CEH Certification Practice Test: 65+ Must-Know Questions

The principle of authority states that people are highly likely to follow directions or requests from individuals they perceive to be in a position of power or expertise.

In a serverless model, the cloud provider manages the OS, patching, and runtime environment. The attacker has no persistent server to compromise, as the execution environments are ephemeral and spun up on demand.

The Protect function supports the ability to limit or contain the impact of a potential cybersecurity event and includes safeguards like access control, data security, and protective technology.

Utility refers to the usefulness of the data. Data stored on an old nine-track tape without a way to read it lacks utility, even if it is available and confidential.

The model’s layered approach is designed to protect the fragile and critical devices in the OT zone (like PLCs) from the threats and traffic originating in the less-trusted IT enterprise zone.

The `-sV` (version scan) flag instructs nmap to probe open ports to grab application banners and determine the specific software and version number listening on that port.

This range, most commonly seen as 127.0.0.1, is used for testing network services on a local machine without sending traffic onto the external network.

Polymorphism (‘many forms’) is a technique where the malware changes its appearance (e.g., by altering its decryption routine or payload) with each replication, making signature-based detection ineffective.

The `rpcinfo` utility is specifically designed to communicate with the RPC portmapper on port 111 to list services like NFS or mountd that are available for remote procedure calls.

A hybrid system uses the strengths of both types. Asymmetric cryptography (e.g., RSA or Diffie-Hellman) is used at the beginning of the session to solve the key exchange problem, allowing both parties to securely agree upon a symmetric key. That faster symmetric key is then used for the actual data encryption.

SNMPv1 relies on well-known community strings like ‘public’ and ‘private’ sent in cleartext. SNMPv3 introduced a user-based security model with strong authentication and encryption capabilities.

After gaining an initial foothold, attackers move ‘sideways’ or laterally from host to host within the trusted internal network to escalate privileges, find sensitive data, and expand their control.

The SYN, SYN/ACK, ACK exchange ensures both parties are ready to communicate and establishes the initial sequence numbers for reliable data transfer.

This is the fundamental distinction. Symmetric systems require a pre-shared secret key, whereas asymmetric systems use a public key to encrypt and a private key to decrypt.

This is a persistent XSS attack because the malicious script is stored in the web application’s database (e.g., as part of a comment or profile) and is served to and executed by all subsequent visitors to that page.

The VRFY command is explicitly designed to ask the server to verify that a given username or email address is valid. Many servers disable this feature for security reasons.

A TPM is a cryptoprocessor that provides a secure anchor for the encryption process. It can store the encryption keys in a way that they are protected from software-based attacks and can tie the decryption process to the specific hardware state, preventing the drive from being decrypted in another computer.

The SYN scan is often called a ‘half-open’ scan because it tears down the connection before it is fully established, whereas the TCP Connect scan uses the operating system’s standard connect call, creating a full connection that is more likely to be logged by the target service.

ARP spoofing works by corrupting the ARP cache of victims on a local network, causing them to send traffic intended for a legitimate host (like the gateway) to the attacker’s machine instead.

A key property of a cryptographic hash is that any change to the input data, no matter how small, results in a completely different output digest. This allows one to verify that a file or message has not been altered.

Because UDP is connectionless, an open port may not respond to a probe. Similarly, a firewall might drop the probe. Since no response could mean either scenario, the port’s state is ambiguous.

Integrity ensures that data is not changed in an unauthorized or unexpected manner. A man-in-the-middle attack that alters data directly violates this principle.

A classic stack-based buffer overflow works by sending more data than a buffer can hold, overflowing it and overwriting adjacent memory on the stack, including the crucial return address that dictates where execution will go next.

Exploit-DB is a well-known repository where security researchers and hackers can find proof-of-concept code to demonstrate and exploit vulnerabilities, and it is searchable via the `searchsploit` command-line tool.

A collision represents a failure of the hash function’s property of being unique. Finding collisions can allow an attacker to create a malicious file that has the same hash as a legitimate one, thereby bypassing integrity checks.

A stateful firewall enhances packet filtering by understanding the context of a conversation, but a DPI firewall goes further by looking inside the packet’s content for signatures of malware or attacks.

sslstrip is a specific tool designed for man-in-the-middle attacks that transparently hijacks HTTP traffic and attempts to downgrade HTTPS connections to HTTP to capture data in cleartext. It is often used in conjunction with ARP spoofing.

NS records specify the authoritative DNS servers for a domain, which hold the official records for that domain.

This is a classic rogue access point attack. Once users connect, the attacker is in a man-in-the-middle position and can monitor or manipulate all of the victims’ unencrypted traffic.

A defensible network architecture prioritizes visibility and control within the network to counter the assumption that a breach will eventually occur and an attacker will try to move from system to system.

A vulnerability scanner automates the process of checking for thousands of known weaknesses based on the services it discovers, providing a report of potential issues for manual verification.

The `site:` operator restricts the search to a specific domain, `filetype:` filters for a specific file extension, and `intext:` searches for a word within the content of those files.

