN/ACK/RST packets.
Question 42
Jake, a network security specialist, is trying to prevent network-level session hijacking attacks in his company. While studying different types of such attacks, he learns about a technique where an attacker inserts their machine into the communication between a client and a server, making it seem like the packets are flowing through the original path. This technique is primarily used to reroute the packets. Which of the following types of network-level session hijacking attacks is Jake studying?
Show answer and explanation
Correct answer: D. Man-in-the-middle Attack Using Forged ICMP and ARP Spoofing
Man-in-the-middle attacks using forged ICMP and ARP spoofing involve inserting an attacker's machine between a client and server by spoofing ARP packets to intercept traffic and redirecting it through their machine. This technique reroutes packets to make them appear to flow through the original path while actually being intercepted and forwarded by the attacker, matching the exact scenario described of intercepting communication while maintaining the appearance of normal flow.
Why the other options are wrong
- A. TCP/IP Hijacking typically involves taking over an established connection but doesn't specifically describe the ICMP/ARP spoofing rerouting technique.
- B. RST Hijacking involves sending RST (reset) packets to terminate connections, not rerouting traffic through an attacker's machine.
- C. UDP Hijacking affects UDP protocol communications, not the described technique of using ARP and ICMP for rerouting between client and server.
Question 43
You are a Certified Ethical Hacker contracted by a technology company to perform a security assessment on Bluetooth-enabled devices. These devices have Secure Simple Pairing (SSP) enabled, which generally offers strong security. During your assessment, you identify an attacker trying to exploit a vulnerability in the SSP implementation by employing sophisticated brute-force techniques. The attacker has partial access to the Diffie-Hellman key exchange. Your mission is to identify the most effective method to counteract this attack. Which of the following countermeasures is most likely to be effective?
Show answer and explanation
Correct answer: B. Impose rate-limiting to slow down the brute-force attack.
Rate-limiting is the most effective countermeasure against the described brute-force attack on Diffie-Hellman key exchange. By imposing rate limits on authentication attempts, the system slows down the attacker's ability to perform sophisticated brute-force techniques, making the attack computationally infeasible within reasonable timeframes. Rate-limiting directly addresses the brute-force vector while maintaining legitimate user connectivity, unlike other options that either add restrictions or change protocols.
Why the other options are wrong
- A. Device whitelisting doesn't prevent brute-force attacks on the Diffie-Hellman exchange itself.
- C. Increasing key length improves security but doesn't directly counter the brute-force attack methodology described.
- D. Switching to BLE doesn't address the current SSP vulnerability or the attacker's existing partial access to the key exchange.
Question 44
A cyber attacker has initiated a series of activities against a high-profile organization following the Cyber Kill Chain Methodology. The attacker is presently in the "Delivery" stage. As an Ethical Hacker, you are trying to anticipate the adversary's next move. What is the most probable subsequent action from the attacker based on the Cyber Kill Chain Methodology?
Show answer and explanation
Correct answer: B. The attacker will exploit the malicious payload delivered to the target organization and establish a foothold.
The Cyber Kill Chain consists of seven stages in order: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. After the Delivery stage, the attacker moves to Exploitation, where they exploit the delivered malicious payload to establish a foothold on the compromised system. This is the logical next step in the methodology.
Why the other options are wrong
- A. Privilege escalation occurs after establishing a foothold, which is a later stage in the kill chain.
- C. Initiating active connections happens during the Command and Control stage, which comes after exploitation and installation.
- D. Reconnaissance is the first stage and occurs before Delivery, not after it.
Question 45
During a covert red team engagement, a penetration tester is tasked with identifying live hosts in a target organization’s internal subnet (10.0.0.0/24) without triggering intrusion detection systems (IDS). To remain undetected, the tester opts to use the command nmap -sn -PE 10.0.0.0/24, which results in several “Host is up” responses, even though the organization’s IDS is tuned to detect high-volume scans. After the engagement, the client reviews the logs and is surprised that the scan was not flagged. What allowed the scan to complete without triggering alerts?
Show answer and explanation
Correct answer: A. It performed an ICMP Echo ping sweep without port probing.
The nmap command 'nmap -sn -PE 10.0.0.0/24' performs an ICMP Echo ping sweep (-PE flag) without any port scanning (-sn flag means ping scan only). This generates minimal traffic compared to full port scans and often avoids IDS detection because many systems are tuned to detect port scanning and high-volume probes rather than simple ICMP Echo requests.
Why the other options are wrong
- B. UDP packets would not be part of the -PE ping echo mechanism, which uses ICMP.
- C. The -sn flag performs ping sweep, not port scanning, so it never probes specific ports.
- D. TCP ACK packets are not used in ICMP Echo ping sweeps; the -PE flag specifically uses ICMP Echo requests.
Question 46
Calvin, a software developer, uses a feature that helps him auto-generate the content of a web page without manual involvement and is integrated with SSI directives. This leads to a vulnerability in the developed web application as this feature accepts remote user inputs and uses them on the page. Hackers can exploit this feature and pass malicious SSI directives as input values to perform malicious activities such as modifying and erasing server files. What is the type of injection attack Calvin's web application is susceptible to?
Show answer and explanation
Correct answer: D. Server-side includes injection
Server-Side Includes (SSI) injection is a vulnerability where an attacker injects malicious SSI directives into a web page that accepts user input. Since SSI directives are processed on the server-side before the page is sent to the client, injected directives can execute arbitrary commands, including modifying or deleting server files.
Why the other options are wrong
- A. CRLF injection exploits carriage return and line feed characters, not SSI directives.
- B. Server-side template injection targets template engines, not SSI directives.
- C. Server-side JS injection targets JavaScript execution contexts, not SSI directives.
Question 47
Mirai malware targets IoT devices. After infiltration, it uses them to propagate and create botnets that are then used to launch which types of attack?
Show answer and explanation
Correct answer: D. DDoS attack
Mirai is an IoT botnet malware that infects IoT devices and uses them to launch Distributed Denial of Service (DDoS) attacks. After compromising vulnerable IoT devices, Mirai creates botnets that are coordinated to overwhelm target systems with massive amounts of traffic, making them unavailable to legitimate users.
Why the other options are wrong
- A. MITM (Man-in-the-Middle) attacks involve intercepting communications between two parties, not the primary function of Mirai botnets.
- B. Password attacks target credential systems directly and are not the main purpose of Mirai botnet propagation.
- C. Birthday attacks are cryptographic attacks used against hash functions, completely unrelated to Mirai's botnet functionality.
Question 48
Which wireless security protocol replaces the personal pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) and is therefore resistant to offline dictionary attacks?
Show answer and explanation
Correct answer: C. WPA3-Personal
WPA3-Personal replaces WPA2-Personal's PSK authentication with Simultaneous Authentication of Equals (SAE), which is resistant to offline dictionary attacks by using a more secure key derivation process. Bluetooth uses different security mechanisms, WPA2-Enterprise uses 802.1X authentication rather than SAE, and ZigBee has its own security framework unrelated to SAE.
Why the other options are wrong
- A. Bluetooth uses its own security protocols, not SAE.
- B. WPA2-Enterprise uses 802.1X authentication, not SAE.
- D. ZigBee has a different security architecture not based on SAE.
Question 49
As a cybersecurity analyst, you were assigned the task of analyzing the traffic patterns of your company’s network. You started noticing irregularities that suggested a potential scanning attempt. The attacker appears to be quite sophisticated, operating slowly and meticulously, making it a challenge to detect or trace. Given the stealthiness of this approach, which of the following scenarios best describes the scanning technique the attacker might be using?
Show answer and explanation
Correct answer: D. The attacker is utilizing a ‘zombie’ machine to transmit the scan, thus making the true source of the scan difficult to determine.
The scenario describes a sophisticated attacker operating slowly and carefully to avoid detection, hallmarks of an idle or zombie scan. In this technique, the attacker uses a compromised 'zombie' machine to perform the scan, obscuring the true source of the attack. This makes it extremely difficult to trace back to the actual attacker while maintaining stealth through slow, methodical scanning patterns that evade traditional IDS detection.
Why the other options are wrong
- A. FIN scanning is stealthy but doesn't explain how the true source becomes difficult to determine.
- B. Establishing direct TCP connections is not stealth, it's the opposite and risks immediate detection.
- C. Sending packets with all flags set (Christmas scan) is stealthy but doesn't explain source obfuscation.
Question 50
You are a penetration tester tasked with testing the wireless network of your client Brakeme SA. You are attempting to break into the wireless network with the SSID “Brakeme-Internal.” You realize that this network uses WPA3 encryption. Which of the following vulnerabilities is the promising to exploit?
Show answer and explanation
Correct answer: B. Dragonblood
Dragonblood is a collection of vulnerabilities discovered in WPA3 encryption, including the Simultaneous Authentication of Equals (SAE) handshake weakness. These vulnerabilities allow attackers to perform brute-force and side-channel attacks against WPA3-protected networks.
Why the other options are wrong
- A. Cross-site request forgery is a web application attack, not related to wireless encryption protocols.
- C. Key Reinstallation Attack (KRACK) targeted WPA2, not WPA3; WPA3 was designed to fix these vulnerabilities.
- D. AP misconfiguration is too generic and doesn't refer to a specific vulnerability within WPA3 protocol itself.
Question 51
An ethical hacker is auditing a hospital’s wireless network, which is currently secured with WPA encryption using TKIP. The hacker successfully demonstrates packet-injection and decryption attacks on the network. Which vulnerability in WPA most likely allowed these attacks to succeed?
Show answer and explanation
Correct answer: C. Use of weak Initialization Vectors (IV).
WPA with TKIP uses weak Initialization Vectors (IVs) that are predictable and can be reused, making the encryption vulnerable to packet injection and decryption attacks. This IV weakness is a critical flaw in TKIP that allows attackers to break the encryption without targeting the password directly. The vulnerability was well-documented in attacks like Chopchop and PTW attacks.
Why the other options are wrong
- A. WPA with TKIP does not mandate AES; the issue is with TKIP itself, not the absence of AES.
- B. GTK vulnerabilities exist but are not the primary reason for successful packet injection attacks in WPA-TKIP.
- D. Weak passwords affect authentication but not the packet injection/decryption attacks described in this scenario.
Question 52
An attacker identified that a user and an access point are both compatible with WPA2 and WPA3 encryption. The attacker installed a rogue access point with only WPA2 compatibility in the vicinity and forced the victim to go through the WPA2 four-way handshake to get connected. After the connection was established, the attacker used automated tools to crack WPA2-encrypted messages. What is the attack performed in the above scenario?
Show answer and explanation
Correct answer: C. Downgrade security attack
A downgrade security attack occurs when an attacker forces a device to use a weaker or older security protocol than what it is capable of supporting. In this scenario, the attacker forces the victim's WPA3-capable device to use only WPA2 encryption, which is less secure, allowing the attacker to exploit WPA2 vulnerabilities.
Why the other options are wrong
- A. Cache-based attacks target cached data, not wireless protocol negotiation.
- B. Timing-based attacks exploit variations in processing time, not protocol selection.
- D. Side-channel attacks exploit indirect information leakage, not forced protocol downgrades.
Question 53
A penetration tester is evaluating a web application that does not properly validate the authenticity of HTTP requests. The tester suspects the application is vulnerable to Cross-Site Request Forgery (CSRF). Which approach should the tester use to exploit this vulnerability?
Show answer and explanation
Correct answer: C. Create a malicious website that sends a crafted request on behalf of the user when visited
To exploit CSRF vulnerability where the application doesn't validate request authenticity, the tester should create a malicious website that automatically sends crafted requests on behalf of a user when the user visits it. This leverages the user's authenticated session to perform unauthorized actions without the user's knowledge.
Why the other options are wrong
- A. SQL injection exploits input validation, not CSRF vulnerability.
- B. Brute-force attacks test login credentials, not CSRF protection.
- D. Directory traversal exploits path traversal, not CSRF.
Question 54
A multinational corporation provides its employees with mobile devices to support remote work and enhance productivity. Recently, the security team detected suspicious activities indicating potential vulnerabilities in the mobile platforms, raising concerns about unauthorized access and data leakage. The team is tasked with identifying advanced hacking techniques targeting mobile platforms and implementing robust measures to enhance mobile security and prevent intrusions. Given the scenario described, which sophisticated hacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of the multinational corporation’s mobile platforms?
Show answer and explanation
Correct answer: C. Remote Access Trojan (RAT) Implanting Malicious Software on Mobile Devices to Gain Unauthorized Remote Access and Monitor User Activities, such as Keystrokes and Screen Capture
Remote Access Trojans (RATs) represent the most sophisticated and difficult-to-detect threat because they operate silently in the background, providing complete unauthorized remote access and comprehensive surveillance capabilities including keystroke logging and screen capture. RATs are challenging to detect because they often masquerade as legitimate applications, use advanced obfuscation techniques, and create persistent backdoors. While MitM attacks, clickjacking, and jailbreaking are serious threats, RATs pose the greatest challenge due to their stealth, persistence, and comprehensive capability to compromise all user data and system functions without obvious indicators of compromise.
Why the other options are wrong
- A. MitM attacks are detectable through network monitoring and can be mitigated with proper encryption and certificate pinning.
- B. Clickjacking attacks are relatively straightforward to identify through user behavior analysis and app testing.
- D. Jailbreaking/rooting can be detected through system integrity checks and mobile device management solutions.
Question 55
A penetration tester discovers that a system is infected with malware that encrypts all the files and demands payment to decrypt them. What type of malware is this?
Show answer and explanation
Correct answer: B. Ransomware
Ransomware is malware that encrypts files on a victim's system and demands payment (ransom) for decryption. This is the defining characteristic of ransomware, distinguishing it from other malware types that perform espionage, system compromise, or self-replication without encryption and extortion.
Why the other options are wrong
- A. Spyware monitors user activity and steals information but does not encrypt files or demand payment.
- C. Keyloggers capture keystrokes for information theft but do not encrypt files or demand ransom.
- D. Worms self-replicate across networks but do not typically encrypt files or demand payment.
Question 56
As a recent graduate, you’ve landed your first job as a junior cybersecurity analyst for a local company. Your team leader is explaining the different types of hackers and their motivations. He mentions the term “hacktivist”. According to the information you recall from your CEH v12 study material, which of the following best describes a hacktivist?
Show answer and explanation
Correct answer: B. A hacker who uses their skills to promote a political agenda or a social cause, often by launching attacks against systems to draw attention to their cause.
A hacktivist is defined as someone who uses hacking skills to promote a political agenda or social cause, typically by launching attacks to draw attention to their beliefs. This distinguishes them from other hacker types: penetration testers (A) are hired professionals, script kiddies (C) hack out of curiosity, and cybercriminals (D) are financially motivated. The term combines 'hack' and 'activist' to describe this activism-driven behavior.
Why the other options are wrong
- A. This describes a penetration tester or ethical hacker, not a hacktivist.
- C. This describes a script kiddie or novice hacker motivated by curiosity, not activism.
- D. This describes a cybercriminal or black hat hacker, not a hacktivist.
Question 57
Richard, an attacker, aimed to hack IoT devices connected to a target network. In this process, Richard recorded the frequency required to share information between connected devices. After obtaining the frequency, he captured the original data when commands were initiated by the connected devices. Once the original data were collected, he used free tools such as URH to segregate the command sequence. Subsequently, he started injecting the segregated command sequence on the same frequency into the IoT network, which repeats the captured signals of the devices. What is the type of attack performed by Richard in the above scenario?
Show answer and explanation
Correct answer: D. Replay attack
Richard captured original command sequences from IoT devices communicating on a specific frequency, then re-injected those same captured signals back into the network. This is the definition of a replay attack, reusing previously captured legitimate communications to perform unauthorized actions. The attack does not involve cryptanalysis (breaking encryption), reconnaissance (information gathering only), or side-channel attacks (exploiting physical characteristics).
Why the other options are wrong
- A. Cryptanalysis involves breaking encryption algorithms, not replaying captured signals.
- B. Reconnaissance is passive information gathering, not active signal injection.
- C. Side-channel attacks exploit timing or power consumption, not signal replay.
Question 58
Lewis, a professional hacker, targeted the IoT cameras and devices used by a target venture-capital firm. He used an information-gathering tool to collect information about the IoT devices connected to a network, open ports and services, and the attack surface area. Using this tool, he also generated statistical reports on broad usage patterns and trends. This tool helped Lewis continually monitor every reachable server and device on the Internet, further allowing him to exploit these devices in the network. Which of the following tools was employed by Lewis in the above scenario?
Show answer and explanation
Correct answer: C. Censys
Censys is a search engine and data collection tool that continuously monitors and indexes devices connected to the internet, including IoT cameras. It provides statistical reports on network devices, open ports, services, and helps identify attack surface areas. This matches Lewis's activities of gathering information about IoT devices, open ports, services, and continuously monitoring reachable servers.
Why the other options are wrong
- A. NeuVector is a container security platform, not an internet-wide reconnaissance tool.
- B. Lacework is a cloud security platform focused on runtime protection, not device enumeration.
- D. Wapiti is a web application vulnerability scanner, not an IoT device discovery tool.
Question 59
A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. It is suspected to be a Bluesnarfing attack, aimed at accessing unauthorized information from Bluetooth-enabled devices. Which of the following would be the most effective countermeasure to prevent further unauthorized access?
Show answer and explanation
Correct answer: C. Disable “Discoverable Mode” and activate “Non-discoverable Mode” on all Bluetooth devices.
Disabling Discoverable Mode (enabling Non-discoverable Mode) is the most effective countermeasure against Bluesnarfing attacks. In non-discoverable mode, devices are hidden from scans and cannot be discovered by potential attackers seeking targets. This prevents the initial reconnaissance phase that attackers use to identify vulnerable devices, making it significantly harder to launch Bluesnarfing attacks.
Why the other options are wrong
- A. PIN complexity doesn't address Bluesnarfing, which exploits unpatched vulnerabilities rather than weak authentication.
- B. Network-level encryption doesn't prevent Bluesnarfing; the attack exploits Bluetooth protocol vulnerabilities, not unencrypted traffic.
- D. Firmware updates help but are reactive; disabling discovery is the most direct preventive measure already available.
Question 60
During a penetration testing assignment, a Certified Ethical Hacker (CEH) used a set of scanning tools to create a profile of the target organization. The CEH wanted to scan for live hosts, open ports, and services on a target network. He used Nmap for network inventory and Hping3 for network security auditing. However, he wanted to spoof IP addresses for anonymity during probing. Which command should the CEH use to perform this task?
Show answer and explanation
Correct answer: D. Hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood
The command 'hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood' uses the '-a' flag to spoof the source IP address (192.168.1.254), which is the mechanism for anonymity during probing. The '-S' flag sends SYN packets and '-p 22' specifies the port. This directly fulfills the requirement to spoof IP addresses during network security auditing.
Why the other options are wrong
- A. The '-1' flag is for ICMP echo request mode and does not include IP spoofing capability.
- B. The '-2' flag is for UDP mode and lacks the '-a' parameter needed for source address spoofing.
- C. This Nmap command performs legitimate scanning but does not spoof IP addresses; Nmap's spoofing capabilities are limited compared to hping3.
Question 61
A penetration tester identifies malware that monitors the activities of a user and secretly collects personal information, such as login credentials and browsing habits. What type of malware is this?
Show answer and explanation
Correct answer: B. Spyware
Spyware is malware specifically designed to monitor user activities and covertly collect personal information such as login credentials, browsing habits, and other sensitive data. This definition perfectly matches the scenario where malware secretly collects personal information and login credentials while monitoring user activities. Spyware operates in the background without user consent or knowledge, making it distinct from other malware categories.
Why the other options are wrong
- A. Worms are self-replicating malware that spread across networks, not information collection tools.
- C. Ransomware encrypts files and demands payment for decryption, not for credential harvesting.
- D. Rootkits provide unauthorized system access and privilege escalation, not specifically for data collection and monitoring.
Question 62
Henry is a cyber security specialist hired by BlackEye, Cyber Security Solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unicornscan tool to discover the OS of the target system. As a result, he obtained a TTL value, which indicates that the target system is running a Windows OS. Identify the TTL value Henry obtained, which indicates that the target OS is Windows.
Show answer and explanation
Correct answer: A. 128
The default Time-To-Live (TTL) value for Windows operating systems is 128. This is a well-established baseline used in network fingerprinting and OS detection. Linux systems typically use 64, and older systems may use 255. Unicornscan and similar tools use TTL values to help identify the target OS, and a TTL of 128 is the standard indicator for Windows systems.
Why the other options are wrong
- B. 255 is typically the default TTL for some network devices and older systems, not modern Windows OS.
- C. 64 is the default TTL for Linux and Unix-based systems, not Windows.
- D. 138 is not a standard default TTL value for any major operating system.
Question 63
A penetration tester is assessing an IoT thermostat used in a smart home system. The device communicates with a cloud server for updates and commands. The tester discovers that communication between the device and the cloud server is not encrypted. What is the most effective way to exploit this vulnerability?
Show answer and explanation
Correct answer: A. Use a man-in-the-middle (MitM) attack to intercept and manipulate unencrypted communication
When communication between a device and server is unencrypted, a Man-in-the-Middle (MitM) attack is the most effective exploitation method. The attacker can intercept the unencrypted traffic, read its contents, and manipulate commands or data being transmitted between the thermostat and cloud server.
Why the other options are wrong
- B. XSS attacks target web interfaces with JavaScript vulnerabilities, not unencrypted network communication.
- C. Brute-force attacks on local admin login are unrelated to the unencrypted cloud communication vulnerability.
- D. SQL injection targets database queries, not the unencrypted communication channel between device and server.
Question 64
In the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
Show answer and explanation
Correct answer: D. 4.0-6.9
In CVSS v3.1, severity ratings are defined as: Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). Medium severity vulnerabilities fall within the 4.0-6.9 score range, representing issues that pose a moderate risk but are not immediately critical.
Why the other options are wrong
- A. 4.0-6.0 is too narrow and excludes medium vulnerabilities scoring between 6.0 and 6.9.
- B. 3.9-6.9 includes Low severity scores, which start at 0.1 and go up to 3.9, not 3.9.
- C. 3.0-6.9 incorrectly includes Low severity scores that start higher than 3.0.
Question 65
You are a penetration tester and are about to perform a scan on a specific server. The agreement that you signed with the client contains the following specific condition for the scan: “The attacker must scan every port on the server several times using a set of spoofed source IP addresses.” Suppose that you are using Nmap to perform this scan. What flag will you use to satisfy this requirement?
Show answer and explanation
Correct answer: D. The -D flag
The -D flag in Nmap enables decoy mode, which allows the user to perform scans using spoofed source IP addresses. This flag masks the attacker's true IP address by using multiple decoy IPs alongside the real scanning IP, satisfying the requirement to use spoofed source IPs for the scan.
Why the other options are wrong
- A. The -g flag is used to specify a source port, not to spoof source IP addresses.
- B. The -A flag enables aggressive scanning (OS detection, version detection, script scanning), not IP spoofing.
- C. The -f flag fragments packets to evade IDS/firewall detection, but does not spoof source IPs.
Question 66
Becky has been hired by a client from Dubai to perform a penetration test against one of their remote offices. Working from her location in Columbus, Ohio, Becky runs her usual reconnaissance scans to obtain basic information about their network. When analyzing the results of her Whois search, Becky notices that the IP was allocated to a location in Le Havre, France. Which regional Internet registry should Becky go to for detailed information?
Show answer and explanation
Correct answer: D. RIPE
RIPE (Réseaux IP Européens) is the Regional Internet Registry responsible for Europe, the Middle East, and Central Asia. Since the IP allocation leads to Le Havre, France, which is in Europe, RIPE is the appropriate RIR to consult for detailed information about IP address allocation and registration details.
Why the other options are wrong
- A. ARIN manages IP addresses for North America, where Becky is located but not where the IP is allocated.
- B. LACNIC manages IP addresses for Latin America and the Caribbean, which is unrelated to France.
- C. APNIC manages IP addresses for Asia-Pacific regions, not Europe.
Question 67
A penetration tester is assessing a web application that uses dynamic SQL queries for searching users in the database. The tester suspects the search input field is vulnerable to SQL injection. What is the best approach to confirm this vulnerability?
Show answer and explanation
Correct answer: D. Input ‘; DROP TABLE users; -- into the search field to test if the database query can be altered
Injecting `'; DROP TABLE users; --` is the most direct and effective method to confirm SQL injection vulnerability. This payload demonstrates that user input is being improperly concatenated into SQL queries without parameterization. If the injection is successful, the query structure will be altered, the DROP TABLE command will execute, and the database table will be deleted, providing definitive proof of vulnerability. This is a classic proof-of-concept for SQL injection testing in penetration assessments.
Why the other options are wrong
- A. Directory traversal is a different vulnerability type used to access files, not to test SQL injection.
- B. XSS testing looks for script execution in web pages, not SQL query manipulation.
- C. Brute-force attacks target authentication mechanisms, not SQL injection vulnerabilities.
Question 68
An organization uses SHA-256 for data integrity checks but is still experiencing unauthorized data modification. Which cryptographic tool can help resolve this issue?
Show answer and explanation
Correct answer: C. Digital signatures
Digital signatures solve the limitation of SHA-256 hashing alone. While SHA-256 verifies data integrity, it cannot authenticate the source or prevent tampering by someone with access to the hash. Digital signatures use asymmetric cryptography to both verify integrity and authenticate the sender, ensuring unauthorized parties cannot modify data and have it still validate with the correct signature.
Why the other options are wrong
- A. Asymmetric encryption alone does not address integrity verification; it provides confidentiality.
- B. Symmetric encryption provides confidentiality, not integrity authentication.
- D. SSL/TLS certificates are for secure communication channels, not direct data integrity verification.
Question 69
A large enterprise has been experiencing sporadic system crashes and instability, resulting in limited access to its web services. The security team suspects it could be a result of a Denial of Service (DoS) attack. A significant increase in traffic was noticed in the network logs, with patterns suggesting packet sizes exceeding the prescribed size limit. Which among the following DoS attack techniques best describes this scenario?
Show answer and explanation
Correct answer: D. Ping of Death attack
A Ping of Death attack involves sending ICMP echo requests (ping packets) with sizes exceeding the normal limit (typically 65,535 bytes), which can cause system crashes and instability when the oversized packets are reassembled. The scenario describes packet sizes exceeding prescribed size limits and resulting system crashes, which are classic indicators of a Ping of Death attack rather than other DoS techniques.
Why the other options are wrong
- A. A Smurf attack uses ICMP echo requests to broadcast addresses and relies on traffic amplification, not oversized packets.
