CEH Practice Questions

Question 1

A security analyst runs `nmap -sS -sV -A 192.168.1.100` and obtains open ports and service versions. However, the analyst suspects the target is behind an IDS/IPS. Which Nmap technique would BEST evade detection while still performing a similar scan?

Accepted Answer

Add -f to fragment IP packets. Using the `-f` flag fragments the IP packets, splitting the TCP header across multiple packets. This helps evade simple IDS/IPS signatures that rely on detecting a complete SYN scan in a single packet, as the fragmented packets may bypass pattern-matching rules or reassembly buffers.

Answer

Use -sT instead of -sS to perform a full TCP connect scan

Answer

Increase timing to -T5 for a faster scan

Answer

Replace -sV with -sU to scan UDP services

Question 2

A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?

Accepted Answer

The zombie host is not truly idle, causing false results. The -sI flag in Nmap performs an idle scan, which relies on a zombie host (192.168.1.50) with a globally predictable IP ID sequence to probe the target. If the zombie host is not truly idle—meaning it is sending or receiving other traffic during the scan—its IP ID values will increment unpredictably, corrupting the side-channel analysis and causing Nmap to report all ports as filtered or closed. This is the most likely reason for the false 'no open ports' result.

Answer

The analyst used the wrong port number

Answer

The target has a firewall blocking the decoy packets

Answer

The target host is offline

Question 3

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

Accepted Answer

Hashcat. Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 4

An organization's security team observes a surge in outgoing DNS queries to external servers from a single internal host, with each query returning unusually large responses (e.g., 4000 bytes). The host is not configured as a DNS resolver. Which attack is MOST likely occurring?

Accepted Answer

DNS tunneling. The scenario describes a single internal host initiating a surge of outgoing DNS queries to external servers and receiving unusually large responses (e.g., 4000 bytes). This behavior, particularly from a host not configured as a DNS resolver, is a strong indicator of DNS tunneling. In DNS tunneling, a compromised host establishes a covert communication channel by encapsulating data within DNS queries and responses, often for data exfiltration or command and control. Large DNS responses, frequently utilizing record types like TXT, are commonly employed to transfer significant amounts of data back to the compromised host. DNS amplification DDoS attacks, in contrast, involve an attacker spoofing a victim's IP address to send small queries to open resolvers, causing the victim to be overwhelmed by large, unsolicited responses; the victim does not actively send the initial queries in this scenario.

Answer

DNS cache poisoning

Answer

DNS zone transfer

Answer

DNS amplification DDoS attack

Question 5

A security team suspects a session hijacking attack. The analyst examines network traffic and sees packets with sequence numbers that increment by predictable values. Which attack is MOST likely occurring?

Accepted Answer

TCP sequence prediction. TCP sequence prediction attacks exploit the ability to guess the next sequence number in a TCP connection, allowing an attacker to inject forged packets and hijack the session. The analyst observed packets with sequence numbers incrementing by predictable values, which is the hallmark of weak or static sequence number generation in older TCP implementations.

Answer

ARP poisoning

Answer

DNS spoofing

Answer

MAC flooding

Question 6

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it specifically encrypts files on the victim's system using a symmetric encryption algorithm (e.g., AES) and then demands a ransom payment, typically in cryptocurrency, to provide the decryption key. This distinguishes it from other malware types that do not perform file encryption for extortion.

Answer

Spyware

Answer

Adware

Answer

Keylogger

Question 7

Which THREE of the following are valid techniques for covering tracks after compromising a system? (Select 3 correct answers)

Accepted Answer

Clearing event logs using wevtutil. A is correct because wevtutil is a Windows command-line utility used to manage event logs. After compromising a system, an attacker can use 'wevtutil cl' followed by a log name (e.g., 'wevtutil cl System') to clear specific event logs, thereby erasing evidence of their activities. This is a direct and common technique for covering tracks by removing forensic artifacts.

Answer

Exploiting SUID binaries to gain root

Answer

Disabling Windows Defender via Group Policy

Question 8

Which command-line tool is specifically designed to extract email addresses, subdomains, and other information from public sources (e.g., search engines, social media) for a given domain?