A botnet is a network of compromised machines (‘bots’). The client software on each machine is responsible for communicating with the C2 server to get commands for coordinated activities like DDoS attacks or spamming.

A switch uses MAC addresses to make decisions about where to forward traffic, which is a core function of Layer 2.

SET acts as a user-friendly, menu-driven front-end that automates the process of using Metasploit’s extensive library of payloads (like Meterpreter), encoders, and handlers to carry out social engineering attacks.

Encoders apply transformations (like XORing with a key) to the payload to make it look different, helping it bypass security products that rely on matching known malicious signatures.

These tools perform directory and file brute-forcing (or ‘fuzzing’) by appending common names from a wordlist to a base URL and checking the server’s response codes.

A network tap is a hardware device that sits inline and creates a mirror of the traffic passing through it, allowing for passive monitoring without the risk of impacting network performance or being detected like a software-based sniffer might be.

SQL injection occurs when an application concatenates user input directly into a SQL statement, allowing an attacker to inject their own SQL commands to manipulate the database.

If permitted, a zone transfer (AXFR) copies the entire DNS zone file from the authoritative server, providing a complete list of all DNS records for that domain, including those not meant for public discovery.

This phase, also known as establishing persistence, involves installing software like backdoors or beacons to maintain control over the compromised system.

Packet crafting tools are often used to send non-standard or ‘illegal’ packets to probe for weaknesses in the target’s TCP/IP implementation or to test how firewalls and IDS/IPS systems handle such anomalies.

Administrative controls are the policies, standards, procedures, and guidelines that govern an organization’s security program and set expectations for personnel.

IaaS is the foundational layer where you rent hardware. SaaS is the top layer where you use a finished product. The level of customer responsibility and control is the main differentiator.

Packers compress or encrypt the main executable code (which would normally be in `.text`) and store it in the `.data` section. The small `.text` section contains only a small stub program responsible for unpacking/decrypting and executing the real code.

Bell-LaPadula is a model designed to prevent the unauthorized disclosure of information. It enforces this with the ‘no read up’ (Simple Security Property) and ‘no write down’ (*-property) rules to stop information from leaking to lower security levels.

Job descriptions often list required skills and experience with specific hardware, software, and cloud services, revealing details about the company’s technology stack.

Gaining higher privileges (e.g., SYSTEM) on the compromised machine is crucial for performing actions like dumping password hashes, disabling security software, and accessing protected files, which facilitates further attacks.

In a bus topology, terminators are crucial to prevent signal reflection (echoes), whereas in a star topology, the central switch or hub manages signal termination.

A man trap is a physical security control with two doors, where only one door can be open at a time and only one person is allowed in the space between them. This makes it physically impossible for someone to tailgate.

A Chromebook is a general-purpose computing device with traditional input/output (keyboard, screen). IoT devices are typically specialized, embedded systems without these general-purpose features.

Pivoting involves using a compromised host as a beachhead to gain access to and attack other systems that are not directly reachable from the attacker’s original position.

SOA promotes loose coupling by treating application components as independent services. This allows for flexibility, reusability, and easier maintenance as services can be updated or replaced without affecting the entire application.

By sending a flood of DHCPDISCOVER requests with spoofed MAC addresses, an attacker can use up all the leases. When a new, legitimate client requests an address, the real server has none to offer, opening the door for the attacker’s rogue server to reply and control the client’s network settings.

ADS allows data to be stored in a separate, hidden stream associated with a file. Standard file system tools typically only show the size and content of the main, unnamed data stream, effectively hiding the ADS content.

NoSQL is a broad category of databases that move away from the rigid, table-based structure of relational systems. Key-value stores are a prominent type of NoSQL database, offering high performance and scalability for certain data models.

RIRs are responsible for allocating IP address blocks to organizations, and the whois service allows querying their databases to find the owner of a given IP.

Baiting uses a physical object and human curiosity as the lure. The attacker ‘baits’ a trap hoping a victim will take the bait and infect their own machine.

A gratuitous ARP is an unsolicited ARP response. Sending many of them is a common technique for ARP poisoning, as hosts will update their caches with the unsolicited information.

The slowloris attack exhausts the web server’s maximum concurrent connection pool by holding connections open with incomplete requests. Since each connection uses minimal bandwidth, a single attacker can take down a powerful server.

Static analysis involves examining the malware file itself to understand its structure, functions, and potential capabilities, all while keeping it inactive to avoid infection.

Kerberoasting requests a service ticket from the domain controller, which is encrypted with the service account’s password hash. The attacker can then take this ticket offline and attempt to brute-force the password.

As part of the Samba suite, `nmblookup` is the Linux equivalent for discovering information about systems communicating via SMB/NetBIOS, such as their advertised names and functions.

A false positive flags a non-existent problem, creating unnecessary work, whereas a false negative fails to detect a genuine threat, creating a dangerous blind spot.

PaaS abstracts away the OS and hardware management, offering a ready-to-use platform with installed software like database servers or application servers for developers.

The CEH code of ethics explicitly requires keeping client and employer information private, emphasizing the protection of confidentiality.