Test
ECHA 2
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (232)
1An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?
- AA. The SAM file has been encrypted using the SYSKEY function.
- BB. The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a "dummy" value.
- CC. The Windows system is Vista or a later version, where LM hashes are disabled by default.
- DD. The Windows system is using the Kerberos authentication protocol as the default method.
2In which of the following incident handling and response phases are the identified security incidents analyzed, validated, categorized, and prioritized?
- AIncident recording and assignment
- BIncident triage
- CContainment
- DEradication
3Which of the following countermeasure should be used to prevent a ping sweep?
- ADisabling the firewall
- BAllowing connection with any host performing more than 10 ICMP ECHO requests
- CAvoiding the use of DMZ and disallowing commands such as ICMP ECHO_REPLY, HOST UNREACHABLE, and TIME EXCEEDED in DMZ
- DLimiting ICMP traffic with access-control lists (ACLs) to the ISP’s specific IP addresses
4You are a cybersecurity consultant for a healthcare organization that utilizes Internet of Medical Things (IoMT) devices, such as connected insulin pumps and heart rate monitors, to provide improved patient care. Recently, the organization has been targeted by ransomware attacks. While the IT infrastructure was unaffected due to robust security measures, they are worried that the IoMT devices could be potential entry points for future attacks.
What would be your main recommendation to protect these devices from such threats?- AA. Disable all wireless connectivity on IoMT devices.
- BB. Regularly change the IP addresses of all IoMT devices.
- CC. Use network segmentation to isolate IoMT devices from the main network.
- DD. Implement multi-factor authentication for all IoMT devices.
5Morris, an attacker, has targeted an organization’s network. To know the structure of the target network, he combined footprinting techniques with a network utility that helped him create diagrammatic representations of the target network. What is the network utility employed by Morris in the above scenario?
- ANetcraft
- BTracert
- CShodan Require
- DEditBuzzSumo
6You are a cybersecurity consultant for a global organization. The organization has adopted a Bring Your Own Device (BYOD) policy, but they have recently experienced a phishing incident where an employee’s device was compromised. In the investigation, you discovered that the phishing attack occurred through a third-party email app that the employee had installed. Given the need to balance security and user autonomy under the BYOD policy, how should the organization mitigate the risk of such incidents? Moreover, consider a measure that would prevent similar attacks without overly restricting the use of personal devices.
- AA. Provide employees with corporate-owned devices for work-related tasks.
- BB. Require all employee devices to use a company-provided VPN for internet access.
- CC. Implement a mobile device management solution that restricts the installation of non-approved applications.
- DD. Conduct regular cybersecurity awareness training, focusing on phishing attacks.
7XYZ company recently discovered a potential vulnerability on their network, originating from misconfigurations. It was found that some of their host servers had enabled debugging functions and unknown users were granted administrative permissions. As a Certified Ethical Hacker, what would be the most potent risk associated with this misconfiguration?
- AA. An attacker may be able to inject a malicious DLL into the current running process
- BB. Weak encryption might be allowing man-in-the-middle attacks, leading to data tampering
- CC. Unauthorized users may perform privilege escalation using unnecessarily created accounts
- DD. An attacker may carry out a Denial-of-Service assault draining the resources of the server in the process
8Which of the following is an attack where an attacker intercepts the communication between a client and server, negotiates cryptographic parameters to decrypt the encrypted content, and obtains confidential information such as system passwords?
- AChosen-key attack
- BMan-in-the-middle attack
- CRubber hose attack
- DChosen-ciphertext attack
9An organization suspects a persistent threat from a cybercriminal. They hire an ethical hacker, John, to evaluate their system security. John identifies several vulnerabilities and advises the organization on preventive measures. However, the organization has limited resources and opts to fix only the most severe vulnerability. Subsequently, a data breach occurs exploiting a different vulnerability. Which of the following statements best describes this scenario?
- AA. The organization is at fault because it did not fix all identified vulnerabilities.
- BB. Both the organization and John share responsibility because they did not adequately manage the vulnerabilities.
- CC. John is at fault because he did not emphasize the necessity of patching all vulnerabilities.
- DD. The organization is not at fault because they used their resources as per their understanding.
10An ethical hacker is attempting to crack NTLM hashed passwords from a Windows SAM file using a rainbow table attack. He has dumped the on-disk contents of the SAM file successfully and noticed that all LM hashes are blank. Given this scenario, which of the following would be the most likely reason for the blank LM hashes?
- AA. The SAM file has been encrypted using the SYSKEY function.
- BB. The passwords exceeded 14 characters in length and therefore, the LM hashes were set to a "dummy" value.
- CC. The Windows system is Vista or a later version, where LM hashes are disabled by default.
- DD. The Windows system is using the Kerberos authentication protocol as the default method.
11In which of the following attacks does an attacker install a fake communication tower between two authentic endpoints with the intention of misleading a user and interrupting the data transmission between the user and real tower to hijack an active session?
- ARogue AP attack
- BKey reinstallation attack
- CWardriving
- DaLTEr attack
12A Certified Ethical Hacker (CEH) is given the task to perform an LDAP enumeration on a target system. The system is secured and accepts connections only on secure LDAP. The CEH uses Python for the enumeration process. After successfully installing LDAP and establishing a connection with the target, he attempts to fetch details like the domain name and naming context but is unable to receive the expected response. Considering the circumstances, which of the following is the most plausible reason for this situation?
- AA. The system failed to establish a connection due to an incorrect port number.
- BB. The enumeration process was blocked by the target system's intrusion detection system.
- CC. The secure LDAP connection was not properly initialized due to a lack of 'use_ssl = True' in the server object creation.
- DD. The Python version installed on the CEH's machine is incompatible with the ldap3 library.
13You are a cybersecurity consultant for a major airport that offers free Wi-Fi to travelers. The management is concerned about the possibility of "Evil Twin" attacks, where a malicious actor sets up a rogue access point that mimics the legitimate one. They are looking for a solution that would not significantly impact the user experience or require travelers to install additional software. What is the most effective security measure you could recommend that fits these constraints, considering the airport’s unique operational environment?
- AA. Regularly change the SSID of the airport’s Wi-Fi network
- BB. Use MAC address filtering on the airport’s Wi-Fi network
- CC. Implement WPA3 encryption for the airport’s Wi-Fi network
- DD. Display a captive portal page that warns users about the possibility of Evil Twin attacks
14As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?
- AA. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
- BB. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
- CC. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std
- DD. dnsrecon -r 162.241.216.0/24 -d example.com -t brt
15Ethan, an Internet user, accessed a web application of a healthcare institution through his registered account. As security controls were not properly implemented during the development of that web application, Ethan’s credentials were compromised during an active session with the application. Identify the application security flaw exploited in the above scenario.
- AInsecure design
- BVulnerable and outdated components
- CInjection
- DBroken access control
16Which of the following risk management phases involves selecting and implementing appropriate controls for the identified risks to modify them?
- ARisk tracking and review
- BRisk identification
- CRisk treatment
- DRisk assessment
17You are an ethical hacker tasked with conducting an enumeration of a company's network. Given a Windows system with NetBIOS enabled, port 139 open, and file and printer sharing active, you are about to run some nbstat commands to enumerate NetBIOS names. The company uses IPv6 for its network. Which of the following actions should you take next?
- AA. Switch to an enumeration tool that supports IPv6
- BB. Use nbtstat -a followed by the IPv6 address of the target machine
- CC. Use nbtstat -c to get the contents of the NetBIOS name cache
- DD. Utilize Nmap Scripting Engine (NSE) for NetBIOS enumeration
18You are an ethical hacker tasked with conducting an enumeration of a company's network. Given a Windows system with NetBIOS enabled, port 139 open, and file and printer sharing active, you are about to run some nbstat commands to enumerate NetBIOS names. The company uses IPv6 for its network. Which of the following actions should you take next?
- AA. Switch to an enumeration tool that supports IPv6
- BB. Use nbtstat -a followed by the IPv6 address of the target machine
- CC. Use nbtstat -c to get the contents of the NetBIOS name cache
- DD. Utilize Nmap Scripting Engine (NSE) for NetBIOS enumeration
19During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
- AA. Use SCTP INIT Scan with the command "-sY"
- BB. Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU"
- CC. Use the ACK flag probe scanning technique with the command "-sA"
- DD. Use the IDLE/IPID header scan technique with the command "-sI"
20During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they use?
- AA. Use SCTP INIT Scan with the command "-sY"
- BB. Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU"
- CC. Use the ACK flag probe scanning technique with the command "-sA"
- DD. Use the IDLE/IPID header scan technique with the command "-sI"
21In which of the following attack types does an attacker use compromised PCs with spoofed IP addresses to intensify DDoS attacks on the victims’ DNS server by exploiting the DNS recursive method?
- ADoS/DDoS attack
- BDNS server hijacking
- CDNS amplification attack
- DDirectory traversal attack
22A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?
- AA. Implement endpoint detection and response solution to oversee endpoint activities
- BB. Set up a honeypot to attract potential attackers into a controlled environment for analysis
- CC. Deploy more security personnel to physically monitor key points of access
- DD. Organize regular employee awareness training regarding social engineering techniques and preventive measures
23A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?
- AA. Implement endpoint detection and response solution to oversee endpoint activities
- BB. Set up a honeypot to attract potential attackers into a controlled environment for analysis
- CC. Deploy more security personnel to physically monitor key points of access
- DD. Organize regular employee awareness training regarding social engineering techniques and preventive measures
24Which of the following DNS poisoning techniques is used by an attacker to infect a victim’s machine with a Trojan and remotely change their DNS IP address to that of the attacker’s?
- ADNS cache poisoning
- BProxy server
- CDNS poisoning Internet
- DDNS spoofing Intranet DNS spoofing
25An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?
- AA. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant.
- BB. m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time.
- CC. m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection.
- DD. m=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower.
26An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?
- AA. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant.
- BB. m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time.
- CC. m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection.
- DD. m=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower.
27A large organization has recently performed a vulnerability assessment using Nessus Professional, and the security team is now preparing the final report. They have identified a high-risk vulnerability, named XYZ, which could potentially allow unauthorized access to the network. In preparing the report, which of the following elements would NOT be typically included in the detailed documentation for this specific vulnerability?
- AA. Proof of concept (PoC) of the vulnerability, if possible, to demonstrate its potential impact on the system.
- BB. The total number of high, medium, and low-risk vulnerabilities detected throughout the network.
- CC. The list of all affected systems within the organization that are susceptible to the identified vulnerability.
- DD. The CVE ID of the vulnerability and its mapping to the vulnerability’s name, XYZ.
28A large organization has recently performed a vulnerability assessment using Nessus Professional, and the security team is now preparing the final report. They have identified a high-risk vulnerability, named XYZ, which could potentially allow unauthorized access to the network. In preparing the report, which of the following elements would NOT be typically included in the detailed documentation for this specific vulnerability?
- AA. Proof of concept (PoC) of the vulnerability, if possible, to demonstrate its potential impact on the system.
- BB. The total number of high, medium, and low-risk vulnerabilities detected throughout the network.
- CC. The list of all affected systems within the organization that are susceptible to the identified vulnerability.
- DD. The CVE ID of the vulnerability and its mapping to the vulnerability’s name, XYZ.
29Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?
- AA. Disabling Autorun functionality on all drives
- BB. Avoiding the use of outdated web browsers and email software
- CC. Regularly scan systems for any new files and examine them
- DD. Applying the latest patches and updating software programs
30Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?
- AA. Disabling Autorun functionality on all drives
- BB. Avoiding the use of outdated web browsers and email software
- CC. Regularly scan systems for any new files and examine them
- DD. Applying the latest patches and updating software programs
31A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?
- AA. Carry out a passive wire sniffing operation using Internet packet sniffers
- BB. Perform a PRobability INfinite Chained Elements (PRINCE) attack
- CC. Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
- DD. Request a service ticket for the service principal name of the target service account
32A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?
- AA. Carry out a passive wire sniffing operation using Internet packet sniffers
- BB. Perform a PRobability INfinite Chained Elements (PRINCE) attack
- CC. Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
- DD. Request a service ticket for the service principal name of the target service account
33Which of the following information is exploited by an attacker to perform a buffer overflow attack on a target web application?
- ACleartext communication
- BError message
- CApplication code
- DEmail interaction
34David, a content writer, was searching online for a specific topic. He visited a web page that appears legitimate and downloaded a file. As soon as he downloaded the file, his laptop started to behave in a weird manner. Out of suspicion, he scanned the laptop for viruses but found nothing. Which of the following programs conceals the malicious code of malware via various techniques, making it difficult for security mechanisms to detect or remove it?
- AExploit
- BDownloader
- CObfuscator
- DPayload
35As a cybersecurity analyst at IoT Defend, you are working with a large utility company that uses Industrial Control Systems (ICS) in its operational technology (OT) environment. The company has recently integrated IoT devices into this environment to enable remote monitoring and control. They want to ensure these devices do not become a weak link in their security posture.
To identify potential vulnerabilities in the IoT devices, which of the following actions should you recommend as the first step?- AA. Use stronger encryption algorithms for data transmission between IoT devices.
- BB. Implement network segmentation to isolate IoT devices from the rest of the network.
- CC. Conduct a vulnerability assessment specifically for the IoT devices.
- DD. Install the latest antivirus software on each IoT device.
36As a cybersecurity analyst at IoT Defend, you are working with a large utility company that uses Industrial Control Systems (ICS) in its operational technology (OT) environment. The company has recently integrated IoT devices into this environment to enable remote monitoring and control. They want to ensure these devices do not become a weak link in their security posture.
To identify potential vulnerabilities in the IoT devices, which of the following actions should you recommend as the first step?- AA. Use stronger encryption algorithms for data transmission between IoT devices.
- BB. Implement network segmentation to isolate IoT devices from the rest of the network.
- CC. Conduct a vulnerability assessment specifically for the IoT devices.
- DD. Install the latest antivirus software on each IoT device.
37A penetration tester is performing an enumeration on a client's network. The tester has acquired permission to perform enumeration activities. They have identified a remote inter-process communication (IPC) share and are trying to collect more information about it. The tester decides to use a common enumeration technique to collect the desired data. Which of the following techniques would be most appropriate for this scenario?
