You must identify vulnerability indicators, dump and crack Windows credentials, escalate privileges on Linux and Windows, and write correct iptables rules. The single most important thing is knowing which tool or command targets which credential store and applying rules in the right order.
Start practicing
Vulnerability Analysis and System Hacking — choose a session length
Free · No account required
Domain overview
This domain covers finding and exploiting weaknesses in systems and applications, then escalating access on the target. CEH tests it through scenario questions on buffer overflows, Windows SAM/LSASS credential dumping with tools like Mimikatz and hashcat, Linux privilege escalation, and configuring iptables firewall rules to block or allow specific traffic.
Exam objectives
Recognizing buffer overflow indicators such as crashes, stack canaries, and unexpected input handling
Dumping and cracking Windows SAM/NTLM hashes with Mimikatz, pwdump, and hashcat
Linux privilege escalation via SUID binaries, sudo misconfiguration, and kernel exploits
Ordering iptables rules to block or permit services like SSH on specific ports
Confusing SAM and LSASS: SAM holds local account hashes at rest, while LSASS holds credentials in memory and requires different dumping techniques.
Placing iptables rules in the wrong order, since the first matching rule wins and a permissive rule above a deny rule nullifies it.
Assuming a successful exploit equals full compromise, when privilege escalation and persistence are separate required steps.
Click any question to see the full explanation and answer options, or start a focused practice session above.
A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?
2During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?
3A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?
4An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?
5Which THREE of the following are common indicators of a buffer overflow vulnerability?
6You are a penetration tester hired by a medium-sized financial company. The company has a network consisting of 50 Windows workstations (Windows 10 Pro) and 5 Windows Server 2019 servers (domain controller, file server, web server, database server, and mail server). The network is segmented into three VLANs: User VLAN (192.168.1.0/24), Server VLAN (192.168.2.0/24), and DMZ (192.168.3.0/24). The web server is in the DMZ and hosts a public-facing e-commerce application built on ASP.NET with a SQL Server backend. The database server is in the Server VLAN and is not directly accessible from the internet. You are given a standard user account on a workstation in the User VLAN. After initial reconnaissance, you discover that the web server is running an outdated version of IIS (7.5) and is vulnerable to a known privilege escalation vulnerability (CVE-2020-0613) that allows local privilege escalation if an attacker has already gained initial access. You also find that the web application has a SQL injection vulnerability in the login page. You successfully exploit the SQL injection to extract the password hash of the web application's service account, which is 'web_svc'. You crack the hash offline and obtain the plaintext password. The 'web_svc' account has local administrative privileges on the web server. Using these credentials, you authenticate to the web server via RDP. From there, you want to pivot to the database server to extract credit card information stored in the database. The database server only allows connections from the web server on port 1433 (SQL Server). Using the 'web_svc' account, you are able to connect to the database server using SQL Server Management Studio. However, you find that the 'web_svc' account has only 'public' and 'guest' database roles, which do not allow reading any sensitive tables. You need to escalate privileges on the database server. What is the most effective next step?
7A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?
8Which TWO vulnerabilities are associated with buffer overflow attacks?
9Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.
10Match each type of attack to its description.
11Refer to the exhibit. An analyst runs netstat on a Windows server and observes multiple established connections to port 3389 from internal IPs. Which attack is most likely occurring?
12Refer to the exhibit. A penetration tester runs hashcat to crack NTLM hashes. Which hash mode (-m) would be correct for NTLM?
13Refer to the exhibit. During a penetration test, the results show port 80 as 'filtered'. Which of the following is the most likely reason?
14An ethical hacker is performing a vulnerability scan against a Windows Server 2019 host using Nessus. The scan returns a finding titled 'Microsoft Windows SMB Registry Remotely Accessible' with a CVSS base score of 5.0. The report marks the vulnerability as 'Medium' severity but does not provide a specific patch. Which of the following should the tester do NEXT to determine the actual risk and remediation?
15A security analyst is reviewing a vulnerability scan report for a web server that hosts an e-commerce application. The report lists a finding: 'SSL Certificate Expired' with a severity of High. The analyst confirms the certificate expired yesterday. Which of the following is the MOST appropriate immediate action?
You must identify vulnerability indicators, dump and crack Windows credentials, escalate privileges on Linux and Windows, and write correct iptables rules. The single most important thing is knowing which tool or command targets which credential store and applying rules in the right order.
The Courseiva CEH question bank contains 15 questions in the Vulnerability Analysis and System Hacking domain, covering the 8% of the exam attributed to this domain in the official EC-Council blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Vulnerability Analysis and System Hacking domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included