Certified Ethical Hacker Certified Ethical Hacker MCQ 3 — Questions and Answers
Question 1: Which type of SQL injection relies on observing the response time of the database to infer data?
- Time-based blind SQL injection (Correct answer)
- Union-based SQL injection
- Error-based SQL injection
- In-band SQL injection
Correct answer: Time-based blind SQL injection
Time-based blind injection uses delay functions to infer true/false conditions from response times.
Question 2: What is the main goal of a session hijacking attack?
- Take over an authenticated user's session (Correct answer)
- Crack a password hash
- Flood a server with requests
- Intercept DNS queries
Correct answer: Take over an authenticated user's session
Session hijacking steals or predicts a valid session token to impersonate a legitimate user.
Question 3: Which wireless attack involves setting up a fraudulent access point that mimics a legitimate one?
- Evil twin (Correct answer)
- Deauthentication
- WPS PIN attack
- Bluejacking
Correct answer: Evil twin
An evil twin is a rogue AP impersonating a trusted network to capture user credentials.
Question 4: What does the term 'privilege escalation' refer to?
- Gaining higher access rights than originally granted (Correct answer)
- Encrypting files for ransom
- Scanning for open ports
- Spoofing a MAC address
Correct answer: Gaining higher access rights than originally granted
Privilege escalation exploits flaws to obtain elevated permissions beyond the initial access level.
Question 5: Which hashing algorithm is considered cryptographically broken and should not be used for security?
- MD5 (Correct answer)
- SHA-256
- SHA-3
- bcrypt
Correct answer: MD5
MD5 is vulnerable to collision attacks and is unsuitable for security-sensitive hashing.
Question 6: In a penetration test, what document defines the scope and legal authorization for the engagement?
- Rules of Engagement (Correct answer)
- Service Level Agreement
- Acceptable Use Policy
- Incident Response Plan
Correct answer: Rules of Engagement
The Rules of Engagement specify the scope, limitations, and authorization for testing.
Question 7: What technique encodes a malicious payload to evade signature-based intrusion detection systems?
- Obfuscation (Correct answer)
- Footprinting
- Enumeration
- Sniffing
Correct answer: Obfuscation
Obfuscation alters the payload's appearance to bypass signature detection while preserving function.
Certified Ethical Hacker Certified Ethical Hacker MCQ 3
Which type of SQL injection relies on observing the response time of the database to infer data?