CEH Practice Questions: Network Scanning and Exploitation Scenarios
Introduction
The Certified Ethical Hacker (CEH) exam is a rigorous test of your ability to think like an attacker while adhering to ethical guidelines. The network scanning and exploitation domain is a critical component, covering techniques from host discovery to vulnerability exploitation. To help you prepare, we've crafted 10 realistic CEH practice questions that mirror the style, difficulty, and content of the actual exam. Each question is followed by a detailed explanation of the correct answer and why the other options are incorrect.
CEH Practice Questions: Network Scanning and Exploitation
Question 1
You are conducting a penetration test and need to identify live hosts on a subnet without being detected by the target's IDS. Which technique is most likely to bypass IDS while still performing host discovery? This topic pairs well with AZ-500 Practice Questions: Identity, Network and Application Security Scenarios.
- A) ICMP Echo Request scan
- B) TCP SYN ping scan
- C) ARP scan
- D) UDP scan
Correct Answer: C) ARP scan
Explanation: ARP scans operate at Layer 2 and are only effective on local networks. They send ARP requests to determine which IP addresses are active. Since ARP requests are not IP-based, they are not typically monitored by IDS systems that focus on IP traffic. ICMP Echo Requests (A) are often blocked or flagged by IDS. TCP SYN pings (B) are also IP-based and can be detected. UDP scans (D) are generally slow and unreliable for host discovery.
Question 2
During a vulnerability scan, you discover that a web server is running Apache 2.4.49. Which vulnerability is this version specifically susceptible to?
- A) CVE-2021-41773
- B) CVE-2017-5638
- C) CVE-2020-1472
- D) CVE-2019-0708
Correct Answer: A) CVE-2021-41773
Explanation: CVE-2021-41773 is a path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49. It allows attackers to traverse directories and potentially execute arbitrary code. CVE-2017-5638 (B) is an Apache Struts vulnerability, not Apache web server. CVE-2020-1472 (C) is the Zerologon vulnerability in Netlogon. CVE-2019-0708 (D) is BlueKeep, a RDP vulnerability.
Question 3
An attacker sends a TCP packet with the SYN flag set and the source IP address spoofed to a non-existent host. They then send a series of ACK packets with the same spoofed IP. What is the attacker attempting?
- A) SYN flood attack
- B) Idle scan
- C) Xmas scan
- D) UDP flood
Correct Answer: B) Idle scan
Explanation: An idle scan uses a zombie host (a host with predictable IP IDs) to scan ports stealthily. The attacker sends SYN packets to the target with the zombie's IP address, and then sends ACK packets to the zombie to observe the IP ID changes. This reveals open ports on the target without revealing the attacker's IP. A SYN flood (A) is a DoS attack that overwhelms a target with SYN packets. Xmas scan (C) sends packets with FIN, URG, and PUSH flags. UDP flood (D) uses UDP packets.
Question 4
After gaining access to a Windows system, you want to maintain persistence. Which of the following is a common persistence mechanism?
- A) Modifying the HOSTS file
- B) Creating a scheduled task
- C) Changing the system time
- D) Disabling the firewall
Correct Answer: B) Creating a scheduled task This connects to what we discuss in CEH Passing Score: Understanding the Pearson VUE Scaled Score.
Explanation: Scheduled tasks can be created to run a malicious payload at a specific time or on system startup, ensuring persistence. Modifying the HOSTS file (A) is used for DNS redirection, not persistence. Changing the system time (C) is irrelevant. Disabling the firewall (D) might aid the attack but does not provide persistence.
Question 5
Which Nmap scan type is considered the most stealthy because it does not complete the TCP handshake?
- A) Connect scan
- B) SYN scan
- C) FIN scan
- D) ACK scan
Correct Answer: B) SYN scan
Explanation: SYN scan (half-open) sends a SYN packet and, if it receives a SYN-ACK, responds with RST instead of completing the handshake. This avoids creating a full connection, making it stealthier than a connect scan (A). FIN scan (C) sends FIN packets, which can be stealthy but may not work on all systems. ACK scan (D) is used for firewall rule detection, not port scanning.
Question 6
What is the primary purpose of using a tool like Metasploit in the exploitation phase?
- A) To scan for open ports
- B) To deliver a payload to exploit a vulnerability
- C) To brute-force passwords
- D) To perform OS fingerprinting
Correct Answer: B) To deliver a payload to exploit a vulnerability
Explanation: Metasploit is a framework that provides ready-made exploits and payloads. It is primarily used to exploit vulnerabilities and deliver payloads to gain access. Port scanning (A) is typically done with Nmap. Brute-forcing (C) is done with tools like Hydra. OS fingerprinting (D) can be done with Nmap or p0f.
Question 7
You are performing a penetration test and need to enumerate services running on a target. Which tool is best suited for this task?
- A) Nmap
- B) John the Ripper
- C) Wireshark
- D) Burp Suite
Correct Answer: A) Nmap
Explanation: Nmap is a versatile tool that can scan ports, detect versions, and enumerate services. It can also run scripts for further enumeration. John the Ripper (B) is a password cracker. Wireshark (C) is a packet analyzer. Burp Suite (D) is a web application security testing tool. For background on this area, read CEH Difficulty: Is Ethical Hacking Harder Than CISSP?.
Question 8
An attacker is attempting to exploit a web application by injecting malicious SQL code into a user input field. Which of the following is a primary defense against SQL injection?
- A) Using client-side validation
- B) Using parameterized queries
- C) Disabling JavaScript
- D) Using HTTPS
Correct Answer: B) Using parameterized queries
Explanation: Parameterized queries (prepared statements) separate SQL code from data, making injection impossible. Client-side validation (A) can be bypassed. Disabling JavaScript (C) is not a defense. HTTPS (D) encrypts data but does not prevent SQL injection.
Question 9
What is the purpose of a buffer overflow attack?
- A) To overwrite adjacent memory to execute arbitrary code
- B) To exhaust system resources
- C) To intercept network traffic
- D) To bypass authentication by resetting passwords
Correct Answer: A) To overwrite adjacent memory to execute arbitrary code
Explanation: Buffer overflow attacks exploit insufficient bounds checking to overwrite memory, potentially allowing the attacker to execute malicious code. Exhausting resources (B) is a DoS technique. Intercepting traffic (C) is a MITM attack. Bypassing authentication (D) could be a result, but the primary purpose is code execution.
Question 10
In the context of network scanning, what is the difference between a vulnerability scan and a penetration test?
- A) Vulnerability scans are manual; penetration tests are automated
- B) Vulnerability scans identify weaknesses; penetration tests exploit them to assess impact
- C) Penetration tests are only for web applications
- D) There is no difference
Correct Answer: B) Vulnerability scans identify weaknesses; penetration tests exploit them to assess impact
Explanation: Vulnerability scans are automated and identify potential vulnerabilities. Penetration tests go further by attempting to exploit those vulnerabilities to determine the actual risk and impact. Vulnerability scans can be automated (A). Penetration tests cover all systems (C). There is a clear difference (D).
Conclusion
These CEH practice questions cover a range of topics in network scanning and exploitation, from stealth techniques to specific vulnerabilities and tools. Understanding the rationale behind each answer is crucial for exam success. Remember to practice with realistic questions and review explanations to solidify your knowledge.
For a study schedule that fits your week and a quick check of your weak topics, use the free study plans and readiness checks.
Mock tests from the certification catalogue show you exactly where your knowledge stands.