- B. UDP flood attacks send large volumes of UDP packets but don't specifically involve packets exceeding size limits.
- C. Pulse wave attack is not a standard recognized DoS technique in the context of the described symptoms.
Question 70
A city’s power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has shown unexplained anomalies such as inconsistent sensor values and intermittent outages. Security experts suspect a side-channel attack aiming to discreetly extract sensitive information from SCADA devices. Which investigative technique would best confirm if attackers employed this specific side-channel method?
Show answer and explanation
Correct answer: A. Measure unusual fluctuations during device operations at the hardware level.
Measuring unusual fluctuations during device operations at the hardware level is the best investigative technique for detecting side-channel attacks on SCADA systems. Side-channel attacks exploit physical phenomena like power consumption, timing variations, electromagnetic emissions, or acoustic signals. Monitoring hardware-level metrics during operations would reveal anomalous power consumption patterns, timing delays, or electromagnetic signatures that indicate side-channel exploitation, directly confirming the attack vector.
Why the other options are wrong
- B. SCADA UI logs show user actions but not the physical side-channel attack mechanisms being exploited.
- C. Weak cryptographic settings address encryption strength but not side-channel vulnerabilities that bypass cryptography.
- D. Network latency assessment doesn't detect hardware-level side-channel exploitations like power or timing analysis.
Question 71
A financial institution’s online banking platform is experiencing intermittent downtime caused by a sophisticated DDoS attack that combines SYN floods and HTTP GET floods from a distributed botnet. Standard firewalls and load balancers are unable to mitigate the attack without affecting legitimate users. To protect their infrastructure and maintain service availability, which advanced mitigation strategy should the institution implement?
Show answer and explanation
Correct answer: A. Utilize a cloud-based DDoS protection service that offers multi-layer traffic scrubbing and auto-scaling
Cloud-based DDoS protection services offer multi-layer traffic scrubbing that can distinguish between legitimate and malicious traffic, with auto-scaling capabilities to handle volumetric attacks while maintaining service availability. These services operate at the network edge before traffic reaches the institution's infrastructure, filtering SYN floods and HTTP floods without impacting legitimate users.
Why the other options are wrong
- B. Blocking all SYN and HTTP requests would completely disable the banking platform for all users, defeating the purpose of maintaining service availability.
- C. Basic rate limiting and increased bandwidth alone cannot differentiate between legitimate and malicious traffic in sophisticated hybrid attacks.
- D. While IPS with deep packet inspection helps, it cannot scale effectively against distributed botnet attacks and would still struggle to process the attack volume without specialized DDoS mitigation.
Question 72
Martin, a Certified Ethical Hacker (CEH), is conducting a penetration test on a large enterprise network. He suspects that sensitive information might be leaking out of the network. Martin decides to use network sniffing as part of his testing methodology. Which of the following sniffing techniques should Martin employ to get a comprehensive understanding of the data flowing across the network?
Show answer and explanation
Correct answer: A. Raw Sniffing
Raw Sniffing is the correct technique for getting comprehensive understanding of all data flowing across the network. Raw sniffing captures packets at the lowest level without filtering, allowing the analyst to see all traffic regardless of protocol or application. This provides complete visibility into network communications and is the proper methodology for a comprehensive network assessment during penetration testing.
Why the other options are wrong
- B. MAC Flooding is an attack technique used to overwhelm switches, not a sniffing methodology.
- C. ARP Poisoning is an attack to redirect traffic, not a passive sniffing technique.
- D. DNS Poisoning is an attack vector, not a network sniffing technique.
Question 73
Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates. Which of the following protocols is used by Bella?
Show answer and explanation
Correct answer: A. FTPS
FTPS (FTP Secure) encrypts file transfers using SSL/TLS and uses digital certificates for authentication. It addresses the plaintext vulnerability of standard FTP by adding encryption and certificate-based security, preventing sensitive credentials and data from being exposed during transfer and protecting against session hijacking.
Why the other options are wrong
- B. FTP sends data in plaintext without encryption, which is the original vulnerability described.
- C. HTTPS is for web/HTTP traffic, not file transfer protocols, though it serves a similar security purpose.
- D. IP is a network layer protocol and doesn't provide encryption or certificate-based security for data transfer.
Question 74
During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this issue?
Show answer and explanation
Correct answer: B. Enforcing timely user de-provisioning
Timely user de-provisioning is the direct and most effective control to prevent former employees from retaining access to resources. When an employee leaves, their accounts and permissions must be promptly removed. The other options address different security concerns, multi-cloud deployment is architectural, penetration testing is assessment-focused, and real-time traffic analysis is detection-oriented, but none directly prevent the root cause of this issue: accounts that were never disabled after departure.
Why the other options are wrong
- A. Multi-cloud deployment is an architectural choice that does not address account termination processes.
- C. Penetration testing detects vulnerabilities but does not prevent orphaned accounts from remaining active.
- D. Real-time traffic analysis can detect suspicious activity but cannot prevent an authorized account from being used.
Question 75
Susan, a software developer, wants her web API to update other applications with the latest information. For this purpose, she uses a user-defined HTTP callback or push APIs that are raised based on trigger events; when invoked, this feature supplies data to other applications so that users can instantly receive real-time information. Which of the following techniques is employed by Susan?
Show answer and explanation
Correct answer: B. Webhooks
Webhooks are user-defined HTTP callbacks triggered by events that push real-time data to other applications. The description explicitly matches webhooks: HTTP callbacks raised by trigger events that supply data to other applications for instant real-time information updates. Web shells are malicious scripts, REST and SOAP are API architectures for request-response, not event-driven pushes.
Why the other options are wrong
- A. Web shells are malicious remote access tools, not legitimate API mechanisms.
- C. REST API is request-response based, not event-driven push notifications.
- D. SOAP API is request-response based, not event-driven push notifications.
Question 76
Kate dropped her phone and subsequently encountered an issue with the phone's internal speaker. Thus, she is using the phone's loudspeaker for phone calls and other activities. Bob, an attacker, takes advantage of this vulnerability and secretly exploits the hardware of Kate's phone so that he can monitor the loudspeaker's output from data sources such as voice assistants, multimedia messages, and audio files by using a malicious app to breach speech privacy. What is the type of attack Bob performed on Kate in the above scenario?
Show answer and explanation
Correct answer: C. Spearphone attack
Spearphone is a specific attack that exploits the loudspeaker of a mobile device to eavesdrop on audio output. In this scenario, Bob uses a malicious app to monitor the loudspeaker's output from various audio sources (voice assistants, multimedia messages, audio files) to breach Kate's speech privacy. This matches the definition of a Spearphone attack, which leverages the physical loudspeaker as a side-channel to capture sensitive audio information.
Why the other options are wrong
- A. SIM card attacks target the SIM card itself or its communication, not loudspeaker monitoring.
- B. aLTEr attacks target the LTE protocol layer, not audio output from loudspeakers.
- D. Man-in-the-disk attacks intercept data written to storage, not loudspeaker audio streams.
Question 77
As a cybersecurity professional, you are responsible for securing a high-traffic web application that uses MySQL as its backend database. Recently, there has been a surge of unauthorized login attempts, and you suspect that a seasoned black-hat hacker is behind them. This hacker has shown proficiency in SQL Injection and appears to be using the 'UNION' SQL keyword to trick the login process into returning additional data. However, your application’s security measures include filtering special characters in user inputs, a method usually effective against such attacks. In this challenging environment, if the hacker still intends to exploit this SQL Injection vulnerability, which strategy is he most likely to employ?
Show answer and explanation
Correct answer: C. The hacker attempts to bypass the special character filter by encoding his malicious input, which could potentially enable him to successfully inject damaging SQL queries.
When special character filtering is in place, an experienced attacker would use encoding techniques (such as URL encoding, Unicode encoding, or hex encoding) to bypass the filter while maintaining the functionality of the SQL injection payload. This allows the malicious SQL to reach the database undetected. Time-based blind SQL injection (B) is effective when output is restricted, but it's not the logical next step when encoding can bypass simpler filters. Option A (triggering errors) and D (DROP TABLE) are attack goals rather than bypass techniques.
Why the other options are wrong
- A. Error-based injection is an attack method, not a bypass technique for character filtering.
- B. Time-based blind SQL injection is used when results aren't visible, not as the primary bypass to character filtering.
- D. DROP TABLE is a destructive action goal, not a technique to bypass the character filter itself.
Question 78
You are an ethical hacker tasked with conducting an enumeration of a company's network. Given a Windows Answered Marked for Review 37.6% system with NetBIOS enabled, port 139 open, and file and printer sharing active, you are about to run some nbtstat commands to enumerate NetBIOS names. The company uses IPv6 for its network. Which of the following actions should you take next?
Show answer and explanation
Correct answer: A. Switch to an enumeration tool that supports IPv6
NetBIOS enumeration tools like nbtstat are designed for IPv4 networks and do not support IPv6. Since the company uses IPv6, the appropriate action is to switch to an enumeration tool that supports IPv6-based enumeration, such as IPv6-aware scanning tools or other enumeration techniques compatible with IPv6 networks.
Why the other options are wrong
- B. nbtstat does not support IPv6 addresses; it only works with IPv4 addresses.
- C. Using nbtstat -c would retrieve local NetBIOS cache but does not solve the IPv6 incompatibility issue.
- D. While NSE could help, it is not the primary answer; the fundamental issue is that nbtstat itself doesn't work with IPv6.
Question 79
A penetration tester is attempting to gain access to a wireless network that is secured with WPA2 encryption. The tester successfully captures the WPA2 handshake but now needs to crack the pre-shared key. What is the most effective method to proceed?
Show answer and explanation
Correct answer: C. Use a dictionary attack against the captured WPA2 handshake to crack the key
A dictionary attack is the most effective and practical method against WPA2 handshakes, as it leverages the human tendency to use common passwords and phrases. With a pre-shared key, computational resources can be focused on likely candidates. De-authentication attacks are prerequisites but not the cracking method, SQL injection targets routers' web interfaces not WPA2 encryption, and brute-force attacks are less efficient than dictionary attacks given the large keyspace.
Why the other options are wrong
- A. De-authentication attacks disconnect clients but do not crack the WPA2 key; they are a prerequisite step.
- B. SQL injection targets web application vulnerabilities, not WPA2 encryption mechanisms.
- D. Brute-force attacks are computationally expensive and less efficient than dictionary attacks for password recovery.
Question 80
A penetration tester evaluates an industrial control system (ICS) that manages critical infrastructure. The tester discovers that the system uses weak default passwords for remote access. What is the most effective method to exploit this vulnerability?
Show answer and explanation
Correct answer: B. Use the default passwords to gain unauthorized access to the ICS and control system operations
The most effective method to exploit weak default passwords is to use them directly to gain unauthorized access. This is the actual exploitation of the vulnerability, using the discovered credentials to authenticate and access the system. Options A, C, and D represent different attack types that are either less direct (brute-force) or entirely inappropriate (DoS and CSRF) for exploiting this specific weakness.
Why the other options are wrong
- A. Brute-force is unnecessary when default passwords are already known or easily guessed.
- C. DoS disrupts availability but does not exploit the weak password vulnerability itself.
- D. CSRF is irrelevant to exploiting weak default credentials for direct authentication.
Question 81
In an intricate web application architecture using an Oracle database, you, as a security analyst, have identified a potential SQL Injection attack surface. The database consists of 'x' tables, each with 'y' columns. Each table contains 'z' records. An attacker, well-versed in SQLi techniques, crafts 'u' SQL payloads, each attempting to extract maximum data from the database. The payloads include 'UNION SELECT' statements and 'DBMS_XSLPROCESSOR.READ2CLOB' to read sensitive files. The attacker aims to maximize the total data extracted 'E=xyz*u'. Assuming 'x=4', 'y=2', and varying 'z' and 'u', which situation is likely to result in the highest extracted data volume?
Show answer and explanation
Correct answer: D. z=400, u=4: The attacker constructs 4 SQL payloads, each focusing on tables with 400 records, influencing all columns of all tables.
With x=4 and y=2, E equals 8 times z times u. Option D gives 8 x 400 x 4 = 12,800, which is the largest result. The other options give 9,600, 8,800 and 12,000.
Why the other options are wrong
- A. 8 x 600 x 2 gives 9,600, which is less than 12,800.
- B. 8 x 550 x 2 gives 8,800, the lowest of the options.
- C. 8 x 500 x 3 gives 12,000, which is still less than 12,800.
Question 82
As a junior security analyst for a small business, you are tasked with setting up the company's first wireless network. The company wants to ensure the network is secure from potential attacks. Given that the company's workforce is relatively small and the need for simplicity in managing network security, which of the following measures would you consider a priority to protect the network?
Show answer and explanation
Correct answer: B. Enable WPA2 or WPA3 encryption on the wireless router
Enabling WPA2 or WPA3 encryption is the highest priority security measure for wireless networks, as it provides strong cryptographic protection for all traffic. This single measure prevents unauthorized access and protects data in transit. While other measures like SSID hiding, MAC filtering, and password rotation have value, encryption is the foundational security control without which other measures provide minimal protection.
Why the other options are wrong
- A. SSID hiding provides only obscurity, not actual security, as SSIDs can be discovered through passive monitoring.
- C. MAC address whitelists are useful but can be spoofed and are less critical than encryption.
- D. Regular password changes are helpful but secondary to the cryptographic protection provided by WPA2/WPA3.
Question 83
A multinational organization has recently faced a severe information security breach. Investigations reveal that the attacker had a high degree of understanding of the organization’s internal processes and systems. This knowledge was utilized to bypass security controls and corrupt valuable resources. Considering this event, the security team is contemplating the type of attack that occurred and the steps they could have taken to prevent it. Choose the most plausible type of attack and a countermeasure that the organization could have employed:
Show answer and explanation
Correct answer: A. Insider attacks and the organization should have implemented robust access control and monitoring.
The attacker demonstrated deep knowledge of internal processes and systems and successfully bypassed security controls. This profile is characteristic of an insider threat, where someone with legitimate access or detailed system knowledge exploits that understanding. Robust access control (principle of least privilege) and continuous monitoring (detecting unusual behavior patterns) are the primary countermeasures to prevent insider attacks.
Why the other options are wrong
- B. Distribution attacks involve compromising software/hardware during distribution; integrity checks address this but don't match the scenario of internal process knowledge.
- C. Passive attacks involve eavesdropping without modifying data; encryption prevents passive interception but the scenario describes active corruption of resources.
- D. Active attacks and network traffic analysis don't specifically address insider threats with internal system knowledge.
Question 84
Alice, a professional hacker, targeted an organization’s cloud services. She infiltrated the target’s MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization. Which of the following cloud attacks did Alice perform in the above scenario?
Show answer and explanation
Correct answer: C. Cloud hopper attack
A Cloud Hopper attack targets the MSP (Managed Service Provider) to gain access to multiple cloud customers. The attacker compromises the MSP provider through spear-phishing and malware, then uses the MSP account to access customer data and systems. This allows them to pivot to attack multiple customers through their trusted cloud provider relationship, which is exactly what Alice performed.
Why the other options are wrong
- A. Cloud cryptojacking involves hijacking computing resources for cryptocurrency mining, not data theft.
- B. Man-in-the-cloud attacks compromise synchronization tokens to intercept cloud data in transit, not MSP compromise.
- D. Cloudborne refers to vulnerabilities in cloud environments, not the specific attack pattern described.
Question 85
A certified ethical hacker is carrying out an email footprinting exercise on a targeted organization using eMailTrackerPro. They want to map out detailed information about the recipient's activities after receiving the email. Which among the following pieces of information would NOT be directly obtained from eMailTrackerPro during this exercise?
Show answer and explanation
Correct answer: C. The email accounts related to the domain of the organization
Email tracking tools such as eMailTrackerPro report what happens to a tracked email: the recipient's IP address and geolocation, when it was read and for how long, the device type, browser and operating system, and whether links were clicked or the email was forwarded. They do not enumerate other email accounts on the organization's domain. That kind of information comes from other footprinting tools and techniques.
Why the other options are wrong
- A. Geolocation of the recipient is derived from the IP address captured when the email is opened.
- B. The device type is reported from details captured when the email is opened.
- D. Email tracking tools report how long the recipient spent reading the email.
Question 86
During a reconnaissance mission, an ethical hacker uses Maltego, a popular footprinting tool, to collect information about a target organization. The information includes the target's Internet infrastructure details (domains, DNS names, Netblocks, IP address information). The hacker decides to use social engineering techniques to gain further information. Which of the following would be the least likely method of social engineering to yield beneficial information based on the data collected?
Show answer and explanation
Correct answer: B. Impersonating an ISP technical support agent to trick the target into providing further network details
Impersonating an ISP technical support agent would be the least likely to yield beneficial information because the hacker already has Internet infrastructure details from Maltego (domains, DNS names, netblocks, IP addresses). An ISP support call would offer redundant network information. In contrast, dumpster diving, shoulder surfing, and eavesdropping target human behavior and internal information that would complement and extend the technical reconnaissance already conducted.
Why the other options are wrong
- A. Dumpster diving could reveal valuable internal documents, policies, or credentials not found in public sources.
- C. Shoulder surfing directly observes sensitive credentials being entered, providing access credentials not discoverable through Maltego.
- D. Eavesdropping reveals strategic information, internal processes, and communication patterns that complement technical reconnaissance.
Question 87
During a red team exercise, a certified ethical hacker (CEH) is working on exploiting a potential vulnerability in the target’s web server. The CEH has completed the information gathering and footprinting stages and mirrored the website for offline analysis. They have also discovered the server is prone to session hijacking. Which next step is most likely to be part of a successful attack methodology, keeping in mind the requirement to minimize the possibility of detection?
Show answer and explanation
Correct answer: A. Perform vulnerability scanning with automated tools to find additional weaknesses.
After footprinting and website mirroring, vulnerability scanning with automated tools is the appropriate next step in the CEH methodology to identify exploitable weaknesses while minimizing detection. This systematic approach follows the proper order of operations before attempting specific exploits. Options B, C, and D are premature actions that would trigger detection and lack the strategic reconnaissance foundation.
Why the other options are wrong
- B. Hijacking sessions and immediately modifying files is premature without full vulnerability assessment and risks immediate detection.
- C. Attempting SQL injection before comprehensive scanning misses other vulnerabilities and is not methodologically sound.
- D. Direct brute force attacks are noisy, easily detected, and inappropriate before vulnerability assessment.
Question 88
As the lead security engineer for a retail corporation, you are assessing the security of the wireless networks in the company's stores. One of your main concerns is the potential for "Wardriving" attacks, where attackers drive around with a Wi-Fi-enabled device to discover vulnerable wireless networks. Given the nature of the retail stores, you need to ensure that any security measures you implement do not interfere with customer experience, such as their ability to access in-store Wi-Fi. Taking into consideration these factors, which of the following would be the most suitable measure to mitigate the risk of Wardriving attacks?
Show answer and explanation
Correct answer: D. Implement WPA3 encryption for the store's Wi-Fi network
WPA3 encryption is the most suitable measure because it provides strong security against wardriving attacks while maintaining customer access to the Wi-Fi network. WPA3 implements the Simultaneous Authentication of Equals (SAE) protocol, protects against brute-force attacks, and ensures that even if an attacker captures traffic, the encryption prevents data interception. It also supports seamless customer onboarding without impacting user experience.
Why the other options are wrong
- A. Limiting wireless signal range doesn't prevent wardriving; attackers can still detect signals from adjacent areas and is impractical for retail customer needs.
- B. MAC address filtering is easily bypassed by spoofing and creates administrative overhead for retail environments with high customer turnover.
- C. Disabling SSID broadcasting provides minimal security (SSID can be discovered through probe requests) and negatively impacts customer Wi-Fi accessibility.
Question 89
An IT company has just implemented new security controls to their network and system setup. As a Certified Ethical Hacker, your responsibility is to assess the possible vulnerabilities in the new setup. You are given the information that the network and system are adequately patched with the latest updates, and all employees have gone through recent cybersecurity awareness training. Considering the potential vulnerability sources, what is the best initial approach to vulnerability assessment?
Show answer and explanation
Correct answer: B. Checking for hardware and software misconfigurations to identify any possible loopholes
Since the systems are already patched with the latest updates and employees have received cybersecurity training, the best initial approach is to check for hardware and software misconfigurations. Misconfigurations represent a significant vulnerability gap that exists independently of patches and training. Configuration errors are among the most common security issues and should be assessed before investigating more complex vulnerabilities.
Why the other options are wrong
- A. Social engineering tests are less critical when employees have already received cybersecurity awareness training.
- C. Technology weaknesses are typically addressed through patches, which are already applied according to the scenario.
- D. Checking ex-employee access is important but is a more specific investigation, not the initial broad assessment approach.
Question 90
As a cybersecurity professional conducting a network vulnerability assessment for your organization, you discover a potentially critical vulnerability. This vulnerability arises from an outdated software component installed on a critical production server used by the financial department. The software vendor has acknowledged this vulnerability and promptly released a patch to fix it. However, the application of the patch has been deferred due to the department’s operational needs, as they cannot tolerate downtime during business hours, which would significantly impact their productivity. The situation poses a significant risk due to the potential for exploitation until the patch is applied. With these constraints in mind, as a Certified Ethical Hacker, what immediate action could you undertake to reduce the risk associated with this vulnerability without disrupting department operations?
Show answer and explanation
Correct answer: A. Implement a strategy of Virtual Patching, providing a protective layer around the vulnerability until the actual patch can be applied.
Virtual Patching is an immediate risk mitigation technique that deploys protective rules in WAFs, IDS/IPS systems, or network devices to block exploitation attempts without requiring the actual patch. This approach protects against known exploits of the vulnerability while the production system remains operational, addressing both the security risk and operational continuity requirements.
Why the other options are wrong
- B. Penetration testing on the vulnerable server increases risk of accidental exploitation and doesn't reduce the vulnerability.
- C. Network monitoring is detective, not preventive; it identifies attacks after they may have succeeded.
- D. Forcing downtime contradicts the stated constraint that the department cannot tolerate operational interruption.
Question 91
You work as a cloud security specialist at SkyNet Solutions. One of your clients is a healthcare organization that plans to migrate its electronic health record (EHR) system to the cloud. This system contains highly sensitive personal and medical data. As part of your job, you need to ensure the security and privacy of this data while it is being transferred and stored in the cloud. You recommend that data should be encrypted during transit and at rest. However, you also need to ensure that even if a cloud service provider(CSP) has access to encrypted data, they should not be able to decrypt it. Which of the following would be the most suitable strategy to meet this requirement?
Show answer and explanation
Correct answer: D. Use client-side encryption and manage encryption keys independently of the CSP.
Client-side encryption with independent key management ensures that the CSP can never decrypt data even if they gain access to the encrypted content. This approach gives the organization complete control over encryption keys and eliminates the CSP's ability to access plaintext data. Options A, B, and C all involve the CSP having some level of access to encryption keys or relying on their encryption infrastructure, which fails to meet the requirement that the CSP should not be able to decrypt data.
Why the other options are wrong
- A. Network-level encryption alone does not prevent the CSP from decrypting data once it reaches their servers.
- B. Allowing the CSP to manage encryption keys means they can decrypt the data, violating the core requirement.
- C. Built-in CSP encryption services typically mean the CSP controls the keys and can decrypt the data.
Question 92
What firewall evasion scanning technique make use of a zombie system that has low network activity as well as its fragment identification numbers?
Show answer and explanation
Correct answer: D. Idle scanning
Idle scanning (also called zombie scanning) uses a third-party zombie system with low network activity and predictable IP fragment identification numbers to perform port scans. The attacker spoofs packets to appear from the zombie, observing the zombie's responses to infer open ports on the target without directly connecting themselves.
Why the other options are wrong
- A. Packet fragmentation breaks packets into smaller pieces but doesn't use a zombie system with fragment ID numbers.
- B. Spoof source address scanning involves spoofing the source IP but doesn't specifically use zombie systems with fragment IDs.
- C. Decoy scanning generates decoy traffic but doesn't use a specific zombie system's fragment identification properties.
Question 93
A cyber adversary is performing external reconnaissance on a large enterprise network with multiple perimeter defenses in place, including packet-filtering firewalls and intrusion detection systems (IDS). The goal is to enumerate the firewall's rule set to identify which TCP and UDP ports are permitted for inbound traffic to internal systems. To minimize noise and avoid immediate detection, the attacker wants to use a method that mimics normal traffic flows while providing insight into how the firewall handles packets based on port and protocol combinations. Which reconnaissance technique should the attacker choose to effectively map the firewall’s filtering behavior without raising alerts?
Show answer and explanation
Correct answer: B. Firewalking with manipulated TTL values to analyze ACL responses
Firewalking uses manipulated TTL (Time-to-Live) values to determine which ports and protocols are permitted through a firewall. By sending packets with TTL values set to expire at the firewall, the attacker observes whether ICMP Time Exceeded responses indicate the packet passed the firewall's filtering rules. This technique effectively maps ACL behavior while appearing as normal traffic with minimal noise.
Why the other options are wrong
- A. Full SYN scans on all ports create significant noise and are easily detected by IDS systems.
- C. ICMP Echo requests to broadcast addresses are easily recognized as reconnaissance and are often filtered.
- D. Passive DNS monitoring reveals domain-to-IP mappings but provides no insight into firewall port filtering rules or ACLs.
Question 94
An ethical hacker needs to enumerate user accounts and shared resources within a company’s internal network without raising any security alerts. The network consists of Windows servers running default configurations. Which method should the hacker use to gather this information covertly?
Show answer and explanation
Correct answer: D. Exploit null sessions to connect anonymously to the IPC$ share
Exploiting null sessions to connect anonymously to the IPC$ share is the most covert method to enumerate user accounts and shared resources on Windows servers with default configurations. Null sessions allow anonymous connections without credentials, enabling enumeration of users, groups, shares, and network information while generating minimal security alerts. This technique is specifically effective against default Windows configurations.
Why the other options are wrong
- A. SNMP queries are limited to network device information and may trigger alerts; they don't effectively enumerate user accounts and shares.
- B. Packet sniffing is noisy and likely to be detected; it's passive but unreliable for systematic enumeration of users and resources.
- C. DNS zone transfers require specific zone transfer permissions and are unlikely on properly configured Windows servers; this targets DNS infrastructure, not user enumeration.
Question 95
In the process of setting up a lab for malware analysis, a cybersecurity analyst is tasked to establish a secure environment using a sheep dip computer. The analyst must prepare the testbed while adhering to best practices. Which of the following steps should the analyst avoid when configuring the environment?
