CEH Vulnerability Analysis and System Hacking Practice Question
Exhibit
C:\Users\Admin> wmic qfe get HotFixID,InstalledOn
HotFixID InstalledOn
KB4569558 9/17/2020
KB4570333 9/17/2020
KB4574727 9/8/2020
KB4577586 9/8/2020
C:\Users\Admin> ver
Microsoft Windows [Version 10.0.19041.508]
C:\Users\Admin> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
CurrentBuild REG_SZ 19041Refer to the exhibit. A security analyst checks for missing patches. Which vulnerability is this system likely exposed to?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PrintNightmare (CVE-2021-34527)
The system is Windows 10 build 19041 (2004) with patches up to 9/17/2020. EternalBlue (MS17-010) was patched in 2017, so it is likely patched. However, BlueKeep (CVE-2019-0708) affects older systems (Windows 7/2008 R2), not Windows 10. ZeroLogon (CVE-2020-1472) was patched in August 2020; the system has KB4577586 from 9/8/2020 which includes the fix. PrintNightmare (CVE-2021-34527) was disclosed in 2021, after the patch dates shown, so the system is likely vulnerable to PrintNightmare.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EternalBlue (MS17-010)
Why it's wrong here
EternalBlue (MS17-010) exploits a critical vulnerability in Microsoft's Server Message Block (SMBv1) protocol. The security update addressing this flaw was released in March 2017. Given that the exhibit's patch dates extend into 2020, it is highly improbable that a system regularly updated would still be vulnerable to EternalBlue, as its patch would have been applied years prior, making it not a 'missing' patch in this context.
- ✗
BlueKeep (CVE-2019-0708)
Why it's wrong here
BlueKeep (CVE-2019-0708) is a severe remote code execution vulnerability affecting the Remote Desktop Services (RDS) in older Windows operating systems, specifically Windows 7, Windows Server 2008 R2, and earlier versions. This critical vulnerability does not impact Windows 8 or Windows 10 systems. Therefore, if the system in question is running Windows 10, BlueKeep would not be a relevant missing patch to check for.
- ✗
ZeroLogon (CVE-2020-1472)
Why it's wrong here
ZeroLogon (CVE-2020-1472) is a critical privilege escalation vulnerability in the Netlogon Remote Protocol (MS-NRPC) that could allow an unauthenticated attacker to gain domain administrator privileges. The necessary security update for this vulnerability, identified as KB4577586, was released in August 2020. As indicated by the exhibit, this specific patch was installed on the system on September 8, 2020, meaning the vulnerability is already addressed and not a missing patch.
- ✓
PrintNightmare (CVE-2021-34527)
Why this is correct
PrintNightmare (CVE-2021-34527) is a critical remote code execution vulnerability affecting the Windows Print Spooler service, enabling attackers to execute arbitrary code with SYSTEM privileges. This vulnerability was publicly disclosed and subsequently patched in July 2021. Since the exhibited patch dates for the system only extend through 2020, the required security update for PrintNightmare would not have been applied, making it a relevant and unpatched vulnerability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.