Certified Ethical Hacker v12 Exam v1.0
Question 1
John, a disgruntled ex-employee of an organization, contacted a professional hacker to exploit the organization. In the attack process, the professional hacker installed a scanner on a machine belonging to one of the victims and scanned several machines on the same network to identify vulnerabilities to perform further exploitation.
What is the type of vulnerability assessment tool employed by John in the above scenario?
- A. Agent-based scanner
- B. Network-based scanner
- C. Cluster scanner
- D. Proxy scanner
Answer : A
Question 2
Joel, a professional hacker, targeted a company and identified the types of websites frequently visited by its employees. Using this information, he searched for possible loopholes in these websites and injected a malicious script that can redirect users from the web page and download malware onto a victim's machine. Joel waits for the victim to access the infected web application so as to compromise the victim's machine.
Which of the following techniques is used by Joel in the above scenario?
- A. Watering hole attack
- B. DNS rebinding attack
- C. MarioNet attack
- D. Clickjacking attack
Answer : A
Question 3
Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs.
What type of malware did the attacker use to bypass the company’s application whitelisting?
- A. File-less malware
- B. Zero-day malware
- C. Phishing malware
- D. Logic bomb malware
Answer : A
Question 4
Dorian is sending a digitally signed email to Poly. With which key is Dorian signing this message and how is Poly validating it?
- A. Dorian is signing the message with his public key, and Poly will verify that the message came from Dorian by using Dorian’s private key.
- B. Dorian is signing the message with Poly’s private key, and Poly will verify that the message came from Dorian by using Dorian’s public key.
- C. Dorian is signing the message with his private key, and Poly will verify that the message came from Dorian by using Dorian’s public key.
- D. Dorian is signing the message with Poly’s public key, and Poly will verify that the message came from Dorian by using Dorian’s public key.
Answer : C
Question 5
Scenario: Joe turns on his home computer to access personal online banking. When he enters the URL www.bank.com, the website is displayed, but it prompts him to re-enter his credentials as if he has never visited the site before. When he examines the website URL closer, he finds that the site is not secure and the web address appears different.
What type of attack he is experiencing?
- A. DHCP spoofing
- B. DoS attack
- C. ARP cache poisoning
- D. DNS hijacking
Answer : D
Question 6
Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney’s account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney’s account.
What is the attack performed by Boney in the above scenario?
- A. Forbidden attack
- B. CRIME attack
- C. Session donation attack
- D. Session fixation attack
Answer : D
Question 7
Kevin, a professional hacker, wants to penetrate CyberTech Inc’s network. He employed a technique, using which he encoded packets with Unicode characters. The company’s IDS cannot recognize the packets, but the target web server can decode them.
What is the technique used by Kevin to evade the IDS system?
- A. Session splicing
- B. Urgency flag
- C. Obfuscating
- D. Desynchronization
Answer : C
Question 8
Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:
Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?
- A. select * from Users where UserName = ‘attack’ ’ or 1=1 -- and UserPassword = ‘123456’
- B. select * from Users where UserName = ‘attack’ or 1=1 -- and UserPassword = ‘123456’
- C. select * from Users where UserName = ‘attack or 1=1 -- and UserPassword = ‘123456’
- D. select * from Users where UserName = ‘attack’ or 1=1 --’ and UserPassword = ‘123456’
Answer : A
Question 9
Which of the following commands checks for valid users on an SMTP server?
- A. RCPT
- B. CHK
- C. VRFY
- D. EXPN
Answer : C
Question 10
Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates.
Which of the following protocols is used by Bella?
- A. FTPS
- B. FTP
- C. HTTPS
- D. IP
Answer : A
Question 11
John wants to send Marie an email that includes sensitive information, and he does not trust the network that he is connected to. Marie gives him the idea of using PGP. What should John do to communicate correctly using this type of encryption?
- A. Use his own private key to encrypt the message.
- B. Use his own public key to encrypt the message.
- C. Use Marie’s private key to encrypt the message.
- D. Use Marie’s public key to encrypt the message.
Answer : D
Question 12
In the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
- A. 4.0-6.0
- B. 3.9-6.9
- C. 3.0-6.9
- D. 4.0-6.9
Answer : D
Question 13
Bill is a network administrator. He wants to eliminate unencrypted traffic inside his company’s network. He decides to setup a SPAN port and capture all traffic to the datacenter. He immediately discovers unencrypted traffic in port UDP 161.
What protocol is this port using and how can he secure that traffic?
- A. RPC and the best practice is to disable RPC completely.
- B. SNMP and he should change it to SNMP V3.
- C. SNMP and he should change it to SNMP V2, which is encrypted.
- D. It is not necessary to perform any actions, as SNMP is not carrying important information.
Answer : B
Question 14
Consider the following Nmap output:
What command-line parameter could you use to determine the type and version number of the web server?
- A. -sV
- B. -sS
- C. -Pn
- D. -V
Answer : A
Question 15
Bob was recently hired by a medical company after it experienced a major cyber security breach. Many patients are complaining that their personal medical records are fully exposed on the Internet and someone can find them with a simple Google search. Bob’s boss is very worried because of regulations that protect those data.
Which of the following regulations is mostly violated?
- A. PCI DSS
- B. PII
- C. ISO 2002
- D. HIPPA/PHI
Answer : D