Show answer and explanation
Correct answer: B. Connecting the system to the production network during the malware analysis
Connecting a malware analysis system to the production network is the critical step to avoid, as it poses an extreme risk of spreading malware to the entire organization. A sheep dip computer is specifically designed as an isolated testbed. All other options (installing malware analysis tools, simulating internet services, and using multiple guest OS) are legitimate and recommended practices for safe malware analysis in an isolated environment.
Why the other options are wrong
- A. Installing malware analysis tools on the guest OS is essential and safe when conducted in an isolated environment.
- C. Simulating Internet services with INetSim is a best practice to safely analyze malware behavior without exposing it to real networks.
- D. Installing multiple guest operating systems supports comprehensive testing across different platforms without creating security risks.
Question 96
A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?
Show answer and explanation
Correct answer: D. Request a service ticket for the service principal name of the target service account
In a Kerberoasting attack, after obtaining a valid TGT (Ticket Granting Ticket), the next step is to request a service ticket (TGS - Ticket Granting Service) for the target service principal name. This service ticket can then be extracted and cracked offline. Options A, B, and C are either unrelated techniques or occur after obtaining the service ticket, not as the next step in this attack sequence.
Why the other options are wrong
- A. Passive wire sniffing is not the standard next step in Kerberoasting; service ticket requests follow.
- B. PRINCE is a password generation attack unrelated to Kerberoasting methodology.
- C. Mimikatz extraction occurs after obtaining the service ticket, not as the immediate next step.
Question 97
Jane, an ethical hacker, is testing a target organization’s web server and website to identify security loopholes. In this process, she copied the entire website and its content on a local drive to view the complete profile of the site’s directory structure, file structure, external links, images, web pages, and so on. This information helps Jane map the website’s directories and gain valuable information. What is the attack technique employed by Jane in the above scenario?
Show answer and explanation
Correct answer: B. Website mirroring
Website mirroring is the process of copying an entire website including all content, directory structure, files, images, and links to a local system for offline analysis and mapping. This technique allows penetration testers to understand the complete structure and organization of a target website without repeatedly accessing the live server.
Why the other options are wrong
- A. Session hijacking involves stealing or intercepting active user sessions, not copying website content.
- C. Website defacement is modifying website content maliciously, not analyzing it locally.
- D. Web cache poisoning involves contaminating cached content to serve malicious data, not copying websites for reconnaissance.
Question 98
During a targeted phishing campaign, an attacker gains access to a trusted internal system within a corporate network protected by advanced firewalls, IDS, and email security gateways. To maintain persistence and evade content inspection, the attacker crafts a malicious HTML email attachment containing obfuscated JavaScript code. When the user opens the attachment in a browser, a hidden JavaScript blob dynamically reconstructs a malware payload and triggers an automatic file download on the client side. No external connections are initiated during this process, making it difficult for network security tools to detect or block the attack. Which evasion technique is being employed to bypass the firewall and IDS protections?
Show answer and explanation
Correct answer: C. HTML smuggling
HTML smuggling is an evasion technique where malicious code (JavaScript) is embedded within a seemingly benign HTML attachment. The code is obfuscated or encoded and only reconstructed and executed when the user opens the attachment in a browser. This bypasses network inspection tools because the malware payload is generated locally on the client side rather than being transmitted over the network, making it invisible to firewalls and IDS systems.
Why the other options are wrong
- A. HTTP header spoofing modifies headers to disguise requests but is not relevant to local payload reconstruction in email attachments.
- B. Port forwarding creates tunnels for network traffic and does not apply to client-side JavaScript execution within an HTML file.
- D. Cross-site scripting typically exploits web vulnerabilities to inject scripts; it does not describe the local payload reconstruction and download mechanism described here.
Question 99
A penetration tester detects malware on a system that secretly records all keystrokes entered by the user. What type of malware is this?
Show answer and explanation
Correct answer: C. Keylogger
A keylogger is malware specifically designed to record and capture all keystrokes entered by a user, which matches the description exactly. This is the defining characteristic of keylogger malware, and it is distinct from rootkits (which gain privileged access), ransomware (which encrypts files for ransom), and worms (which self-replicate across networks).
Why the other options are wrong
- A. Rootkits provide privileged system access but don't specifically record keystrokes as their primary function.
- B. Ransomware encrypts files and demands payment, not records keystrokes.
- D. Worms self-replicate and spread across networks, not capture user input.
Question 100
An e-commerce platform hosted on a public cloud infrastructure begins to experience significant latency and timeout issues during its peak sales hours. Security logs indicate thousands of incoming HTTP connections, each of which starts sending headers extremely slowly and never completes the full request. Over time, the number of open connections rises beyond the server’s handling capacity, leading to system instability and service unavailability. The network team verifies that these connections are not transmitting malformed packets or high volumes of traffic and appear to originate from legitimate IPs. Which specific DoS technique is most likely responsible for the degradation of service?
Show answer and explanation
Correct answer: C. Slowloris holding web server connections
Connections that arrive from legitimate-looking IPs, trickle HTTP headers a few bytes at a time, and never terminate the request are the classic Slowloris pattern. Each incomplete request occupies a server thread or connection slot indefinitely; once the concurrent connection limit is reached the server can no longer serve real customers, producing the latency, timeouts and instability seen at peak hours without any packet malformation or bandwidth spike.
Why the other options are wrong
- A. UDP flooding is a high-volume, connectionless attack, whereas here the traffic volume is low and the sessions are HTTP over TCP.
- B. A fragmentation flood relies on malformed or overlapping fragments, and the network team confirmed the packets are well formed.
- D. A SYN flood leaves half-open connections in SYN_RECEIVED with spoofed sources; these connections complete the handshake and then send real, slow HTTP header data.
Question 101
CyberTech Inc. recently experienced SQL injection attacks on its official website. The company appointed Bob, a security professional, to build and incorporate defensive strategies against such attacks. Bob adopted a practice whereby only a list of entities such as the data type, range, size, and value, which have been approved for secured access, is accepted. What is the defensive technique employed by Bob in the above scenario?
Show answer and explanation
Correct answer: A. Whitelist validation
Whitelist validation is a defensive technique that only accepts data matching an approved list of acceptable values, types, ranges, and sizes. This approach is more secure than blacklisting because it explicitly defines what is allowed rather than trying to block known bad inputs. Bob's practice of approving specific data characteristics exemplifies whitelist validation.
Why the other options are wrong
- B. Output encoding converts data into safe formats for display but doesn't prevent injection at input stage.
- C. Blacklist validation blocks known bad inputs but can be bypassed by new attack variations.
- D. Least privilege restricts user permissions but doesn't validate input data characteristics.
Question 102
Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering. Which of the following design flaws in the authentication mechanism is exploited by Calvin?
Show answer and explanation
Correct answer: D. Verbose failure messages
Verbose failure messages are error messages that reveal too much information about the authentication system. By specifying which field is incorrect when credentials fail, the application leaks information that allows attackers (like Calvin) to enumerate valid usernames, which can then be used for social engineering and further attacks.
Why the other options are wrong
- A. User impersonation involves assuming another user's identity, not related to enumeration through verbose error messages.
- B. Insecure transmission of credentials refers to unencrypted communication of passwords, not information leakage through error messages.
- C. Password reset mechanism flaws involve weak password recovery processes, not enumeration through login form feedback messages.
Question 103
You have been hired as an intern at a start-up company. Your first task is to help set up a basic web server for the company's new website. The team leader has asked you to make sure the server is secure from common threats. Based on your knowledge from studying for the CEH exam, which of the following actions should be your priority to secure the web server?
Show answer and explanation
Correct answer: C. Regularly updating and patching the server software
Regularly updating and patching server software is the highest priority security action because most successful attacks exploit known vulnerabilities. Software patches address security flaws that attackers actively exploit. Without current patches, a server is vulnerable to numerous well-documented attacks regardless of other security measures in place.
Why the other options are wrong
- A. Limiting concurrent connections is a DoS mitigation technique but doesn't address common vulnerabilities.
- B. While WAF is important, unpatched software with known exploits remains the primary attack vector.
- D. SSL/TLS encryption protects data in transit but doesn't protect against exploitation of unpatched software vulnerabilities.
Question 104
A tester evaluates a login form that constructs SQL queries using unsanitized user input. By submitting ‘ OR ‘1’=’1’;--, the tester gains unauthorized access to the application. What type of SQL injection has occurred?
Show answer and explanation
Correct answer: A. Tautology-based SQL injection
The payload ' OR '1'='1';-- is a classic tautology-based SQL injection attack. This technique works by injecting a condition that is always true (1=1) to bypass authentication logic. The query becomes true regardless of the actual username or password, allowing unauthorized access. This is distinctly different from union-based (which requires UNION statements), error-based (which exploits error messages), or time-based blind (which uses timing delays) injection techniques.
Why the other options are wrong
- B. Union-based injection requires UNION keywords to append additional SELECT statements, not simple OR conditions.
- C. Error-based injection relies on database error messages to extract information, not on logical tautologies.
- D. Time-based blind injection uses conditional sleep/delays to infer data, not immediate logical bypasses.
Question 105
Jane invites her friends Alice and John over for a LAN party. Alice and John access Jane’s wireless network without a password. However, Jane has a long, complex password on her router. What attack has likely occurred?
Show answer and explanation
Correct answer: D. Piggybacking
Piggybacking refers to unauthorized access to a wireless network by physically being present and connecting without the owner's knowledge or permission. Alice and John accessed Jane's wireless network without a password in a social context (LAN party), which is classic piggybacking rather than a technical attack.
Why the other options are wrong
- A. Wardriving involves searching for wireless networks from a vehicle while driving, not friends at a LAN party.
- B. Wireless sniffing captures network traffic but doesn't explain how they accessed the network without a password.
- C. Evil twin creates a fake AP mimicking legitimate networks; there's no indication of that here, just physical presence.
Question 106
Widespread fraud at Enron, WorldCom, and Tyco led to the creation of a law that was designed to improve the accuracy and accountability of corporate disclosures. It covers accounting firms and third parties that provide financial services to some organizations and came into effect in 2002. This law is known by what acronym?
Show answer and explanation
Correct answer: A. SOX
SOX (Sarbanes-Oxley Act) was enacted in 2002 in response to corporate accounting scandals at Enron, WorldCom, and Tyco. It requires companies and accounting firms to improve the accuracy and accountability of corporate financial disclosures.
Why the other options are wrong
- B. FedRAMP is a government program for cloud service security authorization, not a response to corporate accounting fraud.
- C. HIPAA is legislation governing healthcare privacy and security, not corporate financial accountability.
- D. PCI DSS is a standard for payment card data security, not a corporate financial disclosure regulation.
Question 107
What is the common name for a vulnerability disclosure program opened by companies in platforms such as HackerOne?
Show answer and explanation
Correct answer: B. Bug bounty program
A Bug Bounty Program is the industry-standard term for a vulnerability disclosure initiative where companies like HackerOne invite security researchers to find and report vulnerabilities in exchange for monetary rewards or recognition.
Why the other options are wrong
- A. White-hat hacking program is a broader term; bug bounty is the specific name for these structured vulnerability disclosure platforms.
- C. Ethical hacking program is too generic and typically refers to formal certifications or training, not vulnerability disclosure platforms.
- D. Vulnerability hunting program is not the standard industry terminology used on platforms like HackerOne.
Question 108
A DDoS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete. Which attack is being described here?
Show answer and explanation
Correct answer: B. Slowloris attack
A Slowloris attack is a Layer 7 DDoS attack that sends partial/incomplete HTTP requests and keeps connections open by slowly sending additional data, causing the server to exhaust resources waiting for request completion. This matches the exact behavior described in the scenario.
Why the other options are wrong
- A. Desynchronization attacks exploit inconsistencies in request parsing between proxies and servers, but don't match the partial request/slow completion pattern.
- C. Session splicing is a Web Application Firewall evasion technique, not a DDoS attack methodology.
- D. Phlashing is a permanent denial of service attack targeting firmware, not related to Layer 7 HTTP attacks.
Question 109
Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions. Which of the following master components is explained in the above scenario?
Show answer and explanation
Correct answer: D. Kube-scheduler
Kube-scheduler is the Kubernetes master component responsible for scanning newly created pods and assigning them to appropriate nodes based on resource requirements, data locality, software/hardware constraints, and policy restrictions. It performs the scheduling function to optimize workload distribution across the cluster.
Why the other options are wrong
- A. Kube-apiserver is the API server that handles all REST requests and management operations, not pod scheduling.
- B. Etcd cluster is a distributed key-value store used for storing cluster state and configuration data, not for scheduling pods.
- C. Kube-controller-manager runs controller processes that regulate the state of the cluster, not specifically schedule pods to nodes.
Question 110
During an internal red team engagement, a penetration tester is tasked with mapping the network topology of an organization with multiple segmented subnets. The tester initiates a series of traceroutes from a compromised host to various internal devices across these segments. Upon analyzing the output, the tester observes that a specific IP address, 10.10.10.1, consistently appears as the second-to-last hop before reaching several target systems located in different IP ranges. Despite varying final destination IPs, this intermediate address remains constant. No signs of DNS spoofing, ICMP anomalies, or host-level misconfigurations are present. What does this repeated hop pattern most likely indicate in the context of network architecture?
Show answer and explanation
Correct answer: A. A core router facilitating communication across multiple internal subnets.
A core router facilitating inter-subnet communication is the most logical explanation for why a single IP address (10.10.10.1) consistently appears as a second-to-last hop across multiple traceroutes to different destination IP ranges. Core routers are central routing devices that handle traffic between segmented subnets. The consistent appearance of this hop regardless of final destination indicates it serves as a central routing point for traffic crossing network segments, which is the defining characteristic of a core router in a segmented network architecture.
Why the other options are wrong
- B. A transparent proxy would typically be bypassed or not appear in traceroute output, and would not be a consistent penultimate hop for diverse internal destinations.
- C. Loopback misconfiguration would affect only specific hosts, not consistently appear across multiple different destination subnets.
- D. DNS poisoning affects name resolution and would not explain consistent intermediate hop behavior in traceroute output.
Question 111
Which of the following tactics uses malicious code to redirect users’ web traffic?
Show answer and explanation
Correct answer: D. Pharming
Pharming is a cyber attack that uses malicious code to redirect users' web traffic from legitimate websites to fraudulent ones without their knowledge. This can be accomplished through DNS poisoning, host file modifications, or malware that alters network settings to intercept and redirect traffic, making it distinct from phishing-based social engineering attacks.
Why the other options are wrong
- A. Spear-phishing is targeted social engineering via email, not malicious code-based traffic redirection.
- B. Phishing is generic social engineering via email/messages, not malicious code redirecting web traffic.
- C. Spimming is spam over instant messaging, not related to web traffic redirection.
Question 112
As a cybersecurity consultant, you are working with a client who wants to migrate their data to a Software as a Service (SaaS) cloud environment. They are particularly concerned about maintaining the privacy of their sensitive data, even from the cloud service provider. Which of the following strategies would best ensure the privacy of their data in the SaaS environment?
Show answer and explanation
Correct answer: C. Encrypt the data client-side before uploading to the SaaS environment and manage encryption keys independently.
Client-side encryption with independent key management ensures that data remains encrypted before transmission to the SaaS provider, meaning the provider cannot access the plaintext data even if their systems are compromised or if they are compelled to disclose data. This zero-knowledge architecture keeps encryption keys under the client's exclusive control, providing the strongest privacy guarantee against unauthorized access, including by the service provider itself.
Why the other options are wrong
- A. VPNs protect data in transit between the user and provider but do not prevent the SaaS provider from accessing plaintext data once it arrives at their servers.
- B. Relying solely on the provider's security features does not prevent the provider from accessing the data and does not protect against insider threats or legal compulsion on the provider.
- D. Multi-factor authentication controls access to accounts but does not encrypt the data itself, leaving plaintext information vulnerable to the provider and their systems.
Question 113
A cybersecurity company wants to prevent attackers from gaining information about its encrypted traffic patterns. Which of the following encryption algorithms should they utilize?
Show answer and explanation
Correct answer: C. AES
AES (Advanced Encryption Standard) is a modern, secure symmetric encryption algorithm specifically designed for protecting data confidentiality. It uses strong encryption that prevents attackers from analyzing encrypted traffic patterns effectively. AES is the current standard recommended by security organizations worldwide for encrypting data in transit and at rest.
Why the other options are wrong
- A. DES is deprecated and cryptographically broken; it provides inadequate security for modern threats.
- B. RSA is an asymmetric algorithm used for key exchange and digital signatures, not for encrypting traffic volumes efficiently.
- D. HMAC is a message authentication code for integrity verification, not encryption for protecting traffic patterns.
Question 114
According to the NIST cloud deployment reference architecture, which of the following provides connectivity and transport services to consumers?
Show answer and explanation
Correct answer: D. Cloud carrier
According to the NIST cloud deployment reference architecture, the cloud carrier is the entity responsible for providing connectivity and transport services between cloud providers and cloud consumers. The cloud carrier ensures reliable network infrastructure and communication channels for accessing cloud services.
Why the other options are wrong
- A. Cloud connector is not a standard NIST reference architecture component; the actual role is handled by the cloud carrier.
- B. Cloud broker acts as an intermediary managing cloud service usage, performance, and delivery between consumers and providers, not providing transport.
- C. Cloud provider delivers cloud services directly to consumers but does not provide the connectivity and transport infrastructure itself.
Question 115
An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combination of scanning tools to obtain a detailed understanding of the network. Which sequence of actions would provide the most comprehensive information about the network's status?
Show answer and explanation
Correct answer: A. Use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on identified active hosts, and finally use Metasploit to exploit identified vulnerabilities.
Option A presents the correct logical progression for comprehensive network reconnaissance: first identify live hosts using ICMP ping sweep with Hping3, then perform detailed port and service scanning on identified active hosts using Nmap's SYN scan, and finally validate findings with targeted exploitation in Metasploit. This follows the proper penetration testing workflow of discovery, enumeration, and exploitation, and each tool is used appropriately for its intended purpose.
Why the other options are wrong
- B. UDP scans on random ports are inefficient; SYN scans on known ports are more effective for identifying active services.
- C. SYN flooding with Hping3 is a DoS attack technique inappropriate for authorized penetration testing and violates ethical boundaries.
- D. Metasploit is a framework for exploitation, not port scanning; using it before Nmap for port discovery is inefficient and incorrect workflow.
Question 116
A penetration tester is evaluating the security of a mobile application and discovers that it lacks proper input validation. The tester suspects that the application is vulnerable to a malicious code injection attack. What is the most effective way to confirm and exploit this vulnerability?
Show answer and explanation
Correct answer: C. Inject a malicious JavaScript code into the input fields and observe the application’s behavior
To confirm and exploit an input validation vulnerability, the tester should inject malicious code (JavaScript in this case) into input fields and observe how the application handles it. This directly tests whether the application properly validates and sanitizes user input. Observing the application's behavior will reveal if the injected code executes, confirming the vulnerability.
Why the other options are wrong
- A. Dictionary attacks target encryption algorithms, not input validation vulnerabilities.
- B. Brute-force attacks on login pages test password strength, not input validation.
- D. Directory traversal attacks exploit path traversal weaknesses, not input validation in the traditional sense.
Question 117
Which type of attack attempts to overflow the content-addressable memory (CAM) table in an Ethernet switch?
Show answer and explanation
Correct answer: D. MAC flooding
MAC flooding is a network attack that overwhelms the CAM (Content Addressable Memory) table in Ethernet switches by flooding it with many fake MAC addresses. When the CAM table fills up, the switch can no longer learn new MAC addresses and typically enters a fail-open state, forwarding all frames to all ports like a hub, allowing attackers to sniff network traffic.
Why the other options are wrong
- A. DDoS attacks aim to overwhelm system resources but don't specifically target CAM tables.
- B. Evil twin attacks involve rogue wireless access points, not CAM table exploitation.
- C. DNS cache flooding targets DNS servers' cache, not switch CAM tables.
Question 118
A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do next to understand the potential impact?
Show answer and explanation
Correct answer: B. Extract and analyze stream objects using PDFStreamDumper.
PDFStreamDumper is a specialized tool designed to extract and analyze PDF stream objects, including JavaScript code embedded in PDFs. Since the initial scan with pdfid confirmed the presence of JavaScript and /OpenAction (which triggers code execution), the next logical step is to extract and analyze the actual JavaScript streams to understand what malicious actions the embedded code attempts to perform.
Why the other options are wrong
- A. Computing file hashes helps with signature matching but doesn't reveal the impact or functionality of embedded JavaScript.
- C. PE Explorer is for analyzing Windows executable files, not PDF documents.
- D. VirusTotal provides signatures but doesn't offer detailed understanding of the specific JavaScript payload's functionality and impact.
Question 119
During a security evaluation of a smart agriculture setup, an analyst investigates a cloud-managed irrigation controller. The device is found to transmit operational commands and receive firmware updates over unencrypted HTTP. Additionally, it lacks mechanisms to verify the integrity or authenticity of those updates. This vulnerability could allow an adversary to intercept communications or inject malicious firmware, leading to unauthorized control over the device’s behavior or denial of essential functionality. Which IoT threat category does this situation best illustrate?
Show answer and explanation
Correct answer: B. Insecure ecosystem interfaces
Insecure ecosystem interfaces refers to weak API security and communication channels between IoT devices and cloud services. The scenario describes unencrypted HTTP communications without integrity verification for firmware updates, these are ecosystem interface weaknesses where the device interacts with external services. Insecure network services involve exposed services, insecure defaults are hardcoded credentials, and privacy protection concerns data handling, not update mechanisms.
Why the other options are wrong
- A. Insecure network services refers to exposed or poorly secured network services, not communication protocol weaknesses.
- C. Insecure default settings typically involve hardcoded credentials or disabled security features, not firmware update mechanisms.
- D. Insufficient privacy protection concerns how personal data is handled, not the integrity of firmware updates or operational commands.
Question 120
You're the security manager for a tech company that uses a database to store sensitive customer data. You have implemented countermeasures against SQL injection attacks. Recently, you noticed some suspicious activities and suspect an attacker is using SQL injection techniques. The attacker is believed to use different forms of payloads in his SQL queries. In the case of a successful SQL injection attack, which of the following payloads would have the most significant impact?
Show answer and explanation
Correct answer: D. ' OR 'a'='a; DROP TABLE members; --: This payload combines the manipulation of the WHERE clause with a destructive action, causing data loss
The payload 'OR 'a'='a; DROP TABLE members; -- combines data exfiltration with permanent data destruction. This represents the most significant impact because it not only bypasses authentication but also causes irreversible data loss by dropping an entire table. Options A, B, and C enable unauthorized data access or viewing, which is serious but reversible and doesn't destroy data. Only option D combines both unauthorized access and destructive capability, making it the most damaging payload.
Why the other options are wrong
- A. UNION SELECT retrieves data but doesn't destroy it or cause permanent damage.
- B. LIKE operator pattern matching allows data viewing but is less impactful than data destruction.
- C. OR '1'='1 bypasses authentication but doesn't involve destructive actions like table deletion.
Question 121
As the Chief Information Security Officer (CISO) at a large university, you are responsible for the security of a campus-wide Wi-Fi network that serves thousands of students, faculty, and staff. Recently, there has been a rise in reports of unauthorized network access, and you suspect that some users are sharing their login credentials. You are considering deploying an additional layer of security that could effectively mitigate this issue. What would be the most suitable measure to implement in this context?
Show answer and explanation
Correct answer: D. Implement 802.1X authentication
802.1X authentication is an IEEE standard for port-based network access control that requires individual user credentials for network access, effectively preventing credential sharing since each user must authenticate separately. This directly addresses the reported problem of users sharing login credentials by enforcing per-user authentication rather than shared network passwords. While network segmentation, VPNs, and password changes provide some security benefits, they do not directly prevent credential sharing or enforce individual authentication.
Why the other options are wrong
- A. Network segmentation limits lateral movement but does not prevent credential sharing or enforce individual user authentication.
- B. A campus-wide VPN would not prevent users from sharing credentials; multiple users could still share the same VPN credentials.
- C. Regularly changing Wi-Fi passwords does not address the underlying issue of shared credentials; users can still share the new password.
Question 122
A well-resourced attacker intends to launch a highly disruptive DDoS attack against a major online retailer. The attacker aims to exhaust all the network resources while keeping their identity concealed. Their method should be resistant to simple defensive measures such as IP-based blocking. Based on these objectives, which of the following attack strategies would be most effective?
Show answer and explanation
Correct answer: B. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals
A botnet-based Pulse Wave attack using high-volume traffic pulses at regular intervals is most effective for a well-resourced attacker seeking to remain concealed while resisting IP-based blocking. Botnets distribute the attack across multiple compromised machines, making it difficult to block by IP address alone. The pulse-wave pattern also complicates simple defensive measures compared to continuous floods.
Why the other options are wrong
- A. SYN flood attacks can be easily mitigated with modern SYN cookies and connection state management; single source is easily blocked.
- C. Using a single compromised machine is easily defended against through IP-based blocking, violating the attacker's requirement for concealment.
- D. ICMP flood from a single IP is trivial to block and provides no concealment for the attacker's identity.
Question 123
You are a security analyst for a medium-sized e-commerce company. Recently, the company has been suffering from repeated incidents of session hijacking. To prevent future incidents, you’ve been asked to suggest a robust strategy to mitigate this disk. Which of the following approaches would you recommend?
Show answer and explanation
Correct answer: B. Apply an IPsec VPN solution that encrypts the entire IP packet, thereby making session hijacking attempts more difficult.
IPsec VPN provides the most robust technical protection against session hijacking by encrypting the entire IP packet end-to-end, making it impossible for attackers to intercept or hijack session tokens in transit. This creates a secure tunnel that protects all traffic, including session identifiers, from eavesdropping and manipulation at the network layer.
Why the other options are wrong
- A. While IPS can detect attacks, it is reactive rather than preventive and doesn't inherently protect sessions from hijacking.
- C. Physical security at data centers does not address session hijacking, which occurs at the network/application layer.
- D. Security awareness is valuable but is a complementary measure; it does not provide the technical encryption needed to prevent active session hijacking attacks.
Question 124
Which of the following web vulnerabilities would an attacker be attempting to exploit if they delivered the following input?
Show answer and explanation
Correct answer: B. XXE
The input shown is an XML DOCTYPE declaration with an ENTITY that references an external file (file:///etc/passwd). This is a classic XXE (XML External Entity) injection attack payload. The attacker is attempting to exploit XML parsing vulnerabilities by injecting a malicious DOCTYPE declaration that defines an external entity pointing to a sensitive file. When the XML parser processes this input without proper validation, it will attempt to load and potentially expose the contents of /etc/passwd, a sensitive system file containing user account information.
