Courseiva
← Back to Certified Ethical Hacker CEH questions

Scenario-based practice

Hard Difficulty Questions

Practise Certified Ethical Hacker CEH practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
CEH
exam code
EC-Council
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related CEH topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Footprinting, Reconnaissance and Scanning practice questions

Practise CEH questions linked to Footprinting, Reconnaissance and Scanning.

Enumeration and System Hacking practice questions

Practise CEH questions linked to Enumeration and System Hacking.

Malware, Social Engineering and Network Attacks practice questions

Practise CEH questions linked to Malware, Social Engineering and Network Attacks.

Web Application and Injection Attacks practice questions

Practise CEH questions linked to Web Application and Injection Attacks.

Introduction to Ethical Hacking practice questions

Practise CEH questions linked to Introduction to Ethical Hacking.

Scanning Networks and Enumeration practice questions

Practise CEH questions linked to Scanning Networks and Enumeration.

Vulnerability Analysis and System Hacking practice questions

Practise CEH questions linked to Vulnerability Analysis and System Hacking.

Advanced Topics: Wireless, Cloud, IoT, Cryptography practice questions

Practise CEH questions linked to Advanced Topics: Wireless, Cloud, IoT, Cryptography.

Footprinting and Reconnaissance practice questions

Practise CEH questions linked to Footprinting and Reconnaissance.

Network and Web Application Attacks practice questions

Practise CEH questions linked to Network and Web Application Attacks.

Wireless, IoT and Cloud Security practice questions

Practise CEH questions linked to Wireless, IoT and Cloud Security.

Cryptography and Malware Analysis practice questions

Practise CEH questions linked to Cryptography and Malware Analysis.

Practice set

Practice scenarios

Question 1hardmulti select
Full question →

Which TWO of the following are effective physical security controls to prevent tailgating?

Question 2hardmulti select
Read the full network assurance explanation →

Which TWO types of information can be obtained through SNMP enumeration on a target device if the community string is 'public'? (Choose two.)

Question 3hardmultiple choice
Read the full wireless explanation →

Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?

Exhibit

Refer to the exhibit.

```
Wireless Capture: Beacon Frame
SSID: CorpNet
Security: WPA2-PSK
BSSID: 00:11:22:33:44:55
Channel: 6
RSN Information:
  Pairwise Ciphers: CCMP
  Group Cipher: TKIP
```
Question 4hardmultiple choice
Full question →

During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?

Question 5hardmultiple choice
Full question →

A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?

Question 6hardmulti select
Read the full wireless explanation →

A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)

Question 7hardmulti select
Full question →

An organization is investigating a potential malware infection. The security analyst observes unusual outbound connections to a known malicious IP address and finds a suspicious process running under a user's session. The analyst decides to perform memory analysis using Volatility. Which TWO commands would be most useful to identify the malicious process and its network connections?

Question 8hardmultiple choice
Review the full subnetting walkthrough →

Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?

Exhibit

Refer to the exhibit.

```
Firewall Log:
Date: 2023-10-12
Time: 14:23:45
Source IP: 10.0.0.45
Destination IP: 192.168.1.100
Protocol: TCP
Port: 445
Action: ALLOW
User: jdoe
Reason: Rule ID 3 (SMB access to file server)
```

Exhibit:
Question 9hardmultiple choice
Full question →

Based on the exhibit, what type of attack is being attempted?

Exhibit

Refer to the exhibit.

192.168.1.10   - - [01/Oct/2023:13:55:36 -0400] "GET /index.html HTTP/1.1" 200 2326
192.168.1.10   - - [01/Oct/2023:13:55:37 -0400] "GET /admin/login.php HTTP/1.1" 404 169
192.168.1.10   - - [01/Oct/2023:13:55:38 -0400] "GET /admin/ HTTP/1.1" 403 195
192.168.1.10   - - [01/Oct/2023:13:55:39 -0400] "GET /images/..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1" 200 523
192.168.1.10   - - [01/Oct/2023:13:55:40 -0400] "GET /cgi-bin/test.cgi HTTP/1.1" 200 89
Question 10hardmultiple choice
Full question →

During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?

Question 11hardmulti select
Full question →

Which TWO of the following are valid techniques for password cracking?

Question 12hardmultiple choice
Full question →

You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?

Question 13hardmultiple choice
Read the full wireless explanation →

During a penetration test, an ethical hacker captures a WPA2 handshake and successfully cracks the PSK. Which additional action must be taken to decrypt previously captured traffic?

Question 14hardmultiple choice
Full question →

You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?

Question 15hardmulti select
Read the full DNS explanation →

Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)

Question 16hardmultiple choice
Full question →

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Refer to the exhibit.
```
$ nmap -sS -T4 -p 22,80,443 192.168.1.10
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for 192.168.1.10
Host is up (0.0012s latency).

PORT    STATE    SERVICE
22/tcp  open     ssh
80/tcp  open     http
443/tcp closed   https

Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds
```
Question 17hardmultiple choice
Full question →

As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?

Question 18hardmultiple choice
Read the full wireless explanation →

During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?

Question 19hardmulti select
Full question →

Which THREE of the following are common security risks associated with cloud computing?

Question 20hardmulti select
Full question →

Which THREE of the following are common indicators of a social engineering attack? (Choose three.)

These CEH practice questions are part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style CEH questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.