ceh-v13 prep questions. Jorge - www.youtube.
com/@itbestpractice2741
CEH v13 Practice Questions – Module 8:
Sniffing
1. What is the primary goal of sniffing in cybersecurity?
• A. To scan for open ports
• B. To capture and analyze network traffic
• C. To brute-force passwords
• D. To disable firewalls
Answer: B
2. Which tool is commonly used for packet sniffing?
• A. Nessus
• B. Nmap
• C. Wireshark
• D. Nikto
Answer: C
3. Which network mode must a network interface be in to perform sniffing?
• A. Managed mode
• B. Broadcast mode
• C. Promiscuous mode
• D. Passive mode
Answer: C
4. Which of the following is a method used to sniff traffic on a switched network?
• A. SYN flood
• B. MAC flooding
• C. Port scanning
• D. DNS spoofing
Answer: B
5. Which protocol is most vulnerable to sniffing attacks if not encrypted?
ceh-v13 prep questions. Jorge - www.youtube.com/@itbestpractice2741
• A. HTTPS
• B. SSH
• C. Telnet
• D. FTPS
Answer: C
6. Which of the following attacks involves spoofing ARP messages to redirect traffic?
• A. DNS poisoning
• B. ARP spoofing
• C. TCP hijacking
• D. DHCP starvation
Answer: B
7. What type of attack does a switch CAM table overflow help enable?
• A. Man-in-the-middle attack
• B. DDoS attack
• C. Email spoofing attack
• D. SQL injection
Answer: A
8. What does the term 'MITM' stand for in the context of sniffing?
• A. Middle Intrusion Tactic Method
• B. Message Interference Technical Malware
• C. Man-in-the-Middle
• D. Monitoring Internal Transmission Model
Answer: C
9. Which tool is used for ARP poisoning on local networks?
• A. sqlmap
• B. ettercap
• C. netcat
• D. dig
Answer: B
ceh-v13 prep questions. Jorge - www.youtube.com/@itbestpractice2741
10. What is the function of a packet sniffer?
• A. Encrypt data in transit
• B. Detect SQL injection
• C. Capture and analyze network traffic
• D. Filter out malicious emails
Answer: C
11. Which protocol does not use encryption and is commonly captured during sniffing
attacks?
• A. FTP
• B. SFTP
• C. HTTPS
• D. SCP
Answer: A
12. What is the primary weakness of Telnet in terms of sniffing?
• A. Port 80 is used for Telnet
• B. It tunnels data over SSL
• C. Data is transmitted in plaintext
• D. It only allows administrator access
Answer: C
13. Which of the following tools supports DNS spoofing and sniffing?
• A. Nmap
• B. Hydra
• C. Cain & Abel
• D. Sqlmap
Answer: C
14. Which command can be used in Linux to capture network packets?
• A. netstat
• B. tcpdump
• C. ifconfig
• D. ping
ceh-v13 prep questions. Jorge - www.youtube.com/@itbestpractice2741
Answer: B
15. What is the default port for unencrypted HTTP traffic, which may be captured by
sniffers?
• A. 443
• B. 20
• C. 22
• D. 80
Answer: D
16. Which protocol is most commonly used in sniffing for session hijacking?
• A. ICMP
• B. TCP
• C. UDP
• D. ARP
Answer: B
17. Which countermeasure helps prevent packet sniffing on a network?
• A. Enable port forwarding
• B. Use HTTPS and SSH protocols
• C. Use plain-text authentication
• D. Implement hub-based networking
Answer: B
18. Which attack sends a continuous flood of ARP requests to a switch?
• A. MAC flooding
• B. DNS poisoning
• C. SYN flood
• D. Smurf attack
Answer: A
19. Which method is effective in detecting sniffers on the same network segment?
• A. Send a malformed DNS request
ceh-v13 prep questions. Jorge - www.youtube.com/@itbestpractice2741
• B. Use anti-virus software
• C. Broadcast a fake ARP request and analyze responses
• D. Perform OSINT on public records
Answer: C
20. What type of attack occurs when a sniffer modifies the traffic in real time?
• A. Passive sniffing
• B. Active sniffing
• C. Port mirroring
• D. Traffic shaping
Answer: B
21. Which sniffing tool is primarily used in GUI-based packet inspection?
• A. Netcat
• B. Wireshark
• C. hping3
• D. curl
Answer: B
22. Which of the following describes sniffing encrypted traffic over HTTPS?
• A. It reveals usernames and passwords in plaintext
• B. Only IP headers can be viewed, not payloads
• C. It reveals session cookies easily
• D. Full decryption is automatic
Answer: B
23. Which attack involves intercepting a communication between two systems and injecting
data?
• A. Passive sniffing
• B. Packet fragmentation
• C. Man-in-the-middle attack
• D. Spoofed DNS request
Answer: C
ceh-v13 prep questions. Jorge - www.youtube.com/@itbestpractice2741
24. Which of the following makes sniffing on wireless networks easier for attackers?
• A. Use of WPA2 encryption
• B. Broadcasting SSIDs
• C. Disabling DHCP
• D. Segmenting traffic with VLANs
Answer: B