Why the other options are wrong
- A. SQLi targets SQL databases with SQL commands, not XML parsers with entity declarations.
- C. XSS involves injecting malicious scripts into web pages to execute in browsers, not XML external entity definitions.
- D. IDOR exploits broken access controls by manipulating object identifiers, not by injecting XML entities.
Question 125
Upon analyzing anomalies in your network’s traffic, you discover traces of an insidious malware strain named “ShadowFlee”. This malware operates without writing files to disk, harnessing system utilities and scripts like PowerShell to stealthily execute tasks, effectively evading traditional detection mechanisms. Further, it exploits legitimate processes to propagate internally. Given “ShadowFlee’s” elusive attributes, which strategy would offer the most focused countermeasure?
Show answer and explanation
Correct answer: D. Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes.
ShadowFlee is described as a fileless malware that uses legitimate system utilities (PowerShell) and scripts for execution while avoiding disk writes. The most effective countermeasure is to restrict and monitor script and system tool execution, particularly when invoked by unauthorized processes. This directly targets the malware's attack vector of leveraging legitimate tools for malicious purposes.
Why the other options are wrong
- A. Cleaning temporary folders and permissions do not address fileless malware that operates in memory without disk artifacts.
- B. System reboots and patching address persistent threats but are insufficient against in-memory fileless malware and do not restrict script execution.
- C. Network isolation and packet inspection are network-focused and do not address the core threat of malicious script execution through legitimate tools.
Question 126
You have been given the responsibility to ensure the security of your school's web server. As a step towards this, you plan to restrict unnecessary services running on the server. In the context of web server security, why is this step considered important?
Show answer and explanation
Correct answer: B. Unnecessary services could contain vulnerabilities; minimize the attack surface.
Restricting unnecessary services is a fundamental security principle because each running service represents a potential attack vector. Unnecessary services may contain unpatched vulnerabilities or misconfigurations that attackers can exploit. By disabling unused services, you reduce the attack surface and limit the number of potential entry points an attacker can exploit.
Why the other options are wrong
- A. While unnecessary services do consume resources, memory optimization is not the primary security concern in web server hardening.
- C. Hiding software details through service restriction is a minor benefit; the primary security value is reducing attack surface.
- D. Server performance optimization is a secondary benefit; the primary security objective is reducing vulnerabilities and attack surface.
Question 127
During a physical penetration test simulating a social engineering attack, a threat actor walks into the lobby of a target organization dressed as a field technician from a known external vendor. Carrying a fake ID badge and referencing a known company name, the attacker confidently claims they’ve been dispatched to perform a routine server room upgrade. Using internal-sounding terminology and referencing real employee names gathered via OSINT, the individual conveys urgency. The receptionist, recognizing the vendor name and the convincing language, allows access without verifying the credentials.
Show answer and explanation
Correct answer: B. Perceived authority and reliance on third-party familiarity.
The attack succeeds primarily through the perception of authority (dressed as technician, fake credentials, internal terminology) combined with reliance on third-party familiarity (recognized vendor name). The receptionist trusts the vendor name and the attacker's confident demeanor rather than verifying actual credentials. This exploits human psychology around authority figures and known entities.
Why the other options are wrong
- A. Physical security logs are not mentioned and would not explain why the receptionist bypassed verification procedures.
- C. While OSINT gathering is mentioned as preparation, the actual exploitation mechanism is authority perception, not leaked credentials.
- D. Network segmentation is an IT infrastructure control unrelated to the physical access decision made by the receptionist in the lobby.
Question 128
Ricardo has discovered the username for an application in his target’s environment. As he has a limited amount of time, he decides to attempt to use a list of common passwords he found on the Internet. He compiles them into a list and then feeds that list as an argument into his password-cracking application. What type of attack is Ricardo performing?
Show answer and explanation
Correct answer: C. Dictionary
Ricardo is performing a dictionary attack because he has compiled a list of common passwords from the internet and is using that wordlist to attempt authentication. Dictionary attacks rely on pre-compiled lists of likely passwords, unlike brute force which tries all possible combinations, known plaintext which requires ciphertext/plaintext pairs, or password spraying which tries a few common passwords across many accounts.
Why the other options are wrong
- A. Brute force would try all possible character combinations, not a curated list of common passwords.
- B. Known plaintext attack is a cryptanalytic technique requiring corresponding ciphertext and plaintext.
- D. Password spraying typically targets multiple accounts with a few passwords, not one account with many passwords.
Question 129
Jude, a pen tester, examined a network from a hacker’s perspective to identify exploits and vulnerabilities accessible to the outside world by using devices such as firewalls, routers, and servers. In this process, he also estimated the threat of network security attacks and determined the level of security of the corporate network. What is the type of vulnerability assessment that Jude performed on the organization?
Show answer and explanation
Correct answer: B. External assessment
An external assessment is a type of vulnerability assessment where the tester examines the network from an attacker's perspective, focusing on externally accessible devices like firewalls, routers, and servers. This matches Jude's approach of identifying exploits and vulnerabilities accessible from the outside world.
Why the other options are wrong
- A. Application assessment focuses on vulnerabilities within software applications, not network perimeter devices.
- C. Passive assessment involves gathering information without active scanning or interaction, whereas Jude actively scanned systems.
- D. Host-based assessment focuses on vulnerabilities within individual hosts/systems, not the external network perimeter.
Question 130
Which of the following commands checks for valid users on an SMTP server?
Show answer and explanation
Correct answer: C. VRFY
The VRFY command in SMTP is used to verify valid user accounts on a mail server. It requests confirmation of whether a given mailbox exists on the system, making it a valuable reconnaissance tool for attackers to enumerate valid usernames without sending actual emails.
Why the other options are wrong
- A. RCPT is used to specify the recipient during message transmission, not to check user validity.
- B. CHK is not a standard SMTP command.
- D. EXPN expands mailing lists but doesn't verify individual user accounts in the same way VRFY does.
Question 131
Which of the following Metasploit post-exploitation modules can be used to escalate privileges on Windows systems?
Show answer and explanation
Correct answer: A. getsystem
The 'getsystem' module is a Metasploit post-exploitation command used to escalate privileges on Windows systems by attempting to gain SYSTEM-level access. 'getuid' retrieves current user information, 'keylogrecorder' captures keystrokes, and 'autoroute' manages network routing, none of which directly escalate privileges.
Why the other options are wrong
- B. getuid is used to identify the current user ID, not to escalate privileges.
- C. keylogrecorder is a post-exploitation module for capturing keyboard input, not for privilege escalation.
- D. autoroute is used to manage routing tables and network pivoting, not for privilege escalation.
Question 132
A penetration tester intercepts HTTP requests between a user and a vulnerable web server. The tester observes that the session ID is embedded in the URL, and the web application does not regenerate the session upon login. Which session hijacking technique is most likely to succeed in this scenario?
Show answer and explanation
Correct answer: A. Session fixation by pre-setting the token in a URL.
Session fixation is the most likely to succeed here because the scenario explicitly states the session ID is embedded in the URL and the application does not regenerate the session upon login. An attacker can pre-set a known session ID in a URL, send it to the victim, and once the victim logs in, the attacker can use that same fixed session ID to hijack the authenticated session. The lack of session regeneration is the critical vulnerability enabling this attack.
Why the other options are wrong
- B. DNS cache poisoning is a separate attack requiring DNS infrastructure compromise, not related to session management.
- C. XSS requires a separate vulnerability in the application's input handling and is not guaranteed by the session ID in URL scenario.
- D. CSRF exploits user trust but requires different conditions; session fixation is more direct given the URL-embedded session ID.
Question 133
Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. The time a hacker spends performing research to locate this information about a company is known as?
Show answer and explanation
Correct answer: C. Reconnaissance
Reconnaissance is the systematic process of gathering information about a target organization before launching an attack. Researching company logos, formatting, executive names, and internal email structures to create convincing phishing messages is a key reconnaissance activity that increases the success rate of social engineering attacks.
Why the other options are wrong
- A. Exploration is a general term and not the specific cybersecurity term for this information-gathering phase.
- B. Investigation refers to analyzing a completed incident, not the preparation phase of an attack.
- D. Enumeration is the process of extracting information from a network or system during active exploitation, not pre-attack research.
Question 134
A system analyst wants to implement an encryption solution that allows safe key distribution. Which encryption method should the analyst consider?
Show answer and explanation
Correct answer: A. Asymmetric encryption
Asymmetric encryption is the correct choice for safe key distribution because it uses a public-private key pair. The public key can be freely distributed over insecure channels without compromising security, while the private key remains secret. This solves the key distribution problem that symmetric encryption faces, where the shared secret key itself must be transmitted securely. Asymmetric encryption is specifically designed to enable secure communication without requiring a pre-shared secret.
Why the other options are wrong
- B. Hash functions are for data integrity verification, not encryption or key distribution.
- C. Disk encryption protects data at rest but doesn't solve key distribution challenges.
- D. Symmetric encryption requires secure pre-shared keys, which creates the key distribution problem it's trying to solve.
Question 135
Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney’s account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney’s account. What is the attack performed by Boney in the above scenario?
Show answer and explanation
Correct answer: C. Session donation attack
In a session donation attack the attacker logs in, obtains their own valid session ID and feeds it to the victim, so the victim unknowingly works inside the attacker's account. Anything the victim enters, such as payment details, is saved to the attacker's account. This matches the scenario exactly, where the aim is to capture the victim's data rather than to hijack the victim's own session.
Why the other options are wrong
- A. The Forbidden attack targets nonce reuse in AES-GCM for TLS and has nothing to do with planting a session ID.
- B. CRIME is a compression side-channel attack that recovers secrets from encrypted TLS traffic.
- D. Session fixation plants a session ID so the attacker can take over the victim's authenticated session, whereas here the victim is linked to the attacker's own account.
Question 136
A penetration tester is assessing an organization’s cloud infrastructure and discovers that the cloud storage buckets are not publicly accessible but have misconfigured Identity and Access Management (IAM) policies. The IAM policies unintentionally grant read and write permissions to any authenticated user. What is the most effective way to exploit this misconfiguration?
Show answer and explanation
Correct answer: C. Create a personal cloud account to authenticate and access the misconfigured storage buckets
The most effective exploitation method is to create a personal cloud account to authenticate and access the misconfigured storage buckets. Since the IAM policy grants read and write permissions to any authenticated user, an attacker simply needs valid authentication credentials. This is the direct and simplest path to exploit the misconfiguration without requiring pre-existing access or stolen credentials.
Why the other options are wrong
- A. SQL injection targets databases through web applications, not cloud storage access which is governed by IAM policies.
- B. XSS attacks compromise user browsers, not cloud management portals with IAM policies; this doesn't exploit the IAM misconfiguration.
- D. Using leaked API keys is an alternative exploitation method but less efficient than simply authenticating with a new account when any authenticated user is permitted.
Question 137
A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?
Show answer and explanation
Correct answer: D. Organize regular employee awareness training regarding social engineering techniques and preventive measures
The organization has already implemented technical controls (IDS and network monitoring). The most effective next step against social engineering attacks is employee awareness training, as social engineering primarily targets human behavior and psychology. Technical defenses cannot prevent attacks that exploit human trust and manipulation, making user education the critical missing layer in the security strategy.
Why the other options are wrong
- A. EDR solutions focus on endpoint malware and behavioral analysis, not on preventing social engineering attacks at the human level.
- B. Honeypots are useful for detecting advanced threats and malware, not for countering broad social engineering techniques.
- C. Physical security personnel cannot scale to prevent social engineering attacks, which often occur remotely via email, phone, or other indirect methods.
Question 138
An ethical hacker is performing a network scan to evaluate the security of a company's IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYCK packet back. He then sends an ACK packet for the received SYCK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?
Show answer and explanation
Correct answer: D. Send a FIN or RST packet to close the connection.
After successfully establishing a TCP connection (SYN, SYN-ACK, ACK three-way handshake), an ethical hacker performing reconnaissance should properly close the connection to avoid leaving open sockets and to demonstrate responsible testing practices. Sending a FIN or RST packet gracefully terminates the connection. This is the most professional and ethical approach after completing the port discovery phase.
Why the other options are wrong
- A. Sending PSH is premature without first determining what application or service is running and whether communication is appropriate.
- B. A vulnerability scan should be conducted after completing reconnaissance and mapping, not immediately after each connection.
- C. Scanning other ports should occur systematically, not immediately after establishing one connection.
Question 139
An ethical hacker is testing the security of a website's database system against SQL Injection attacks. They discover that the IDS has a strong signature detection mechanism to detect typical SQL injection patterns. Which evasion technique can be most effectively used to bypass the IDS signature detection while performing a SQL Injection attack?
Show answer and explanation
Correct answer: D. Use Hex encoding to represent the SQL query string
Hex encoding represents SQL query strings in hexadecimal format, which effectively bypasses signature-based IDS detection because the encoded payload doesn't match typical SQL injection patterns. Most IDS systems look for identifiable SQL keywords and syntax, but hex-encoded strings appear as different characters, evading signature detection while still being executable by the database backend.
Why the other options are wrong
- A. IP fragmentation works at the network layer and doesn't effectively bypass application-layer IDS signatures for SQL injection.
- B. Case variation of SQL statements is easily detected by modern IDS systems through case-insensitive pattern matching.
- C. String concatenation can be detected by IDS systems; it's not as effective as encoding techniques for bypassing signature detection.
Question 140
An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?
Show answer and explanation
Correct answer: C. The Windows system is Vista or a later version, where LM hashes are disabled by default.
Windows Vista and later versions disable LM hashing by default as a security measure. LM hashes are considered cryptographically weak and were disabled in modern Windows versions to prevent rainbow table attacks. The blank LM hashes indicate that the system is not generating them anymore, which is the default behavior in Vista and later OS versions.
Why the other options are wrong
- A. SYSKEY encryption would encrypt the SAM file contents, not selectively blank LM hashes while keeping NTLM hashes.
- B. Passwords exceeding 14 characters would not produce blank LM hashes; LM hashing would simply fail to process them, but this isn't a system-wide default behavior.
- D. Kerberos as a default authentication method does not affect whether LM hashes are stored in the SAM file.
Question 141
A penetration tester evaluates a company’s secure web application, which uses HTTPS, secure cookie flags, and strict session management to prevent session hijacking. To bypass these protections and hijack a legitimate user’s session without detection, which advanced technique should the tester employ?
Show answer and explanation
Correct answer: D. Perform a Cross-Site Scripting (XSS) attack to steal the session token
Against a well-secured web application using HTTPS, secure cookies, and strict session management, a Cross-Site Scripting (XSS) attack is the most viable technique to steal session tokens. XSS allows the attacker to execute JavaScript in the user's browser to access and exfiltrate session cookies, bypassing transport-layer protections like HTTPS.
Why the other options are wrong
- A. Session fixation requires the ability to set a session ID during login, which strict session management prevents.
- B. Compromising a certificate authority is extraordinarily difficult and beyond the scope of typical testing.
- C. Timing side-channel attacks on session tokens are theoretical and impractical compared to XSS.
Question 142
In a healthcare organization, the network security team detects unusual network activity, indicating advanced sniffing techniques used by a potential attacker. Upon investigation, it’s found that the attacker exploits vulnerabilities in medical imaging protocols to intercept patient data. The security team must identify the specific sniffing technique being used and take action to protect patient privacy. Considering the scenario, which sophisticated sniffing technique poses the greatest challenge for the security team, potentially compromising patient data security?
Show answer and explanation
Correct answer: D. Exploiting MRI machine firmware vulnerabilities to intercept real-time patient scans.
Exploiting firmware vulnerabilities in medical imaging devices like MRI machines presents the most sophisticated sniffing challenge because it targets the hardware-software boundary at the device level, allowing real-time interception of patient data during active scanning. This is more difficult to detect and defend against than application-level attacks because it operates at the embedded system level where security monitoring is typically minimal. Firmware-level access enables persistent, undetectable sniffing of sensitive medical imaging data.
Why the other options are wrong
- A. Software code injection is detectable through integrity checking and is less sophisticated than firmware exploitation.
- B. Administrative message interception is network-level sniffing, less effective for real-time medical data capture.
- C. Report format manipulation is file-level tampering, not a sniffing technique and easier to detect through validation checks.
Question 143
Which type of malware spreads from one system to another or from one network to another and causes similar types of damage as viruses do to the infected system?
Show answer and explanation
Correct answer: A. Worm
A worm is self-propagating malware that spreads from one system to another or across networks without requiring user interaction, similar to how viruses spread. Unlike viruses which attach to files, worms are standalone programs that replicate independently and can cause similar damage across infected systems. Worms are specifically designed for autonomous network propagation.
Why the other options are wrong
- B. Rootkits provide privileged access but don't self-propagate like worms.
- C. Adware displays unwanted advertisements and doesn't spread autonomously.
- D. Trojans require user interaction to execute and don't self-propagate like worms.
Question 144
A penetration tester is hired by a company to assess its vulnerability to social engineering attacks targeting its IT department. The tester decides to use a sophisticated pretext involving technical jargon and insider information to deceive employees into revealing their network credentials. What is the most effective social engineering technique the tester should employ to maximize the chances of obtaining valid credentials without raising suspicion?
Show answer and explanation
Correct answer: D. Conduct a phone call posing as a high-level executive requesting urgent password resets
Phoning as a high-level executive requesting urgent password resets is the most effective social engineering technique because it leverages authority, urgency, and psychological pressure. Employees are more likely to bypass security procedures when pressured by apparent authority figures, especially during time-sensitive situations. This pretext exploits social hierarchy and the human tendency to comply with urgent requests from perceived superiors, making it highly effective at obtaining credentials without raising suspicion compared to other methods that may trigger security awareness training responses.
Why the other options are wrong
- A. Fake portals require user initiative to visit and may be detected by browser warnings or security tools.
- B. Generic phishing emails are easily recognized and blocked by modern email filters and security awareness programs.
- C. Physical visits require someone to notice a stranger and may trigger security protocols more readily than verbal persuasion.
Question 145
Your company suspects a potential security breach and has hired you as a Certified Ethical Hacker to investigate. You discover evidence of footprinting through search engines and advanced Google hacking techniques. The attacker utilized Google search operators to extract sensitive information. You further notice queries that indicate the use of the Google Hacking Database (CHDB) with an emphasis on VPN footprinting. Which of the following Google advanced search operators would be the LEAST useful in providing the attacker with sensitive VPN-related information?
Show answer and explanation
Correct answer: A. location: This operator finds information for a specific location
The location: operator finds information specific to geographic locations and would be the least useful for VPN footprinting. VPN-related sensitive information typically involves configuration files, login pages, documentation, and technical details that are better discovered through URL-based (inurl:), content-based (intitle:), and link-based (link:) searches rather than geographic location filtering.
Why the other options are wrong
- B. The inurl: operator is highly effective for finding VPN configuration files and pages (e.g., inurl:vpn) containing sensitive setup information.
- C. The link: operator can identify websites linking to VPN documentation or misconfigured VPN portals, revealing infrastructure details.
- D. The intitle: operator is useful for finding pages with VPN-related titles like 'VPN Configuration', 'VPN Login', or technical documentation in page titles.
Question 146
Stephen, an attacker, targeted the industrial control systems of an organization. He generated a fraudulent email with a malicious attachment and sent it to employees of the target organization. An employee who manages the sales software of the operational plant opened the fraudulent email and clicked on the malicious attachment. This resulted in the malicious attachment being downloaded and malware being injected into the sales software maintained in the victim's system. Further, the malware propagated itself to other networked systems, finally damaging the industrial automation components. What is the attack technique used by Stephen to damage the industrial systems?
Show answer and explanation
Correct answer: D. Spear-phishing attack
The attack described is a spear-phishing attack because it involves targeted fraudulent emails with malicious attachments sent to specific employees of an organization. Spear-phishing is personalized phishing that targets specific individuals or organizations, which matches the scenario where an employee received a fraudulent email with a malicious attachment. HMI-based attacks target human-machine interfaces directly, SMishing uses SMS messages, and reconnaissance is passive information gathering.
Why the other options are wrong
- A. HMI-based attacks target industrial control system interfaces directly, not email-based methods.
- B. SMishing attacks use SMS text messages, not email with malicious attachments.
- C. Reconnaissance is passive information gathering, not an active attack technique involving malware delivery.
Question 147
A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hide malicious activities?
Show answer and explanation
Correct answer: B. Because BITS packets appear identical to normal Windows update traffic.
BITS (Background Intelligent Transfer Service) is a legitimate Windows service used for system updates, so its traffic blends naturally with normal Windows update traffic. Attackers abuse this legitimacy because security systems and firewalls commonly whitelist or deprioritize BITS traffic, allowing malware to hide in plain sight as ordinary system maintenance communication.
Why the other options are wrong
- A. BITS traffic does not use encrypted DNS packets; this is not its primary characteristic.
- C. BITS does not operate exclusively through HTTP tunneling; it uses standard Windows transfer protocols.
- D. BITS does not inherently utilize IP fragmentation for IDS evasion; this is not a defining feature.
Question 148
In her role as a cybersecurity analyst for an established technology firm, Maria is assigned a crucial task. She’s instructed to perform a thorough passive reconnaissance of a major competitor’s online environment to understand their digital strategies better. The challenge, however, is to gather as much relevant information as she can without directly interacting with the competitor’s systems or alerting them to her activities, to avoid any potential legal implications. Given these constraints and the sensitive nature of her assignment, which of the following tools or methods would be least appropriate and potentially risky for Maria to employ in her task?
Show answer and explanation
Correct answer: A. Running an intensive port scan against the competitor’s public IP addresses to gain information on their internal network and server structure.
Running intensive port scans is active reconnaissance that directly interacts with the competitor's systems and crosses legal/ethical boundaries. This violates the constraint to avoid direct interaction and potential legal implications. Options B, C, and D are legitimate passive reconnaissance methods using publicly available information without system interaction.
Why the other options are wrong
- B. The Wayback Machine is purely passive, using archived public data with no system interaction or legal risk.
- C. Patent databases and public records are passive sources of publicly available information with no legal implications.
- D. Examining forums and social media is passive gathering of publicly available information without direct system interaction.
Question 149
What is the main difference between ethical hacking and malicious hacking?
Show answer and explanation
Correct answer: C. Ethical hacking is performed with permission, while malicious hacking is unauthorized
The fundamental distinction between ethical and malicious hacking is authorization and consent. Ethical hackers operate with explicit permission from the organization, while malicious hackers perform unauthorized activities. Both may use similar tools and techniques, both are illegal when unauthorized, and team size is irrelevant to the ethical classification.
Why the other options are wrong
- A. Both ethical and malicious hackers can use the same tools; the tools themselves are not the differentiator.
- B. Ethical hacking is legal when authorized; malicious hacking is illegal regardless.
- D. Team size and composition do not determine whether hacking is ethical or malicious.
Question 150
A penetration tester is tasked with identifying vulnerabilities on a web server running outdated software. The server hosts several web applications and is protected by a basic firewall. Which technique should the tester use to exploit potential server vulnerabilities?
Show answer and explanation
Correct answer: D. Execute a buffer overflow attack targeting the web server software
A buffer overflow attack targeting the web server software is the most likely to expose critical vulnerabilities in outdated software. Outdated web servers frequently contain buffer overflow vulnerabilities that provide direct code execution and system compromise. This technique exploits the fundamental weakness of running unpatched, outdated software versions.
Why the other options are wrong
- A. Brute-force login attacks target authentication, not software vulnerabilities, and are less likely to succeed than exploiting known software flaws.
- B. Directory traversal may work but is typically less severe than exploiting outdated server software vulnerabilities directly.
- C. SQL injection targets application logic and databases, not web server software itself; it's application-layer rather than server software exploitation.
Question 151
During a red team operation on a segmented enterprise network, the testers discover that the organization’s perimeter devices are configured to deeply inspect only connection initiation packets, especially TCP SYNs and HTTP requests. However, response traffic and acknowledgment packets within ongoing sessions are allowed with minimal inspection. The red team needs to covertly transmit payloads to an internal compromised host using a method that blends into existing session traffic and avoids detection. Which approach should they take to bypass these defensive mechanisms?
Show answer and explanation
Correct answer: B. ACK tunneling
ACK tunneling is the appropriate technique for this scenario. Since the perimeter devices allow ACK packets and response traffic within established sessions with minimal inspection, ACK tunneling exploits this by embedding data in ACK packets of legitimate sessions. This allows covert payload transmission that blends seamlessly into normal traffic and avoids detection by inspection mechanisms focused on connection initiation.
Why the other options are wrong
- A. Port knocking is a defense mechanism, not an offensive evasion technique for this scenario.
- C. ICMP flooding is a DoS attack, not a covert exfiltration method.
- D. SYN scanning is reconnaissance, not a method to transmit payloads through established sessions.
Question 152
Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks. What is the type of threat intelligence collected by Arnold in the above scenario?
Show answer and explanation
Correct answer: B. Operational threat intelligence
Operational threat intelligence focuses on understanding specific threats and incidents occurring in real-time or recently, collected from human sources, social media, and chat rooms, and provides actionable recommendations and warnings about emerging attacks. It bridges tactical and strategic intelligence by providing context about security events and attacker methodologies. Strategic intelligence is high-level policy-focused, tactical is about specific attack techniques, and technical is about indicators and tools.
Why the other options are wrong
- A. Strategic threat intelligence is high-level and focused on organizational strategy, not specific incidents.
- C. Technical threat intelligence concerns technical indicators and tools, not contextual incident analysis.
- D. Tactical threat intelligence covers attacker techniques and procedures, not operational incident response.
Question 153
A malicious user has acquired a Ticket Granting Service from the domain controller using a valid user's Ticket Granting Ticket in a Kerberoasting attack. He exhorted the TGS tickets from memory for offline cracking. But the attacker was stopped before he could complete his attack. The system administrator needs to investigate and remediate the potential breach. What should be the immediate step the system administrator takes?
Show answer and explanation
Correct answer: C. Change the NTLM password hash used to encrypt the ST
In Kerberoasting the stolen service ticket is encrypted with the service account's NTLM password hash, and the attacker cracks it offline to recover that password. Issued Kerberos tickets cannot simply be revoked, so the immediate fix is to reset the service account's password, which changes the hash. This makes the stolen tickets useless and any cracked password worthless.
Why the other options are wrong
- A. Rebooting clears local memory but the attacker already has the tickets and can still crack them offline.