- AA. Probe the IPC share by attempting to brute force admin credentials
- BB. Brute force Active Directory
- CC. Extract usernames using email IDs
- DD. Conduct a DNS zone transfer
38A penetration tester is performing an enumeration on a client's network. The tester has acquired permission to perform enumeration activities. They have identified a remote inter-process communication (IPC) share and are trying to collect more information about it. The tester decides to use a common enumeration technique to collect the desired data. Which of the following techniques would be most appropriate for this scenario?
- AA. Probe the IPC share by attempting to brute force admin credentials
- BB. Brute force Active Directory
- CC. Extract usernames using email IDs
- DD. Conduct a DNS zone transfer
39As a cybersecurity analyst at TechSafe Inc., you are working on a project to improve the security of a smart home system. This IoT-enabled system controls various aspects of the home, from heating and lighting to security cameras and door locks. Your client wants to ensure that even if one device is compromised, the rest of the system remains secure. Which of the following strategies would be most effective for this purpose?
- AA. Recommend using a strong password for the smart home system's main control panel.
- BB. Suggest implementing two-factor authentication for the smart home system's mobile app.
- CC. Propose frequent system resets to clear any potential malware.
- DD. Advise using a dedicated network for the smart home system, separate from the home's main Wi-Fi network.
40As a cybersecurity analyst at TechSafe Inc., you are working on a project to improve the security of a smart home system. This IoT-enabled system controls various aspects of the home, from heating and lighting to security cameras and door locks. Your client wants to ensure that even if one device is compromised, the rest of the system remains secure. Which of the following strategies would be most effective for this purpose?
- AA. Recommend using a strong password for the smart home system's main control panel.
- BB. Suggest implementing two-factor authentication for the smart home system's mobile app.
- CC. Propose frequent system resets to clear any potential malware.
- DD. Advise using a dedicated network for the smart home system, separate from the home's main Wi-Fi network.
41During your summer internship at a tech company, you have been asked to review the security settings of their web server. While inspecting, you notice the server reveals detailed error messages to users, including database query errors and internal server errors. As a cybersecurity beginner, what is your understanding of this setting, and how would you advise the company?
- AA. Retain the setting as it aids in troubleshooting user issues.
- BB. Suppress detailed error messages, as they can expose sensitive information.
- CC. Implement stronger encryption to secure the error messages.
- DD. Increase the frequency of automated server backups.
42During your summer internship at a tech company, you have been asked to review the security settings of their web server. While inspecting, you notice the server reveals detailed error messages to users, including database query errors and internal server errors. As a cybersecurity beginner, what is your understanding of this setting, and how would you advise the company?
- AA. Retain the setting as it aids in troubleshooting user issues.
- BB. Suppress detailed error messages, as they can expose sensitive information.
- CC. Implement stronger encryption to secure the error messages.
- DD. Increase the frequency of automated server backups.
43You are the chief security officer at AlphaTech, a tech company that specializes in data storage solutions. Your company is developing a new cloud storage platform where users can store their personal files. To ensure data security, the development team is proposing to use symmetric encryption for data at rest. However, they are unsure of how to securely manage and distribute the symmetric keys to users. Which of the following strategies would you recommend to them?
- AA. Use hash functions to distribute the keys.
- BB. Use HTTPS protocol for secure key transfer.
- CC. Use digital signatures to encrypt the symmetric keys.
- DD. Implement the Diffie-Hellman protocol for secure key exchange.
44You are the chief security officer at AlphaTech, a tech company that specializes in data storage solutions. Your company is developing a new cloud storage platform where users can store their personal files. To ensure data security, the development team is proposing to use symmetric encryption for data at rest. However, they are unsure of how to securely manage and distribute the symmetric keys to users. Which of the following strategies would you recommend to them?
- AA. Use hash functions to distribute the keys.
- BB. Use HTTPS protocol for secure key transfer.
- CC. Use digital signatures to encrypt the symmetric keys.
- DD. Implement the Diffie-Hellman protocol for secure key exchange.
45When Jake, a software engineer, was using social media, he abruptly received a friend request from an unknown lady. Out of curiosity, he accepted it. She pretended to be nice and tricked Jake into revealing sensitive information about his organization. Once she obtained the information, she deactivated her account. Which of the following types of attack was performed on Jake in the above scenario?
- AShoulder surfing
- BHoney trap
- CDiversion theft
- DTailgating
46You work as a cloud security specialist at SkyNet Solutions. One of your clients is a healthcare organization that plans to migrate its electronic health record (EHR) system to the cloud. This system contains highly sensitive personal and medical data. As part of your job, you need to ensure the security and privacy of this data while it is being transferred and stored in the cloud. You recommend that data should be encrypted during transit and at rest. However, you also need to ensure that even if a cloud service provider (CSP) has access to encrypted data, they should not be able to decrypt it. Which of the following would be the most suitable strategy to meet this requirement?
- AA. Rely on network-level encryption protocols for data transfer.
- BB. Use SSL/TLS for data transfer and allow the CSP to manage encryption keys.
- CC. Utilize the CSP's built-in data encryption services.
- DD. Use client-side encryption and manage encryption keys independently of the CSP.
47You work as a cloud security specialist at SkyNet Solutions. One of your clients is a healthcare organization that plans to migrate its electronic health record (EHR) system to the cloud. This system contains highly sensitive personal and medical data. As part of your job, you need to ensure the security and privacy of this data while it is being transferred and stored in the cloud. You recommend that data should be encrypted during transit and at rest. However, you also need to ensure that even if a cloud service provider (CSP) has access to encrypted data, they should not be able to decrypt it. Which of the following would be the most suitable strategy to meet this requirement?
- AA. Rely on network-level encryption protocols for data transfer.
- BB. Use SSL/TLS for data transfer and allow the CSP to manage encryption keys.
- CC. Utilize the CSP's built-in data encryption services.
- DD. Use client-side encryption and manage encryption keys independently of the CSP.
48A certified ethical hacker is conducting a Whois footprinting activity on a specific domain. The individual is leveraging various tools such as Batch IP Converter and Whois Analyzer Pro to retrieve vital details but is unable to gather complete Whois information from the registrar for a particular set of data. As the hacker, what might be the probable data model being utilized by the domain's registrar for storing and looking up Whois information?
- AA. Thin Whois model working correctly
- BB. Thin Whois model with a malfunctioning server
- CC. Thick Whois model with a malfunctioning server
- DD. Thick Whois model working correctly
49A certified ethical hacker is conducting a Whois footprinting activity on a specific domain. The individual is leveraging various tools such as Batch IP Converter and Whois Analyzer Pro to retrieve vital details but is unable to gather complete Whois information from the registrar for a particular set of data. As the hacker, what might be the probable data model being utilized by the domain's registrar for storing and looking up Whois information?
- AA. Thin Whois model working correctly
- BB. Thin Whois model with a malfunctioning server
- CC. Thick Whois model with a malfunctioning server
- DD. Thick Whois model working correctly
50You are a cybersecurity professional managing cryptographic systems for a global corporation. The company uses a mix of Elliptic Curve Cryptography (ECC) for key exchange and symmetric encryption algorithms for data encryption. The time complexity of ECC key pair generation is O(n^3), where 'n' is the size of the key. An advanced threat actor group has a quantum computer that can potentially break ECC with a time complexity of O((log n)^2). Given that the ECC key size is 'n=512' and varying symmetric encryption algorithms and key sizes, which scenario would provide the best balance of security and performance?
- AA. Data encryption with AES-128: Provides moderate security and fast encryption, offering a balance between the two.
- BB. Data encryption with AES-256: Provides high security with better performance than 3DES, but not as fast as other AES key sizes.
- CC. Data encryption with 3DES using a 168-bit key: Offers high security but slower performance due to 3DES's inherent inefficiencies.
- DD. Data encryption with Blowfish using a 448-bit key: Offers high security but potential compatibility issues due to Blowfish’s less widespread use.
51You are a cybersecurity professional managing cryptographic systems for a global corporation. The company uses a mix of Elliptic Curve Cryptography (ECC) for key exchange and symmetric encryption algorithms for data encryption. The time complexity of ECC key pair generation is O(n^3), where 'n' is the size of the key. An advanced threat actor group has a quantum computer that can potentially break ECC with a time complexity of O((log n)^2). Given that the ECC key size is 'n=512' and varying symmetric encryption algorithms and key sizes, which scenario would provide the best balance of security and performance?
- AA. Data encryption with AES-128: Provides moderate security and fast encryption, offering a balance between the two.
- BB. Data encryption with AES-256: Provides high security with better performance than 3DES, but not as fast as other AES key sizes.
- CC. Data encryption with 3DES using a 168-bit key: Offers high security but slower performance due to 3DES's inherent inefficiencies.
- DD. Data encryption with Blowfish using a 448-bit key: Offers high security but potential compatibility issues due to Blowfish’s less widespread use.
52In which of the following phases of social engineering attacks does an attacker collect sensitive information about the organization’s accounts, finance, technologies in use, and upcoming plans?
- AResearch the target company
- BSelect a target
- CDevelop a relationship
- DExploit the relationship
53You are a security analyst for CloudSec, a company providing cloud security solutions. One of your clients, a financial institution, wants to shift its operations to a public cloud while maintaining a high level of security control. They want to ensure that they can monitor all their cloud resources continuously and receive real-time alerts about potential security threats. They also want to enforce their security policies consistently across all cloud workloads. Which of the following solutions would best meet these requirements?
- AA. Implement a Virtual Private Network (VPN) for secure data transmission.
- BB. Deploy a Cloud Access Security Broker (CASB).
- CC. Use multi-factor authentication for all cloud user accounts.
- DD. Use client-side encryption for all stored data.
54You are a security analyst for CloudSec, a company providing cloud security solutions. One of your clients, a financial institution, wants to shift its operations to a public cloud while maintaining a high level of security control. They want to ensure that they can monitor all their cloud resources continuously and receive real-time alerts about potential security threats. They also want to enforce their security policies consistently across all cloud workloads. Which of the following solutions would best meet these requirements?
- AA. Implement a Virtual Private Network (VPN) for secure data transmission.
- BB. Deploy a Cloud Access Security Broker (CASB).
- CC. Use multi-factor authentication for all cloud user accounts.
- DD. Use client-side encryption for all stored data.
55Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts ‘q’ malicious SQL queries, each inducing a delay of ‘d’ seconds in the server response. This delay in response is an indicator of a potential attack. If the total delay, represented by the product ‘q*d’, crosses a defined threshold ‘T’, an alert is activated in your security system. Furthermore, it is observed that the attacker prefers prime numbers for ‘q’, and ‘d’ follows a pattern in the Fibonacci sequence. Now, consider ‘d=13’ seconds (a Fibonacci number) and various values of ‘q’ (a prime number) and ‘T’. Which among the following scenarios will most likely trigger an alert?
- AA. q=17, T=220: Even though the attacker increases ‘q’, the total delay (‘qd’ = 221 seconds) just surpasses the threshold, possibly activating an alert.
- BB. q=13, T=180: In this case, the total delay caused by the attacker (‘qd’ = 169 seconds) breaches the threshold, likely leading to the triggering of a security alert.
- CC. q=11, T=150: Here, the total delay induced by the attacker (‘qd’ = 143 seconds) does not surpass the threshold, so the security system remains dormant.
- DD. q=19, T=260: Despite the attacker’s increased effort, the total delay (‘qd’ = 247 seconds) does not exceed the threshold, thus no alert is triggered.
56Consider a hypothetical situation where an attacker, known for his proficiency in SQL Injection attacks, is targeting your web server. This adversary meticulously crafts ‘q’ malicious SQL queries, each inducing a delay of ‘d’ seconds in the server response. This delay in response is an indicator of a potential attack. If the total delay, represented by the product ‘q*d’, crosses a defined threshold ‘T’, an alert is activated in your security system. Furthermore, it is observed that the attacker prefers prime numbers for ‘q’, and ‘d’ follows a pattern in the Fibonacci sequence. Now, consider ‘d=13’ seconds (a Fibonacci number) and various values of ‘q’ (a prime number) and ‘T’. Which among the following scenarios will most likely trigger an alert?
- AA. q=17, T=220: Even though the attacker increases ‘q’, the total delay (‘qd’ = 221 seconds) just surpasses the threshold, possibly activating an alert.
- BB. q=13, T=180: In this case, the total delay caused by the attacker (‘qd’ = 169 seconds) breaches the threshold, likely leading to the triggering of a security alert.
- CC. q=11, T=150: Here, the total delay induced by the attacker (‘qd’ = 143 seconds) does not surpass the threshold, so the security system remains dormant.
- DD. q=19, T=260: Despite the attacker’s increased effort, the total delay (‘qd’ = 247 seconds) does not exceed the threshold, thus no alert is triggered.
57Which of the following cryptography algorithms can be used in low-complexity applications such as RFID tags, sensor-based applications, and other IoT-based applications for easy processing?
- AElliptic curve cryptography
- BLightweight cryptography
- CHard drive encryption
- DQuantum cryptography
58You are an ethical hacker contracted to conduct a security audit for a company. During the audit, you discover that the company's wireless network is using WEP encryption. You understand the vulnerabilities associated with WEP and plan to recommend a more secure encryption method.
Which of the following would you recommend as a suitable replacement to enhance the security of the company’s wireless network?- AA. Open System authentication
- BB. WPA2-PSK with AES encryption
- CC. SSID broadcast disabling
- DD. MAC address filtering
59In one of the following social engineering techniques, an attacker assumes the role of a knowledgeable professional so that the organization’s employees ask them for information. The attacker then manipulates questions to draw out the required information. Which is this technique?
- ABaiting
- BQuid pro quo
- CReverse social engineering
- DDumpster diving
60You are the lead cybersecurity analyst at a multinational corporation that uses a hybrid encryption system to secure inter-departmental communications. The system uses RSA encryption for key exchange and AES for data encryption, taking advantage of the strengths of both asymmetric and symmetric encryption. Each RSA key pair has a size of ‘n’ bits, with larger keys providing more security at the cost of slower performance. The time complexity of generating an RSA key pair is O(n^2), and AES encryption has a time complexity of O(n). An attacker has developed a quantum algorithm with time complexity O((log n)^2) to crack RSA encryption.
