Classification and Types of Attacks CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   A penetration tester submits a crafted input into a search field on a web application. The application returns an error message that includes the original SQL query. Which type of web application attack is this?

   • ACross-site request forgery (CSRF), which is an active attack that forces a user to perform actions.
   • BSession fixation, which is a passive attack that sets a known session ID.
   • CSQL injection, which is an active attack that targets the application's database layer.
   • DCross-site scripting (XSS), which is an active attack that executes scripts in the user's browser.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An attacker sets up a rogue access point with the same SSID as the corporate network. When users connect, the attacker captures their credentials. Which type of wireless attack is this?

   • ADeauthentication attack, which is an active attack that disconnects users from the legitimate AP.
   • BEvil twin attack, which is an active attack that tricks users into connecting to a malicious AP.
   • CRogue access point attack, which is a passive attack that simply provides unauthorized access.
   • DSniffing attack, which is a passive attack that monitors wireless traffic.
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   A web application allows users to upload profile pictures. An attacker uploads a file containing JavaScript that executes when another user views the profile. The script steals the viewer's session cookie. Which type of web application attack is this?

   • ACross-site request forgery (CSRF), because the attacker steals the session cookie.
   • BSQL injection, because the attacker uploads a file to the database.
   • CCross-site scripting (XSS), because the attacker injects malicious script that executes in another user's browser.
   • DSession fixation, because the attacker sets a known session ID.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which type of malware is designed to spread from one system to another without requiring user interaction?

   • ATrojan
   • BVirus
   • CWorm
   • DRansomware
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of an active attack?

   • APassively scanning for open ports
   • BMonitoring network traffic with a packet sniffer
   • CEavesdropping on unencrypted communications
   • DReplaying a captured authentication message
   Reveal Solution Discussion Select an answer first