CEH Network and Perimeter Hacking: 81 practice questions

12 of the 81 Network and Perimeter Hacking questions in the Certsqill CEH bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CEH? Take the free 5-min readiness check →

1. To intercept traffic between the victim and the gateway: What is the primary goal of this attack?

1. To intercept traffic between the victim and the gateway (Man-in-the-Middle attack) ✓

   Correct. ARP poisoning corrupts the ARP cache on the gateway, causing it to forward traffic destined for the victim to the attacker's MAC. The attacker forwards it onward, becoming a transparent MITM.
2. To cause a Denial-of-Service by flooding the network with ARP traffic

   Incorrect. While ARP flooding can cause DoS, the described attack sends targeted gratuitous replies to specific hosts — the goal is traffic interception (MITM), not service disruption.
3. To enumerate usernames from the victim's NetBIOS name service

   Incorrect. NetBIOS enumeration uses nbtstat and UDP port 137. ARP poisoning operates at Layer 2 and has no relationship to NetBIOS name service queries.
4. To prevent the victim from connecting to the internet by corrupting routing tables

   Incorrect. ARP poisoning corrupts Layer 2 MAC address tables, not Layer 3 routing tables. Routing table manipulation requires different techniques (e.g., BGP hijacking).

ARP poisoning sends fake ARP replies to associate the attacker's MAC with the victim's IP, redirecting the victim's traffic through the attacker for interception.

2. Whaling: This attack is BEST described as:

1. Whaling ✓

   Correct. Whaling is a spear phishing attack specifically targeting high-level executives (C-suite). The personalization and targeting of a CFO makes this a whaling attack.
2. Spear phishing

   Partially correct but not the BEST answer. Spear phishing is targeted phishing against any specific individual. Whaling is the more specific term when the target is a senior executive — it is the most accurate classification.
3. Vishing

   Incorrect. Vishing (voice phishing) is conducted over phone calls or voice messages. The described attack uses email.
4. Smishing

   Incorrect. Smishing is phishing via SMS text messages. The described attack is delivered via email.

Whaling is spear phishing targeting C-suite or high-value executives. The CFO targeting with personalized, research-based content is the hallmark of a whaling attack.

3. SYN flood: What type of attack is this?

1. SYN flood (TCP state exhaustion attack) ✓

   Correct. A SYN flood exploits the TCP three-way handshake by creating thousands of half-open connections. The server's connection table (backlog queue) fills up, preventing legitimate connections.
2. UDP flood

   Incorrect. A UDP flood sends high volumes of UDP datagrams to random ports, causing the server to reply with ICMP Port Unreachable messages. It does not involve TCP handshakes or half-open connections.
3. Smurf attack

   Incorrect. A Smurf attack uses ICMP echo requests sent to a broadcast address with the victim's spoofed IP — all hosts on the network reply to the victim. It uses ICMP, not TCP SYN packets.
4. HTTP slow-read attack

   Incorrect. HTTP slow-read attacks keep connections open by reading responses very slowly, exhausting application-layer connection pools. This is an application-layer attack, not a TCP state exhaustion attack using spoofed SYNs.

A SYN flood exploits TCP's three-way handshake by sending many SYN packets with spoofed IPs, filling the server's half-open connection queue and blocking legitimate connections.

4. Session prediction attack: What is the MOST effective attack the attacker can attempt against other active ses

1. Session prediction attack — enumerate probable session IDs of other logged-in users and attempt to use them ✓

   Correct. Predictable session tokens allow attackers to enumerate valid session IDs for other users. Since sessions 100001–100049 may still be active, the attacker can iterate through these values to hijack other sessions.
2. Cross-Site Scripting (XSS) — inject script to steal session cookies from other users

   Incorrect. XSS requires the attacker to inject and have script execute in another user's browser. The described scenario is about predictable server-side session ID generation — XSS is not needed when tokens are simply guessable.
3. SQL injection — extract session tokens directly from the database

   Incorrect. SQL injection would also work if the application is vulnerable, but the question specifically highlights the predictable token weakness — the most direct and efficient attack exploits that specific weakness.
4. CSRF — craft requests that force other users to perform actions

   Incorrect. CSRF tricks users into submitting requests unintentionally. It does not give the attacker direct access to another session or their data — it is not a session hijacking technique.

Predictable session tokens can be enumerated by an authenticated user to guess valid session IDs of other users, enabling direct session hijacking without XSS or MITM.