- B. The user account was only used to request the ticket; the real target is the service account's password.
- D. Kerberos has no mechanism to invalidate an individual ticket that has already been issued.
Question 154
During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
Show answer and explanation
Correct answer: D. Use the IDLE/IPID header scan technique with the command "-sI"
The IDLE/IPID header scan technique (-sI flag) is a stealthy scanning method that bounces scans off a third-party zombie host, completely hiding the attacker's IP address. This technique allows the attacker to discover open ports and services on the target while remaining anonymous, making it ideal for the red team requirement of scanning without revealing their own IP address.
Why the other options are wrong
- A. SCTP INIT Scan (-sY) does not hide the attacker's IP address and is not designed for stealth.
- B. UDP Raw ICMP Port Unreachable (-sU) scanning reveals the attacker's IP and is not a stealthy technique.
- C. ACK flag probe scanning (-sA) does not hide the attacker's IP and is primarily used for firewall rule mapping, not service detection.
Question 155
By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login and password in plaintext. Which file do you have to clean to clear the password?
Show answer and explanation
Correct answer: D. .bash_history
The .bash_history file stores all previously executed commands in a bash shell. Since the penetration tester entered login credentials in plaintext during SMB connections, these credentials would be logged in this file. Clearing .bash_history is essential to remove evidence of the plaintext credentials.
Why the other options are wrong
- A. .xsession-log contains session information but not command history with credentials.
- B. .profile contains shell configuration settings, not command history.
- C. .bashrc contains bash configuration and aliases, not the history of executed commands.
Question 156
A multinational organization is implementing a security upgrade for its corporate wireless infrastructure. The current WPA2-Personal configuration relies on a shared passphrase, which the IT team finds difficult to rotate and manage securely across hundreds of employee devices. To enhance security and scalability, the organization decides to migrate to WPA2-Enterprise. The new setup must allow for centralized control of user authentication, support certificate-based identity verification, and ensure that each authenticated client is assigned a unique session encryption key to prevent key reuse and limit the blast radius of potential breaches. Which component is essential for enabling this centralized, certificate-based authentication with unique key generation per session in a WPA2-Enterprise environment?
Show answer and explanation
Correct answer: D. RADIUS with Extensible Authentication Protocol (EAP)
RADIUS with EAP (Extensible Authentication Protocol) is the essential component for WPA2-Enterprise environments. It provides centralized authentication through a RADIUS server, supports certificate-based identity verification through various EAP methods (EAP-TLS, PEAP, etc.), and generates unique session keys per authenticated user. This architecture enables scalable, secure management of user identities with individual encryption keys, preventing key reuse and limiting breach impact.
Why the other options are wrong
- A. TKIP is a legacy encryption protocol superseded by CCMP/AES and is not related to centralized authentication or certificate-based identity verification.
- B. OWE (Opportunistic Wireless Encryption) provides encryption for open networks without authentication and does not support centralized, certificate-based control.
- C. Pre-Shared Key is a shared passphrase used in WPA2-Personal, not scalable or suitable for enterprise centralized authentication with per-user keys.
Question 157
There have been concerns in your network that the wireless network component is not sufficiently secure. You perform a vulnerability scan of the wireless network and find that it is using an old encryption protocol that was designed to mimic wired encryption. What encryption protocol is being used?
Show answer and explanation
Correct answer: C. WEP
WEP (Wired Equivalent Privacy) was designed to mimic the security of wired networks and is an old, deprecated wireless encryption protocol. It was the first security standard for wireless networks but has numerous vulnerabilities and is no longer considered secure.
Why the other options are wrong
- A. RADIUS is an authentication protocol, not an encryption protocol for wireless networks.
- B. WPA is a more modern encryption protocol that replaced WEP, not the old protocol being referenced.
- D. WPA3 is the newest wireless encryption standard, not an old protocol designed to mimic wired encryption.
Question 158
Dorian is sending a digitally signed email to Poly. With which key is Dorian signing this message and how is Poly validating it?
Show answer and explanation
Correct answer: C. Dorian is signing the message with his private key, and Poly will verify that the message came from Dorian by using Dorian’s public key.
Digital signatures use asymmetric cryptography where the sender signs with their private key to prove authenticity and non-repudiation. The recipient verifies using the sender's public key to confirm the message came from that specific sender and hasn't been altered. This is the fundamental principle of digital signatures in email and other communications.
Why the other options are wrong
- A. Public keys cannot be used to sign; they are used for encryption and verification only.
- B. Dorian would never use Poly's private key, which only Poly should possess, and verification wouldn't work with Dorian's public key in this context.
- D. Dorian cannot sign with Poly's public key, which is not his to use, and the verification mechanism is incorrect.
Question 159
Attacker Simon targeted the communication network of an organization and disabled the security controls of NetNTLMv1 by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic. He then extracted all the non-network logon tokens from all the active processes to masquerade as a legitimate user to launch further attacks. What is the type of attack performed by Simon?
Show answer and explanation
Correct answer: D. Internal monologue attack
An internal monologue attack exploits NTLM authentication by disabling security controls and extracting non-network logon tokens from active processes to impersonate legitimate users. This attack involves modifying registry values like LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic to weaken NTLM security, then harvesting tokens for lateral movement.
Why the other options are wrong
- A. Combinator attack combines wordlists to generate password candidates, not related to NTLM token extraction.
- B. Dictionary attack uses predefined word lists against passwords, not registry manipulation or token extraction.
- C. Rainbow table attack uses precomputed hash chains for password cracking, not token harvesting or registry modification.
Question 160
During a security assessment, an attacker identifies a flaw in a multi-user file system. The system first verifies access rights to a temporary file created by a user. However, immediately after this verification, and before the file is processed, the attacker manages to swap the original file with a malicious version. This manipulation happens in the brief interval between the system's access verification and the moment it handles the file, resulting in the malicious file being treated as legitimate. Which vulnerability is the attacker exploiting?
Show answer and explanation
Correct answer: C. Time-of-validation/time-of-execution issue in resource management logic.
This is a classic Time-of-Validation/Time-of-Execution (TOCTOU or TOCTTOU) vulnerability. The system validates access rights at one point in time (time-of-validation), but the file is used later (time-of-execution) without re-validating. An attacker exploits the race condition window between validation and execution to swap the legitimate file with a malicious one, causing the system to process the malicious file as if it had passed validation.
Why the other options are wrong
- A. Integer overflow involves arithmetic operations exceeding memory bounds, not file manipulation timing issues.
- B. Null pointer dereference causes crashes from uninitialized pointers, not file substitution attacks.
- D. Certificate validation issues affect encrypted communications, not file system access control timing.
Question 161
Eric, a cloud security engineer, implements a technique for securing the cloud resources used by his organization. This technique assumes by default that a user attempting to access the network is not an authentic entity and verifies every incoming connection before allowing access to the network. Using this technique, he also imposed conditions such that employees can access only the resources required for their role. What is the technique employed by Eric to secure cloud resources?
Show answer and explanation
Correct answer: B. Zero trust network
Zero Trust Network is a security model that assumes no user or device is trustworthy by default, requires verification of every connection attempt, and implements least-privilege access (users can only access resources needed for their role). This matches Eric's implementation exactly.
Why the other options are wrong
- A. Demilitarized Zone (DMZ) is a network segment between internal and external networks, not a verification methodology for user authentication.
- C. Serverless computing is an application deployment model, not a security access control technique.
- D. Container technology is for application packaging and deployment, not for implementing authentication and authorization policies.
Question 162
Your company, SecureTech Inc., is planning to transmit some sensitive data over an unsecured communication channel. As a cyber security expert, you decide to use symmetric key encryption to protect the data. However, you must also ensure the secure exchange of the symmetric key. Which of the following protocols would you recommend to the team to achieve this?
Show answer and explanation
Correct answer: D. Applying the Diffie-Hellman protocol to exchange the symmetric key.
Diffie-Hellman is specifically designed for secure symmetric key exchange over unsecured channels, allowing two parties to establish a shared secret without directly transmitting the key. While HTTPS, SSL, and SSH all provide encryption, none directly address the core requirement of securely exchanging a symmetric key. The Diffie-Hellman protocol solves the fundamental key distribution problem by enabling agreement on a shared key through public parameters.
Why the other options are wrong
- A. HTTPS is a transport protocol that encrypts data but doesn't specifically address symmetric key exchange mechanisms.
- B. SSL certificates authenticate servers and enable encryption but don't provide a protocol for symmetric key exchange.
- C. SSH secures remote access but is not the protocol for exchanging symmetric keys for general data transmission.
Question 163
During a black-box assessment, an attacker executes the Nmap command nmap -p25 --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY, EXPN, RCPT) . The script successfully returns multiple valid usernames. What server misconfiguration is being exploited?
Show answer and explanation
Correct answer: B. SMTP user verification commands are exposed without restrictions.
The SMTP server is misconfigured by exposing user verification commands (VRFY, EXPN, RCPT) without restrictions. These commands are designed for legitimate mail system purposes but when exposed without rate limiting or access controls, they allow attackers to enumerate valid usernames. The Nmap script exploits this by sending these commands without authentication, and the server responds with valid usernames, confirming the misconfiguration allows unauthorized enumeration.
Why the other options are wrong
- A. Disabled STARTTLS allows plaintext communication but doesn't specifically enable the VRFY/EXPN/RCPT enumeration commands.
- C. MX record misconfiguration affects mail routing, not SMTP command restrictions and user enumeration.
- D. Authentication bypass doesn't explain why enumeration commands return valid usernames without credentials.
Question 164
In this attack, an adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages. When the victim reinstalls the key, associated parameters such as the incremental transmit packet number and receive packet number are reset to their initial values. What is this attack called?
Show answer and explanation
Correct answer: D. KRACK
KRACK (Key Reinstallation Attack) is the attack that manipulates and replays cryptographic handshake messages to trick a victim into reinstalling an already-in-use key. When the key is reinstalled, the nonce and packet number counters are reset, allowing attackers to replay, decrypt, and forge packets. This is a critical vulnerability in WPA2 protocol implementations.
Why the other options are wrong
- A. Evil twin is an attack involving a rogue access point impersonating a legitimate one, not key reinstallation attacks.
- B. Chop chop attack is used to recover WEP encryption keys by fragmenting encrypted packets, not manipulating handshake messages.
- C. Wardriving is a reconnaissance technique of surveying wireless networks, not a cryptographic attack on key management.
Question 165
A multinational corporation's computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly sophisticated techniques to stay undetected and continue its operations. Firstly, the malware was embedding its harmful code into the actual binary or executable part of genuine system files rather than appending or prepending itself to the files. This made it exceptionally difficult to detect and eradicate, as doing so risked damaging the system files themselves. Secondly, the malware exhibited characteristics of a type of malware that changes its code as it propagates, making signature-based detection approaches nearly impossible. On top of these, the malware maintained a persistent presence by installing itself in the registry, making it able to survive system reboots. Given these distinctive characteristics, which two types of malware techniques does this malware most closely embody?
Show answer and explanation
Correct answer: D. Metamorphic and Rootkit malware
The malware exhibits three key characteristics: (1) code embedding into legitimate binaries (rootkit behavior allowing persistence and evasion), (2) code changes during propagation making signatures ineffective (metamorphic malware), and (3) registry installation for persistence across reboots (rootkit behavior). Metamorphic malware changes its code structure, while rootkits embed into system files and the kernel to maintain hidden persistence. Both techniques are clearly described in the scenario.
Why the other options are wrong
- A. Polymorphic malware uses encryption with varied keys, not the code embedding into binaries described here; metamorphic is correct but polymorphic is not.
- B. Macro malware targets application macros, not system binaries; it doesn't exhibit the embedding behavior described.
- C. Macro malware is not relevant to this scenario; the key techniques are metamorphic changes and rootkit persistence.
Question 166
In your role as a cybersecurity specialist for a growing tech company, you are tasked with performing a regular network scan to check for any potential vulnerabilities. Your manager has specifically asked you to use a NULL scan for this round. In the context of TCP NULL scanning, what response (or lack thereof) would indicate that a particular port on a target machine is closed?
Show answer and explanation
Correct answer: B. The target machine responds with a TCP RST packet.
In TCP NULL scanning, no flags are set in the TCP header. According to RFC 793, when a closed port receives a packet with no flags set, it responds with a TCP RST (reset) packet. An open port would ignore the packet (no response), and open|filtered ports would also not respond, making the RST response the indicator of a closed port.
Why the other options are wrong
- A. No response indicates an open or filtered port, not a closed port.
- C. ICMP errors are not the standard response to NULL scan packets; they indicate a different condition.
- D. There is no TCP SYCK packet; this appears to be a misspelling and is not a valid TCP response type.
Question 167
Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FICK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed. What is the port scanning technique used by Sam to discover open ports?
Show answer and explanation
Correct answer: C. TCP Maimon scan
The TCP Maimon scan sends FIN/ACK probes to determine port status. If an RST packet is received, the port is closed; if no response, the port may be open or filtered. This matches the scenario where Sam sends probes (FIN/ACK) and receives RST responses indicating closed ports. Xmas scans use FIN/PSH/URG flags, IDLE scans use spoofed zombie IPs, and ACK flag probes are used for firewall mapping rather than port discovery.
Why the other options are wrong
- A. Xmas scan uses FIN, PSH, and URG flags, not FICK probes as described in the question.
- B. IDLE/IPID header scan uses a spoofed zombie host to perform port scanning indirectly, not FIN/ACK probes.
- D. ACK flag probe scan is used to map firewall rules and determine filtering, not primarily to discover open ports through RST responses.
Question 168
During an internal penetration test, a security analyst assesses a web application that interfaces with a backend Oracle database. Initial attempts using standard SQL injection payloads such as ‘ OR ‘1’=’l and UNION SELECT return no useful output and do not affect application behavior. Suspecting input sanitization and error suppression, the analyst crafts a new payload: 1 AND 1 < (SELECT COUNT(*) FROM all_users A, all_users B, all_users C) Upon submitting this payload, the page takes significantly longer to respond compared to previous inputs, even though no visible output is returned. What type of SQL injection technique is most likely being used here?
Show answer and explanation
Correct answer: D. Heavy query-based SQL injection
The analyst is exploiting heavy query-based SQL injection, a variant of blind SQL injection that uses computationally expensive queries to cause noticeable response time delays. The payload creates a nested cartesian product (all_users joined with itself three times) that forces the database to perform massive computations. When the injected condition is true, the heavy query executes and causes significant delay; when false, it doesn't. This timing difference reveals SQL injection vulnerability without requiring visible output or errors, exploiting the database's processing burden rather than time-based sleep functions.
Why the other options are wrong
- A. WAITFOR DELAY is a SQL Server time-based injection function; this payload uses Oracle's all_users table and achieves delays through query complexity, not explicit delay functions.
- B. Union-based injection requires extracting data or observing error messages; this payload causes delays through query computation without returning visible output.
- C. Out-of-band injection uses DNS or HTTP channels to exfiltrate data externally; this technique relies purely on response time observation within the normal channel.
Question 169
Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?
Show answer and explanation
Correct answer: B. Use a scan tool like Nessus
Nessus is a professional vulnerability scanning tool that systematically identifies vulnerabilities, misconfigurations, and missing patches on Windows systems and across networks. It provides comprehensive, automated vulnerability detection tailored for security assessments. Windows Update is a patching tool, not a discovery tool; MITRE.org is a reference database, not a scanning tool; and disk imaging is for forensics, not vulnerability discovery.
Why the other options are wrong
- A. Windows Update applies patches but does not discover existing vulnerabilities.
- C. MITRE.org is a reference resource, not a scanning tool for discovering vulnerabilities.
- D. Disk imaging is used for forensic analysis, not vulnerability discovery.
Question 170
Jake, a professional hacker, installed spyware on a target iPhone to spy on the target user’s activities. He can take complete control of the target mobile device by jailbreaking the device remotely and record audio, capture screenshots, and monitor all phone calls and SMS messages. What is the type of spyware that Jake used to infect the target device?
Show answer and explanation
Correct answer: C. Trident
Trident is sophisticated iOS spyware that performs remote jailbreaking and provides complete control over target iPhone devices. It allows attackers to record audio, capture screenshots, and monitor communications including phone calls and SMS messages. DroidSheep and Androrat are Android-specific malware, and Zscaler is a cloud security platform, not spyware.
Why the other options are wrong
- A. DroidSheep is Android malware specifically designed for Android devices, not iOS iPhones.
- B. Androrat is Android remote access trojan malware, not an iOS spyware tool.
- D. Zscaler is a cloud security and proxy platform, not spyware for monitoring device activities.
Question 171
What is the following command used for?
Show answer and explanation
Correct answer: C. Enumerating the databases in the DBMS for the URL
The command runs sqlmap against the URL http://10.10.1.20/?p=1&forumaction=search with the -dbs option, written --dbs in sqlmap's documentation, which enumerates the databases in the DBMS. sqlmap tests the URL's parameters for SQL injection and lists the database names it can reach. The option lists databases rather than retrieving statements or creating backdoors.
Why the other options are wrong
- A. Retrieving the SQL statements being run on the DBMS uses the --statements option, not --dbs.
- B. While sqlmap can exploit SQL injection vulnerabilities, the -dbs flag is for enumeration purposes, not backdoor creation.
- D. The command is not searching database statements; it enumerates the database names in the DBMS.
Question 172
You are tasked with assessing wireless network security for a corporation using WPA2 encryption. During the assessment, you identify vulnerabilities that could allow attackers to intercept and replay previously captured packets. Which WPA2 vulnerability is likely being exploited?
Show answer and explanation
Correct answer: C. KRACK vulnerabilities through key reinstallation.
KRACK (Key Reinstallation Attack) vulnerabilities specifically exploit the key reinstallation process in WPA2 handshakes, allowing attackers to intercept and replay packets by forcing cryptographic key reuse. This vulnerability enables packet interception and replay attacks exactly as described in the scenario, and was a major WPA2 weakness discovered in 2017.
Why the other options are wrong
- A. Hole196 is not a standard recognized WPA2 vulnerability terminology in security literature.
- B. WPS PIN vulnerabilities are separate from WPA2 encryption vulnerabilities and don't directly enable packet replay attacks.
- D. While weak RNG could affect key generation, KRACK is the specific known vulnerability enabling packet interception and replay in WPA2.
Question 173
In a recent cyber-attack against a large corporation, an unknown adversary compromised the network and began escalating privileges and lateral movement. The security team identified that the adversary used a sophisticated set of techniques, specifically targeting zero-day vulnerabilities. As a Certified Ethical Hacker (CEH) hired to understand this attack and propose preventive measures, which of the following actions will be most crucial for your initial analysis?
Show answer and explanation
Correct answer: B. Analyzing the initial exploitation methods, the adversary used.
Analyzing the initial exploitation methods is most crucial for initial analysis because understanding how the attacker gained initial access to zero-day vulnerabilities provides the foundation for all subsequent defensive measures. This reveals the attack vector, allows for vulnerability patching, and helps prevent similar attacks in the future. Without understanding the initial compromise, addressing privilege escalation, persistence, or exfiltration would not prevent recurrence.
Why the other options are wrong
- A. Identifying tools used is secondary to understanding the methods; tools are just instruments used to execute known attack methodologies.
- C. Checking persistence mechanisms comes after understanding initial compromise; persistence is established after initial exploitation succeeds.
- D. Investigating data exfiltration is important for damage assessment but occurs after the network is already compromised, making it reactive rather than preventive.
Question 174
Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?
Show answer and explanation
Correct answer: D. Applying the latest patches and updating software programs
Applying latest patches and updating software programs is the most effective measure because it closes security vulnerabilities that malware exploits to gain entry. While options A and B are helpful preventative measures, they are more reactive or limited in scope. Option C (scanning) is detective rather than preventive. Patching addresses the root cause by eliminating the attack vectors malware uses.
Why the other options are wrong
- A. Disabling Autorun helps but doesn't address the vulnerability exploitation mechanism.
- B. Avoiding outdated software is good practice but reactive; patching is proactive.
- C. Scanning detects malware after infection; patching prevents infection in the first place.
Question 175
In a recent penetration testing assignment, you were able to breach a servers web service and install a backdoor. Your aim is to maintain access for as long as possible without getting detected. Considering the web server countermeasures explained earlier, which of the following actions would make your backdoor most likely to remain undetected?
Show answer and explanation
Correct answer: B. Install the backdoor on a non-web file referenced in a URL.
Installing the backdoor on a non-web file referenced in a URL avoids detection because security tools typically focus on monitoring web-accessible files and common web file types. A non-web file that is referenced but not directly served as web content is less likely to be scanned, monitored, or included in security resource maps. This approach evades signature-based detection and resource enumeration tools. Placing it in excluded file types (A) assumes knowledge of exclusions, embedding in updated files (C) risks detection during updates, and increasing code size (D) actually increases the chance of signature detection.
Why the other options are wrong
- A. Exclusion lists vary between tools and are not reliable; this approach depends on luck rather than evasion technique.
- C. Regularly updated files are frequently scanned and compared, increasing the likelihood of detection during updates.
- D. Larger code is easier to detect through signature-based detection and anomaly analysis rather than harder.
Question 176
Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php? url=externalsite.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server. What is the type of attack Jason performed in the above scenario?
Show answer and explanation
Correct answer: B. Server-side request forgery (SSRF) attack
Jason modified a URL parameter that fetches external content (feed.php?url=) to point to localhost, allowing him to access internal resources bypassed by the firewall. This is the classic definition of a Server-Side Request Forgery (SSRF) attack, where the server makes requests on behalf of the attacker to internal resources it shouldn't expose.
Why the other options are wrong
- A. Web server misconfiguration is too generic and doesn't describe the specific exploitation technique of manipulating a URL parameter to access internal resources.
- C. Web cache poisoning involves injecting malicious content into cached responses; this attack is about accessing internal resources via parameter manipulation.
- D. Website defacement involves altering visible website content; this attack focused on backend access, not changing displayed content.
Question 177
During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the following tactics best represents this scenario?
Show answer and explanation
Correct answer: B. Gaining physical access by assuming the identity of a trusted internal staff.
This scenario best represents gaining physical access by assuming the identity of a trusted internal staff member (network technician). The attacker impersonates a legitimate employee, uses this false identity to bypass physical security controls, and then exploits the trust to roam freely and access sensitive information. This is a classic impersonation-based social engineering attack targeting physical security.
Why the other options are wrong
- A. Remote tech support social engineering is conducted over phone/digital channels, not through physical impersonation and in-person access.
- C. Dumpster diving (trash bin searching) is passive information gathering, not an active impersonation scenario involving facility access.
- D. Pretexting as an executive over the phone is a remote social engineering attack, not a physical impersonation and facility access scenario.
Question 178
Sophia is a shopping enthusiast who spends significant time searching for trendy outfits online. Clark, an attacker, noticed her activities several times and sent a fake email containing a deceptive page link to her social media page displaying all-new and trendy outfits. In excitement, Sophia clicked on the malicious link and logged in to that page using her valid credentials. Which of the following tools is employed by Clark to create the spoofed email?
Show answer and explanation
Correct answer: A. Evilginx
Evilginx is a specialized tool designed for creating sophisticated phishing pages and spoofed emails that can capture credentials. It is specifically used to create deceptive login pages that mimic legitimate social media platforms, allowing attackers to harvest credentials from victims. The scenario of a fake email with a deceptive login page directly matches Evilginx's capabilities.
Why the other options are wrong
- B. Slowloris is a denial-of-service tool that floods servers with slow HTTP requests.
- C. PLCinject is used for injecting code into industrial control systems, not for creating phishing pages.
- D. PyLoris is another DoS tool variant, not a phishing or spoofing tool.
Question 179
A penetration tester performs a vulnerability scan on a company’s network and identifies a critical vulnerability related to an outdated version of a database server. What should the tester prioritize as the next step?
Show answer and explanation
Correct answer: C. Attempt to exploit the vulnerability using publicly available tools or exploits
After identifying a critical vulnerability, the ethical next step in a penetration test is to attempt exploitation using publicly available tools to validate the vulnerability and assess its real-world impact. This is a standard part of the penetration testing methodology within authorized scope. The tester should document findings and work toward remediation recommendations.
Why the other options are wrong
- A. Brute-force attacks are not the appropriate next step for validating a known vulnerability; they target authentication rather than the vulnerability itself.
- B. DoS attacks are destructive and outside the scope of authorized penetration testing; they do not validate vulnerability exploitability.
- D. Ignoring critical vulnerabilities defeats the purpose of the penetration test and leaves the organization exposed to real attack risk.
Question 180
Which of the following types of SQL injection attacks extends the results returned by the original query, enabling attackers to run two or more statements if they have the same structure as the original one?
Show answer and explanation
Correct answer: A. Union SQL injection
Union SQL injection extends the results returned by the original query by appending a UNION SELECT statement, allowing attackers to run two or more queries with compatible structures and retrieve combined results. This technique requires the attacker to match the column count and data types of the original query. Error-based injection uses error messages, blind injection infers information from responses, and boolean-based blind is a variant that uses true/false conditions but doesn't extend query results like UNION does.
Why the other options are wrong
- B. Error-based injection exploits error messages, not query result extension.
- C. Blind SQL injection infers information through application behavior, not by appending results.
- D. Boolean-based blind SQL injection uses true/false conditions but doesn't extend original query results like UNION.
Question 181
A red team member uses an access token obtained from an Azure function to authenticate with Azure PowerShell and retrieve storage account keys. What kind of abuse does this scenario demonstrate?
Show answer and explanation
Correct answer: C. Exploiting managed identities for unauthorized access
This scenario demonstrates exploiting managed identities for unauthorized access. An Azure function's managed identity token is being used to authenticate with Azure services and retrieve sensitive information (storage account keys) that should not be accessible through this token. This is classic misuse of the implicit trust granted to managed identities to move laterally and escalate privileges.
Why the other options are wrong
- A. User group enumeration via AzureGraph is a separate reconnaissance technique.
- B. Stormspotter is a tool for mapping cloud resources, not the abuse vector described.
- D. NSG rule gathering is network reconnaissance, not related to managed identity token abuse.
Question 182
David is a security professional working in an organization, and he is implementing a vulnerability management program in the organization to evaluate and control the risks and vulnerabilities in its IT infrastructure. He is currently executing the process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities. Which phase of the vulnerability-management life cycle is David currently in?
Show answer and explanation
Correct answer: A. Remediation
Remediation is the phase in the vulnerability management lifecycle where fixes and patches are applied to vulnerable systems to reduce their severity and impact. This is exactly what David is doing, applying fixes to vulnerable systems. This phase follows vulnerability assessment and precedes verification.
