CEH Introduction to Ethical Hacking — 10 Questions

Question 1

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Accepted Answer

Maintaining Access. Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.

Answer

Cracking

Question 2

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. Well-known port numbers are standardized by IANA. HTTP uses 80, HTTPS uses 443, FTP uses 21, SSH uses 22, and DNS uses 53. Common confusions include swapping FTP and SSH ports.

Answer

FTP: 22

Answer

SSH: 21

Question 3

Select all that apply: Which of the following IDS/IPS terms are correctly matched to their meanings?

Accepted Answer

Signature-based IDS: Uses predefined patterns of known attacks. Signature-based IDS identifies threats by matching traffic against known attack patterns (signatures). Anomaly-based IDS detects threats by identifying deviations from a learned baseline of normal network behavior. A false positive occurs when benign activity is incorrectly identified as malicious. A false negative occurs when an actual attack is missed by the IDS. A true positive occurs when an actual attack is correctly identified.

Answer

False positive: When the IDS fails to detect an attack

Answer

True positive: When the IDS incorrectly flags benign activity

Question 4

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Accepted Answer

SYN scan. C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

Answer

TCP connect scan

Answer

UDP scan

Answer

FIN scan

Question 5

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Accepted Answer

Slow down the scan rate. Slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

Answer

Use random source ports

Answer

Use a decoy scan

Answer

Use fragmented packets

Question 6

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Accepted Answer

Black-box test. A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Answer

White-box test

Answer

Red team engagement

Answer

Gray-box test

Question 7

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. A 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 8

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Accepted Answer

Restrict access to the Engineering web server to only the Engineering VLAN.. The Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

Answer

Implement a password policy requiring complex passwords for all users.

Answer

Enable two-factor authentication on the web server.

Answer

Apply the latest security patches to the web server.

Question 9

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 10

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting