tag from the HTTP response body. In a real-world scenario, discovering 'Login Portal' as the title could indicate a web application login page, which an attacker would then target with credential brute-forcing or vulnerability scanning during the exploitation phase. The distinction between footprinting and scanning is critical: footprinting uses public data (e.g., DNS records), whereas scanning involves direct interaction with the target system.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.881+00:00","questionType":"multiple_choice"},{"id":"71e230ab-014f-4c2b-99e3-266944b9adbf","slug":"which-three-of-the-following-are-valid-pieces-of-information-10fpy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Internal IP addresses of the servers","explanation":"Netcraft shows public IP.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Hosting provider and country","explanation":"Netcraft shows hosting location.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Site's first seen date and uptime history","explanation":"Netcraft tracks history.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Web server software and version","explanation":"Netcraft identifies server info.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Employee email addresses","explanation":"Netcraft does not provide emails.","masteryContext":""}],"correctOptionKey":"B,C,D","correctOptions":["B","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.","examTrap":"EC-Council often tests the distinction between passive reconnaissance (which yields only public information) and active reconnaissance (which might reveal internal details), leading candidates to mistakenly assume that internal IPs or employee emails are obtainable from a public site report.","examTip":null,"technicalDeepDive":"Netcraft's 'Site Report' tool performs a series of passive probes, including an HTTP GET request to capture the Server header (e.g., 'Apache/2.4.41') and a DNS lookup to resolve the domain to its public IP. The 'first seen' date is derived from Netcraft's historical crawl database, which tracks when the site was first observed, while uptime history is calculated from periodic availability checks. This data is invaluable for identifying technology stacks and infrastructure changes over time.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.84+00:00","questionType":"multi_select"},{"id":"a2a7fcba-8605-4f73-a6e1-10e4763759ef","slug":"a-penetration-tester-is-analyzing-a-windows-10-system-and-ru-9xkyr","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?","difficulty":"hard","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Run the tool as Administrator","explanation":"Administrator privileges are required but not sufficient to read the locked SAM file directly.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use reg.exe save to export SAM hive","explanation":"The SAM hive is locked when the OS is running; reg save may fail without admin privileges or VSS.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Create a Volume Shadow Copy to access SAM file","explanation":"VSS provides a read-only snapshot of the SAM file, bypassing the OS lock.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enable SeDebugPrivilege for the current process","explanation":"SeDebugPrivilege is needed for process injection but does not unlock the SAM file.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.","examTrap":"The trap here is that candidates assume Administrator privileges alone are sufficient to read the SAM file, overlooking the fact that Windows locks the file even for administrators, and that VSS is the required bypass.","examTip":null,"technicalDeepDive":"The Volume Shadow Copy Service (VSS) creates a read-only snapshot of the volume at a specific point in time, allowing access to files that are otherwise locked. Tools like vssadmin or wmic can create the shadow copy, and then the SAM, SYSTEM, and SECURITY hives can be copied from the shadow copy path (e.g., \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM). This technique is commonly used in penetration testing and forensic acquisitions to extract password hashes without altering the live system.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:06:20.004+00:00","questionType":"multiple_choice"},{"id":"e3c984e3-af96-467d-bb11-1afad26987f8","slug":"which-of-the-following-is-the-best-defense-against-brute-for-5vyyb","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following is the BEST defense against brute-force attacks on a login form?","difficulty":"easy","domain":"Web Application and Injection Attacks","domainSlug":"ceh-web-injection","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Rate limiting on the login endpoint","explanation":"Rate limiting reduces the speed of brute-force attempts, but account lockout is a more specific defense.","masteryContext":""},{"key":"B","isCorrect":true,"text":"CAPTCHA","explanation":"CAPTCHA can deter automated attacks but can be bypassed; lockout is more reliable.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Complex password policy","explanation":"Complex passwords make brute-force harder but do not prevent automated attempts; lockout is more effective.