Why the other options are wrong
- B. Verification occurs after remediation to confirm that fixes were successful.
- C. Risk assessment is an earlier phase that evaluates the severity of vulnerabilities.
- D. Vulnerability scan is the phase where vulnerabilities are identified, not where fixes are applied.
Question 183
A globally-operating bank recently encountered a severe security breach within its Android OS-based mobile banking application. Cybercriminals managed to exploit the bank’s Mobile Device Management (MDM) system and successfully carried out a series of remote commands, creating significant havoc. Upon thorough investigation of this incident, it emerged that the attackers might have leveraged the Android Debug Bridge (ADB) as a conduit for unauthorized access. As a Certified Ethical Hacker tasked with developing countermeasures to this issue, which action would you consider the most potent response in this situation?
Show answer and explanation
Correct answer: C. Establishing and enforcing a rigorous policy that unequivocally mandates the disabling of ADB, except when absolutely necessary and only within strictly regulated environments.
Disabling Android Debug Bridge (ADB) except in strictly controlled environments is the most potent countermeasure because ADB is the direct attack vector exploited in this scenario. Eliminating the vector itself is more effective than mitigating secondary defenses. While updates, biometrics, and VPNs add security layers, they don't address the root cause of ADB exploitation.
Why the other options are wrong
- A. MDM updates improve security but don't eliminate the fundamental ADB vulnerability vector used in the attack.
- B. Biometric authentication strengthens access control but doesn't prevent ADB exploitation if enabled.
- D. VPN encryption protects transaction confidentiality but doesn't prevent remote command execution via ADB.
Question 184
Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection. Identify the behavior of the adversary in the above scenario.
Show answer and explanation
Correct answer: A. Unspecified proxy activities
Clark's use of multiple domains pointing to the same host to switch between them and avoid detection is characteristic of unspecified proxy activities. This technique allows an attacker to obscure their true source and evade detection by routing traffic through multiple domain aliases. While DNS tunneling involves using DNS queries to exfiltrate data, that's not the primary behavior described here.
Why the other options are wrong
- B. Command-line interface usage is a tool, not the behavior of using multiple domains for evasion.
- C. Data staging involves preparing data for exfiltration, which is not mentioned in this scenario.
- D. DNS tunneling uses DNS for covert communication channels, not simply pointing domains to the same host.
Question 185
Jason, a certified ethical hacker, is hired by a major e-commerce company to evaluate their network's security. As part of his reconnaissance, Jason is trying to gain as much information as possible about the company's public-facing servers without arousing suspicion. His goal is to find potential points of entry and map out the network infrastructure for further examination. Which technique should Jason employ to gather this information without alerting the company's intrusion detection systems (IDS)?
Show answer and explanation
Correct answer: B. Jason should use passive reconnaissance techniques such as WHOIS lookups, NS lookups, and web research.
Passive reconnaissance techniques like WHOIS lookups, NS lookups, and web research gather information without generating network traffic or triggering alarms. These methods query publicly available information sources and analyze existing data without directly interacting with the target systems, making them undetectable by IDS systems. This is the appropriate first phase of reconnaissance to understand network infrastructure without raising suspicion.
Why the other options are wrong
- A. Directly connecting to servers and exploiting vulnerabilities is active reconnaissance and would immediately alert security systems and the company.
- C. DNS zone transfers are active reconnaissance attempts that would be logged and detected; many networks also restrict zone transfers.
- D. Ping sweeps generate ICMP traffic that IDS systems can detect and alert on, arousing suspicion of malicious activity.
Question 186
A large multinational corporation is in the process of evaluating its security infrastructure to identify potential vulnerabilities. After a comprehensive analysis, they found multiple areas of concern, including time of check/time of use (TOC/TOU) errors, improper input handling, and poor patch management. Which of the following approaches will best help the organization mitigate the vulnerability associated with TOC/TOU errors?
Show answer and explanation
Correct answer: B. Ensuring atomicity of operations between checking and using data resources
Ensuring atomicity of operations between checking and using data resources is the correct mitigation for TOC/TOU errors. TOC/TOU vulnerabilities occur when there is a time gap between verifying a condition and using it, allowing changes in between. By making the check and use operations atomic (indivisible), the system ensures no changes can occur between verification and utilization, eliminating the vulnerability.
Why the other options are wrong
- A. Regular patching addresses code vulnerabilities but doesn't specifically prevent TOC/TOU race conditions.
- C. Firewall configuration changes prevent network intrusions but don't address application-level TOC/TOU errors.
- D. Encryption protects data in transit but doesn't prevent race conditions in check-use sequences.
Question 187
A security analyst is tasked with gathering detailed information about an organization’s network infrastructure without making any direct contact that could be logged or trigger alarms. Which method should the analyst use to obtain this information covertly?
Show answer and explanation
Correct answer: D. Examine leaked documents or data dumps related to the organization
Examining leaked documents and data dumps is a passive reconnaissance technique that leaves no forensic footprint on the target organization's systems. It gathers information without direct contact, avoiding logs or triggers. Social engineering and network scanning involve active engagement, and DNS brute-force creates detectable network traffic, all of which could trigger alarms.
Why the other options are wrong
- A. Social engineering requires direct contact and communication, which can be logged and detected.
- B. DNS brute-force attacks generate network traffic that can be logged and detected by security monitoring.
- C. Network mapping tools create active connections and traffic that would be logged in network monitoring systems.
Question 188
As a cybersecurity analyst working for a multinational corporation, you are tasked with the responsibility of conducting routine vulnerability scans. This time around, you decided to use a different strategy and opted to employ a FIN scan, which is a type of stealth scanning technique. Upon conclusion of your scan, you notice an interesting anomaly, a significant number of ports did not respond to your FIN packets. With this unexpected result, you are now faced with the challenge of correctly interpreting the findings and planning the next course of action. Based on your understanding of FIN scanning and TCP/IP protocols, how should you interpret these findings?
Show answer and explanation
Correct answer: B. Consider the possibility of firewall blocking the FIN packets and investigate further.
When FIN packets receive no response, this is ambiguous under normal TCP/IP behavior, it could indicate open ports (which ignore FIN packets) or closed ports (which should respond with RST). The most likely explanation is firewall filtering, which silently drops FIN packets without responding. Further investigation is required to distinguish between actual open/closed ports and firewall-induced silence.
Why the other options are wrong
- A. No response to FIN packets does not definitively indicate closed ports; they could be open with firewall blocking.
- C. Network congestion causing no responses across multiple ports is highly unlikely and unrelated to FIN scan mechanics.
- D. No response to FIN packets is a normal scanning artifact, not indicative of an ongoing breach requiring immediate escalation.
Question 189
A red team simulation reveals a malware strain that adapts its behavior based on observed user activity and evades detection by altering its code dynamically. The malware exfiltrates data only when the system is idle and uses encrypted channels for communication. Based on these traits, what is the most probable nature of this malware?
Show answer and explanation
Correct answer: A. AI-powered malware using machine learning to tailor its execution.
The malware exhibits intelligent behavioral adaptation based on observed user activity, dynamically alters its code (not just its signature), and exhibits decision-making about when to exfiltrate data (idle system detection). These characteristics are hallmarks of AI-powered or machine learning-based malware that learns and adapts its execution patterns. While polymorphic malware changes signatures, it doesn't exhibit the sophisticated behavioral adaptation and environmental awareness described here.
Why the other options are wrong
- B. Polymorphic viruses change their signature during replication but lack the intelligent behavioral adaptation and environmental awareness described.
- C. Worms exploit vulnerabilities for propagation and don't exhibit the adaptive behavior and evasion intelligence described in the scenario.
- D. Rootkits hide system artifacts but don't inherently possess AI-driven behavioral adaptation or dynamic code alteration based on user activity monitoring.
Question 190
A Certified Ethical Hacker is attempting to gather information about a target organization's network structure through network footprinting. During the operation, they encounter ICMP blocking by the target system's firewall. The hacker wants to ascertain the path that packets take to the host system from a source, using an alternative protocol. Which of the following actions should the hacker consider next?
Show answer and explanation
Correct answer: A. Use UDP Traceroute in the Linux operating system by executing the 'traceroute' command with the destination IP or domain name.
When ICMP is blocked by a firewall, UDP traceroute is an effective alternative for discovering the network path to a target. The Linux traceroute command defaults to UDP probes when ICMP is unavailable, making it the appropriate choice for this scenario. Option B is incorrect because Windows traceroute uses ICMP by default, which is already blocked. Option C (ARIN Whois) gathers IP range information, not network paths. Option D (Path Analyzer Pro) requires a GUI tool which may not be practical in all penetration testing scenarios.
Why the other options are wrong
- B. Windows traceroute uses ICMP by default, which is already being blocked by the firewall.
- C. ARIN Whois provides IP range information, not the actual packet path to the target.
- D. Path Analyzer Pro is a GUI tool less suitable for command-line network footprinting operations.
Question 191
John, a professional hacker, targeted an organization that uses LDAP for accessing distributed directory services. He used an automated tool to anonymously query the LDAP service for sensitive information such as usernames, addresses, departmental details, and server names to launch further attacks on the target organization. What is the tool employed by John to gather information from the LDAP service?
Show answer and explanation
Correct answer: C. JXplorer
JXplorer is a GUI-based LDAP browser and editor tool that can be used to query and browse LDAP directory services. An attacker can use it to anonymously query LDAP servers and extract sensitive information such as usernames, addresses, organizational details, and server names for reconnaissance and further attack planning.
Why the other options are wrong
- A. ike-scan is used for discovering and fingerprinting IKE services, not LDAP directories.
- B. Zabasearch is a people search engine for finding personal information online, not an LDAP tool.
- D. EarthExplorer is a satellite imagery and geospatial data tool, unrelated to LDAP services.
Question 192
A penetration tester identifies malware on a system that hides its presence and gives an attacker access to administrative functions without being detected. What type of malware is this?
Show answer and explanation
Correct answer: A. Rootkit
A rootkit is malware that hides its presence at the operating system level and grants attacker access to administrative functions while remaining undetected. Rootkits specifically operate by compromising kernel-level or deep system components to conceal their presence and maintain privileged access, which matches the described behavior exactly.
Why the other options are wrong
- B. Ransomware encrypts data and demands payment; it does not focus on hiding presence or maintaining administrative access.
- C. Keyloggers record user input; they don't hide at system level or provide administrative access.
- D. Viruses replicate through host files; they don't specifically hide their presence or provide administrative functions like rootkits do.
Question 193
John, a disgruntled ex-employee of an organization, contacted a professional hacker to exploit the organization. In the attack process, the professional hacker installed a scanner on a machine belonging to one of the victims and scanned several machines on the same network to identify vulnerabilities to perform further exploitation. What is the type of vulnerability assessment tool employed by John in the above scenario?
Show answer and explanation
Correct answer: B. Network-based scanner
The scenario describes an agent-like tool installed on a compromised machine that scans other machines on the same network for vulnerabilities. This is characteristic of a network-based scanner, which operates from within the network to identify vulnerable systems. The scanner identifies vulnerabilities across multiple networked machines from a single compromised point, which is the definition of network-based scanning.
Why the other options are wrong
- A. Agent-based scanners install agents on each individual target machine to be scanned, not scanning from one machine to many others.
- C. Cluster scanner is not a standard vulnerability assessment tool classification.
- D. Proxy scanner routes scanning through a proxy, but does not fit the description of scanning multiple machines on the same network from an installed agent.
Question 194
During an internal penetration test within a large corporate environment, the red team gains access to an unrestricted network port in a public-facing meeting room. Upon connecting a laptop, the tester deploys an automated tool configured to continuously send DHCPDISCOVER requests using thousands of randomly generated spoofed MAC addresses. Within minutes, several employees report that their devices are unable to access the internal network or obtain valid IP configurations. The IT team observes that the DHCP server’s IP lease pool is completely depleted, even though few devices are actually connected at the time. What type of attack did the penetration tester perform?
Show answer and explanation
Correct answer: B. DHCP starvation
The attacker is depleting the DHCP server's IP lease pool by sending thousands of DHCPDISCOVER requests with spoofed MAC addresses. Each request causes the DHCP server to allocate an IP address from its limited pool, exhausting all available leases and preventing legitimate devices from obtaining IP configurations. This is the classic definition of a DHCP starvation attack.
Why the other options are wrong
- A. Rogue DHCP relay injection involves compromising DHCP relay agents, not flooding with discovery requests.
- C. DNS cache poisoning attacks target DNS resolution, not DHCP IP allocation.
- D. ARP spoofing manipulates ARP tables to redirect traffic, not deplete DHCP pools.
Question 195
An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability. Which of the following statements best describes this scenario?
Show answer and explanation
Correct answer: A. The organization is at fault because it did not fix all identified vulnerabilities.
John did his job by identifying the vulnerabilities and advising on preventive measures. The organization chose to fix only one, accepting the risk of the others, and the breach came through a vulnerability it left unpatched. Responsibility for that decision rests with the organization.
Why the other options are wrong
- B. John reported all the vulnerabilities and advised on them, so he did not fail to manage them.
- C. John identified the vulnerabilities and recommended fixes; the decision not to act was the organization's.
- D. Limited resources do not remove responsibility for knowingly leaving reported vulnerabilities open.
Question 196
A penetration tester is tasked with uncovering historical content from a company’s website, including previously exposed login portals or sensitive internal pages. Direct interaction with the live site is prohibited due to strict monitoring policies. To stay undetected, the tester decides to explore previously indexed snapshots of the organization’s web content saved by external sources. Which approach would most effectively support this passive information-gathering objective?
Show answer and explanation
Correct answer: A. Apply the cache: operator to view Google’s stored versions of target pages.
The cache: operator (or similar cached snapshots from services like the Wayback Machine/archive.org) allows access to previously indexed versions of web pages without directly interacting with the live site. This is purely passive reconnaissance as it queries external archival services rather than the target organization, making it undetectable to the organization's monitoring systems. This directly addresses the requirement to access historical content while avoiding detection.
Why the other options are wrong
- B. The intitle: operator searches current, live pages on search engines, which are active interactions and may be detected.
- C. Using intext: with site: directly queries the target domain, which is active reconnaissance and can trigger security monitoring.
- D. The link: operator queries current backlink information and does not retrieve historical snapshots of login portals.
Question 197
You are a cybersecurity analyst at a tech startup that provides cloud-based services to its clients. Recently, your team detected suspicious activity on one of your critical servers. After further investigation, you discovered an unauthorized user gained escalated privileges and is attempting to perform malicious actions. Your task is to thwart the attack and secure the system from future exploits. Considering the potential consequences and complex nature of the situation, which of the following actions would you take first to immediately contain the threat without causing significant disruption to your services?
Show answer and explanation
Correct answer: A. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network.
The correct approach to threat containment prioritizes understanding the threat before isolating it completely. Option A captures real-time analysis while simultaneously implementing countermeasures and isolation, which balances the need to contain the threat with preserving forensic evidence and understanding the attack vector. This approach prevents further damage while maintaining the ability to analyze the threat and implement targeted defenses. Option C (immediate shutdown) could destroy evidence and disrupt services unnecessarily, while options B and D are secondary or follow-up actions rather than immediate containment measures.
Why the other options are wrong
- B. A comprehensive vulnerability scan is a follow-up action, not an immediate containment step for an active threat.
- C. Immediate shutdown destroys evidence needed for forensics and causes unnecessary service disruption when isolation and monitoring would suffice.
- D. Engaging forensics is important but should occur after the immediate threat is contained and monitored.
Question 198
Robert, a professional hacker, is attempting to execute a fault injection attack on a target IoT device. In this process, he injects faults into the power supply that can be used for remote execution, also causing the skipping of key instructions. He also injects faults into the clock network used for delivering a synchronized signal across the chip. Which of the following types of fault injection attack is performed by Robert in the above scenario?
Show answer and explanation
Correct answer: D. Power/clock/reset glitching
Power/clock/reset glitching is the specific type of fault injection attack described in the scenario. It involves injecting faults into the power supply to enable remote code execution and skip instructions, and injecting faults into the clock network to disrupt synchronized signals across the chip. Frequency/voltage tampering affects device performance but is less specific, Optical/EMFI uses external electromagnetic pulses, and Temperature attacks affect device operation through thermal manipulation.
Why the other options are wrong
- A. Frequency/voltage tampering affects device performance and operation but doesn't specifically describe power supply and clock injection attacks.
- B. Optical and electromagnetic fault injection (EMFI) uses external physical methods like lasers and EM pulses, not direct power supply and clock manipulation.
- C. Temperature attacks use thermal manipulation to affect device behavior, not power and clock fault injection.
Question 199
John, a professional hacker, decided to use DNS to perform data exfiltration on a target network. In this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique, John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server. What is the technique employed by John to bypass the firewall?
Show answer and explanation
Correct answer: D. DNS tunneling method
DNS tunneling is a technique that encapsulates malicious data within DNS protocol packets to bypass firewalls and maintain covert communication between compromised systems and command-and-control servers. DNS is commonly allowed through firewalls, making it an ideal tunnel for data exfiltration.
Why the other options are wrong
- A. DNSSEC zone walking is used to enumerate DNS records, not for data exfiltration or bypassing firewalls.
- B. DNS cache snooping retrieves cached DNS records, not a method for data exfiltration.
- C. DNS enumeration discovers DNS records and server information, not used for firewall bypass.
Question 200
What would be the purpose of running " wget 192.168.0.15 -q -S" against a web server?
Show answer and explanation
Correct answer: B. Using wget to perform banner grabbing on the webserver
The wget command with the -S (show headers) flag retrieves and displays HTTP response headers from a web server without downloading the full page content. This is a banner grabbing technique used to identify server information such as server type, version, and other HTTP header details that can reveal system characteristics.
Why the other options are wrong
- A. The -S flag does not perform content enumeration or discover hidden folders.
- C. A single wget request is not a DoS attack; it does not flood the server.
- D. While wget can download content, the -q -S flags specifically show headers without full page download.
Question 201
A penetration tester discovers malware on a system that disguises itself as legitimate software but performs malicious actions in the background. What type of malware is this?
Show answer and explanation
Correct answer: C. Trojan
A Trojan is malware that disguises itself as legitimate software while performing malicious actions in the background. The term originates from the Trojan Horse concept, where the program appears benign but contains hidden malicious functionality that executes without the user's knowledge or consent.
Why the other options are wrong
- A. Worms are self-replicating malware that spread across networks, not software that disguises itself as legitimate.
- B. Rootkits hide malware presence by modifying system files but do not necessarily disguise themselves as legitimate software.
- D. Spyware monitors and steals information but does not necessarily present itself as legitimate software in the same manner.
Question 202
At what stage of the cyber kill chain theory model does data exfiltration occur?
Show answer and explanation
Correct answer: B. Actions on objectives
Data exfiltration occurs at the 'Actions on Objectives' stage of the cyber kill chain. This is the final phase where attackers accomplish their goals, which typically involves stealing, manipulating, or destroying data. Weaponization involves creating malware, Command and Control involves establishing communication channels, and Installation involves deploying the malware, all of which occur before data exfiltration.
Why the other options are wrong
- A. Weaponization is where attackers prepare and create malicious tools, not where data is exfiltrated.
- C. Command and Control is the communication channel established between attacker and compromised system, not the data theft stage.
- D. Installation is where malware is deployed on the target system, preceding the data exfiltration phase.
Question 203
Harry, a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection. What is the APT lifecycle phase that Harry is currently executing?
Show answer and explanation
Correct answer: A. Initial intrusion
Harry is in the Initial Intrusion phase of the APT lifecycle. This phase involves the attacker gaining their first foothold in the target network through techniques like spear-phishing and vulnerability exploitation. He has successfully deployed malware and established an outbound connection, which represents successful initial access but comes before the persistence phase where attackers would maintain long-term access.
Why the other options are wrong
- B. Persistence occurs after initial intrusion and involves techniques to maintain long-term access to compromised systems.
- C. Cleanup is a final phase where attackers remove evidence of their activities before exfiltration.
- D. Preparation occurs before any intrusion attempts and involves reconnaissance and tool development.
Question 204
A major financial institution is experiencing persistent Denial-of-Service (DoS) attacks targeting its online banking services, causing significant disruption to customer transactions and eroding trust in the institution. The security team is under immense pressure to identify and mitigate the sophisticated tactics employed by the attackers to ensure uninterrupted access to banking services. Considering the scenario described, which sophisticated Denial-of-Service (DoS) technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially jeopardizing the availability of online banking services?
Show answer and explanation
Correct answer: B. A coordinated UDP flood attack exploiting vulnerabilities in the institution’s DNS infrastructure, flooding authoritative DNS servers to disrupt domain resolution services.
A coordinated UDP flood attack targeting DNS infrastructure presents the greatest challenge because it exploits the critical dependency of banking services on DNS resolution while being difficult to distinguish from legitimate traffic. DNS attacks are infrastructure-level threats that can completely disable domain resolution for all services. While zero-day exploits are serious, successful DNS attacks create immediate, widespread outage affecting all customer access.
Why the other options are wrong
- A. Smurf attacks are relatively outdated and easier to detect/mitigate through ingress filtering and rate limiting.
- C. SQL injection is an application-layer attack that can be mitigated through input validation and parameterized queries.
- D. While zero-day exploits are dangerous, they affect specific services; DNS attacks disable the entire domain's accessibility.
Question 205
During a penetration test, a security analyst encounters a web page that returns identical generic error messages regardless of input. To test for SQL injection, they submit a query that includes AND 1=1 and later AND 1=2, observing a change in the page content. What type of injection is being tested?
Show answer and explanation
Correct answer: D. The analyst is using conditional logic to infer database behavior from page responses.
The analyst is using boolean-based blind SQL injection, a technique that exploits conditional logic to infer database behavior. By submitting AND 1=1 (always true) and AND 1=2 (always false) and observing different page responses, the analyst determines whether input is vulnerable to SQL injection without seeing error messages or data. The different page content confirms the application processes these conditions differently, revealing SQL injection vulnerability through logical inference rather than visible errors or data extraction.
Why the other options are wrong
- A. Time-based injection measures response delays to infer true/false outcomes, but this technique observes visible page content changes, not timing differences.
- B. Union-based injection appends UNION clauses to extract data from other tables, but this approach uses conditional logic without UNION statements.
- C. Error-based injection triggers visible database errors; this scenario explicitly mentions the page returns identical generic error messages, so error triggering isn't occurring.
Question 206
A penetration tester is tasked with assessing the security of a smart home IoT device that communicates with a mobile app over an unencrypted connection. The tester wants to intercept the communication and extract sensitive information. What is the most effective approach to exploit this vulnerability?
Show answer and explanation
Correct answer: C. Use a man-in-the-middle (MitM) attack to intercept and analyze the unencrypted traffic
A man-in-the-middle (MitM) attack is the most effective approach to exploit unencrypted communication between an IoT device and its mobile app. Since the connection is unencrypted, the attacker can intercept the traffic directly to analyze and extract sensitive information. This is the most direct exploitation method for the stated vulnerability of unencrypted communication.
Why the other options are wrong
- A. Brute-forcing Wi-Fi credentials is indirect and unnecessary when unencrypted traffic can be directly intercepted.
- B. Dictionary attacks on device credentials are ineffective and indirect when the communication itself is unencrypted and accessible.
- D. SQL injection targets databases, not IoT devices communicating over unencrypted channels; this doesn't exploit the stated vulnerability.
Question 207
Kevin, a professional hacker, wants to penetrate CyberTech Inc’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packets, but the target web server can decode them. What is the technique used by Kevin to evade the IDS system?
Show answer and explanation
Correct answer: C. Obfuscating
Obfuscation involves encoding or transforming data in ways that hide its true content from detection systems while remaining interpretable to the target application. By encoding packets with Unicode characters, Kevin's packets bypass the IDS signature detection but the web server can still decode and process them normally. This is a classic IDS evasion through obfuscation.
Why the other options are wrong
- A. Session splicing involves fragmenting attack data across multiple packets or sessions, not encoding with Unicode.
- B. Urgency flag is not a standard IDS evasion technique.
- D. Desynchronization causes the IDS and target system to process packets differently, but doesn't specifically involve Unicode character encoding.
Question 208
A large e-commerce organization is planning to implement a vulnerability assessment solution to enhance its security posture. They require a solution that imitates the outside view of attackers, performs well-organized inference-based testing, scans automatically against continuously updated databases, and supports multiple networks. Given these requirements, which type of vulnerability assessment solution would be most appropriate?
Show answer and explanation
Correct answer: D. Service-based solution offered by an auditing firm
A service-based solution offered by an auditing firm best meets all stated requirements: it provides an external attacker perspective, uses organized systematic testing methodologies, maintains continuously updated vulnerability databases, and can scan across multiple distributed networks through a managed service model. While inference-based solutions exist, service-based solutions better combine the external perspective, automation, database updates, and multi-network support required.
Why the other options are wrong
- A. Inference-based assessment is a testing methodology but does not inherently provide external perspective or multi-network scanning capabilities.
- B. Tree-based assessment approach is not a standard vulnerability assessment solution type and does not match the stated requirements.
- C. A product installed on a private network would not provide the external attacker perspective and would be limited to scanning only that single network.
Question 209
To hide the file on a Linux system, you have to start the filename with a specific character. What is the character?
Show answer and explanation
Correct answer: C. Period (.)
In Linux systems, files and directories that begin with a period (.) are hidden by default. They are not displayed in standard directory listings with the 'ls' command unless the -a (all) flag is used. This is a convention used to hide configuration files and other system files from casual viewing.
Why the other options are wrong
- A. The tilde (~) represents the home directory but does not hide files when used as a filename prefix.
- B. The underscore (_) has no special meaning for file visibility in Linux.
- D. The exclamation mark (!) has special meaning in bash history expansion but does not hide files.
Question 210
Your role as a network administrator in a mid-sized company involves protecting the company's web servers from potential security threats. Recently, your company’s web server experienced a Distributed Denial of Service (DDoS) attack. In explaining the situation to your team, you mention the attack specifically targeted the web server's application layer. Which type of DDoS attack was most likely used against your company’s web server?
Show answer and explanation
Correct answer: A. HTTP flood attack
HTTP flood attacks operate at the application layer (Layer 7), making them the correct answer for an application-layer targeted attack. HTTP floods send seemingly legitimate HTTP requests to overwhelm the web server's application processing capabilities. In contrast, SYN floods (Layer 4), ICMP floods (Layer 3), and UDP floods (Layer 4) all operate at lower network and transport layers. Since the scenario explicitly states the attack targeted the application layer, HTTP flood is the only correct choice.