Given ‘n=4000’ and variable ‘AES key size’, which scenario is likely to provide the best balance of security and performance?- AA. AES key size=128 bits: This configuration provides less security than option A, but RSA key generation and AES encryption will be faster.
- BB. AES key size=256 bits: This configuration provides a high level of security, but RSA key generation may be slow.
- CC. AES key size=192 bits: This configuration is a balance between options A and B, providing moderate security and performance.
- DD. AES key size=512 bits: This configuration provides the highest level of security but at a significant performance cost due to the large AES key size.
61You are the lead cybersecurity analyst at a multinational corporation that uses a hybrid encryption system to secure inter-departmental communications. The system uses RSA encryption for key exchange and AES for data encryption, taking advantage of the strengths of both asymmetric and symmetric encryption. Each RSA key pair has a size of ‘n’ bits, with larger keys providing more security at the cost of slower performance. The time complexity of generating an RSA key pair is O(n^2), and AES encryption has a time complexity of O(n). An attacker has developed a quantum algorithm with time complexity O((log n)^2) to crack RSA encryption.
Given ‘n=4000’ and variable ‘AES key size’, which scenario is likely to provide the best balance of security and performance?- AA. AES key size=128 bits: This configuration provides less security than option A, but RSA key generation and AES encryption will be faster.
- BB. AES key size=256 bits: This configuration provides a high level of security, but RSA key generation may be slow.
- CC. AES key size=192 bits: This configuration is a balance between options A and B, providing moderate security and performance.
- DD. AES key size=512 bits: This configuration provides the highest level of security but at a significant performance cost due to the large AES key size.
62An experienced cyber attacker has created a fake LinkedIn profile, successfully impersonating a high-ranking official from a well-established company, to execute a social engineering attack. The attacker then connected with other employees within the organization, receiving invitations to exclusive corporate events and gaining access to proprietary project details shared within the network.
What advanced social engineering technique has the attacker primarily used to exploit the system and what is the most likely immediate threat to the organization?- AA. Whaling and Targeted Attacks
- BB. Pretexting and Network Vulnerability
- CC. Spear Phishing and Spam
- DD. Baiting and Involuntary Data Leakage
63An experienced cyber attacker has created a fake LinkedIn profile, successfully impersonating a high-ranking official from a well-established company, to execute a social engineering attack. The attacker then connected with other employees within the organization, receiving invitations to exclusive corporate events and gaining access to proprietary project details shared within the network.
What advanced social engineering technique has the attacker primarily used to exploit the system and what is the most likely immediate threat to the organization?- AA. Whaling and Targeted Attacks
- BB. Pretexting and Network Vulnerability
- CC. Spear Phishing and Spam
- DD. Baiting and Involuntary Data Leakage
64As a cybersecurity analyst for a large corporation, you are auditing the company’s mobile device management (MDM) policy. One of your areas of concern is data leakage from company-provided smartphones. You are worried about employees unintentionally installing malicious apps that could access sensitive corporate data on their devices.
Which of the following would be an effective measure to prevent such data leakage?- AA. Require biometric authentication for unlocking devices.
- BB. Regularly change Wi-Fi passwords used by the devices.
- CC. Mandate the use of VPNs when accessing corporate data.
- DD. Enforce a policy that only allows app installations from approved corporate app stores.
65As a cybersecurity analyst for a large corporation, you are auditing the company’s mobile device management (MDM) policy. One of your areas of concern is data leakage from company-provided smartphones. You are worried about employees unintentionally installing malicious apps that could access sensitive corporate data on their devices.
Which of the following would be an effective measure to prevent such data leakage?- AA. Require biometric authentication for unlocking devices.
- BB. Regularly change Wi-Fi passwords used by the devices.
- CC. Mandate the use of VPNs when accessing corporate data.
- DD. Enforce a policy that only allows app installations from approved corporate app stores.
66 Which of the following is a process that can be used to convert object data into a linear format for transportation to a different system or different network?
- ADeserialization
- BSerialization
- CInsecure deserialization
- DDirectory traversal
67A certified ethical hacker is carrying out an email footprinting exercise on a targeted organization using eMailTrackerPro. They want to map out detailed information about the recipient's activities after receiving the email. Which among the following pieces of information would NOT be directly obtained from eMailTrackerPro during this exercise?
- AA. Geolocation of the recipient
- BB. Type of device used to open the email
- CC. The email accounts related to the domain of the organization
- DD. The time recipient spent reading the email
68A certified ethical hacker is carrying out an email footprinting exercise on a targeted organization using eMailTrackerPro. They want to map out detailed information about the recipient's activities after receiving the email. Which among the following pieces of information would NOT be directly obtained from eMailTrackerPro during this exercise?
- AA. Geolocation of the recipient
- BB. Type of device used to open the email
- CC. The email accounts related to the domain of the organization
- DD. The time recipient spent reading the email
69In one of the following IoT attacks, attackers intercept legitimate messages from a valid communication and continuously send the intercepted message to the target device to perform a denial-of-service attack or crash the target device. Which is this IoT attack?
- AReplay attack
- BExploit kits
- CNetwork pivoting
- DBlueBorne attack
70Jaden, a security professional in an organization, introduced new tools and services into the organization. Before introducing the tools, he had to evaluate whether the tools are effective and appropriate for the organization. He used a publicly available and free-to-use list of standardized identifiers for software vulnerabilities and exposures to evaluate the tools. Which of the following databases did Jaden use to evaluate the tools and services?
- ALACNIC
- BCVE
- CWhois
- DARIN
71You are a cybersecurity trainee tasked with securing a small home network. The homeowner is concerned about potential "Wi-Fi eavesdropping," where unauthorized individuals could intercept the wireless communications. What would be the most effective first step to mitigate this risk, considering the simplicity and the residential nature of the network?
- AA. Disable the network's SSID broadcast
- BB. Enable encryption on the wireless network
- CC. Enable MAC address filtering
- DD. Reduce the signal strength of the wireless router
72You are a cybersecurity trainee tasked with securing a small home network. The homeowner is concerned about potential "Wi-Fi eavesdropping," where unauthorized individuals could intercept the wireless communications. What would be the most effective first step to mitigate this risk, considering the simplicity and the residential nature of the network?
- AA. Disable the network's SSID broadcast
- BB. Enable encryption on the wireless network
- CC. Enable MAC address filtering
- DD. Reduce the signal strength of the wireless router
73A well-resourced attacker intends to launch a highly disruptive DDoS attack against a major online retailer. The attacker aims to exhaust all the network resources while keeping their identity concealed. Their method should be resistant to simple defensive measures such as IP-based blocking. Based on these objectives, which of the following attack strategies would be most effective?
- AA. The attacker should instigate a protocol-based SYN flood attack, consuming connection state tables on the retailer's servers
- BB. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals
- CC. The attacker should initiate a volumetric flood attack using a single compromised machine to overwhelm the retailer's network bandwidth
- DD. The attacker should execute a simple ICMP flood attack from a single IP, exploiting the retailer's ICMP processing
74A well-resourced attacker intends to launch a highly disruptive DDoS attack against a major online retailer. The attacker aims to exhaust all the network resources while keeping their identity concealed. Their method should be resistant to simple defensive measures such as IP-based blocking. Based on these objectives, which of the following attack strategies would be most effective?
- AA. The attacker should instigate a protocol-based SYN flood attack, consuming connection state tables on the retailer's servers
- BB. The attacker should leverage a botnet to launch a Pulse Wave attack, sending high-volume traffic pulses at regular intervals
- CC. The attacker should initiate a volumetric flood attack using a single compromised machine to overwhelm the retailer's network bandwidth
- DD. The attacker should execute a simple ICMP flood attack from a single IP, exploiting the retailer's ICMP processing
75Larry, a professional hacker, was hired to launch a few attacks on an organization. In the process, he identified that FTP server ports are open and performed enumeration on FTP to find the software version and state of existing vulnerabilities for performing further exploitations. What is the FTP port number that Larry has targeted?
- ATCP 25
- BTCP 20/21
- CTCP/UDP 5060, 5061
- DTCP 179
76A large organization is investigating a possible identity theft case where an attacker has created a new identity by combining multiple pieces of information from different victims to open a new bank account. The attacker also managed to receive government benefits using a fraudulent identity. Given the circumstances, which type of identity theft is the organization dealing with?
- AA. Identity Cloning and Concealment
- BB. Child Identity Theft
- CC. Social Identity Theft
- DD. Synthetic Identity Theft
77A large organization is investigating a possible identity theft case where an attacker has created a new identity by combining multiple pieces of information from different victims to open a new bank account. The attacker also managed to receive government benefits using a fraudulent identity. Given the circumstances, which type of identity theft is the organization dealing with?
- AA. Identity Cloning and Concealment
- BB. Child Identity Theft
- CC. Social Identity Theft
- DD. Synthetic Identity Theft
78A company recently experienced a debilitating social engineering attack that led to substantial identity theft. An inquiry found that the employee inadvertently provided critical information during an innocuous phone conversation. Considering the specific guidelines issued by the company to thwart social engineering attacks, which countermeasure would have been the most successful in averting the incident?
- AA. Conduct comprehensive training sessions for employees on various social engineering methodologies and the risks associated with revealing confidential data
- BB. Implement a well-documented change management process for modifications related to hardware or software
- CC. Adopt a robust software policy that restricts the installation of unauthorized applications
- DD. Reinforce physical security measures to limit access to sensitive zones within the company premises, thereby warding off unauthorized intruders
79A company recently experienced a debilitating social engineering attack that led to substantial identity theft. An inquiry found that the employee inadvertently provided critical information during an innocuous phone conversation. Considering the specific guidelines issued by the company to thwart social engineering attacks, which countermeasure would have been the most successful in averting the incident?
- AA. Conduct comprehensive training sessions for employees on various social engineering methodologies and the risks associated with revealing confidential data
- BB. Implement a well-documented change management process for modifications related to hardware or software
- CC. Adopt a robust software policy that restricts the installation of unauthorized applications
- DD. Reinforce physical security measures to limit access to sensitive zones within the company premises, thereby warding off unauthorized intruders
80Which of the following information security elements guarantees that the sender of a message cannot later deny having sent the message and the recipient cannot deny having received the message?
- AConfidentiality
- BNon-repudiation
- CAvailability
- DIntegrity
81An IT company has just implemented new security controls to their network and system setup. As a Certified Ethical Hacker, your responsibility is to assess the possible vulnerabilities in the new setup. You are given the information that the network and system are adequately patched with the latest updates, and all employees have gone through recent cybersecurity awareness training. Considering the potential vulnerability sources, what is the best initial approach to vulnerability assessment?
- AA. Conducting social engineering tests to check if employees can be tricked into revealing sensitive information
- BB. Checking for hardware and software misconfigurations to identify any possible loopholes
- CC. Evaluating the network for inherent technology weaknesses prone to specific types of attacks
- DD. Investigating if any ex-employees still have access to the company’s system and data
82An IT company has just implemented new security controls to their network and system setup. As a Certified Ethical Hacker, your responsibility is to assess the possible vulnerabilities in the new setup. You are given the information that the network and system are adequately patched with the latest updates, and all employees have gone through recent cybersecurity awareness training. Considering the potential vulnerability sources, what is the best initial approach to vulnerability assessment?
- AA. Conducting social engineering tests to check if employees can be tricked into revealing sensitive information
- BB. Checking for hardware and software misconfigurations to identify any possible loopholes
- CC. Evaluating the network for inherent technology weaknesses prone to specific types of attacks
- DD. Investigating if any ex-employees still have access to the company’s system and data
83In which of the following attack types does an attacker exploit vulnerabilities that evolve from the unsafe use of functions in an application in public web servers to send crafted requests to internal or backend servers?
- ASSH brute forcing
- BWeb-server password cracking
- CServer-side request forgery
- DWeb-server misconfiguration
84An ethical hacker has been tasked with assessing the security of a major corporation's network. She suspects the network uses default SNMP community strings. To exploit this, she plans to extract valuable network information using SNMP enumeration. Which tool could best help her to get the information without directly modifying any parameters within the SNMP agent’s management information base (MIB)?
- AA. SnmpWalk, with a command to change an OID to a different value
- BB. snmp-check (snmp_enum Module) to gather a wide array of information about the target
- CC. Nmap, with a script to retrieve all running SNMP processes and associated ports
- DD. OpUtils, are mainly designed for device management and not SNMP enumeration
85During a recent vulnerability assessment of a major corporation’s IT systems, the security team identified several potential risks. They want to use a vulnerability scoring system to quantify and prioritize these vulnerabilities. They decide to use the Common Vulnerability Scoring System (CVSS). Given the characteristics of the identified vulnerabilities, which of the following statements is the most accurate regarding the metric types used by CVSS to measure these vulnerabilities?
- AA. Temporal metric represents the inherent qualities of a vulnerability.
- BB. Base metric represents the inherent qualities of a vulnerability.
- CC. Temporal metric involves measuring vulnerabilities based on a specific environment or implementation.
- DD. Environmental metric involves the features that change during the lifetime of the vulnerability.
86During a recent vulnerability assessment of a major corporation’s IT systems, the security team identified several potential risks. They want to use a vulnerability scoring system to quantify and prioritize these vulnerabilities. They decide to use the Common Vulnerability Scoring System (CVSS). Given the characteristics of the identified vulnerabilities, which of the following statements is the most accurate regarding the metric types used by CVSS to measure these vulnerabilities?
- AA. Temporal metric represents the inherent qualities of a vulnerability.
- BB. Base metric represents the inherent qualities of a vulnerability.
- CC. Temporal metric involves measuring vulnerabilities based on a specific environment or implementation.
- DD. Environmental metric involves the features that change during the lifetime of the vulnerability.
87You are a cybersecurity consultant at SecureIoT Inc. A manufacturing company has contracted you to strengthen the security of their Industrial IoT (IIoT) devices used in their operational technology (OT) environment. They are concerned about potential attacks that could disrupt their production lines and compromise safety. They have an advanced firewall system in place, but you know this alone is not enough. Which of the following measures should you suggest to provide comprehensive protection for their IIoT devices?
- AA. Increase the frequency of changing passwords on all IIoT devices.
- BB. Use the same encryption standards for IIoT devices as for IT devices.
- CC. Rely on the existing firewall and install antivirus software on each IIoT device.