Accepted Answer

theHarvester. theHarvester is a dedicated open-source intelligence (OSINT) tool designed to gather emails, subdomains, IPs, and employee names from public sources such as Google, Bing, LinkedIn, and PGP key servers. It specifically targets a given domain and queries search engines and social media APIs to extract this reconnaissance data, making it the correct choice for this task.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 9

Which wireless security standard introduced in 2018 uses Simultaneous Authentication of Equals (SAE) to replace the pre-shared key exchange in WPA2, providing forward secrecy and resistance to offline dictionary attacks?

Accepted Answer

WPA3. WPA3 uses SAE (Dragonfly handshake) to provide forward secrecy and protect against offline dictionary attacks. WPA2 used PSK which is vulnerable to dictionary attacks. WEP and 802.1X are older or different.

Answer

802.1X/EAP

Answer

WEP

Answer

WPA2

Question 10

A network administrator receives an alert that the switch's CAM table is full, causing the switch to flood frames out all ports. Which attack has likely occurred?

Accepted Answer

MAC flooding. MAC flooding (Option C) is the correct answer because it directly exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending a high volume of frames with unique, spoofed source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and flood all incoming frames out every port, effectively turning it into a hub. This allows the attacker to capture traffic that was not originally destined for their port.

Answer

DNS spoofing

Answer

ARP poisoning

Answer

SYN flood

Question 11

Which THREE of the following are common indicators of a buffer overflow vulnerability?

Accepted Answer

Unexpected program crashes or segmentation faults. A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.

Answer

Use of return-oriented programming (ROP)

Answer

High CPU usage

Question 12

A forensic analyst finds a system where the user's password hash was obtained and cracked offline. The attacker then used stolen credentials to log in and run `wevtutil cl system`. What is the purpose of this command?

Accepted Answer

Clear the System event log. The `wevtutil cl system` command clears the System event log on Windows. After cracking the user's password hash offline, the attacker logs in with stolen credentials and runs this command to erase forensic evidence of their activities, such as logon events or service failures, from the System log. This is a common post-exploitation step to hinder incident response.

Answer

Remove scheduled tasks

Answer

Delete the SAM database

Answer

Disable Windows Defender

Question 13

Which TWO of the following are considered passive reconnaissance techniques? (Choose TWO.)

Accepted Answer

WHOIS lookup. WHOIS lookup is a passive reconnaissance technique because it queries public domain registration databases (via WHOIS protocol, RFC 3912) to obtain information such as registrar, registrant contact details, name servers, and expiration dates. This process does not send any packets directly to the target's infrastructure; instead, it relies on third-party data sources, making it undetectable by the target.

Answer

Ping sweep

Answer

Banner grabbing with Telnet

Answer

Port scanning

Question 14

Which of the following is a form of social engineering where an attacker physically follows an authorized person into a restricted area without proper authentication?

Accepted Answer

Tailgating. Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area, bypassing authentication mechanisms such as badge readers, PIN pads, or biometric scanners. The attacker exploits the natural courtesy of the authorized person holding the door open, thereby gaining physical access without any credential validation.

Answer

Pretexting

Answer

Baiting

Answer

Quid pro quo

Question 15

An attacker discovers that a web application's login form allows unlimited login attempts. The attacker uses a list of usernames and passwords obtained from a previous breach to gain access. This attack is known as:

Accepted Answer

Credential stuffing. Credential stuffing (option D) is correct because the attacker uses a list of known username/password pairs from a previous breach to automate login attempts against the web application. This attack exploits password reuse across services, not the weakness of the passwords themselves, and relies on the application's lack of rate limiting or account lockout mechanisms.

Answer

Password spraying

Answer

Brute force attack

Answer

Dictionary attack

Certified Ethical Hacker CEH practice test

Three ways to study

Study CEH by domain

Study CEH by topic

Scanning Networks and Enumeration practice questions

Wireless, IoT and Cloud Security practice questions

Vulnerability Analysis and System Hacking practice questions

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Cryptography and Malware Analysis practice questions

Footprinting and Reconnaissance practice questions

Network and Web Application Attacks practice questions

Enumeration and System Hacking practice questions

Footprinting, Reconnaissance and Scanning practice questions

Social Engineering and Physical Security practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions

Top CEH questions

Certified Ethical Hacker CEH practice questions