20+ practice questions focused on Enumeration and System Hacking — one of the most tested topics on the Certified Ethical Hacker CEH exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Enumeration and System Hacking PracticeDuring a penetration test, you gain access to a target system as a low-privileged user. Which of the following is the BEST next step according to the CEH system hacking methodology (CHPSET)?
Explanation: The CEH methodology includes phases such as Cracking passwords, Privilege escalation, Hiding files, Executing applications, Spying, and Erasing tracks. After gaining initial access as a low-privileged user, the next logical step is to escalate privileges to gain higher access (e.g., administrator or root).
During a penetration test, you successfully execute a privilege escalation attack by abusing a service running with SYSTEM privileges on a Windows machine. Which of the following techniques is MOST likely being used?
Explanation: DLL hijacking is the most likely technique because it involves placing a malicious DLL where a service that runs with SYSTEM privileges will load it, causing the attacker's code to execute with SYSTEM privileges. Token impersonation relies on stealing or duplicating access tokens and typically requires SeImpersonate/SeAssignPrimaryToken privileges; it does not require modifying what a service loads. Pass-the-hash is primarily credential-based lateral movement, and SUID abuse is a Unix/Linux privilege escalation method.
Which TWO of the following are valid SMTP enumeration commands that can be used to discover valid email addresses? (Select 2)
Explanation: EXPN is a valid SMTP command that requests the server to expand a mailing list or alias, revealing the individual email addresses that belong to it. VRFY is another valid SMTP command that requests the server to verify if a mailbox exists for a given user. Both commands are useful for discovering valid email addresses without sending a message, as defined in RFC 821.
Which THREE of the following are password cracking techniques that can be used with Hashcat? (Select 3)
Explanation: Hashcat is a GPU-accelerated password recovery tool that supports multiple attack modes. A **Brute-force attack** (option B) systematically tries every possible combination of characters from a defined keyspace until the correct password is found. Hashcat implements this via its '?a' mask or direct brute-force mode, making it a core technique for cracking hashes when no prior knowledge of the password exists. A **Dictionary attack** (option D) attempts to crack passwords by trying words from a predefined list (dictionary). Hashcat supports this mode, allowing users to specify wordlists for efficient cracking of common or weak passwords. A **Hybrid attack** (option E) combines elements of dictionary and brute-force attacks. For example, it might append or prepend numbers/symbols to dictionary words, or use a mask with a dictionary word, significantly increasing the chances of cracking passwords that are variations of common words.
A system administrator wants to enumerate all users in an Active Directory domain. Which protocol and query technique should they use?
Explanation: LDAP anonymous queries allow unauthenticated users to query an Active Directory domain for directory information, including user enumeration. While modern Active Directory configurations often restrict anonymous LDAP binds by default for security reasons, if enabled or misconfigured, it becomes a highly effective technique for enumerating users without credentials.
+15 more Enumeration and System Hacking questions available
Practice all Enumeration and System Hacking questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Enumeration and System Hacking. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Enumeration and System Hacking questions on the CEH frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Enumeration and System Hacking is tested as part of the Certified Ethical Hacker CEH blueprint. Practicing with targeted Enumeration and System Hacking questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CEH practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Enumeration and System Hacking is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Enumeration and System Hacking practice session with instant scoring and detailed explanations.
Start Enumeration and System Hacking Practice →