- DD. Implement network segmentation to separate IIoT devices from the rest of the network.
88You are a cybersecurity consultant at SecureIoT Inc. A manufacturing company has contracted you to strengthen the security of their Industrial IoT (IIoT) devices used in their operational technology (OT) environment. They are concerned about potential attacks that could disrupt their production lines and compromise safety. They have an advanced firewall system in place, but you know this alone is not enough. Which of the following measures should you suggest to provide comprehensive protection for their IIoT devices?
- AA. Increase the frequency of changing passwords on all IIoT devices.
- BB. Use the same encryption standards for IIoT devices as for IT devices.
- CC. Rely on the existing firewall and install antivirus software on each IIoT device.
- DD. Implement network segmentation to separate IIoT devices from the rest of the network.
89Williams, a professional hacker, gained initial access to a remote system via a compromised user. To gain root-level access, he copied the file sethc.exe from %systemroot%\system32 and the file cmd.exe to another location. Now, he restarted the system and pressed the Shift key 5 times to launch Command Prompt with system-level access. Which of the following privilege escalation techniques did Williams employ in the above scenario?
- APrivilege escalation by abusing boot or logon initialization scripts
- BPrivilege escalation using Dylib hijacking
- CPrivilege escalation by modifying domain policy
- DPrivilege escalation using Windows Sticky Keys
90In an advanced digital security scenario, a multinational enterprise is being targeted with a complex series of assaults aimed to disrupt operations, manipulate data integrity, and cause serious financial damage. As the Lead Cybersecurity Analyst with CEH and CISSP certifications, your responsibility is to correctly identify the specific type of attack based on the following indicators:
The attacks are exploiting a vulnerability in the target system's hardware, inducing misprediction of future instructions in a program’s control flow. The attackers are strategically inducing the victim process to speculatively execute instructions sequences that would not have been executed in the absence of the misprediction, leading to subtle side effects. These side effects, which are observable from the shared state, are then utilized to infer the values of in-flight data.
What type of attack best describes this scenario?- AA. Rowhammer Attack
- BB. Watering Hole Attack
- CC. Side-Channel Attack
- DD. Privilege Escalation Attack
91In the process of implementing a network vulnerability assessment strategy for a tech company, the security analyst is confronted with the following scenarios:
A legacy application is discovered on the network, which no longer receives updates from the vendor.
Several systems in the network are found running outdated versions of web browsers prone to distributed attacks.
The network firewall has been configured using default settings and passwords.
Certain TCP/IP protocols used in the organization are inherently insecure.
The security analyst decides to use vulnerability scanning software. Which of the following limitations of vulnerability assessment should the analyst be most cautious about in this context?- AA. Vulnerability scanning software cannot define the impact of an identified vulnerability on different business operations
- BB. Vulnerability scanning software is not immune to software engineering flaws that might lead to serious vulnerabilities being missed
- CC. Vulnerability scanning software is limited in its ability to detect vulnerabilities at a given point in time
- DD. Vulnerability scanning software is limited in its ability to perform live tests on web applications to detect errors or unexpected behavior
92In the process of implementing a network vulnerability assessment strategy for a tech company, the security analyst is confronted with the following scenarios:
A legacy application is discovered on the network, which no longer receives updates from the vendor.
Several systems in the network are found running outdated versions of web browsers prone to distributed attacks.
The network firewall has been configured using default settings and passwords.
Certain TCP/IP protocols used in the organization are inherently insecure.
The security analyst decides to use vulnerability scanning software. Which of the following limitations of vulnerability assessment should the analyst be most cautious about in this context?- AA. Vulnerability scanning software cannot define the impact of an identified vulnerability on different business operations
- BB. Vulnerability scanning software is not immune to software engineering flaws that might lead to serious vulnerabilities being missed
- CC. Vulnerability scanning software is limited in its ability to detect vulnerabilities at a given point in time
- DD. Vulnerability scanning software is limited in its ability to perform live tests on web applications to detect errors or unexpected behavior
93In which of the following attacks does an attacker dump memory by rebooting a victim’s device with a malicious OS and then extract sensitive data from the dumped memory?
- AiOS jailbreaking
- BOS data caching
- CCarrier-loaded software
- DUser-initiated code
94In your cybersecurity class, you are learning about common security risks associated with web servers. One topic that comes up is the risk posed by using default server settings. Why is using default settings on a web server considered a security risk, and what would be the best initial step to mitigate this risk?
- AA. Default settings allow unlimited login attempts; setup account lockout
- BB. Default settings reveal server software type; change these settings
- CC. Default settings cause server malfunctions; simplify the settings
- DD. Default settings enable auto-updates; disable and manually patch
95In your cybersecurity class, you are learning about common security risks associated with web servers. One topic that comes up is the risk posed by using default server settings. Why is using default settings on a web server considered a security risk, and what would be the best initial step to mitigate this risk?
- AA. Default settings allow unlimited login attempts; setup account lockout
- BB. Default settings reveal server software type; change these settings
- CC. Default settings cause server malfunctions; simplify the settings
- DD. Default settings enable auto-updates; disable and manually patch
96As a junior security analyst for a small business, you are tasked with setting up the company’s first wireless network. The company wants to ensure the network is secure from potential attacks. Given that the company’s workforce is relatively small and the need for simplicity in managing network security, which of the following measures would you consider a priority to protect the network?
- AA. Hide the network SSID
- BB. Enable WPA2 or WPA3 encryption on the wireless router
- CC. Implement a MAC address whitelist
- DD. Establish a regular schedule for changing the network password
97As a junior security analyst for a small business, you are tasked with setting up the company’s first wireless network. The company wants to ensure the network is secure from potential attacks. Given that the company’s workforce is relatively small and the need for simplicity in managing network security, which of the following measures would you consider a priority to protect the network?
- AA. Hide the network SSID
- BB. Enable WPA2 or WPA3 encryption on the wireless router
- CC. Implement a MAC address whitelist
- DD. Establish a regular schedule for changing the network password
98During a reconnaissance mission, an ethical hacker uses Maltego, a popular footprinting tool, to collect information about a target organization. The information includes the target’s Internet infrastructure details (domains, DNS names, Netblocks, IP address information). The hacker decides to use social engineering techniques to gain further information. Which of the following would be the least likely method of social engineering to yield beneficial information based on the data collected?
- AA. Dumpster diving in the target company’s trash bins for valuable printouts
- BB. Impersonating an ISP technical support agent to trick the target into providing further network details
- CC. Shoulder surfing to observe sensitive credentials input on the target’s computers
- DD. Eavesdropping on internal corporate conversations to understand key topics
99During a reconnaissance mission, an ethical hacker uses Maltego, a popular footprinting tool, to collect information about a target organization. The information includes the target’s Internet infrastructure details (domains, DNS names, Netblocks, IP address information). The hacker decides to use social engineering techniques to gain further information. Which of the following would be the least likely method of social engineering to yield beneficial information based on the data collected?
- AA. Dumpster diving in the target company’s trash bins for valuable printouts
- BB. Impersonating an ISP technical support agent to trick the target into providing further network details
- CC. Shoulder surfing to observe sensitive credentials input on the target’s computers
- DD. Eavesdropping on internal corporate conversations to understand key topics
100An organization has been experiencing intrusion attempts despite deploying an Intrusion Detection System (IDS) and Firewalls. As a Certified Ethical Hacker, you are asked to reinforce the intrusion detection process and recommend a better rule-based approach. The IDS uses Snort rules and the new recommended tool should be able to complement it. You suggest using YARA rules with an additional tool for rule generation. Which of the following tools would be the best choice for this purpose and why?
- AA. yarGen – Because it generates YARA rules from strings identified in malware files while removing strings that also appear in goodware files
- BB. Koodous – Because it combines social networking with antivirus signatures and YARA rules to detect malware
- CC. YaraRET – Because it helps in reverse engineering Trojans to generate YARA rules
- DD. AutoYara – Because it automates the generation of YARA rules from a set of malicious and benign files
101An organization has been experiencing intrusion attempts despite deploying an Intrusion Detection System (IDS) and Firewalls. As a Certified Ethical Hacker, you are asked to reinforce the intrusion detection process and recommend a better rule-based approach. The IDS uses Snort rules and the new recommended tool should be able to complement it. You suggest using YARA rules with an additional tool for rule generation. Which of the following tools would be the best choice for this purpose and why?
- AA. yarGen – Because it generates YARA rules from strings identified in malware files while removing strings that also appear in goodware files
- BB. Koodous – Because it combines social networking with antivirus signatures and YARA rules to detect malware
- CC. YaraRET – Because it helps in reverse engineering Trojans to generate YARA rules
- DD. AutoYara – Because it automates the generation of YARA rules from a set of malicious and benign files
102During an attempt to perform an SQL injection attack, a certified ethical hacker is focusing on the identification of database engine type by generating an ODBC error. The ethical hacker, after injecting various payloads, finds that the web application returns a standard, generic error message that does not reveal any detailed database information. Which of the following techniques would the hacker consider next to obtain useful information about the underlying database?
- AA. Utilize a blind injection technique that uses time delays or error signatures to extract information
- BB. Try to insert a string value where a number is expected in the input field
- CC. Attempt to compromise the system through OS-level command shell execution
- DD. Use the UNION operator to combine the result sets of two or more SELECT statements
103During an attempt to perform an SQL injection attack, a certified ethical hacker is focusing on the identification of database engine type by generating an ODBC error. The ethical hacker, after injecting various payloads, finds that the web application returns a standard, generic error message that does not reveal any detailed database information. Which of the following techniques would the hacker consider next to obtain useful information about the underlying database?
- AA. Utilize a blind injection technique that uses time delays or error signatures to extract information
- BB. Try to insert a string value where a number is expected in the input field
- CC. Attempt to compromise the system through OS-level command shell execution
- DD. Use the UNION operator to combine the result sets of two or more SELECT statements
104TechSoft Inc. recently experienced many cyberattacks. The management of the organization instructed David, a security engineer, to strengthen the security of the organization. In this process, David employed a tool for detecting session hijacking attempts and performed asset discovery, intrusion detection, threat intelligence, and vulnerability assessment using that tool. Which of the following tools did David employ in the above scenario?
- AUSM Anywhere
- BDependency Walker
- CWeevely
- DAPI Monitor
105Which of the following types of malware remains dormant until the user performs an online financial transaction, replicates itself on the computer, and edits the registry entries each time the computer starts?
- ATAN grabber
- BCovert credential grabber
- CHTML injection
- DForm grabber
106A certain type of port scanning technique is similar to the TCP SYN scan and can be performed quickly by scanning thousands of ports per second on a fast network that is not obstructed by a firewall, offering a strong sense of security. Which of the following is this type of port scanning technique?
- AIDLE/IPID header scanning
- BSCTP COOKIE ECHO scanning
- CSSDP scanning
- DSCTP INIT scanning
107An attacker aims to hack an organization and gather sensitive information. In this process, they lure an employee of the organization into clicking on a fake link, which appears legitimate but redirects the user to the attacker’s server. The attacker then forwards the request to the legitimate server on behalf of the victim. Which of the following types of attack is performed by the attacker in the above scenario?
- AMan-in-the-middle attack
- BCross-site script attack
- CSession replay attack
- DSession hijacking using proxy servers
108During an ethical hacking engagement, you have been assigned to evaluate the security of a large organization's network. While examining the network traffic, you notice numerous incoming requests on various ports from different locations that show a pattern of an orchestrated attack. Based on your analysis, you deduce that the requests are likely to be automated scripts being run by unskilled hackers. What type of hacker classification does this scenario most likely represent?
- AA. Script Kiddies trying to compromise the system using pre-made scripts.
- BB. Gray Hats testing system vulnerabilities to help vendors improve security.
- CC. White Hats conducting penetration testing to identify security weaknesses.
- DD. Black Hats trying to exploit system vulnerabilities for malicious intent.
109Jack, a security professional, was instructed to introduce a security standard to handle cardholder information for major debit, credit, prepaid, e-purse, ATM, and POS cards. In the process, Jack has employed a standard that offers robust and comprehensive standards as well as supporting materials to enhance payment-card data security. What is the security standard that Jack has employed?
- AHIPAA
- BSOX
- CDMCA
- DPCI DSS
110Your company suspects a potential security breach and has hired you as a Certified Ethical Hacker to investigate. You discover evidence of footprinting through search engines and advanced Google hacking techniques. The attacker utilized Google search operators to extract sensitive information. You further notice queries that indicate the use of the Google Hacking Database (GHDB) with an emphasis on VPN footprinting. Which of the following Google advanced search operators would be the LEAST useful in providing the attacker with sensitive VPN-related information?
- AA. location: This operator finds information for a specific location
- BB. inurl: This operator restricts the results to only the pages containing the specified word in the URL
- CC. link: This operator searches websites or pages that contain links to the specified website or page
- DD. intitle: This operator restricts results to only the pages containing the specified term in the title
111Your company suspects a potential security breach and has hired you as a Certified Ethical Hacker to investigate. You discover evidence of footprinting through search engines and advanced Google hacking techniques. The attacker utilized Google search operators to extract sensitive information. You further notice queries that indicate the use of the Google Hacking Database (GHDB) with an emphasis on VPN footprinting. Which of the following Google advanced search operators would be the LEAST useful in providing the attacker with sensitive VPN-related information?
- AA. location: This operator finds information for a specific location
- BB. inurl: This operator restricts the results to only the pages containing the specified word in the URL
- CC. link: This operator searches websites or pages that contain links to the specified website or page
- DD. intitle: This operator restricts results to only the pages containing the specified term in the title
112In a recent cyber-attack against a large corporation, an unknown adversary compromised the network and began escalating privileges and lateral movement. The security team identified that the adversary used a sophisticated set of techniques, specifically targeting zero-day vulnerabilities. As a Certified Ethical Hacker (CEH) hired to understand this attack and propose preventive measures, which of the following actions will be most crucial for your initial analysis?
- AA. Identifying the specific tools used by the adversary for privilege escalation.
- BB. Analyzing the initial exploitation methods the adversary used.
- CC. Checking the persistence mechanisms used by the adversary in compromised systems.
- DD. Investigating the data exfiltration methods used by the adversary.