Why the other options are wrong
- B. SYN flood attacks operate at the transport layer (Layer 4), not the application layer.
- C. ICMP flood attacks operate at the network layer (Layer 3), not the application layer.
- D. UDP flood attacks operate at the transport layer (Layer 4), not the application layer.
Question 211
Juliet, a security researcher in an organization, was tasked with checking for the authenticity of images to be used in the organization's magazines. She used these images as a search query and tracked the original source and details of the images, which included photographs, profile pictures, and memes. Which of the following footprinting techniques did Rachel use to finish her task?
Show answer and explanation
Correct answer: C. Reverse image search
Reverse image search is the footprinting technique used to find the original source and details of images by using an image as a search query. This technique allows tracking photographs, profile pictures, and memes back to their original sources. Google advanced search focuses on text-based operators, meta search engines aggregate results from multiple engines, and advanced image search is filtered image searching on a single platform, none match the reverse image search functionality described.
Why the other options are wrong
- A. Google advanced search uses text-based operators to refine searches, not image-based queries to track origins.
- B. Meta search engines combine results from multiple search engines but don't specifically track image origins.
- D. Advanced image search filters images based on criteria within a search engine, not reverse searches to find original sources.
Question 212
A penetration tester is hired to legally assess the security of a company’s network by identifying vulnerabilities and attempting to exploit them. What type of hacker is this?
Show answer and explanation
Correct answer: A. White Hat
A white hat hacker is a security professional who is legally authorized to test systems for vulnerabilities with the organization's permission. The scenario explicitly states the penetration tester is 'legally' hired to assess security, which is the defining characteristic of white hat activity. The primary distinction of white hat hackers is authorization and ethical intent.
Why the other options are wrong
- B. Script kiddies use pre-existing tools without understanding them and typically lack authorization.
- C. Black hat hackers act without authorization and with malicious intent.
- D. Grey hat hackers operate in a legal gray area, sometimes without explicit authorization or with questionable methods.
Question 213
A system administrator observes that several machines in the network are repeatedly sending out traffic to unknown IP addresses. Upon inspection, these machines were part of a coordinated spam campaign. What is the most probable cause?
Show answer and explanation
Correct answer: B. Devices were enslaved into a botnet network
When multiple machines are coordinating to send traffic to unknown IP addresses for spam campaigns, they are part of a botnet, a network of compromised devices controlled by an attacker. This describes the hallmark behavior of botnet-enslaved machines executing commands from a command-and-control server. Keyloggers harvest credentials, worms self-replicate, and adware redirects browsers, none of which cause coordinated spam campaigns.
Why the other options are wrong
- A. Keyloggers steal credentials; they don't cause machines to send spam traffic.
- C. Worms exploit vulnerabilities to spread themselves, not to launch coordinated spam campaigns.
- D. Adware redirects browsers to malicious sites; it doesn't coordinate machines for spam campaigns.
Question 214
A penetration tester suspects that a web application’s login form is vulnerable to SQL injection due to improper sanitization of user input. What is the most appropriate approach to test for SQL injection in the login form?
Show answer and explanation
Correct answer: B. Enter ‘ OR ‘1’=’1 in the username and password fields to bypass authentication
Injecting ' OR '1'='1 into authentication fields is the classic and most appropriate test for SQL injection vulnerabilities in login forms. This payload attempts to bypass authentication by making the WHERE clause always true, allowing access without valid credentials. This directly tests for the suspected improper input sanitization.
Why the other options are wrong
- A. Directory traversal is a separate vulnerability unrelated to SQL injection in login forms.
- C. Brute-force does not test for SQL injection; it is a credential guessing attack.
- D. JavaScript injection tests for XSS, not SQL injection.
Question 215
Clark, a professional hacker, was hired by an organization to gather sensitive information about its competitors surreptitiously. Clark gathers the server IP address of the target organization using Whois footprinting. Further, he entered the server IP address as an input to an online tool to retrieve information such as the network range of the target organization and to identify the network topology and operating system used in the network. What is the online tool employed by Clark in the above scenario?
Show answer and explanation
Correct answer: C. ARIN
ARIN (American Registry for Internet Numbers) is a Regional Internet Registry (RIR) that maintains IP address allocations, network ranges, and topology information for North America. It provides whois lookups and network information retrieval capabilities that would allow an attacker to identify network ranges, topology, and OS information from an IP address.
Why the other options are wrong
- A. DuckDuckGo is a search engine, not a specialized network information registry.
- B. AOL is a web portal and ISP, not a network registry or footprinting tool.
- D. Baidu is a Chinese search engine, not a network information registry for IP address research.
Question 216
Ron, a security professional, was pen testing web applications and SaaS platforms used by his company. While testing, he found a vulnerability that allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company. What is the API vulnerability revealed in the above scenario?
Show answer and explanation
Correct answer: A. No ABAC validation
The scenario describes unauthorized access to API objects with ability to view, update, and delete data, which is a classic Attribute-Based Access Control (ABAC) or Access Control List (ACL) validation failure. When APIs lack proper authorization checks to validate that users have permission to access specific objects, attackers can exploit this to gain unauthorized access. This is fundamentally an access control vulnerability rather than business logic, CORS, or code injection.
Why the other options are wrong
- B. Business logic flaws relate to flawed application workflows, not generic unauthorized object access.
- C. CORS (Cross-Origin Resource Sharing) issues relate to cross-origin requests, not direct API object authorization.
- D. Code injection attacks involve inserting malicious code, not exploiting missing access control validation.
Question 217
An ethical hacker is testing a web application of a financial firm. During the test, a 'Contact Us' form's input field is found to lack proper user input validation, indicating a potential Cross-Site Scripting (XSS) vulnerability. However, the application has a stringent Content Security Policy (CSP) disallowing inline scripts and scripts from external domains but permitting scripts from its own domain. What would be the hacker's next step to confirm the XSS vulnerability?
Show answer and explanation
Correct answer: A. Utilize a script hosted on the application's domain to test the form
Given the CSP policy allows scripts from the application's own domain but blocks inline scripts and external sources, the hacker should test with a script hosted on the application's domain. This respects the CSP constraints while still exploiting the XSS vulnerability in the Contact Us form. If the form's input is reflected without proper sanitization and the injected script from the allowed domain executes, it confirms the XSS vulnerability.
Why the other options are wrong
- B. Disabling CSP is not a legitimate testing step; the goal is to exploit within the existing security constraints.
- C. Inline scripts are explicitly blocked by the CSP, making this approach ineffective for testing.
- D. External domain scripts are explicitly disallowed by the CSP and won't execute regardless of the XSS vulnerability.
Question 218
In an advanced digital security scenario, a multinational enterprise is being targeted with a complex series of assaults aimed to disrupt operations, manipulate data integrity, and cause serious financial damage. As the Lead Cybersecurity Analyst with CEH and CISSP certifications, your responsibility is to correctly identify the specific type of attack based on the following indicators: The attacks are exploiting a vulnerability in the target system's hardware, inducing misprediction of future instructions in a program's control flow. The attackers are strategically inducing the victim process to speculatively execute instructions sequences that would not have been executed in the absence of the misprediction, leading to subtle side effects. These side effects, which are observable from the shared state, are then utilized to infer the values of in-flight data. What type of attack best describes this scenario?
Show answer and explanation
Correct answer: C. Side-Channel Attack
This scenario describes a side-channel attack, specifically speculative execution attacks like Spectre. The indicators are characteristic: exploiting hardware vulnerabilities to cause misprediction of instruction execution, inducing speculative execution of unintended instructions, and then observing side effects in shared state to infer data values. This is the hallmark of side-channel attacks that leverage architectural characteristics to leak information.
Why the other options are wrong
- A. Rowhammer attacks target DRAM memory by repeatedly accessing rows to cause bit flips, not hardware misprediction.
- B. Watering hole attacks are web-based compromise attacks targeting legitimate websites, unrelated to speculative execution.
- D. Privilege escalation attacks aim to gain higher privileges, not to exploit speculative execution for data inference.
Question 219
George, an employee of an organization, is attempting to access restricted websites from an official computer. For this purpose, he used an anonymizer that masked his real IP address and ensured complete and continuous anonymity for all his online activities. Which of the following anonymizers helps George hide his activities?
Show answer and explanation
Correct answer: B. https://www.guardster.com
Guardster.com is a web-based anonymizer service that masks users' real IP addresses and provides anonymity for online activities. It allows users to access restricted websites while hiding their identity and location. Baidu is a search engine, Wolfram Alpha is a computational knowledge engine, and KarmaDecay is a reverse image search tool, none are anonymizers.
Why the other options are wrong
- A. Baidu is a Chinese search engine, not an anonymizer service.
- C. Wolfram Alpha is a computational knowledge engine, not an anonymizer for hiding IP addresses.
- D. KarmaDecay is a reverse image search tool used for finding image sources, not for anonymity.
Question 220
While testing a web application in development, you notice that the web server does not properly ignore the “dot dot slash” (../) character string and instead returns the file listing of a folder higher up in the folder structure of the server. What kind of attack is possible in this scenario?
Show answer and explanation
Correct answer: D. Directory traversal
Directory traversal (also called path traversal) is an attack where an attacker uses sequences like '../' to navigate to parent directories and access files outside the intended directory structure. The scenario describes exactly this vulnerability, the web server not properly sanitizing '../' input, allowing access to higher folder levels.
Why the other options are wrong
- A. Cross-site scripting involves injecting malicious scripts into web pages, not using '../' to traverse directories.
- B. SQL injection targets databases through improperly sanitized SQL input, unrelated to directory path traversal.
- C. Denial of service attacks aim to make services unavailable, not to access files through path traversal.
Question 221
A penetration tester is tasked with enumerating user accounts and network resources in a highly secured Windows environment where standard methods like SMB null sessions are blocked. The network employs strict firewall rules and intrusion detection systems to prevent unauthorized access. Which technique should the tester use to discreetly gather the required information without triggering security alarms?
Show answer and explanation
Correct answer: A. Exploit a misconfigured LDAP service to perform anonymous searches
Misconfigured LDAP services often allow anonymous searches without authentication, enabling attackers to enumerate user accounts and resources discreetly. LDAP queries are typically less monitored than SMB and generate less IDS noise, making this the most effective technique for gathering information in a highly secured Windows environment with strict firewall rules.
Why the other options are wrong
- B. DNS zone transfers are less likely to reveal user accounts and network resources compared to LDAP, and modern DNS is typically configured to prevent unauthorized transfers.
- C. NetBIOS over TCP/IP would likely be blocked by the strict firewall rules mentioned, and SMB null sessions are already stated as blocked.
- D. Active Directory Web Services typically require authentication and would be monitored more closely than misconfigured LDAP services.
Question 222
You are a cybersecurity analyst at a financial institution. Your company has a strict policy against any unencrypted protocols. You’ve noticed some data packets being sent via HTTP rather than HTTPS on the network. This raises your concern because HTTP is a protocol that sends data in plaintext. To further investigate this matter, you decide to use a sniffing tool. Which of the following would be the most appropriate choice?
Show answer and explanation
Correct answer: B. Wireshark
Wireshark is a packet sniffing and analysis tool specifically designed to capture and examine network traffic, including plaintext HTTP data. It allows the analyst to inspect individual packets, view unencrypted data, and investigate protocol details, making it the appropriate choice for investigating HTTP traffic and data packets.
Why the other options are wrong
- A. Netcat is a network utility for creating connections but is not designed for packet sniffing and analysis.
- C. Nmap is a port scanning and network discovery tool, not a packet sniffer.
- D. Nessus is a vulnerability assessment tool, not a packet sniffer for analyzing traffic.
Question 223
You are a cybersecurity consultant for a global organization. The organization has adopted a Bring Your Own Device (BYOD)policy, but they have recently experienced a phishing incident where an employee's device was compromised. In the investigation, you discovered that the phishing attack occurred through a third-party email app that the employee had installed. Given the need to balance security and user autonomy under the BYOD policy, how should the organization mitigate the risk of such incidents? Moreover, consider a measure that would prevent similar attacks without overly restricting the use of personal devices.
Show answer and explanation
Correct answer: C. Implement a mobile device management solution that restricts the installation of non-approved applications.
Implementing a Mobile Device Management (MDM) solution that restricts non-approved applications directly addresses the root cause of the incident, the installation of an untrusted third-party email app. This approach balances security by controlling what can be installed while still allowing BYOD use. Option A abandons BYOD entirely. Option B (VPN requirement) doesn't prevent malicious app installation. Option D (awareness training alone) is reactive rather than preventive; while important, it doesn't stop users from installing harmful applications.
Why the other options are wrong
- A. Providing corporate devices defeats the purpose of a BYOD policy.
- B. VPN access doesn't prevent the installation of malicious third-party applications.
- D. Awareness training is valuable but doesn't technically prevent users from installing non-approved applications.
Question 224
Jim, a professional hacker, targeted an organization that is operating critical industrial infrastructure. Jim used Nmap to scan open ports and running services on systems connected to the organization’s OT network. He used an Nmap command to identify Ethernet/IP devices connected to the Internet and further gathered information such as the vendor name, product code and name, device name, and IP address. Which of the following Nmap commands helped Jim retrieve the required information?
Show answer and explanation
Correct answer: B. nmap -Pn -sU -p 44818 --script enip-info < Target IP >
The command 'nmap -Pn -sU -p 44818 --script enip-info <Target IP>' scans UDP port 44818 (EtherNet/IP protocol port) and uses the enip-info script to gather Ethernet/IP device information including vendor name, product code/name, device name, and IP address from industrial control systems.
Why the other options are wrong
- A. This command performs basic TCP scanning with parallelism limits but lacks the EtherNet/IP-specific script needed to extract device information.
- C. This command only performs TCP scanning on port 46824 without using any script to retrieve EtherNet/IP device details.
- D. This command targets port 102 with s7-info script, which is for Siemens S7 devices, not generic EtherNet/IP device enumeration.
Question 225
You have recently been hired as an entry-level IT technician in a large corporation. In a meeting with the IT team, the terms “ethical hacking” and “penetration testing” are mentioned frequently. Later, a colleague explains to you that the main difference between the two is based on their goals. What is the primary goal of an ethical hacker in comparison to a penetration tester?
Show answer and explanation
Correct answer: B. An ethical hacker is primarily focused on securing the system, while a penetration tester tries to exploit the system's vulnerabilities.
While the terms are often used interchangeably, the distinction in this context is that ethical hackers are primarily focused on securing systems and identifying vulnerabilities for defensive purposes, whereas penetration testers actively exploit vulnerabilities as part of authorized security testing. Both operate ethically and legally, but their primary orientation differs: ethical hackers lean toward defense and improvement, while penetration testers lean toward offensive testing.
Why the other options are wrong
- A. Reverses the roles; penetration testers exploit vulnerabilities while ethical hackers secure systems.
- C. Neither seeks to bring systems down; both operate within ethical and legal bounds.
- D. Describes malicious activity; ethical hackers and penetration testers both operate legitimately.
Question 226
You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side controls. During your testing, you discover that client-side controls enforce password strength and ensure CAPTCHA validation. The application also uses a proprietary encryption algorithm for client-side data. Your goal is to bypass these client-side controls to assess how robust they really are. What method would be the most effective for bypassing these controls without triggering server-side alarms?
Show answer and explanation
Correct answer: C. Utilize a proxy tool to intercept and modify the client-side controls before they reach the server.
Using a proxy tool (like Burp Suite) to intercept and modify client-side controls before they reach the server is the most effective method for bypassing JavaScript-based controls. By intercepting at the network layer, all client-side validations can be circumvented without triggering server-side alarms, as the modified requests appear to come from legitimate client processing.
Why the other options are wrong
- A. Injecting malicious JavaScript into the login form may trigger security monitoring and is less reliable than proxy interception.
- B. Disabling JavaScript will likely cause the form to fail or alert the server of abnormal client behavior, triggering alarms.
- D. Reverse-engineering the encryption algorithm is unnecessarily complex and time-consuming compared to simple proxy interception.
Question 227
You are a security analyst investigating a network compromise. The infected systems are receiving external instructions, masking the control traffic using widely allowed protocols like HTTP and DNS. The payloads are stealthy and modify system components without saving files to disk. What would be the most effective action to detect and disrupt this kind of malware communication?
Show answer and explanation
Correct answer: C. Use behavioral analytics to monitor for irregular outbound requests and abnormal application behavior.
Behavioral analytics is the most effective approach for detecting this sophisticated malware because it operates at the application and network behavior level, independent of protocol or file system artifacts. The malware described uses legitimate protocols (HTTP/DNS) as camouflage and operates in-memory without disk writes, defeating signature-based detection. Behavioral analytics detects the abnormal patterns of command-and-control communications and suspicious application activities regardless of the protocol used.
Why the other options are wrong
- A. Signature-based antivirus cannot detect in-memory, fileless malware or unknown command-and-control traffic patterns that use legitimate protocols.
- B. Blocking HTTP outright is impractical in modern environments and doesn't specifically target the irregular behavioral patterns that indicate C2 communication.
- D. Port blocking assumes malware uses specific ports; this threat uses standard ports (80, 53) for HTTP and DNS, making port-based blocking ineffective.
Question 228
Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an IaaS. What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?
Show answer and explanation
Correct answer: A. Cloudborne attack
A cloudborne attack refers to malicious code (such as backdoors) implanted in cloud infrastructure hardware or firmware that persists across server reallocations and affects multiple cloud customers. The scenario specifically describes a firmware backdoor on bare-metal cloud servers that persists even when reallocated to new clients, which is the defining characteristic of a cloudborne attack, infrastructure-level compromise affecting multiple tenants.
Why the other options are wrong
- B. Man-in-the-cloud attacks involve compromising cloud synchronization services, not firmware backdoors on bare-metal servers.
- C. Metadata spoofing involves falsifying metadata rather than implanting persistent firmware backdoors.
- D. Cloud cryptojacking involves hijacking computing resources for cryptocurrency mining, not implanting firmware backdoors.
Question 229
As a newly appointed network security analyst at a mid-tier company, you have been tasked with assessing the security of the network. As part of this, you need to ensure that your company’s network can detect and prevent evasion techniques. You know that one popular evasion technique used by attackers is using ‘packet fragmentation’. Which of the following IDS configurations should you implement to counteract this particular technique?
Show answer and explanation
Correct answer: B. Implementing an anomaly-based IDS that can recognize the irregular traffic patterns caused by packet fragmentation.
An anomaly-based IDS is most effective against packet fragmentation evasion because it detects unusual or abnormal traffic patterns rather than relying on specific signatures. Fragmented packets create irregular patterns in network traffic that deviate from normal behavior, making anomaly detection effective at identifying this evasion technique regardless of the specific fragmentation method used.
Why the other options are wrong
- A. Rejecting all fragmented packets would break legitimate applications and services that use fragmentation.
- C. Fragmented packets don't have regular intervals; the timing is variable and unpredictable.
- D. Signature-based IDS may fail to detect fragmented malicious payloads because reassembled signatures may not match.
Question 230
Steve, an attacker, created a fake profile on a social media website and sent a request to Stella. Stella was enthralled by Steve’s profile picture and the description given for his profile, and she initiated a conversation with him soon after accepting the request. After a few days, Steve started asking about her company details and eventually gathered all the essential information regarding her company. What is the social engineering technique Steve employed in the above scenario?
Show answer and explanation
Correct answer: D. Honey trap
A honey trap is a social engineering technique where an attacker creates a fake attractive profile to lure a target into a personal relationship. Once trust is established, the attacker extracts sensitive information such as company details. Steve's use of an appealing profile picture and description to attract Stella and gradually extract company information is a textbook honey trap scenario.
Why the other options are wrong
- A. Baiting involves offering something enticing like USB drives to trick people into compromising security.
- B. Piggybacking involves following an authorized person into a restricted area, not online social engineering.
- C. Diversion theft is the act of stealing physical goods by creating a distraction, not gathering information.
Question 231
Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API. Which of the following tools is used by Wilson in the above scenario?
Show answer and explanation
Correct answer: D. Infoga
Infoga is a tool specifically designed for email reconnaissance and OSINT. It extracts information from emails including sender identities, mail servers, sender IP addresses, and sender locations from public sources. It also integrates with haveibeenpwned.com to check if email addresses have been compromised in data breaches, which matches all the activities described.
Why the other options are wrong
- A. Factiva is a business intelligence tool for news and document research, not email reconnaissance.
- B. ZoomInfo is a B2B intelligence platform focused on business contact information, not email tracking.
- C. Netcraft provides web server and SSL certificate information, not email reconnaissance capabilities.
Question 232
Kevin, an encryption specialist, implemented a technique that enhances the security of keys used for encryption and authentication. Using this technique, Kevin input an initial key to an algorithm that generated an enhanced key that is resistant to brute-force attacks. What is the technique employed by Kevin to improve the security of encryption keys?
Show answer and explanation
Correct answer: A. Key stretching
Key stretching is a technique that takes an initial key and applies an algorithm to generate a stronger, enhanced key that is resistant to brute-force attacks. It increases the computational cost of attacking the key, making brute-force attempts impractical. Public Key Infrastructure manages key distribution, Key Derivation Function is related but specifically refers to deriving keys from passwords, and Key Reinstallation is a vulnerability type.
Why the other options are wrong
- B. Public Key Infrastructure is a system for managing digital certificates and keys, not for strengthening individual keys against brute-force attacks.
- C. Key Derivation Function derives cryptographic keys from passwords but is more specific than the general key stretching technique described.
- D. Key Reinstallation is a type of security vulnerability, not a technique for improving key security.
Question 233
An attacker performs DNS cache snooping using the dig command with the +norecurse flag against a known DNS server. The server returns NOERROR but provides no answer to the query. What does this most likely suggest?
Show answer and explanation
Correct answer: A. No client from the DNS server’s network has recently accessed the domain.
DNS cache snooping with +norecurse flag queries the server's cache without requesting recursion. A NOERROR response with no answer indicates the record is not in the cache, suggesting no client from that network has recently accessed the domain. If the record were cached, it would be returned; if the domain didn't exist, a different response would indicate that.
Why the other options are wrong
- B. Domain expiration would not prevent cached records from being returned; expiration affects future resolution, not cached contents.
- C. A failed DNS resolution would typically return a different response code, not NOERROR with no answer.
- D. If the record were in cache, the server would return the cached answer, not provide no answer despite NOERROR.
Question 234
During a security assessment of a cloud-hosted application using SOAP-based web services, a red team operator intercepts a legitimate SOAP request sent by a user. The operator duplicates the body of the message along with its digital signature, inserts the duplicate into the same SOAP envelope, and forwards it to the server. Due to improper validation of the message structure, the server accepts the duplicated body as authentic and processes it, resulting in unauthorized code execution. This behavior reveals a vulnerability in how the server handles signed SOAP messages. What type of attack does this scenario illustrate?
Show answer and explanation
Correct answer: A. Wrapping attack
A wrapping attack on SOAP messages involves duplicating or modifying the structure of a signed SOAP message envelope without invalidating the signature. The attacker wraps the original signed content with additional or duplicate bodies, exploiting improper validation that doesn't strictly verify the message structure, allowing the server to process the duplicated body as authentic.
Why the other options are wrong
- B. Cryptanalysis attacks attempt to break encryption itself, not exploit structural validation issues in SOAP messages.
- C. IMDS abuse refers to exploiting Instance Metadata Services in cloud environments, unrelated to SOAP message handling.
- D. Cloud Snooper uses a rootkit to pass C2 traffic through AWS security groups and firewalls; it does not manipulate SOAP messages.
Question 235
In an advanced persistent threat scenario, an adversary follows a detailed set of procedures in the cyber kill chain. During one such instance, the adversary has successfully gained access to a corporate network and now attempts to obfuscate malicious traffic within legitimate network traffic. Which of the following actions would most likely be part of the adversary's current procedures?
Show answer and explanation
Correct answer: B. Initiating DNS tunneling to communicate with the command-and-control server.
During the actions on objectives phase of the cyber kill chain, after gaining access, an adversary needs to establish command and control communication while evading detection. DNS tunneling is a technique that obfuscates malicious traffic within legitimate DNS queries and responses, making it appear as normal network activity while communicating with command-and-control servers. This directly matches the scenario of hiding traffic within legitimate network communications.
Why the other options are wrong
- A. Data staging occurs later in the attack lifecycle after establishing persistent control, not during initial obfuscation of command-and-control traffic.
- C. Establishing a C2 server is a preparatory step done before gaining access, not part of obfuscating traffic after compromise.
- D. Reconnaissance with PowerShell is a discovery technique, not a method for obfuscating traffic to hide communications.
Question 236
A penetration tester is evaluating a web application that uses HTTPS, secure cookies, and implements multi factor authentication to prevent session hijacking. To hijack a legitimate user’s session without triggering security alerts, which advanced technique should the tester employ?
Show answer and explanation
Correct answer: B. Exploit a browser zero-day vulnerability to inject malicious scripts
A browser zero-day vulnerability is the most advanced technique that could bypass HTTPS encryption, secure cookies, and multi-factor authentication by operating at the browser level itself. Zero-days allow code execution before security patches are available, enabling malicious script injection that can steal session tokens directly or perform actions on behalf of the user without triggering authentication alerts.
Why the other options are wrong
- A. CSRF attacks don't directly hijack sessions; they manipulate authenticated users into performing unwanted actions.
- C. Encrypted tokens cannot be replayed if proper TLS protections and secure cookies are implemented.
- D. HTTPS with certificate pinning protects against man-in-the-middle attacks at the network level.
Question 237
As a senior cybersecurity professional at a multinational bank, you are investigating an incident where multiple systems have been infected with malware. On the affected systems, the malware remains dormant until a specific action triggers its malicious activity. The malware has also shown signs of being able to avoid detection by changing its code or encryption each time it infects a new. Based on these characteristics, which type of malware is likely causing this problem, and what is the best method to mitigate its impact?
Show answer and explanation
Correct answer: B. Polymorphic Malware: Employ advanced threat detection tools that use behavior-based detection techniques and ensure all systems are patched.
The malware described exhibits two key characteristics: dormancy until triggered (indicating logic bombs or similar mechanisms) and the ability to change code/encryption with each infection (polymorphic behavior). Polymorphic malware specifically changes its code signature to evade detection while maintaining functionality. Behavior-based detection is essential because signature-based detection fails against code that constantly changes. Regular patching addresses vulnerability exploitation vectors. Adware doesn't exhibit these characteristics, rootkits focus on privilege elevation/hiding, and worms self-propagate but aren't necessarily polymorphic.