5. Exploit IP fragment reassembly ambiguity to evade IDS: This technique is specifically designed to:

1. Exploit IP fragment reassembly ambiguity to evade IDS signature detection ✓

   Correct. Overlapping fragments create ambiguity during reassembly. If the IDS and target OS resolve overlapping offsets differently, the IDS sees benign data while the OS reconstructs the malicious payload — evading detection.
2. Crash the target system by sending malformed IP packets

   Incorrect. Malformed packet DoS attacks (like Ping of Death or Teardrop) are designed to crash targets. Overlapping fragments with different reassembly policies are designed for IDS evasion, not system crashes — though older systems could be destabilized.
3. Bypass stateful firewalls by exploiting TCP session state tracking

   Incorrect. Stateful firewall bypass uses different techniques (ACK scanning, out-of-order packets). Fragment overlap attacks target IDS reassembly logic, not firewall state tables.
4. Reduce the signature match probability by spreading attack data across many packets

   Incorrect. Simple fragmentation (splitting without overlap) reduces signature matching probability. Overlapping offsets specifically exploit *reassembly policy differences* between IDS and OS — this is a distinct and more sophisticated technique.

Overlapping IP fragments exploit differences in IDS vs. OS fragment reassembly policies, allowing attackers to hide malicious payloads that only the OS sees correctly.

6. To become a rogue DHCP server and set the attacker's: What is the MOST likely objective?

1. To become a rogue DHCP server and set the attacker's system as the default gateway, enabling traffic interception ✓

   Correct. After DHCP starvation exhausts the legitimate pool, the rogue DHCP server responds to new clients and can assign attacker-controlled values: default gateway (MITM), DNS server (DNS hijacking), and search domain.
2. To cause a Denial-of-Service by preventing new devices from obtaining IP addresses

   Partially correct but incomplete. DoS is an effect of the starvation phase, but the setup of a rogue DHCP server indicates the primary goal is traffic interception, not just denial of service.
3. To enumerate all active IP addresses on the subnet

   Incorrect. Enumerating active IPs uses ARP scanning or ICMP ping sweeps, not DHCP starvation. DHCP starvation does not reveal existing IP allocations.
4. To bypass 802.1X port authentication by impersonating a DHCP server

   Incorrect. 802.1X is a port-based network access control protocol that operates at Layer 2 before IP addressing. DHCP starvation cannot bypass 802.1X authentication.

DHCP starvation + rogue DHCP server is a two-stage attack: starve the legitimate server, then hand out attacker-controlled network settings (gateway, DNS) to new clients for MITM.

7. Application layer attack: Which DDoS category does this represent?

1. Application layer (Layer 7) attack — Slowloris ✓

   Correct. Slowloris is an application-layer attack that holds HTTP connections open by sending partial headers, exhausting the web server's connection thread pool without requiring high bandwidth. This is a Layer 7 attack.
2. Volumetric attack — UDP flood

   Incorrect. Volumetric attacks overwhelm bandwidth with massive traffic volumes. The described attack uses a small number of incomplete requests that hold connections — it is a low-bandwidth, connection-exhaustion attack.
3. Protocol attack — ICMP flood

   Incorrect. Protocol attacks (SYN flood, ICMP flood) exploit network/transport layer protocol weaknesses. Slowloris operates at the HTTP (application) layer and exploits web server connection concurrency limits.
4. Reflection attack — DNS amplification

   Incorrect. Reflection/amplification attacks use third-party servers to amplify traffic toward a victim. Slowloris is a direct attack originating from the attacker, not a reflected/amplified attack.

Slowloris is an application-layer (Layer 7) attack that exhausts web server connections by sending partial HTTP requests and holding them open indefinitely with minimal bandwidth.

8. Malicious insider: What type of insider threat does this represent?

1. Malicious insider (intentional data theft) ✓

   Correct. A malicious insider intentionally misuses authorized access for personal gain or to harm the organization. Deliberately copying and selling customer data is clear-cut malicious insider activity.
2. Negligent insider

   Incorrect. A negligent insider causes harm accidentally through carelessness (e.g., misconfiguring a server, falling for phishing, using weak passwords). The DBA's actions are deliberate and intentional — not accidental.
3. Compromised insider

   Incorrect. A compromised insider is a legitimate employee whose credentials or system have been taken over by an external attacker. The described scenario involves the DBA acting under their own volition, not under external attacker control.
4. Unintentional insider

   Incorrect. Unintentional insiders inadvertently expose data or create vulnerabilities without awareness. The deliberate copying and commercial sale of data is clearly intentional.

A malicious insider deliberately misuses authorized access to steal or harm. Intentional data theft for commercial gain by a privileged employee is the classic malicious insider scenario.

9. Honeynet: What type of deception technology is this?

1. Honeynet ✓

   Correct. A honeynet is a network of multiple honeypots designed to emulate an entire environment. Its scale and realism make it suitable for attracting and studying sophisticated attackers over extended periods.
2. Honeypot

   Incorrect. A honeypot is a single decoy system. The described technology emulates an entire network of servers — making it a honeynet, not a single honeypot.
3. Honeytoken

   Incorrect. A honeytoken is a fake data artifact (fake credit card number, fake document, decoy URL) designed to trigger alerts when accessed. It is not a network-level deception environment.
4. IDS sensor

   Incorrect. IDS sensors passively monitor network traffic for malicious patterns. They do not emulate servers or networks — they detect rather than deceive.

A honeynet is a network of honeypots that simulates an entire enterprise environment to attract, deceive, and study sophisticated attackers at scale.

10. Telnet: Which of the following protocols transmits usernames and passwords in CLEARTEXT and should be replaced

1. Telnet ✓

   Correct. Telnet transmits all data, including authentication credentials, in plain unencrypted text. Any network sniffer on the path can capture the username and password. It should be replaced with SSH.
2. SSH

   Incorrect. SSH (Secure Shell) is the encrypted replacement for Telnet. All SSH traffic, including credentials, is encrypted end-to-end. It does not transmit credentials in cleartext.
3. HTTPS

   Incorrect. HTTPS uses TLS to encrypt HTTP traffic, including any login credentials submitted through web forms. Cleartext transmission is not a concern for properly implemented HTTPS.
4. SFTP

   Incorrect. SFTP (SSH File Transfer Protocol) runs over SSH and inherits its encryption. It is the secure replacement for plain FTP, not a cleartext protocol.

Telnet transmits all data including credentials in plain unencrypted text. SSH is its encrypted replacement and should be used instead in all environments.

11. It redirects the victim's browser to the attacker's server: What does this payload accomplish?

1. It redirects the victim's browser to the attacker's server, appending the victim's session cookies as a URL parameter — allowing the attacker to steal the session ✓

   Correct. The script redirects the browser to attacker.com with the victim's document.cookie value in the URL. The attacker's server logs this request, capturing the session cookie.
2. It permanently deletes the victim's cookies to force re-authentication

   Incorrect. This script reads and transmits cookies — it does not delete them. document.location redirect does not affect cookie storage.
3. It establishes an encrypted tunnel between the victim and the attacker

   Incorrect. The script is a simple HTTP redirect — there is no tunnel or encryption involved. The cookie is transmitted in the URL via a plain HTTP GET request.
4. It scans the victim's local network for other vulnerable hosts

   Incorrect. The payload is a simple cookie theft redirect. Network scanning via XSS is possible (JavaScript XMLHttpRequest-based port scanning) but is not what this specific payload does.

This XSS payload redirects the victim to an attacker-controlled server with their session cookie in the URL — enabling session hijacking without needing the victim's password.

12. Pretexting: What social engineering technique is this?

1. Vishing

   Incorrect. Vishing (voice phishing) is a broader category of phone-based social engineering. Pretexting is a specific technique used within vishing — the scenario described uses pretexting specifically. The most precise classification is pretexting.
2. Baiting

   Incorrect. Baiting involves enticing victims with something desirable (infected USB drive, free downloads) to trigger malware execution. The described attack uses deceptive impersonation, not bait.
3. Quid pro quo

   Incorrect. Quid pro quo involves offering a service in exchange for information (e.g., offering IT support in exchange for credentials). The auditor scenario is one-directional deception, not a service exchange.
4. Pretexting ✓

   Correct. Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into providing information or access. Impersonating an IT auditor to extract passwords is a classic pretext attack.

Pretexting creates a fabricated authoritative scenario to manipulate targets into disclosing information. Impersonating an IT auditor to request passwords is the textbook pretexting attack.

Other CEH domains

• Web Application Hacking — 100 questions →
• System Hacking Phases and Attack Techniques — 96 questions →
• Reconnaissance Techniques — 84 questions →
• Mobile Platform, IoT, and OT Hacking — 38 questions →
• Cryptography — 35 questions →
• All 498 CEH questions →