CEH v13 Domain 5.1 Practice Test 002

Question 1

Kevin is conducting a black-box penetration test against a target web server and submits a crafted HTTP GET request to the server's default port to retrieve response headers including software type, version number, and installed modules. The server responds with headers revealing it runs Apache 2.4.49 on Ubuntu Linux, which Kevin cross-references against known CVE databases to identify unpatched vulnerabilities. Which web server reconnaissance technique did Kevin perform?

A. Banner Grabbing B. Directory Traversal C. Website Mirroring D. Session Hijacking

Question 2

Jane is assessing a web application hosted on a Windows IIS server and discovers that by appending path sequences such as '../../../../windows/system32/drivers/etc/hosts' to a URL parameter, she can read files located outside the web root directory. The web server fails to normalize and sanitize the path before resolving it to the filesystem, allowing Jane to retrieve sensitive configuration files. Which web server attack technique did Jane exploit?

A. HTTP Response Splitting B. Web Cache Poisoning C. Directory Traversal D. WebDAV Exploitation

Question 3

A penetration tester is fingerprinting a target web server whose administrator has suppressed all standard server banners and replaced default error pages to prevent easy version identification. The tester uses a tool that sends a series of malformed HTTP requests and statistically analyzes the response codes, header ordering, and behavioral deviations to match the server against a signature database without relying on banner content. Which tool is specifically designed for this behavioral web server fingerprinting technique?

A. Nikto B. Httprint C. Wireshark D. Nessus

Question 4

Elijah is testing an enterprise web application and discovers that a URL parameter value is directly reflected inside an HTTP response header without sanitization, allowing him to inject CRLF sequences that split the server's single response into two separate HTTP responses. The second injected response contains a malicious script payload that poisons the proxy cache and executes in victims' browsers when the cached response is served. Which web server attack technique is Elijah exploiting?

A. HTTP Request Smuggling B. HTTP Response Splitting C. DNS Cache Poisoning D. Cross-Site Request Forgery

Question 5

Select all that apply

A security analyst is reconstructing the methodology used by a threat actor who successfully compromised an enterprise web server and must identify which techniques were used during the initial information-gathering and footprinting phases before any exploitation occurred. The analyst reviews HTTP access logs, Shodan historical records, archived DNS data, and WHOIS history to map the attacker's pre-exploitation activity. Which two techniques are commonly used during the web server attack methodology's footprinting phase? (Choose two)

A. Google Dorking B. Banner Grabbing C. SQL Injection D. Buffer Overflow E. ARP Poisoning

Question 6

A penetration tester runs Nikto against an externally facing web server and receives a detailed report listing outdated Apache software, the presence of default test files, the TRACE HTTP method enabled, and PHP version 5.6 with multiple publicly known critical vulnerabilities. The tester also notes verbose error messages that disclose the server's full internal directory path when an invalid request is submitted. Which category of tool does Nikto represent within the CEH web server attack methodology?

A. Packet Sniffer B. Password Cracker C. Web Vulnerability Scanner D. Exploit Framework

Question 7

During a red team engagement against an enterprise intranet, the team discovers that WebDAV is enabled on the target IIS 10 server and the HTTP PUT method is unrestricted, allowing file uploads to the web root without authentication. Using the Cadaver WebDAV client, the team uploads a malicious ASPX web shell to the server's document root directory and gains persistent remote code execution access while completely bypassing the organization's file upload restriction policy. Which web server attack technique does this scenario illustrate?

A. Session Splicing B. WebDAV Exploitation C. Source Code Disclosure D. HTTP Request Smuggling

Question 8

Select all that apply

A CISO reviewing the results of an external web server penetration assessment identifies critical findings related to information disclosure: the web server's response headers reveal its exact software version and operating system, and detailed stack-trace error pages expose internal file paths and database connection strings to unauthenticated users. The security team has been tasked with immediately implementing countermeasures to eliminate these information disclosure risks before the next compliance audit. Which two countermeasures directly address web server information disclosure? (Choose two)

A. Suppress Server Response Banners B. Deploy Custom Error Pages C. Enable Directory Listing D. Increase Session Timeout E. Allow HTTP TRACE Method

Question 9

A threat actor targeting a financial institution's cloud-hosted application sends crafted HTTP requests to the organization's reverse proxy, manipulating cache key parameters so that the proxy stores a malicious response containing a redirect to a credential-harvesting page. All subsequent legitimate users requesting the same URL receive the poisoned cached response and are redirected to the phishing site before the security team detects the anomaly and purges the cache. Which web server attack technique does this scenario describe?

A. DNS Cache Poisoning B. Session Fixation C. Web Cache Poisoning D. ARP Spoofing

Question 10

A red team using Metasploit identifies an unpatched remote code execution vulnerability in an Apache module on a production web server and successfully delivers a payload that establishes a reverse shell session without requiring valid credentials. Following initial access, the team uploads a PHP web shell to the document root and uses it to pivot laterally to connected database servers and internal management systems. Which phase of the CEH web server attack methodology does the initial exploitation of the Apache module vulnerability represent?

A. Footprinting B. Vulnerability Scanning C. Launching Attacks D. Patch Management Review

ByThe Test Master

Related Post

CEH v13 Domain 7.1 Practice Test 002

CEH v13 Domain 6.1 Practice Test 002

CEH v13 Domain 5.3 Practice Test 002

Leave a Reply Cancel reply

You missed

CEH v13 Domain 7.1 Practice Test 002

CEH v13 Domain 6.1 Practice Test 002

CEH v13 Domain 5.3 Practice Test 002

CEH v13 Domain 5.2 Practice Test 002