Why the other options are wrong
- A. Adware displays advertisements and doesn't typically exhibit polymorphic or dormancy characteristics.
- C. Rootkits focus on hiding their presence and gaining elevated privileges, not code polymorphism.
- D. Worms self-propagate but the scenario emphasizes polymorphism and dormancy, not worm-specific behavior.
Question 238
During a penetration test against a network defended by a signature-based Intrusion Detection System (IDS), the tester initiates a port scan but notices that traditional scanning methods like full SYN or TCP Connect scans are being flagged and blocked. To evade detection, the tester modifies their approach: they split the TCP headers into multiple smaller IP segments before sending them across the network. This ensures that the IDS sees only incomplete segments of the packet. Once these segments reach the target, the destination host reassembles them and processes the scan as a normal SYN request. No alerts are raised on the IDS, yet the scan reveals open ports on the target. Which evasion technique has the tester most likely employed to avoid triggering IDS alerts?
Show answer and explanation
Correct answer: C. Packet fragmentation to bypass filtering logic
Packet fragmentation splits TCP headers across multiple IP fragments, causing the IDS to see only incomplete packet segments that do not match its attack signatures. When the target host reassembles the fragments, it reconstructs the complete packet and processes it normally. This evasion technique exploits the difference in how IDS engines and end-host systems handle fragmented packets, allowing the scan to proceed without triggering alerts.
Why the other options are wrong
- A. IP decoying with randomized addresses is not related to fragmenting headers to evade signature detection.
- B. Randomized window sizes do not fragment TCP headers or bypass signature-based IDS detection.
- D. Spoofing MAC addresses does not relate to fragmenting packets for IDS evasion.
Question 239
An attacker is analyzing traffic from a mobile app and finds that sensitive data like session tokens are being transmitted over HTTP instead of HTTPS. The attacker plans to intercept and manipulate the data during transmission. Which vulnerability is the attacker exploiting?
Show answer and explanation
Correct answer: C. Insecure Communication
Insecure Communication refers to the transmission of sensitive data over unencrypted protocols like HTTP instead of encrypted protocols like HTTPS. This allows attackers to intercept and manipulate data in transit, which is exactly what the scenario describes.
Why the other options are wrong
- A. Insufficient Input Validation refers to inadequate checking of user-supplied data, not transmission security.
- B. Improper SSL Pinning relates to certificate validation mechanisms in mobile apps but is not the primary vulnerability when HTTP is used instead of HTTPS.
- D. Security Misconfiguration is broader and could apply, but Insecure Communication more precisely describes the use of unencrypted protocols.
Question 240
The web application security team of a global firm detected a sophisticated injection attack that exploited a flaw in the application’s input validation. The attack was carried out using a custom script that used obfuscation and evasion techniques to bypass security measures. To counter such attacks in the future, the security team is considering implementing additional security measures. Which of the following would be the most effective?
Show answer and explanation
Correct answer: A. Deploy a Web Application Firewall (WAF) with built-in evasion detection features.
A Web Application Firewall (WAF) with evasion detection features directly addresses injection attacks by inspecting and filtering malicious input patterns, including obfuscated payloads. It operates at the application layer and can detect sophisticated attack techniques in real-time before they reach the application code.
Why the other options are wrong
- B. 2FA protects against unauthorized access but does not prevent injection attacks at the input validation layer.
- C. While valuable, code review and penetration testing are reactive measures that don't provide real-time protection against current attacks.
- D. SIEM monitors activity but is detective in nature; it identifies attacks after they occur rather than preventing injection attacks.
Question 241
During an internal security audit, the cybersecurity team at a large healthcare organization detects abnormal patterns in DNS resolution behavior on the corporate internal network. Several employees report that when they attempt to visit legitimate internal and external websites, they are redirected to login pages that appear slightly altered. Upon deeper inspection, security logs reveal that DNS responses are being returned from an internal IP address that is not an authorized DNS server. These rogue responses are consistently faster than the legitimate replies from the corporate DNS server. Around the same time, network monitoring tools register a sharp spike in ARP spoofing alerts originating from a specific subnet. The organization becomes concerned that sensitive login credentials and personal health data may have been intercepted by an insider. Given this scenario, what type of sniffing-based attack is most likely being executed?
Show answer and explanation
Correct answer: C. Intranet DNS poisoning via local spoofed responses
The attack indicators, rogue DNS responses from an internal IP address, faster responses than legitimate DNS, ARP spoofing alerts from a specific subnet, and altered login pages, all point to intranet DNS poisoning via local spoofed responses. This is an ARP spoofing-based attack where the attacker sends spoofed ARP replies to redirect traffic to their rogue DNS server on the local network. The internal origin of the rogue responses and the correlated ARP spoofing activity confirm this is local network poisoning rather than upstream DNS cache poisoning or remote DNS manipulation.
Why the other options are wrong
- A. Proxy-based DNS redirection would not explain the ARP spoofing alerts or the internal rogue DNS server.
- B. Upstream DNS cache poisoning would originate from external DNS servers, not an internal IP address.
- D. Internet DNS spoofing via altered primary DNS settings would require modifying DNS client configurations, not local ARP-based interception.
Question 242
This form of encryption algorithm is a symmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits. Which among the following is this encryption algorithm?
Show answer and explanation
Correct answer: B. Twofish encryption algorithm
Twofish is a symmetric key block cipher with a 128-bit block size and supports key sizes up to 256 bits. It was designed as an AES candidate and provides these exact specifications.
Why the other options are wrong
- A. HMAC is a message authentication code algorithm, not a block cipher with the specified block and key sizes.
- C. IDEA is a block cipher with a 64-bit block size, not 128 bits.
- D. Blowfish has a 64-bit block size, not 128 bits, and a maximum key size of 448 bits.
Question 243
A hacker is analyzing a system that uses two rounds of symmetric encryption with different keys. To speed up key recovery, the attacker encrypts the known plaintext with all possible values of the first key and stores the intermediate ciphertexts. Then, they decrypt the final ciphertext using all possible values of the second key and compare the results to the stored values. Which cryptanalytic method does this approach represent?
Show answer and explanation
Correct answer: C. Use midpoint collision to identify key pair
The described attack is a meet-in-the-middle (or midpoint collision) attack against double encryption. The attacker encrypts plaintext with all first-key values, stores intermediate results, then decrypts the ciphertext with all second-key values and compares to find matches. This technique reduces the effective key space from 2^(2n) to 2^(n+1), making two-key encryption vulnerable. The attack literally works by finding collision at the midpoint between encryption and decryption.
Why the other options are wrong
- A. Flooding memory with brute-forced credentials is an attack on authentication systems, not a cryptanalytic method for symmetric encryption.
- B. Reverse permutations do not describe this attack; meet-in-the-middle uses encryption and decryption, not permutation reversal.
- D. Electromagnetic leakage analysis is a side-channel attack, not related to this key recovery technique.
Question 244
As a certified ethical hacker, you are tasked with gaining information about an enterprise's internal network. You are permitted to test the network's security using enumeration techniques. You successfully obtain a list of usernames using email IDs and execute a DNS Zone Transfer. Which enumeration technique would be most effective for your next move given that you have identified open TCP ports 25 (SMTP) and 139 (NetBIOS Session Service)?
Show answer and explanation
Correct answer: B. Exploit the NetBIOS Session Service on TCP port 139 to gain unauthorized access to the file system
TCP port 139 runs NetBIOS Session Service, which provides file sharing and other network services without encryption. After identifying usernames and discovering open NetBIOS ports, exploiting NetBIOS enumeration is the most effective next step to gain information about shared resources, file systems, and system details. NetBIOS enumeration naturally follows the discovery of this open port.
Why the other options are wrong
- A. Active Directory brute force is less efficient than exploiting the already-identified open NetBIOS port.
- C. SNMP typically runs on UDP port 161, not on the identified open ports 25 or 139.
- D. NFS runs on TCP port 2049, which was not identified as open in the scenario.
Question 245
A large corporate network is being subjected to repeated sniffing attacks. To increase security, the company's IT department decides to implement a combination of several security measures. They permanently add the MAC address of the gateway to the ARP cache, switch to using IPv6 instead of IPv4, implement the use of encrypted sessions such as SSH instead of Telnet, and use Secure File Transfer Protocol instead of FTP. However, they are still faced with the threat of sniffing. Considering the countermeasures, what should be their next step to enhance network security?
Show answer and explanation
Correct answer: B. Implement network scanning and monitoring tools
After implementing encryption (SSH, SFTP, IPv6), static ARP entries, and protocol upgrades, the next logical security step is to deploy network monitoring and scanning tools to detect and identify sniffing attacks in real-time. These tools can identify suspicious traffic patterns, unauthorized access attempts, and active sniffing activities that encryption alone cannot prevent.
Why the other options are wrong
- A. Using unencrypted HTTP would worsen security and contradict the encrypted protocols already implemented.
- C. Network identification broadcasts have no bearing on preventing sniffing attacks.
- D. Retrieving MAC addresses from the OS is a technical operation but doesn't enhance security against sniffing attacks.
Question 246
During a cybersecurity training session at your organization, you present several hypothetical scenarios to the trainees to assess their understanding of social engineering threats. Which of these scenarios best describes a social engineering attack?
Show answer and explanation
Correct answer: C. Sarah, a new recruit, receives a call from someone claiming to be from the IT department, who asks for her login credentials to solve a nonexisting issue.
Sarah's scenario is a textbook social engineering attack: an attacker impersonates an authority figure (IT department) and uses psychological manipulation to trick the victim into revealing sensitive credentials. This involves deception and exploitation of human psychology rather than technical exploits. Option A describes legitimate security monitoring, option B describes accidental malware introduction through system administration, and option D describes physical security breach. Only option C involves the core social engineering technique of manipulation through false pretenses to obtain sensitive information.
Why the other options are wrong
- A. Packet sniffing is a technical network attack, not social engineering.
- B. Accidental malware introduction during legitimate updates is not social engineering but operational negligence.
- D. Physical security breach through unlocked equipment is not social engineering but physical security compromise.
Question 247
Jacob works as a system administrator in an organization. He wants to extract the source code of a mobile application and disassemble the application to analyze its design flaws. Using this technique, he wants to fix any bugs in the application, discover underlying vulnerabilities, and improve defense strategies against attacks. What is the technique used by Jacob in the above scenario to improve the security of the mobile application?
Show answer and explanation
Correct answer: A. Reverse engineering
Reverse engineering is the process of extracting source code, disassembling applications, and analyzing their design to identify vulnerabilities and flaws. This technique allows developers and security professionals to understand the application's internal workings, discover bugs, identify security weaknesses, and improve defense mechanisms against attacks.
Why the other options are wrong
- B. App sandboxing is a containment technique that isolates applications to prevent them from accessing system resources, not a method for extracting and analyzing source code.
- C. Jailbreaking refers to removing restrictions on a device to gain unauthorized access, not a technique for analyzing application code for security improvements.
- D. Social engineering is a manipulation technique targeting humans, not a technical method for analyzing application code and design flaws.
Question 248
Sarah, a system administrator, was alerted of potential malicious activity on the network of her company. She discovered a malicious program spread through the instant messenger application used by her team. The attacker had obtained access to one of her teammate's messenger accounts and started sending files across the contact list. Which best describes the attack scenario and what measure could have prevented it?
Show answer and explanation
Correct answer: B. Instant Messenger Applications; verifying the sender's identity before opening any files
The attack scenario involves a compromised messenger account being used to distribute malicious files through a trusted communication channel. The attacker exploited the trust relationship between the compromised account owner and their contacts. The best preventive measure is verifying the sender's identity before opening files, which would help detect that an account has been compromised even if the file comes from a known contact.
Why the other options are wrong
- A. Insecure patch management relates to unpatched software vulnerabilities, not to verification of file sources in messaging applications.
- C. Rogue/decoy applications refers to malicious apps posing as legitimate software; this attack used a legitimate application that was compromised.
- D. Portable hardware and autorun functionality are relevant to removable media attacks, not to malicious files sent through instant messaging.
Question 249
During an internal security assessment of a medium-sized enterprise network, a security analyst notices an unusual spike in ARP traffic. Closer inspection reveals that one particular MAC address is associated with multiple IP addresses across different subnets. The ARP packets were unsolicited replies rather than requests, and several employees from different departments have reported intermittent connection drops, failed logins, and broken intranet sessions. The analyst suspects an intentional interference on the local network segment. What is the most likely cause of this abnormal behavior?
Show answer and explanation
Correct answer: A. ARP poisoning causing routing inconsistencies
ARP poisoning is occurring when one MAC address is associated with multiple IP addresses and unsolicited ARP replies flood the network. This causes hosts to have incorrect ARP table entries, routing traffic destined for legitimate targets to the attacker's machine instead. The reported symptoms of intermittent connection drops, failed logins, and broken intranet sessions are classic indicators of ARP poisoning, as legitimate traffic gets intercepted or redirected, disrupting normal network communication and authentication services.
Why the other options are wrong
- B. DHCP snooping misconfigurations would cause DHCP issues, not the described ARP-specific symptoms.
- C. Port security restrictions would prevent legitimate traffic outright, not cause intermittent failures typical of ARP poisoning.
- D. Legitimate ARP refreshes would be solicited requests, not unsolicited replies from a single suspicious MAC.
Question 250
In a highly secure online banking environment, customers have reported unauthorized access to their accounts despite robust authentication measures in place. Upon investigation, it is discovered that attackers are employing sophisticated session hijacking techniques to compromise user sessions and conduct fraudulent transactions. The security team is tasked with implementing effective countermeasures to prevent further unauthorized access and protect customer accounts. Considering the scenario described, which advanced session-hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of online banking transactions?
Show answer and explanation
Correct answer: C. Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User Sessions
Man-in-the-Browser (MitB) attacks using malicious browser extensions are the most difficult to detect and mitigate in banking environments because they operate within the trusted browser context on the user's own machine. The malware has visibility into all user interactions, HTTPS-encrypted traffic, and legitimate session tokens, making it nearly invisible to network-based defenses. It can intercept keystrokes, modify requests in-flight, and respond to multi-factor authentication challenges. Passive sniffing is defeated by encryption, session fixation is prevented by proper session management, and XSS can be mitigated by CSP and input validation, but MitB requires endpoint-level detection and response.
Why the other options are wrong
- A. Encrypted session tokens cannot be captured via passive sniffing if HTTPS is properly implemented.
- B. Session fixation is prevented through proper session identifier generation and validation protocols.
- D. XSS attacks can be significantly mitigated through Content Security Policy (CSP) and input validation controls.
Question 251
A penetration tester is assessing a company’s executive team for vulnerability to sophisticated social engineering attacks by impersonating a trusted vendor and leveraging internal communications. What is the most effective social engineering technique to obtain sensitive executive credentials without being detected?
Show answer and explanation
Correct answer: A. Create a targeted spear-phishing email that references recent internal projects and requests credential verification
Spear-phishing is the most effective social engineering technique for targeting executives without detection because it's personalized and contextual. By referencing recent internal projects and requesting credential verification, the attack appears legitimate and leverages the executive's trust. This targeted approach has higher success rates than mass phishing and is more sophisticated than impersonation calls.
Why the other options are wrong
- B. Fake social media profiles are less effective with executives who are typically more security-aware and cautious online.
- C. Impersonating the CEO via phone is easily verified and likely to be detected.
- D. Mass phishing emails lack personalization and are more likely to be caught by spam filters and security awareness.
Question 252
As a cybersecurity consultant, you have been hired by a multinational corporation to identify potential security risks in their network. During the enumeration phase, you utilize LDAP to gather information about the network infrastructure. However, you observe that some critical information isn’t retrievable. What could be the primary reason for this?
Show answer and explanation
Correct answer: D. The LDAP directory data is protected by Access Control Lists (ACLs).
Access Control Lists (ACLs) on LDAP directory objects are the primary mechanism for controlling what information is retrievable during enumeration. Even with valid LDAP queries, ACLs restrict access to sensitive directory data based on user permissions, preventing unauthorized information disclosure.
Why the other options are wrong
- A. Non-standard ports do not prevent successful LDAP queries if the correct port is discovered; the protocol functions identically.
- B. Different subnets are transparent to LDAP queries over IP networks; network topology doesn't restrict LDAP information retrieval.
- C. Network congestion causes packet loss/timeouts, not selective information unavailability across specific directory objects.
Question 253
The security team of Debry Inc. decided to upgrade Wi-Fi security to thwart attacks such as dictionary attacks and key recovery attacks. For this purpose, the security team started implementing cutting-edge technology that uses a modern key establishment protocol called the simultaneous authentication of equals (SAE), also known as dragonfly key exchange, which replaces the PSK concept. What is the Wi-Fi encryption technology implemented by Debry Inc.?
Show answer and explanation
Correct answer: C. WPA3
WPA3 is the latest Wi-Fi security standard that implements Simultaneous Authentication of Equals (SAE), also known as the Dragonfly key exchange protocol. SAE replaces the Pre-Shared Key (PSK) concept and provides stronger protection against dictionary attacks and key recovery attacks. WPA3 represents a significant security advancement for wireless networks, addressing vulnerabilities found in previous WPA2 implementations.
Why the other options are wrong
- A. WPA uses TKIP and is an older standard that predates SAE and does not offer the same level of protection.
- B. WEP is an outdated and insecure encryption standard with known vulnerabilities, not a cutting-edge technology.
- D. WPA2 uses PSK-based key establishment and CCMP, not the SAE/Dragonfly key exchange protocol implemented in WPA3.
Question 254
An attacker examines differences in ciphertext outputs resulting from small changes in the input to deduce key patterns in a symmetric algorithm. What method is being employed?
Show answer and explanation
Correct answer: C. Differential cryptanalysis on input-output differences
Differential cryptanalysis involves analyzing how small differences in input (plaintext) produce differences in output (ciphertext) to deduce patterns in a cryptographic algorithm's key schedule and operations. This is a sophisticated mathematical attack technique developed specifically for analyzing symmetric algorithms like DES. Timing attacks measure processing duration, chosen-ciphertext attacks require decryption capabilities, and brute-force is exhaustive key enumeration, none of these focus on examining input-output differential patterns.
Why the other options are wrong
- A. Timing attacks measure execution time differences, not input-output plaintext-ciphertext relationships.
- B. Chosen-ciphertext attacks require the ability to decrypt arbitrary ciphertexts, not differential analysis.
- D. Brute-force attacks try all possible keys without analyzing input-output differences.
Question 255
You are a cybersecurity consultant at SecureIoT Inc. A manufacturing company has contracted you to strengthen the security of their Industrial IoT (IIoT) devices used in their operational technology (OT)environment. They are concerned about potential attacks that could disrupt their production lines and compromise safety. They have an advanced firewall system in place, but you know this alone is not enough. Which of the following measures should you suggest to provide comprehensive protection for their IIoT devices?
Show answer and explanation
Correct answer: D. Implement network segmentation to separate IIoT devices from the rest of the network.
Network segmentation is the most comprehensive measure for protecting IIoT devices by isolating them from the rest of the network, preventing lateral movement and reducing attack surface. While the other options have merit, password changes are insufficient for OT environments, IIoT devices may not support the same encryption as IT devices, and antivirus alone cannot protect specialized industrial systems. Segmentation creates a fundamental architectural defense layer.
Why the other options are wrong
- A. Frequent password changes alone do not address the fundamental architectural vulnerabilities in IIoT systems.
- B. IIoT devices have different resource constraints and requirements than IT devices, making identical encryption standards impractical and ineffective.
- C. Firewalls and antivirus are insufficient; antivirus may not even be appropriate for embedded IIoT systems and doesn't provide architectural isolation.
Question 256
You are a cybersecurity consultant for a smart city project. The project involves deploying a vast network of IoT devices for public utilities like traffic control, water supply, and power grid management. The city administration is concerned about the possibility of a Distributed Denial of Service (DDoS) attack crippling these critical services. They have asked you for advice on how to prevent such an attack. What would be your primary recommendation?
Show answer and explanation
Correct answer: C. Deploy network intrusion detection systems (IDS) across the IoT network.
Network Intrusion Detection Systems (IDS) provide real-time monitoring and detection of abnormal traffic patterns characteristic of DDoS attacks across the entire IoT network. They can identify volumetric, protocol, and application-layer attacks and trigger countermeasures. While firmware updates, strong passwords, and IP whitelisting are important security practices, none directly address DDoS attack prevention. IDS specifically monitors and alerts on attack traffic patterns, making it the primary recommendation for preventing DDoS impact.
Why the other options are wrong
- A. Firmware updates improve overall security but don't directly prevent or mitigate DDoS attacks.
- B. Strong passwords protect against credential compromise but don't address DDoS attacks.
- D. IP whitelisting helps control access but cannot prevent DDoS attacks from whitelisted sources or distributed attack patterns.
Question 257
John wants to send Marie an email that includes sensitive information, and he does not trust the network that he is connected to. Marie gives him the idea of using PGP. What should John do to communicate correctly using this type of encryption?
Show answer and explanation
Correct answer: D. Use Marie’s public key to encrypt the message.
In PGP encryption, the sender encrypts messages using the recipient's public key. Only the recipient with their corresponding private key can decrypt the message. This ensures confidentiality because only Marie (who has her private key) can decrypt the sensitive information John sends, even if the network is untrusted.
Why the other options are wrong
- A. John's private key should never be used to encrypt messages; it's used for signing to prove authenticity.
- B. John's public key is shared and anyone could decrypt with it, providing no security.
- C. John should never have access to Marie's private key, which only she possesses.
Question 258
A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreign threats and gather intelligence without being detected. These experts work exclusively for national interests. What classification best describes them?
Show answer and explanation
Correct answer: A. State-sponsored hackers
State-sponsored hackers are government-trained cybersecurity experts who conduct covert cyber operations for national interests and intelligence gathering. This definition directly matches the scenario: a government agency training experts for covert missions against foreign threats while working exclusively for national interests. State-sponsored hackers operate under official government authority and funding, distinguishing them from other hacker categories.
Why the other options are wrong
- B. Organized hackers operate for profit-driven criminal enterprises, not government national interests.
- C. Gray hat hackers operate independently and are not officially sanctioned by governments for state missions.
- D. Hacktivists pursue ideological causes and social justice, not governmental foreign intelligence objectives.
Question 259
As a security analyst, you’re investigating an incident where an attacker was able to gain access to your network. Upon initial examination of the log files, you noticed a large number of TCP SYN packets sent to various ports on the network but with no corresponding ACKs. What type of scanning technique do you think the attacker may have used?
Show answer and explanation
Correct answer: D. The attacker has used a SYN scan, also known as half-open scanning, which involves sending SYN packets and waiting for SYCK responses.
A SYN scan (half-open scan) involves sending SYN packets to target ports and analyzing responses without completing the full TCP three-way handshake. The attacker receives SYN-ACK responses from open ports but does not send the final ACK, leaving half-open connections. This matches the observed pattern of many SYN packets with no corresponding ACKs in the logs.
Why the other options are wrong
- A. SYCK scans do not exist; this is not a recognized scanning technique.
- B. XMAS scans use flag combinations (FIN, PSH, URG), not SYN packets without ACKs.
- C. TCP Connect scans establish full connections with ACKs, contradicting the observed log pattern of no ACKs.
Question 260
A penetration tester needs to identify open ports and services on a target network without triggering the organization’s intrusion detection systems, which are configured to detect high-volume traffic and common scanning techniques. To achieve stealth, the tester decides to use a method that spreads out the scan over an extended period. Which scanning technique should the tester employ to minimize the risk of detection?
Show answer and explanation
Correct answer: B. Use a Stealth scan by adjusting the scan timing options to be slow and random
Using a stealth scan with adjusted timing options to be slow and random minimizes detection by spreading the scan over an extended period and avoiding patterns that trigger IDS alerts. This technique specifically addresses the requirement to avoid high-volume traffic detection and common scanning signatures. Slow, randomized scanning evades threshold-based and pattern-matching detection systems.
Why the other options are wrong
- A. TCP Xmas scans use distinctive flag patterns that are easily detected by IDS systems and violate the stealth requirement.
- C. Fast TCP SYN scans generate high-volume traffic that explicitly triggers IDS alerts configured to detect high-volume scanning.
- D. UDP scans targeting all ports simultaneously create high-volume traffic patterns that are easily detected by monitoring systems.
Question 261
Tony wants to integrate a 128-bit symmetric block cipher with key sizes of 128, 192, or 256 bits into a software program, which involves 32 rounds of computational operations that include substitution and permutation operations on four 32-bit word blocks using 8-variable S-boxes with 4-bit entry and 4-bit exit. Which of the following algorithms includes all the above features and can be integrated by Tony into the software program?
Show answer and explanation
Correct answer: D. Serpent
Serpent is a 128-bit symmetric block cipher that supports key sizes of 128, 192, and 256 bits. It uses 32 rounds of substitution and permutation operations with 8 S-boxes that have 4-bit inputs and 4-bit outputs. It operates on four 32-bit word blocks and is an AES finalist known for its high security margin.
Why the other options are wrong
- A. CAST-128 is a 64-bit block cipher with 16 rounds, not 128-bit blocks with 32 rounds.
- B. RC5 is a variable block cipher with different design parameters and doesn't match the specified 8-variable S-boxes configuration.
- C. TEA (Tiny Encryption Algorithm) is a 64-bit block cipher with 32 rounds but uses different S-box architecture than described.
Question 262
George is a security professional working for iTech Solutions. He was tasked with securely transferring sensitive data of the organization between industrial systems. In this process, he used a short-range communication protocol based on the IEEE 203.15.4 standard. This protocol is used in devices that transfer data infrequently at a low rate in a restricted area, within a range of 10-100 m. What is the short-range wireless communication technology George employed in the above scenario?
Show answer and explanation
Correct answer: D. Zigbee
Zigbee is the short-range wireless technology based on IEEE 802.15.4 standard, operating at 2.4 GHz, with a range of 10-100 meters, designed for low-power devices with infrequent data transmission in restricted areas. The question explicitly mentions IEEE 203.15.4 (likely a typo for 802.15.4), which is Zigbee's foundation.
Why the other options are wrong
- A. LPWAN (Low-Power Wide-Area Network) covers much longer ranges (kilometers) and is not based on IEEE 802.15.4.
- B. MQTT is a messaging protocol/broker system, not a wireless communication technology standard.
- C. NB-IoT is a cellular technology for IoT with much longer range, not a short-range protocol based on IEEE 802.15.4.
That was 262 of 1,049.
The full EC-Council 312-50v13 CEH v13 pack has all 1,049 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 524 free as one PDF by email. Get the Half Pack →