CEH Introduction to Ethical Hacking Practice Test 1 — 15 Questions

Question 1

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Accepted Answer

Maintaining Access. Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.

Answer

Cracking

Question 2

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. Well-known port numbers are standardized by IANA. HTTP uses 80, HTTPS uses 443, FTP uses 21, SSH uses 22, and DNS uses 53. Common confusions include swapping FTP and SSH ports.

Answer

FTP: 22

Answer

SSH: 21

Question 3

Select all that apply: Which of the following IDS/IPS terms are correctly matched to their meanings?

Accepted Answer

Signature-based IDS: Uses predefined patterns of known attacks. Signature-based IDS identifies threats by matching traffic against known attack patterns (signatures). Anomaly-based IDS detects threats by identifying deviations from a learned baseline of normal network behavior. A false positive occurs when benign activity is incorrectly identified as malicious. A false negative occurs when an actual attack is missed by the IDS. A true positive occurs when an actual attack is correctly identified.

Answer

False positive: When the IDS fails to detect an attack

Answer

True positive: When the IDS incorrectly flags benign activity

Question 4

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Accepted Answer

SYN scan. C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.

Answer

TCP connect scan

Answer

UDP scan

Answer

FIN scan

Question 5

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Accepted Answer

Slow down the scan rate. Slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.

Answer

Use random source ports

Answer

Use a decoy scan

Answer

Use fragmented packets

Question 6

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Accepted Answer

Black-box test. A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.

Answer

White-box test

Answer

Red team engagement

Answer

Gray-box test

Question 7

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Accepted Answer

closed. A 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.

Answer

open

Answer

filtered

Answer

unfiltered

Question 8

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Accepted Answer

Restrict access to the Engineering web server to only the Engineering VLAN.. The Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.

Answer

Implement a password policy requiring complex passwords for all users.

Answer

Enable two-factor authentication on the web server.

Answer

Apply the latest security patches to the web server.

Question 9

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Accepted Answer

Maintaining Access. Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.

Answer

Enumeration

Answer

Social Engineering

Question 10

Based on the exhibit, what type of attack is being attempted?

Accepted Answer

Directory Traversal. The exhibit shows a URL parameter (e.g., `?file=../../etc/passwd`) that uses `../` sequences to traverse outside the web root directory. This is the classic signature of a directory traversal attack, which attempts to access restricted files like `/etc/passwd` by manipulating file path references. The attack exploits insufficient input validation in the application's file retrieval logic.

Answer

Command Injection

Answer

SQL Injection

Answer

Cross-Site Scripting

Question 11

You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?

Accepted Answer

Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.. The server allows file uploads with .phtml extension, which Apache processes as PHP due to its configuration. Uploading a PHP web shell with .phtml extension to the /uploads/ directory and accessing it directly allows command execution, escalating the attack. This bypasses the 403 Forbidden restriction on .php files while leveraging the existing upload functionality.

Answer

Use the PUT method to upload a malicious file directly to the web root.

Answer

Exploit the IIS WebDAV vulnerability to execute commands.

Answer

Attempt SQL injection in the login form to extract database credentials.

Question 12

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Accepted Answer

Send SYN, then receive SYN-ACK, then send ACK. The TCP three-way handshake establishes a connection: SYN, SYN-ACK, ACK, then data transfer.

Answer

Send SYN-ACK, then send SYN, then send ACK

Answer

Send SYN, then send ACK, then send SYN-ACK

Answer

Send ACK, then send SYN, then send SYN-ACK

Question 13

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Accepted Answer

Set up listener on attacker machine, then victim connects back, then attacker gains shell access, then execute commands, then cleanup. In a reverse shell using Netcat, the correct sequence is: first, the attacker sets up a listener on a chosen port; second, the victim executes a command that connects back to the attacker's listener; third, the attacker gains a shell on the victim machine; fourth, the attacker executes commands; and finally, cleanup is performed to close the connection. This order ensures the listener is ready before the victim connects, and that the shell is operational before executing any commands or terminating the session.

Answer

Victim connects back first, then set up listener, then attacker gains shell access, then execute commands, then cleanup

Answer

Set up listener, then victim connects back, then cleanup, then attacker gains shell access, then execute commands

Answer

Set up listener, then attacker gains shell access, then victim connects back, then execute commands, then cleanup

Question 14

A junior security consultant is preparing to conduct an authorized penetration test for a retail client. Before any scanning begins, the client's legal team asks the consultant to confirm which document defines the exact IP ranges, testing window, and prohibited actions such as denial-of-service attempts. Which document should the consultant reference?

Accepted Answer

Rules of Engagement (RoE). Before active testing, an ethical hacker must operate under explicit written authorization that defines scope, timing, and restrictions. The Rules of Engagement captures those operational constraints, including in-scope IP ranges and forbidden actions such as denial-of-service. Referencing it ensures the consultant stays within legal and contractual boundaries and can demonstrate authorization if questioned during the engagement.

Answer

Statement of Work (SOW)

Answer

Non-Disclosure Agreement (NDA)

Answer

Master Service Agreement (MSA)

Question 15

An ethical hacker is hired to assess a hospital's network. The contract permits vulnerability discovery but explicitly forbids exploiting a flaw to access patient records. During testing, the hacker finds a SQL injection that would expose the patient database. Which action best reflects the ethical hacking principle of maintaining integrity and minimizing harm?

Accepted Answer

Document the vulnerability with a non-destructive proof of concept, such as a boolean-based test, and report it without accessing patient data.. Ethical hacking requires proving risk without causing harm or exceeding authorization. A non-destructive proof of concept, such as a boolean-based injection test or retrieving only non-sensitive metadata, demonstrates the vulnerability exists while honoring the contract's restriction on patient data. This approach protects patients, preserves the client relationship, and still gives the hospital actionable evidence for remediation.

Answer

Stop testing entirely and immediately terminate the engagement because a serious flaw was found.

Answer

Share the injection details with a public forum to pressure the hospital into patching quickly.

Answer

Exploit the injection fully and download a sample of patient records to prove the vulnerability is real.