Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CEH Introduction to Ethical Hacking Practice Question
Drag and drop the steps to set up a reverse shell using Netcat into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up listener on attacker machine, then victim connects back, then attacker gains shell access, then execute commands, then cleanup
In a reverse shell using Netcat, the correct sequence is: first, the attacker sets up a listener on a chosen port; second, the victim executes a command that connects back to the attacker's listener; third, the attacker gains a shell on the victim machine; fourth, the attacker executes commands; and finally, cleanup is performed to close the connection. This order ensures the listener is ready before the victim connects, and that the shell is operational before executing any commands or terminating the session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set up listener on attacker machine, then victim connects back, then attacker gains shell access, then execute commands, then cleanup
Why this is correct
This sequence correctly outlines the establishment of a reverse shell using Netcat. The attacker's machine must first set up a listener (e.g., `nc -lvnp <port>`) to await an incoming connection. Once active, the victim machine initiates an outbound connection to the attacker, piping a shell process. This establishes the communication channel, granting the attacker interactive shell access to execute commands, followed by proper session cleanup.
- ✗
Victim connects back first, then set up listener, then attacker gains shell access, then execute commands, then cleanup
Why it's wrong here
This order is fundamentally incorrect because a victim machine cannot successfully connect to a listener that has not yet been established. The TCP handshake requires an active listening socket on the specified port to complete. Any attempt by the victim to connect before the listener is running would result in a "Connection refused" error, preventing any shell from being established.
- ✗
Set up listener, then victim connects back, then cleanup, then attacker gains shell access, then execute commands
Why it's wrong here
This sequence is flawed because inserting "cleanup" immediately after the victim connects would prematurely terminate the network session. Cleanup typically involves closing the connection, which would occur before the attacker has had any opportunity to gain interactive shell access or execute a single command. The session would be closed before its intended purpose could be fulfilled.
- ✗
Set up listener, then attacker gains shell access, then victim connects back, then execute commands, then cleanup
Why it's wrong here
This order is incorrect because the attacker cannot "gain shell access" until the victim machine has successfully connected to the listener. The attacker's netcat listener simply waits passively for an incoming connection. Shell access is only granted when the victim actively connects and redirects its shell's input/output streams over the established TCP tunnel, not before.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.