113In a recent cyber-attack against a large corporation, an unknown adversary compromised the network and began escalating privileges and lateral movement. The security team identified that the adversary used a sophisticated set of techniques, specifically targeting zero-day vulnerabilities. As a Certified Ethical Hacker (CEH) hired to understand this attack and propose preventive measures, which of the following actions will be most crucial for your initial analysis?
- AA. Identifying the specific tools used by the adversary for privilege escalation.
- BB. Analyzing the initial exploitation methods the adversary used.
- CC. Checking the persistence mechanisms used by the adversary in compromised systems.
- DD. Investigating the data exfiltration methods used by the adversary.
114Jason, a certified ethical hacker, is hired by a major e-commerce company to evaluate their network's security. As part of his reconnaissance, Jason is trying to gain as much information as possible about the company's public-facing servers without arousing suspicion. His goal is to find potential points of entry and map out the network infrastructure for further examination. Which technique should Jason employ to gather this information without alerting the company's intrusion detection systems (IDS)?
- AA. Jason should directly connect to each server and attempt to exploit known vulnerabilities.
- BB. Jason should use passive reconnaissance techniques such as WHOIS lookups, NS lookups, and web research.
- CC. Jason should use a DNS zone transfer to gather information about the company's servers.
- DD. Jason should perform a ping sweep to identify all the live hosts in the company's IP range.
115Jason, a certified ethical hacker, is hired by a major e-commerce company to evaluate their network's security. As part of his reconnaissance, Jason is trying to gain as much information as possible about the company's public-facing servers without arousing suspicion. His goal is to find potential points of entry and map out the network infrastructure for further examination. Which technique should Jason employ to gather this information without alerting the company's intrusion detection systems (IDS)?
- AA. Jason should directly connect to each server and attempt to exploit known vulnerabilities.
- BB. Jason should use passive reconnaissance techniques such as WHOIS lookups, NS lookups, and web research.
- CC. Jason should use a DNS zone transfer to gather information about the company's servers.
- DD. Jason should perform a ping sweep to identify all the live hosts in the company's IP range.
116Ronnie disguised himself as a salesperson, entered a target company, and managed to access phone bills, contact information, and financial information secretly from printer trash bins and user desks to perform further exploitation. What is the attack performed by Ronnie in the above scenario?
- AEavesdropping
- BShoulder surfing
- CDumpster diving
- DImpersonation
117A penetration tester was assigned to scan a large network range to find live hosts. The network is known for using strict TCP filtering rules on its firewall, which may obstruct common host discovery techniques. The tester needs a method that can bypass these firewall restrictions and accurately identify live systems. What host discovery technique should the tester use?
- AA. ICMP Timestamp Ping Scan
- BB. ICMP ECHO Ping Scan
- CC. TCP SYN Ping Scan
- DD. UDP Ping Scan
118As part of a college project, you have set up a web server for hosting your team's application. Given your interest in cybersecurity, you have taken the lead in securing the server. You are aware that hackers often attempt to exploit server misconfigurations. Which of the following actions would best protect your web server from potential misconfiguration-based attacks?
- AA. Regularly backing up server data
- BB. Enabling multi-factor authentication for users
- CC. Implementing a firewall to filter traffic
- DD. Performing regular server configuration audits
119You are the chief cybersecurity officer at CloudSecure Inc., and your team is responsible for securing a cloud-based application that handles sensitive customer data. To ensure that the data is protected from breaches, you have decided to implement encryption for both data-at-rest and data-in-transit. The development team suggests using SSL/TLS for securing data in transit. However, you want to also implement a mechanism to detect if the data was tampered with during transmission. Which of the following should you propose?
- AA. Implement IPsec in addition to SSL/TLS
- BB. Switch to using SSH for data transmission
- CC. Encrypt data using the AES algorithm before transmission
- DD. Use the cloud service provider’s built-in encryption services
120Sarah, a system administrator, was alerted of potential malicious activity on the network of her company. She discovered a malicious program spread through the instant messenger application used by her team. The attacker had obtained access to one of her teammate’s messenger accounts and started sending files across the contact list. Which best describes the attack scenario and what measure could have prevented it?
- AA. Insecure Patch Management; updating application software regularly
- BB. Instant Messenger Applications; verifying the sender’s identity before opening any files
- CC. Rogue/Decoy Applications; ensuring software is labeled as TRUSTED
- DD. Portable Hardware Media/Removable Devices; disabling Autorun functionality
121A multinational organization has recently faced a severe information security breach. Investigations reveal that the attacker had a high degree of understanding of the organization’s internal processes and systems. This knowledge was utilized to bypass security controls and corrupt valuable resources. Considering this event, the security team is contemplating the type of attack that occurred and the steps they could have taken to prevent it. Choose the most plausible type of attack and a countermeasure that the organization could have employed:
- AA. Insider attacks and the organization should have implemented robust access control and monitoring
- BB. Distribution attack and the organization could have ensured software and hardware integrity checks
- CC. Passive attack and the organization should have used encryption techniques
- DD. Active attack and the organization could have used network traffic analysis
122As a security analyst for SkySecure Inc., you are working with a client that uses a multi-cloud strategy, utilizing services from several cloud providers. The client wants to implement a system that will provide unified security management across all their cloud platforms. They need a solution that allows them to consistently enforce security policies, identify and respond to threats, and maintain visibility of all their cloud resources. Which of the following should you recommend as the best solution?
- AA. Use a Cloud Access Security Broker (CASB).
- BB. Use a hardware-based firewall to secure all cloud resources.
- CC. Implement separate security management tools for each cloud platform.
- DD. Rely on the built-in security features of each cloud platform.
123As a security consultant, you are advising a startup that is developing an IoT device for home security. The device communicates with a mobile app, allowing homeowners to monitor their homes in real time. The CEO is concerned about potential Man-in-the-Middle (MitM) attacks that could allow an attacker to intercept and manipulate the device's communication. Which of the following solutions would best protect against such attacks?
- AA. Use CAPTCHA on the mobile app's login screen.
- BB. Implement SSL/TLS encryption for data transmission between the IoT device and the mobile app.
- CC. Limit the range of the IoT device's wireless signals.
- DD. Frequently change the IoT device's IP address.
124A Certified Ethical Hacker (CEH) is analyzing a target network. To do this, he decides to utilize an IDLE/IPID header scan using Nmap. The network analysis reveals that the IPID number increases by 2 after following the steps of an IDLE scan. Based on this information, what can the CEH conclude about the target network?
- AA. The ports on the target network are open.
- BB. The target network has no firewall present.
- CC. The ports on the target network are closed.
- DD. The target network has a stateful firewall present.
125You have been given the responsibility to ensure the security of your school’s web server. As a step towards this, you plan to restrict unnecessary services running on the server. In the context of web server security, why is this step considered important?
- AA. Unnecessary services eat up server memory; save memory resources.
- BB. Unnecessary services could contain vulnerabilities; minimize the attack surface.
- CC. Unnecessary services reveal server software; hide software details.
- DD. Unnecessary services slow down the server; optimize server speed.
126An ethical hacker is hired to evaluate the defenses of an organization’s database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system’s signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique. Which of the following could he have used?
- AA. Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing
- BB. Implementing sophisticated matches such as “OR john’ = ‘john’” in place of classical matches like “OR 1=1”
- CC. Manipulating white spaces in SQL queries to bypass signature detection
- DD. Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form
127As the Chief Information Security Officer (CISO) at a large university, you are responsible for the security of a campus-wide Wi-Fi network that serves thousands of students, faculty, and staff. Recently, there has been a rise in reports of unauthorized network access, and you suspect that some users are sharing their login credentials. You are considering deploying an additional layer of security that could effectively mitigate this issue. What would be the most suitable measure to implement in this context?
- AA. Implement network segmentation
- BB. Deploy a VPN for the entire campus
- CC. Enforce a policy of regularly changing Wi-Fi passwords
- DD. Implement 802.1X authentication
128An ethical hacker is scanning a target network. They initiate a TCP connection by sending an SYN packet to a target machine and receiving a SYN/ACK packet in response. But instead of completing the three-way handshake with an ACK packet, they send an RST packet. What kind of scan is the ethical hacker likely performing and what is their goal?
- AA. They are performing an SYN scan to stealthily identify open ports without fully establishing a connection.
- BB. They are performing a network scan to identify live hosts and their IP addresses.
- CC. They are performing a TCP connect scan to identify open ports on the target machine.
- DD. They are performing a vulnerability scan to identify any weaknesses in the target system.
129In the process of setting up a lab for malware analysis, a cybersecurity analyst is tasked to establish a secure environment using a sheep dip computer. The analyst must prepare the testbed while adhering to best practices. Which of the following steps should the analyst avoid when configuring the environment?
- AA. Installing malware analysis tools on the guest OS
- BB. Connecting the system to the production network during the malware analysis
- CC. Simulating Internet services using tools such as INetSim
- DD. Installing multiple guest operating systems on the virtual machine(s)
130A large e-commerce organization is planning to implement a vulnerability assessment solution to enhance its security posture. They require a solution that imitates the outside view of attackers, performs well-organized inference-based testing, scans automatically against continuously updated databases, and supports multiple networks. Given these requirements, which type of vulnerability assessment solution would be most appropriate?
- AA. Inference-based assessment solution
- BB. Tree-based assessment approach
- CC. Product-based solution installed on a private network
- DD. Service-based solution offered by an auditing firm
131During a penetration testing assignment, a Certified Ethical Hacker (CEH) used a set of scanning tools to create a profile of the target organization. The CEH wanted to scan for live hosts, open ports, and services on a target network. He used Nmap for network inventory and Hping3 for network security auditing. However, he wanted to spoof IP addresses for anonymity during probing. Which command should the CEH use to perform this task?
- AA. Hping3 -1 10.0.0.25 -ICMP
- BB. Hping3 -2 10.0.0.25 -p 80
- CC. Nmap -sS -Pn -n -vv --packet-trace -p- --script discovery -T4
- DD. Hping3 -S 192.168.1.1 -a 192.168.1.254 -p 22 --flood
132An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combination of scanning tools to obtain a detailed understanding of the network. Which sequence of actions would provide the most comprehensive information about the network's status?
- AA. Use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on identified active hosts, and finally use Metasploit to exploit identified vulnerabilities.
- BB. Start with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan, and finally use Metasploit to exploit detected vulnerabilities.
- CC. Begin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and version detection, and finally perform an SYN flooding with Hping3.
133An ethical hacker is hired to conduct a comprehensive network scan of a large organization that strongly suspects potential intrusions into their internal systems. The hacker decides to employ a combination of scanning tools to obtain a detailed understanding of the network. Which sequence of actions would provide the most comprehensive information about the network’s status?
- AA. Use Hping3 for an ICMP ping scan on the entire subnet, then use Nmap for a SYN scan on identified active hosts, and finally use Metasploit to exploit identified vulnerabilities.
- BB. Start with Hping3 for a UDP scan on random ports, then use Nmap for a version detection scan, and finally use Metasploit to exploit detected vulnerabilities.
- CC. Begin with NetScanTools Pro for a general network scan, then use Nmap for OS detection and version detection, and finally perform an SYN flooding with Hping3.
- DD. Initiate with Nmap for a ping sweep, then use Metasploit to scan for open ports and services, and finally use Hping3 to perform remote OS fingerprinting.
134While working as an intern for a small business, you have been tasked with managing the company’s web server. The server is being bombarded with requests, and the company’s website is intermittently going offline. You suspect that this could be a Distributed Denial of Service (DDoS) attack. As an ethical hacker, which of the following steps would be your first course of action to mitigate the issue?
- AA. Contact your Internet Service Provider (ISP) for assistance.
- BB. Install a newer version of the server software
- CC. Implement IP address whitelisting
- DD. Increase the server’s bandwidth
135As a cybersecurity consultant, you are working with a client who wants to migrate their data to a Software as a Service (SaaS) cloud environment. They are particularly concerned about maintaining the privacy of their sensitive data, even from the cloud service provider. Which of the following strategies would best ensure the privacy of their data in the SaaS environment?
- AA. Implement a Virtual Private Network (VPN) for accessing the SaaS applications.
- BB. Rely on the cloud service provider’s built-in security features.
- CC. Encrypt the data client-side before uploading to the SaaS environment and manage encryption keys independently.
- DD. Use multi-factor authentication for all user accounts accessing the SaaS applications.
136An ethical hacker is performing a network scan to evaluate the security of a company’s IT infrastructure. During the scan, he discovers an active host with multiple open ports running various services. The hacker uses TCP communication flags to establish a connection with the host and starts communicating with it. He sends a SYN packet to a port on the host and receives a SYN/ACK packet back. He then sends an ACK packet for the received SYN/ACK packet, which triggers an open connection. Which of the following actions should the ethical hacker perform next?
- AA. Send a PSH packet to inform the receiving application about the buffered data.
- BB. Conduct a vulnerability scan on the open port to identify any potential weaknesses.
- CC. Scan another port on the same host using the SYN, ACK, and RST flags.
- DD. Send a FIN or RST packet to close the connection
137A multinational corporation’s computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly sophisticated techniques to stay undetected and continue its operations.
The malware:
Embedded harmful code into the binary of genuine system files (hard to detect).
Changed its code as it propagated (resists signature-based detection).
Maintained persistence by surviving system reboots.
Given these characteristics, which two types of malware does this malware most closely embody?- AA. Polymorphic and Metamorphic malware
- BB. Polymorphic and Macro malware
- CC. Macro and Rootkit malware
D. Metamorphic and Rootkit malware
138A security analyst is investigating a potential network-level session hijacking incident. During the investigation, the analyst finds that the attacker has been using a technique in which they injected an authentic-looking reset packet using a spoofed source IP address and a guessed acknowledgment number. As a result, the victim’s connection was reset. Which of the following hijacking techniques has the attacker most likely used?
- AA. Blind hijacking
- BB. UDP hijacking
- CC. RST hijacking ✅
- DD. TCP/IP hijacking
139During a red team engagement, an ethical hacker is tasked with testing the security measures of an organization’s wireless network. The hacker needs to select an appropriate tool to carry out a session hijacking attack. Which of the following tools should the hacker use to effectively perform session hijacking and subsequent security analysis, given that the target wireless network has the Wi-Fi Protected Access pre-shared key (WPA-PSK) security protocol in place?
- AA. Hetty
- BB. bettercap ✅
- CC. DroidSheep
- DD. FaceNiff
140A large corporate network is being subjected to repeated sniffing attacks. To increase security, the company's IT department decides to implement a combination of several security measures. They permanently add the MAC address of the gateway to the ARP cache, switch to using IPv6 instead of IPv4, implement the use of encrypted sessions such as SSH instead of Telnet, and use Secure File Transfer Protocol instead of FTP. However, they are still faced with the threat of sniffing. Considering the countermeasures, what should be their next step to enhance network security?
- AA. Use HTTP instead of HTTPS for protecting usernames and passwords
- BB. Implement network scanning and monitoring tools
- CC. Enable network identification broadcasts
- DD. Retrieve MAC addresses from the OS
141As the chief security officer at SecureMobile, you are overseeing the development of a mobile banking application. You are aware of the potential risks of man-in-the-middle (MitM) attacks where an attacker might intercept communication between the app and the bank’s servers. Recently, you have learned about a technique used by attackers where they use rogue Wi-Fi hotspots to conduct MitM attacks. To prevent this type of attack, you plan to implement a security feature in the mobile app. What should this feature accomplish?
- AA. It should require two-factor authentication for user logins.
- BB. It should prevent the app from communicating over a network if it detects a rogue access point.
- CC. It should prevent the app from connecting to any unencrypted Wi-Fi networks.
- DD. It should require users to change their password every 30 days.
142A cyber attacker has initiated a series of activities against a high-profile organization following the Cyber Kill Chain Methodology. The attacker is presently in the “Delivery” stage. As an Ethical Hacker, you are trying to anticipate the adversary’s next move. What is the most probable subsequent action from the attacker based on the Cyber Kill Chain Methodology?
- AA. The attacker will attempt to escalate privileges to gain complete control of the compromised system.
- BB. The attacker will exploit the malicious payload delivered to the target organization and establish a foothold.
- CC. The attacker will initiate an active connection to the target system to gather more data.
- DD. The attacker will start reconnaissance to gather as much information as possible about the target.
143You are a cloud security expert at CloudGuard Inc. working with a client who plans to transition their infrastructure to a public cloud. The client expresses concern about potential data breaches and wants to ensure that only authorized personnel can access certain sensitive resources. You propose implementing a Zero Trust security model. Which of the following best describes how the Zero Trust model would enhance the security of their cloud resources?
- AA. It operates on the principle of least privilege, verifying each request as if it is from an untrusted source, regardless of its location.
- BB. It encrypts all data stored in the cloud, ensuring only authorized users can decrypt it.
- CC. It uses multi-factor authentication for all user accounts.
- DD. It ensures secure data transmission by implementing SSL/TLS protocols.
144Your company, Encryptor Corp., is developing a new application that will handle highly sensitive user information. As a cybersecurity specialist, you want to ensure this data is securely stored. The development team proposes a method where data is hashed and then encrypted before storage. However, you want an added layer of security to verify the integrity of the data upon retrieval. Which of the following cryptographic concepts should you propose to the team?
- AA. Switch to elliptic curve cryptography.
- BB. Implement a block cipher mode of operation.
- CC. Apply a digital signature mechanism.
- DD. Suggest using salt with hashing.
145As part of a penetration testing team, you’ve discovered a web application vulnerable to Cross-Site Scripting (XSS). The application sanitizes inputs against standard XSS payloads but fails to filter out HTML-encoded characters. On further analysis, you’ve noticed that the web application uses cookies to track session IDs. You decide to exploit the XSS vulnerability to steal users’ session cookies. However, the application implements HTTPOnly cookies, complicating your original plan. Which of the following would be the most viable strategy for a successful attack?
- AA. Build an XSS payload using HTML encoding and use it to exploit the server-side code, potentially disabling the HTTPOnly flag on cookies.
- BB. Develop a browser exploit to bypass the HTTPOnly restriction, then use an HTML-encoded XSS payload to retrieve the cookies.
- CC. Utilize an HTML-encoded XSS payload to trigger a buffer overflow attack, forcing the server to reveal the HTTPOnly cookies.
- DD. Create a sophisticated XSS payload that leverages HTML encoding to bypass the input sanitization, and then use it to redirect users to a malicious site where their cookies can be captured.
146An ethical hacker is testing the security of a website's database system against SQL Injection attacks. They discover that the IDS has a strong signature detection mechanism to detect typical SQL injection patterns. Which evasion technique can be most effectively used to bypass the IDS signature detection while performing a SQL Injection attack?
- AA. Employ IP fragmentation to obscure the attack payload
- BB. Implement case variation by altering the case of SQL statements
- CC. Leverage string concatenation to break identifiable keywords
- DD. Use Hex encoding to represent the SQL query string
147You have been hired as an intern at a start-up company. Your first task is to help set up a basic web server for the company's new website. The team leader has asked you to make sure the server is secure from common threats. Based on your knowledge from studying for the CEH exam, which of the following actions should be your priority to secure the web server?
- AA. Limiting the number of concurrent connections to the server
- BB. Installing a web application firewall
- CC. Regularly updating and patching the server software
- DD. Encrypting the company's website with SSL/TLS
148A sophisticated attacker targets your web server with the intent to execute a Denial of Service (DoS) attack. His strategy involves a unique mixture of TCP SYN, UDP, and ICMP floods, using ‘r’ packets per second. Your server, reinforced with advanced security measures, can handle 'h' packets per second before it starts showing signs of strain. If 'r' surpasses 'h', it overwhelms the server, causing it to become unresponsive. In a peculiar pattern, the attacker selects 'r' as a composite number and 'h' as a prime number, making the attack detection more challenging. Considering 'r=2010' and different values for 'h', which of the following scenarios would potentially cause the server to falter?
- AA. h = 1987 (prime): The attacker's packet rate exceeds the server's capacity, causing potential unresponsiveness.
- BB. h = 1999 (prime): Despite the attacker's packet flood, the server can handle these requests, remaining responsive.
- CC. h = 1993 (prime): Despite being less than 'r', the server's prime number capacity keeps it barely operational, but the risk of failing is imminent.
- DD. h = 2003 (prime): The server can manage more packets than the attacker is sending, hence it stays operational.
149An IT security team is conducting an internal review of security protocols in their organization to identify potential vulnerabilities. During their investigation, they encounter a suspicious program running on several computers. Further examination reveals that the program has been logging all user keystrokes. How can the security team confirm the type of program and what countermeasures should be taken to ensure the same attack does not occur in the future?
- AA. The program is spyware; the team should use password managers and encrypt sensitive data.
- BB. The program is a keylogger; the team should employ intrusion detection systems and regularly update the system software.
- CC. The program is a keylogger; the team should educate employees about phishing attacks and maintain regular backups.
- DD. The program is a Trojan; the team should regularly update antivirus software and install a reliable firewall.
150Being a Certified Ethical Hacker (CEH), a company has brought you on board to evaluate the safety measures in place for their network system. The company uses a network time protocol server in the demilitarized zone. During your enumeration, you decide to run a ntptrace command. Given the syntax:
ntptrace [-n] [-m maxhosts] [servername/IP_address],
which command usage would best serve your objective to find where the NTP server obtains the time from and to trace the list of NTP servers connected to the network?- AA. ntptrace -n -m 5192.168.1.1
- BB. ntptrace -m 5192.168.1.1
- CC. ntptrace -n localhost
- DD. ntptrace 192.168.1.1
151A Certified Ethical Hacker is attempting to gather information about a target organization’s network structure through network footprinting. During the operation, they encounter ICMP blocking by the target system’s firewall. The hacker wants to ascertain the path that packets take to the host system from a source, using an alternative protocol. Which of the following actions should the hacker consider next?
- AA. Use UDP Traceroute in the Linux operating system by executing the traceroute command with the destination IP or domain name.
- BB. Use the ICMP Traceroute on the Windows operating system as it is the default utility.
- CC. Use the ARIN Whois database search tool to find the network range of the target network.
- DD. Utilize the Path Analyzer Pro to trace the route from the source to the destination target systems.
152An ethical hacker is preparing to scan a network to identify live systems. To increase the efficiency and accuracy of his scans, he is considering several different host discovery techniques. He expects several unused IP addresses at any given time, specifically within the private address range of the LAN, but he also anticipates the presence of restrictive firewalls that may conceal active devices. Which scanning method would be most effective in this situation?
- AA. ICMP ECHO Ping Sweep
- BB. ICMP Timestamp Ping
- CC. TCP SYN Ping
- DD. ARP Ping Scan
153A penetration tester is tasked with gathering information about the subdomains of a target organization’s website. The tester needs a versatile and efficient solution for the task. Which of the following options would be the most effective method to accomplish this goal?
- AA. Analyzing LinkedIn profiles to find employees of the target company and their job titles
- BB. Employing a tool like Sublist3r, which is designed to enumerate the subdomains of websites using OSINT
- CC. Using a people search service, such as Spokeo or Intelius, to gather information about the employees of the target organization
- DD. Utilizing the Harvester tool to extract email addresses related to the target domain using a search engine like Google or Bing
154Your network infrastructure is under a SYN flood attack. The attacker has crafted an automated botnet to simultaneously send ‘s’ SYN packets per second to the server. You have put measures in place to manage ‘f’ SYN packets per second, and the system is designed to deal with this number without any performance issues. If ‘s’ exceeds ‘f’, the network infrastructure begins to show signs of overload. The system’s response time increases exponentially (2^k), where ‘k’ represents each additional SYN packet above the ‘f’ limit. Now, considering ‘s=500’ and different ‘f’ values, in which scenario is the server most likely to experience overload and significantly increased response times?
- AA. f=510: The server can handle 510 SYN packets per second, which is greater than what the attacker is sending. The system stays stable, and the response time remains unaffected.
- BB. f=495: The server can handle 495 SYN packets per second. The response time drastically rises (2^5 = 32 times the normal), indicating a probable system overload.
- CC. f=505: The server can handle 505 SYN packets per second. In this case, the response time increases but not as drastically (2^5 = 32 times the normal), and the system might still function, albeit slowly.
- DD. f=490: The server can handle 490 SYN packets per second. With ‘s’ exceeding ‘f’ by 10, the response time shoots up (2^10 = 1024 times the usual response time), indicating a system overload.
155A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies after multiple failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the username or password entered is incorrect. The tester also notices that the application uses HTTP headers to prevent clickjacking attacks but does not implement Content Security Policy (CSP). With these observations, which of the following attack methods would likely be the most effective for the penetration tester to exploit these vulnerabilities and attempt unauthorized access?
- AA. The tester could exploit a potential SQL Injection vulnerability to manipulate the application’s database.
- BB. The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and the verbose error messages to guess the correct credentials.
- CC. The tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP headers for a Clickjacking attack.
- DD. The tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session cookies, potentially bypassing the clickjacking protection.
156In a large organization, a network security analyst discovered a series of packet captures that seem unusual. The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?
- AA. The attacker might be compromising physical security to plug into the network directly.
- BB. The attacker might be implementing MAC flooding to overwhelm the switch's memory.
- CC. The attacker is probably using a Trojan horse with in-built sniffing capability.
- DD. The attacker might be using passive sniffing, as it provides significant stealth advantages.
157You are a cybersecurity consultant for a smart city project. The project involves deploying a vast network of IoT devices for public utilities like traffic control, water supply, and power grid management. The city administration is concerned about the possibility of a Distributed Denial of Service (DDoS) attack crippling these critical services. They have asked you for advice on how to prevent such an attack. What would be your primary recommendation?
- AA. Implement regular firmware updates for all IoT devices.
- BB. Establish strong, unique passwords for each IoT device.
- CC. Deploy network intrusion detection systems (IDS) across the IoT network.
- DD. Implement IP address whitelisting for all IoT devices.
158Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but he suspects that the network security devices may be able to detect SYN packets. Based on this information, which of the following methods should he use to bypass the detection mechanisms and why?
- AA. Maimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here is FIN/ACK
- BB. Xmas Scan, because it can pass through filters undetected, depending on the security mechanisms installed
- CC. TCP Connect/Full-Open Scan, because it completes a three-way handshake with the target machine
- DD. ACK Flag Probe Scan, because it exploits the vulnerabilities within the BSD-derived TCP/IP stack
159While performing a security audit of a web application, an ethical hacker discovers a potential vulnerability. The application responds to logically incorrect queries with detailed error messages that divulge the underlying database’s structure. The ethical hacker decides to exploit this vulnerability further. Which type of SQL Injection attack is the ethical hacker likely to use?
- AA. UNION SQL Injection
- BB. Error-based SQL Injection
- CC. In-band SQL Injection
- DD. Blind/Inferential SQL Injection
160You are a security analyst of a large IT company and are responsible for maintaining the organization's security posture. You are evaluating multiple vulnerability assessment tools for your network. Given that your network has a hybrid IT environment with on-premise and cloud assets, which tool would be most appropriate considering its comprehensive coverage and visibility, continuous scanning, and ability to monitor unexpected changes before they turn into breaches?
- AA. GFI LanGuard
- BB. Qualys Vulnerability Management
- CC. Open VAS
- DD. Nessus Professional
161Martin, a Certified Ethical Hacker (CEH), is conducting a penetration test on a large enterprise network. He suspects that sensitive information might be leaking out of the network. Martin decides to use network sniffing as part of his testing methodology. Which of the following sniffing techniques should Martin employ to get a comprehensive understanding of the data flowing across the network?
- AA. Raw Sniffing
- BB. MAC Flooding
- CC. ARP Poisoning
- DD. DNS Poisoning|
162As a cybersecurity consultant for SafePath Corp, you have been tasked with implementing a system for secure email communication. The key requirement is to ensure both confidentiality and non-repudiation. While considering various encryption methods, you are inclined towards using a combination of symmetric and asymmetric cryptography. However, you are unsure which cryptographic technique would best serve the purpose. Which of the following options would you choose to meet these requirements?
- AA. Apply asymmetric encryption with RSA and use the private key for signing.
- BB. Use the Diffie-Hellman protocol for key exchange and encryption.
- CC. Apply asymmetric encryption with RSA and use the public key for encryption.
D. Use symmetric encryption with the AES algorithm.
163While performing a security audit of a web application, an ethical hacker discovers a potential vulnerability. The application responds to logically incorrect queries with detailed error messages that divulge the underlying database’s structure. The ethical hacker decides to exploit this vulnerability further. Which type of SQL Injection attack is the ethical hacker likely to use?
- AA. UNION SQL Injection
- BB. Error-based SQL Injection
- CC. In-band SQL Injection
- DD. Blind/Inferential SQL Injection
164You are a security analyst of a large IT company and are responsible for maintaining the organization's security posture. You are evaluating multiple vulnerability assessment tools for your network. Given that your network has a hybrid IT environment with on-premise and cloud assets, which tool would be most appropriate considering its comprehensive coverage and visibility, continuous scanning, and ability to monitor unexpected changes before they turn into breaches?
- AA. GFI LanGuard
- BB. Qualys Vulnerability Management
- CC. Open VAS
- DD. Nessus Professional
165Martin, a Certified Ethical Hacker (CEH), is conducting a penetration test on a large enterprise network. He suspects that sensitive information might be leaking out of the network. Martin decides to use network sniffing as part of his testing methodology. Which of the following sniffing techniques should Martin employ to get a comprehensive understanding of the data flowing across the network?
- AA. Raw Sniffing
- BB. MAC Flooding
- CC. ARP Poisoning
- DD. DNS Poisoning
166As an IT Security Analyst, you've been asked to review the security measures of an e-commerce website that relies on a SQL database for storing sensitive customer data. Recently, an anonymous tip has alerted you to a possible threat: a seasoned hacker who specializes in SQL Injection attacks may be targeting your system. The site already employs input validation measures to prevent basic injection attacks, and it blocks any user inputs containing suspicious patterns. However, this hacker is known to use advanced SQL Injection techniques. Given this situation, which of the following strategies would the hacker most likely adopt to bypass your security measures?
- AA. The hacker might employ a ‘blind’ SQL Injection attack, taking advantage of the application's true or false responses to extract data bit by bit.
- BB. The hacker may resort to a DDoS attack instead, attempting to crash the server and thus render the e-commerce site unavailable.
- CC. The hacker may try to use SQL commands which are less known and less likely to be blocked by your system's security.
- DC. The hacker may try to use SQL commands which are less known and less likely to be blocked by your system's security.
D. The hacker could deploy an ‘out-of-band’ SQL Injection attack, extracting data via a different communication channel, such as DNS or HTTP requests.
167Your company, SecureTech Inc., is planning to transmit some sensitive data over an unsecured communication channel. As a cybersecurity expert, you decide to use symmetric key encryption to protect the data. However, you must also ensure the secure exchange of the symmetric key. Which of the following protocols would you recommend to the team to achieve this?
- AA. Switching all data transmission to the HTTPS protocol.
- BB. Implementing SSL certificates on your company's web servers.
- CC. Utilizing SSH for secure remote logins to the servers.
- DD. Applying the Diffie-Hellman protocol to exchange the symmetric key.
168As an IT intern, you have been asked to help set up a secure Wi-Fi network for a local coffee shop. The owners want to provide free Wi-Fi to their customers, but they are concerned about potential security risks. They are looking for a simple yet effective solution that would not require a lot of technical knowledge to manage. Which of the following security measures would be the most suitable in this context?
- AA. Disable the network's SSID broadcast.
- BB. Enable MAC address filtering.
- CC. Require customers to use VPN when connected to the Wi-Fi.
- DD. Implement WPA2 or WPA3 encryption.
169As a cybersecurity analyst for SecureNet, you are performing a security assessment of a new mobile payment application. One of your primary concerns is the secure storage of customer data on the device. The application stores sensitive information such as credit card details and personal identification numbers (PINs) on the device. Which of the following measures would best ensure the security of this data?
- AA. Enable GPS tracking for all devices using the app.
- BB. Regularly update the app to the latest version.
- CC. Encrypt all sensitive data stored on the device.
- DD. Implement biometric authentication for app access.
170A large multinational corporation is in the process of evaluating its security infrastructure to identify potential vulnerabilities. After a comprehensive analysis, they found multiple areas of concern, including time of check/time of use (TOC/TOU) errors, improper input handling, and poor patch management. Which of the following approaches will best help the organization mitigate the vulnerability associated with TOC/TOU errors?
- AA. Regular patching of servers, firmware, operating system, and applications
- BB. Ensuring atomicity of operations between checking and using data resources
- CC. Frequently updating firewall configurations to prevent intrusion attempts
- DD. Implementing stronger encryption algorithms for all data transfers
171A security analyst is preparing to analyze a potentially malicious program believed to have infiltrated an organization's network. To ensure the safety and integrity of the production environment, the analyst decided to use a sheep dip computer for the analysis. Before initiating the analysis, what key step should the analyst take?
- AA. Install the potentially malicious program on the sheep dip computer.
- BB. Store the potentially malicious program on an external medium, such as a CD-ROM.
- CC. Run the potentially malicious program on the sheep dip computer to determine its behavior.
- DD. Connect the sheep dip computer to the organization's internal network.
172During a penetration test, an ethical hacker is exploring the security of a complex web application.
The application heavily relies on JavaScript for client-side input sanitization, with an apparent assumption that this alone is adequate to prevent injection attacks. During the investigation, the ethical hacker also notices that the application utilizes cookies to manage user sessions but does not enable the HttpOnly flag. This lack of flag potentially exposes the cookies to client-side scripts. Given these identified vulnerabilities, what would be the most effective strategy for the ethical hacker to exploit this application?- AA. Instigate a Distributed Denial of Service (DDoS) attack to overload the server, capitalizing on potential weak server-side security.
posure of session cookies. - BB. Implement an SQL Injection attack to take advantage of potential unvalidated input and gain unauthorized database access.
exploit the ex - CC. Employ a brute-force attack to decipher user credentials, considering the lack of server-side validation.
- DD. Launch a Cross-Site Scripting (XSS) attack, aiming to bypass the client-side sanitization and
- AA. Instigate a Distributed Denial of Service (DDoS) attack to overload the server, capitalizing on potential weak server-side security.
173In the process of footprinting a target website, an ethical hacker utilized various tools to gather critical information. The hacker encountered a target site where standard web spiders were ineffective due to a specific file in its root directory. However, they managed to uncover all the files and web pages on the target site, monitoring the resulting incoming and outgoing traffic while browsing the website manually. What technique did the hacker likely employ to achieve this?
- AA. Using the Netcraft tool to gather website information
- BB. Examining HTML source code and cookies
- CC. Using Photon to retrieve archived URLs of the target website from archive.org
- DD. User-directed spidering with tools like Burp Suite and WebScarab
174During a comprehensive security assessment, your cybersecurity team at XYZ Corp stumbles upon signs that point toward a possible Advanced Persistent Threat (APT) infiltration in the network infrastructure. These sophisticated threats often exhibit subtle indicators that distinguish them from other types of cyberattacks. To confirm your suspicion and adequately isolate the potential APT, which of the following actions should you prioritize?
- AA. Investigate for anomalies in file movements or unauthorized data access attempts within your database system
- BB. Scrutinize for repeat network login attempts from unrecognized geographical regions
- CC. Vigilantly monitor for evidence of zero-day exploits that manage to evade your firewall or antivirus software
- DD. Search for proof of a spear-phishing attempt, such as the presence of malicious emails or risky attachments
175As a budding cybersecurity enthusiast, you have set up a small lab at home to learn more about wireless network security. While experimenting with your home Wi-Fi network, you decide to use a well-known hacking tool to capture network traffic and attempt to crack the Wi-Fi password. However, despite many attempts, you have been unsuccessful. Your home Wi-Fi network uses WPA2 Personal with AES encryption. Why are you finding it difficult to crack the Wi-Fi password?
- AA. Your hacking tool is outdated.
- BB. The Wi-Fi password is too complex and long.
- CC. The network is using an uncrackable encryption method.
- DD. The network is using MAC address filtering.
176An ethical hacker is testing a web application of a financial firm. During the test, a 'Contact Us' form's input field is found to lack proper user input validation, indicating a potential Cross-Site Scripting (XSS) vulnerability. However, the application has a stringent Content Security Policy (CSP) disallowing inline scripts and scripts from external domains but permitting scripts from its own domain. What would be the hacker's next step to confirm the XSS vulnerability?
- AA. Utilize a script hosted on the application’s domain to test the form
- BB. Try to disable the CSP to bypass script restrictions
- CC. Inject a benign script inline to the form to see if it executes
- DD. Load a script from an external domain to test the vulnerability
177John, a security analyst, is analyzing a server suspected of being compromised. The attacker has used a non admin account and has already gained a foothold on the system. John discovers that a new Dynamic Link Library is loaded in the application directory of the affected server. This DLL does not have a fully qualified path and seems to be malicious. What privilege escalation technique has the attacker likely used to compromise this server?
- AA. DLL Hijacking
- BB. Named Pipe Impersonation
- CC. Spectre and Meltdown Vulnerabilities
- DD. Exploiting Misconfigured Services
178Gregory, a professional penetration tester working at Sys Security Ltd., is tasked with performing a security test of web applications used in the company. For this purpose, Gregory uses a tool to test for any security loopholes by hijacking a session between a client and server. This tool has a feature of intercepting proxy that can be used to inspect and modify the traffic between the browser and target application. This tool can also perform customized attacks and can be used to test the randomness of session tokens.
Which of the following tools is used by Gregory in the above scenario?- AA. Wireshark
- BB. Nmap
- CC. Burp Suite
- DD. CxSAST
179A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system. What is the first step that the bank should take before enabling the audit feature?
- AA. Perform a vulnerability scan of the system.
- BB. Determine the impact of enabling the audit feature.
- CC. Perform a cost/benefit analysis of the audit feature.
- DD. Allocate funds for staffing of audit log review.
180A penetration tester is performing the footprinting process and is reviewing publicly available information about an organization by using the Google search engine.
Which of the following advanced operators would allow the pen tester to restrict the search to the organization's web domain?- AA. [allinurl:]
- BB. [location:]
- CC. [site:]
- DD. [link:]
181The security team of Debry Inc. decided to upgrade Wi-Fi security to thwart attacks such as dictionary attacks and key recovery attacks. For this purpose, the security team started implementing cutting-edge technology that uses a modern key establishment protocol called the simultaneous authentication of equals (SAE), also known as dragonfly key exchange, which replaces the PSK concept.
What is the Wi-Fi encryption technology implemented by Debry Inc.?- AA. WPA
- BB. WEP
- CC. WPA3
- DD. WPA2
182A security analyst uses Zenmap to perform an ICMP timestamp ping scan to acquire information related to the current time from the target host machine.
Which of the following Zenmap options must the analyst use to perform the ICMP timestamp ping scan?- AA. -Pn
- BB. -PU
- CC. -PP
- DD. -PY
183An attacker decided to crack the passwords used by industrial control systems. In this process, he employed a loop strategy to recover these passwords. He used one character at a time to check whether the first character entered is correct; if so, he continued the loop for consecutive characters. If not, he terminated the loop. Furthermore, the attacker checked how much time the device took to finish one complete password authentication process, through which he deduced how many characters entered are correct.
What is the attack technique employed by the attacker to crack the passwords of the industrial control systems?- AA. Buffer overflow attack
- BB. Side-channel attack
- CC. Denial-of-service attack
- DD. HMI-based attack
184Given below are different steps involved in the vulnerability-management life cycle:
Remediation
Identify assets and create a baseline
Verification
Monitor
Vulnerability scan
Risk assessment
Identify the correct sequence of steps involved in vulnerability management.- AA. 2 → 5 → 6 → 1 → 3 → 4
- BB. 2 → 4 → 5 → 3 → 6 → 1
- CC. 2 → 1 → 5 → 6 → 4 → 3
- DD. 1 → 2 → 3 → 4 → 5 → 6
185Which type of attack attempts to overflow the content-addressable memory (CAM) table in an Ethernet switch?
- AA. DDoS attack
- BB. Evil twin attack
- CC. DNS cache flooding
- DD. MAC flooding
186What is the following command used for?
- AA. Retrieving SQL statements being executed on the database
- BB. Creating backdoors using SQL injection
- CC. Enumerating the databases in the DBMS for the URL
- DD. Searching database statements at the IP address given
187Jane is working as a security professional at CyberSol Inc. She was tasked with ensuring the authentication and integrity of messages being transmitted in the corporate network. To encrypt the messages, she implemented a security model in which every user in the network maintains a ring of public keys. In this model, a user needs to encrypt a message using the receiver's public key, and only the receiver can decrypt the message using their private key.
What is the security model implemented by Jane to secure corporate messages?- AA. Zero trust network
- BB. Secure Socket Layer (SSL)
- CC. Transport Layer Security (TLS)
- DD. Web of trust (WOT)
188Clark, a professional hacker, attempted to perform a Btlejacking attack using an automated tool, Btleyjack, and hardware tool, micro:bit. This attack allowed Clark to hijack, read, and export sensitive information shared between connected devices. To perform this attack, Clark executed various btlejack commands.
Which of the following commands was used by Clark to hijack the connections?- AA. btlejack -f 0x9c68fd30 -t -m 0x1fffffffff
- BB. btlejack -c any
- CC. btlejack -d /dev/ttyACM0 -d /dev/ttyACM2 -s
- DD. btlejack -f 0x129f3244 -j
189John, a professional hacker, targeted CyberSol Inc., an MNC. He decided to discover the IoT devices connected in the target network that are using default credentials and are vulnerable to various hijacking attacks. For this purpose, he used an automated tool to scan the target network for specific types of IoT devices and detect whether they are using the default, factory-set credentials.
What is the tool employed by John in the above scenario?- AA. IoT Inspector
- BB. AT&T IoT Platform
- CC. IoTSeeker
- DD. Azure IoT Central
190To hide the file on a Linux system, you have to start the filename with a specific character.
What is the character?- AA. Tilde (~)
- BB. Underscore (_)
- CC. Period (.)
- DD. Exclamation mark (!)
191Tony wants to integrate a 128-bit symmetric block cipher with key sizes of 128, 192, or 256 bits into a software program, which involves 32 rounds of computational operations that include substitution and permutation operations on four 32-bit word blocks using 8-variable S-boxes with 4-bit entry and 4-bit exit.
Which of the following algorithms includes all the above features and can be integrated by Tony into the software program?- AA. CAST-128
- BB. RC5
- CC. TEA
- DD. Serpent
192Jacob works as a system administrator in an organization. He wants to extract the source code of a mobile application and disassemble the application to analyze its design flaws. Using this technique, he wants to fix any bugs in the application, discover underlying vulnerabilities, and improve defense strategies against attacks.
What is the technique used by Jacob in the above scenario to improve the security of the mobile application?- AA. Reverse engineering
- BB. App sandboxing
- CC. Jailbreaking
- DD. Social engineering
193Mirai malware targets IoT devices.
After infiltration, it uses them to propagate and create botnets that are then used to launch which types of attack?- AA. MITM attack
- BB. Password attack
- CC. Birthday attack
- DD. DDoS attack
194Bill has been hired as a penetration tester and cyber security auditor for a major credit card company.
Which information security standard is most applicable to his role?- AA. FISMA
- BB. Sarbanes-Oxley Act
- CC. HITECH
- DD. PCI-DSS
195Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions.
Which of the following master components is explained in the above scenario?- AA. Kube-apiserver
- BB. Etcd cluster
- CC. Kube-controller-manager
- DD. Kube-scheduler
196According to the NIST cloud deployment reference architecture, which of the following provides connectivity and transport services to consumers?
- AA. Cloud connector
- BB. Cloud broker
- CC. Cloud provider
- DD. Cloud carrier
197A group of hackers were roaming around a bank office building in a city, driving a luxury car. They were using hacking tools on their laptop with the intention to find a free-access wireless network.
What is this hacking process known as?- AA. Wardriving
- BB. Spectrum analysis
- CC. Wireless sniffing
- DD. GPS mapping
198Which of the following standards is primarily focused on providing guidelines for implementing a robust cybersecurity framework within critical infrastructure sectors?
- AA. ISO/IEC 27001
- BB. NIST SP 800-53
- CC. NIST Cybersecurity Framework (CSF)
- DD. CIS Controls
199Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to feed data and specifies the incorrect field in case of invalid credentials. Later, Calvin uses this information to perform social engineering. Which of the following design flaws in the authentication mechanism is exploited by Calvin?
- AA. User impersonation
- BB. Insecure transmission of credentials
- CC. Password reset mechanism
- DD. Verbose failure messages
200Rebecca, a security professional, wants to authenticate employees who use web services for safe and secure communication. In this process, she employs a component of the Web Service Architecture, which is an extension of SOAP, and it can maintain the integrity and confidentiality of SOAP messages.
Which of the following components of the Web Service Architecture is used by Rebecca for securing the communication?- AA. WS-Work Processes
- BB. WS-Security
- CC. WS-Policy
- DD. WSDL
201Which wireless security protocol replaces the personal pre-shared key (PSK) authentication with Simultaneous Authentication of Equals (SAE) and is therefore resistant to offline dictionary attacks?
- AA. Bluetooth
- BB. WPA2-Enterprise
- CC. WPA3-Personal
- DD. ZigBee
202Sam, a web developer, was instructed to incorporate a hybrid encryption software program into a web application to secure email messages. Sam used an encryption software, which is a free implementation of the OpenPGP standard that uses both symmetric-key cryptography and asymmetric-key cryptography for improved speed and secure key exchange.
What is the encryption software employed by Sam for securing the email messages?- AA. PGP
- BB. SMTP
- CC. GPG
- DD. S/MIME
203Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the security devices in a digital format to block and identify inbound and outbound malicious traffic entering the organization's network.
Which type of threat intelligence is used by Roma to secure the internal network?- AA. Operational threat intelligence
- BB. Strategic threat intelligence
- CC. Tactical threat intelligence
- DD. Technical threat intelligence
204This type of injection attack does not show any error message. It is difficult to exploit as it returns information when the application is given SQL payloads that elicit a true or false response from the server. By observing the response, an attacker can extract sensitive information.
What type of attack is this?- AA. Union SQL injection
- BB. Error-based SQL injection
- CC. Time-based SQL injection
- DD. Blind SQL injection
205An attacker can employ many methods to perform social engineering against unsuspecting employees, including scareware.
What is the best example of a scareware attack?- AA. A pop-up appears to a user stating, "You have won a free cruise! Click here to claim your prize!"
- BB. A banner appears to a user stating, "Your account has been locked. Click here to reset your password and unlock your account."
- CC. A pop-up appears to a user stating, "Your computer may have been infected with spyware. Click here to install an anti-spyware tool to resolve this issue."
- DD. A banner appears to a user stating, "Your Amazon order has been delayed. Click here to find out your new delivery date."
206Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks.
What is the type of threat intelligence collected by Arnold in the above scenario?- AA. Strategic threat intelligence
- BB. Operational threat intelligence
- CC. Technical threat intelligence
- DD. Tactical threat intelligence
207Which of the following types of SQL injection attacks extends the results returned by the original query, enabling attackers to run two or more statements if they have the same structure as the original one?
- AA. Union SQL injection
- BB. Error-based injection
- CC. Blind SQL injection
- DD. Boolean-based blind SQL injection
208What information security law or standard aims at protecting stakeholders and the general public from accounting errors and fraudulent activities within organizations?
- AA. FISMA
- BB. PCI-DSS
- CC. SOX
- DD. ISO/IEC 27001:2013
209Which of the following web vulnerabilities would an attacker be attempting to exploit if they delivered the following input?
- AA. SQLi
- BB. XXE
- CC. XXS
- DD. IDOR
210What useful information is gathered during a successful Simple Mail Transfer Protocol (SMTP) enumeration?
- AA. A list of all mail proxy server addresses used by the targeted host.
- BB. The internal command RCPT provides a list of ports open to message traffic.
- CC. The two internal commands VRFY and EXPN provide a confirmation of valid users, email addresses, aliases, and mailing lists.
- DD. Reveals the daily outgoing message limits before mailboxes are locked.
211James is working as an ethical hacker at Technix Solutions. The management ordered James to discover how vulnerable its network is towards footprinting attacks. James took the help of an open-source framework for performing automated reconnaissance activities. This framework helped James in gathering information using free tools and resources.
What is the framework used by James to conduct footprinting and reconnaissance activities?- AA. OSINT framework
- BB. WebSploit Framework
- CC. Browser Exploitation Framework
- DD. SpeedPhish Framework
212What would be the purpose of running "wget 192.168.0.15 -q -S" against a web server?
- AA. Performing content enumeration on the web server to discover hidden folders
- BB. Using wget to perform banner grabbing on the webserver
- CC. Flooding the web server with requests to perform a DoS attack
- DD. Downloading all the contents of the web page locally for further examination
213QUESTION 302
Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results:
yaml
Copiar
Editar
TTL: 64
Window Size: 5840
What the OS running on the target machine?- AA. Windows OS
- BB. Mac OS
- CC. Linux OS
- DD. Solaris OS
214Calvin, a software developer, uses a feature that helps him auto-generate the content of a web page without manual involvement and is integrated with SSI directives. This leads to a vulnerability in the developed web application as this feature accepts remote user inputs and uses them on the page. Hackers can exploit this feature and pass malicious SSI directives as input values to perform malicious activities such as modifying and erasing server files.
What is the type of injection attack Calvin’s web application is susceptible to?- AA. CRLF injection
- BB. Server-side template injection
- CC. Server-side JS injection
- DD. Server-side includes injection
215Jack, a professional hacker, targets an organization and performs vulnerability scanning on the target web server to identify any possible weaknesses, vulnerabilities, and misconfigurations. In this process, Jack uses an automated tool that eases his work and performs vulnerability scanning to find hosts, services, and other vulnerabilities in the target server.
Which of the following tools is used by Jack to perform vulnerability scanning?- AA. Infoga
- BB. NCollector Studio
- CC. Netsparker
- DD. WebCopier Pro
216Stephen, an attacker, targeted the industrial control systems of an organization. He generated a fraudulent email with a malicious attachment and sent it to employees of the target organization. An employee who manages the sales software of the operational plant opened the fraudulent email and clicked on the malicious attachment. This resulted in the malicious attachment being downloaded and malware being injected into the sales software maintained in the victim's system. Further, the malware propagated itself to other networked systems, finally damaging the industrial automation components.
What is the attack technique used by Stephen to damage the industrial systems?- AA. HMI-based attack
- BB. SMishing attack
- CC. Reconnaissance attack
- DD. Spear-phishing attack
217In an attempt to damage the reputation of a competitor organization, Hailey, a professional hacker, gathers a list of employee and client email addresses and other related information by using various search engines, social networking sites, and web spidering tools. In this process, she also uses an automated tool to gather a list of words from the target website to further perform a brute-force attack on the previously gathered email addresses.
What is the tool used by Hailey for gathering a list of words from the target website?- AA. CeWL
- BB. Orbot
- CC. Shadowsocks
- DD. Psiphon
218Miley, a professional hacker, decided to attack a target organization's network. To perform the attack, she used a tool to send fake ARP messages over the target network to link her MAC address with the target system's IP address. By performing this, Miley received messages directed to the victim's MAC address and further used the tool to intercept, steal, modify, and block sensitive communication to the target system.
What is the tool employed by Miley to perform the above attack?- AA. Wireshark
- BB. BetterCAP
- CC. DerpNSpoof
- DD. Gobbler
219George, an employee of an organization, is attempting to access restricted websites from an official computer. For this purpose, he used an anonymizer that masked his real IP address and ensured complete and continuous anonymity for all his online activities.
Which of the following anonymizers helps George hide his activities?- AA. https://www.baidu.com
- BB. https://www.guardster.com
- CC. https://www.wolframalpha.com
- DD. https://karmadecay.com
220Kevin, an encryption specialist, implemented a technique that enhances the security of keys used for encryption and authentication. Using this technique, Kevin input an initial key to an algorithm that generated an enhanced key that is resistant to brute-force attacks.
What is the technique employed by Kevin to improve the security of encryption keys?- AA. Key stretching
- BB. Public key infrastructure
- CC. Key derivation function
- DD. Key reinstallation
221Jake, a professional hacker, installed spyware on a target iPhone to spy on the target user’s activities. He can take complete control of the target mobile device by jailbreaking the device remotely and record audio, capture screenshots, and monitor all phone calls and SMS messages.
What is the type of spyware that Jake used to infect the target device?- AA. DroidSheep
- BB. AndroRat
- CC. Trident
- DD. Zscaler
222Robert, a professional hacker, is attempting to execute a fault injection attack on a target IoT device. In this process, he injects faults into the power supply that can be used for remote execution, also causing the skipping of key instructions. He also injects faults into the clock network used for delivering a synchronized signal across the chip.
Which of the following types of fault injection attack is performed by Robert in the above scenario?- AA. Frequency/voltage tampering
- BB. Optical, electromagnetic fault injection (EMFI)
- CC. Temperature attack
- DD. Power/clock/reset glitching
223Kate dropped her phone and subsequently encountered an issue with the phone’s internal speaker. Thus, she is using the phone’s loudspeaker for phone calls and other activities. Bob, an attacker, takes advantage of this vulnerability and secretly exploits the hardware of Kate’s phone so that he can monitor the loudspeaker’s output from data sources such as voice assistants, multimedia messages, and audio files by using a malicious app to breach speech privacy.
What is the type of attack Bob performed on Kate in the above scenario?- AA. SIM card attack
- BB. aLTEr attack
- CC. Spearphone attack
- DD. Man-in-the-disk attack
224Dayn, an attacker, wanted to detect if any honeypots are installed in a target network. For this purpose, he used a time-based TCP fingerprinting method to validate the response to a normal computer and the response of a honeypot to a manual SYN request.
Which of the following techniques is employed by Dayn to detect honeypots?- AA. Detecting honeypots running on VMware
- BB. Detecting the presence of Snort_inline honeypots
- CC. Detecting the presence of Honeyd honeypots
- DD. Detecting the presence of Sebek-based honeypots
225Morris, an attacker, wanted to check whether the target AP is in a locked state. He attempted using different utilities to identify WPS-enabled APs in the target wireless network. Ultimately, he succeeded with one special command-line utility.
Which of the following command-line utilities allowed Morris to discover the WPS-enabled APs?- AA. wash
- BB. net view
- CC. macof
- DD. ntptrace
226BitLocker encryption has been implemented for all the Windows-based computers in an organization. You are concerned that someone might lose their cryptographic key. Therefore, a mechanism was implemented to recover the keys from Active Directory.
What is this mechanism called in cryptography?- AA. Key archival
- BB. Certificate rollover
- CC. Key escrow
- DD. Key renewal
227A post-breach forensic investigation revealed that a known vulnerability in Apache Struts was to blame for the Equifax data breach that affected 143 million customers. A fix was available from the software vendor for several months prior to the intrusion. This is likely a failure in which of the following security processes?
- AA. Secure development lifecycle
- BB. Security awareness training
- CC. Vendor risk management
- DD. Patch management
228Which type of malware spreads from one system to another or from one network to another and causes similar types of damage as viruses do to the infected system?
- AA. Worm
- BB. Rootkit
- CC. Adware
- DD. Trojan
229Ron, a security professional, was pen testing web applications and SaaS platforms used by his company. While testing, he found a vulnerability that allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company.
What is the API vulnerability revealed in the above scenario?- AA. No ABAC validation
- BB. Business logic flaws
- CC. Improper use of CORS
- DD. Code injections
230Louis, a professional hacker, had used specialized tools or search engines to encrypt all his browsing activity and navigate anonymously to obtain sensitive/hidden information about official government or federal databases. After gathering the information, he successfully performed an attack on the target government organization without being traced.
Which of the following techniques is described in the above scenario?- AA. Website footprinting
- BB. Dark web footprinting
- CC. VPN footprinting
- DD. VoIP footprinting
231Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an IaaS.
What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?- AA. Cloudborne attack
- BB. Man-in-the-cloud (MITC) attack
- CC. Metadata spoofing attack
- DD. Cloud cryptojacking
232Which of the following tactics uses malicious code to redirect users' web traffic?
- AA. Spear-phishing
- BB. Phishing
- CC. Spimming
- DD. Pharming
Información
- Descripción
- Sexto ciber Test sobre ECHA 2, creado por Carlos Velas el 16/05/2025.
- Autor
- Carlos Velas
- Idioma
- Español
- Visitas
- 0
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test