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Account lockout after 5 failed attempts","explanation":"Account lockout directly prevents further attempts after a threshold, effectively stopping brute-force.","masteryContext":""}],"correctOptionKey":"A,B,D","correctOptions":["A","B","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Rate limiting on the login endpoint is the best defense because it directly restricts the number of requests an attacker can send over a given time window, making brute-force attacks impractical. Unlike reactive measures like account lockout, rate limiting proactively throttles traffic at the network or application layer, preventing the attacker from even attempting many guesses. This approach is effective against distributed brute-force attacks where lockout policies can be bypassed by rotating IP addresses.","examTrap":"EC-Council often tests the misconception that account lockout is the strongest defense, but the trap here is that lockout can be circumvented by distributed attacks or cause denial of service, whereas rate limiting is a proactive, scalable control that works at the protocol level.","examTip":null,"technicalDeepDive":"Rate limiting is typically implemented using token bucket or leaky bucket algorithms at the web server or reverse proxy (e.g., Nginx's `limit_req_zone` or Apache's `mod_evasive`). In a real-world scenario, an attacker using a botnet with thousands of IPs can bypass account lockout, but rate limiting per IP or per session still caps the overall attempt rate, making the attack take years to complete. The OWASP recommendation for brute-force prevention emphasizes rate limiting as a primary control because it works regardless of the number of accounts targeted.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.554+00:00","questionType":"multiple_choice"},{"id":"4d9ee012-0394-47cf-9bc4-619d19c0842e","slug":"which-nmap-flag-is-used-to-perform-a-tcp-syn-scan-without-co-c0m5k","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"-sS","explanation":"-sS is the SYN stealth scan.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-sT","explanation":"-sT performs a full TCP Connect scan.","masteryContext":""},{"key":"C","isCorrect":false,"text":"-sU","explanation":"-sU performs a UDP scan.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-sA","explanation":"-sA sends ACK packets to map firewall rules.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.","examTrap":"The trap here is that candidates often confuse -sS (SYN scan) with -sT (TCP connect scan), mistakenly thinking that -sT also avoids completing the handshake, when in fact -sT completes the full three-way handshake and is logged by the target system.","examTip":null,"technicalDeepDive":"The TCP SYN scan leverages the fact that a SYN/ACK response indicates an open port, while an RST response indicates a closed port; the scanner immediately sends an RST to abort the handshake, preventing the target from logging a full connection. This technique is often referred to as 'half-open scanning' and is the default scan type when Nmap is run with root privileges because it requires raw packet crafting via libpcap. In real-world scenarios, SYN scans can bypass some stateless firewalls but may be detected by intrusion detection systems (IDS) that monitor for rapid RST packets after SYN/ACK responses.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:34:02.956+00:00","questionType":"multiple_choice"},{"id":"db34dd9f-387e-47b3-979e-977b9974b54c","slug":"a-security-analyst-observes-unusual-outbound-traffic-from-an-g51ob","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"tls-nextprotoneg","explanation":"This script enumerates TLS next protocol negotiation, not useful for reverse shell detection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"smb-enum-shares","explanation":"This script enumerates SMB shares and is unrelated to HTTPS traffic.","masteryContext":""},{"key":"C","isCorrect":true,"text":"http-malware-host","explanation":"This script checks if the target domain is listed as malicious, which could indicate a command-and-control server.","masteryContext":""},{"key":"D","isCorrect":false,"text":"ssh2-enum-algos","explanation":"This script enumerates SSH algorithms and does not help identify reverse shells.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C (http-malware-host) is correct because it checks the internal host's DNS cache or HTTP traffic against known malware domains, which can reveal if the outbound HTTPS connection is to a command-and-control server. Since the traffic is on port 443 (HTTPS), this script can identify malicious destinations without decrypting the traffic, making it ideal for confirming a reverse shell scenario.","examTrap":"The trap here is that candidates may choose tls-nextprotoneg (Option A) thinking it analyzes HTTPS traffic, but it only checks protocol negotiation, not malicious destinations, while http-malware-host directly correlates outbound connections with known threat intelligence.","examTip":null,"technicalDeepDive":"The http-malware-host script queries the host's DNS resolver cache or performs HTTP requests to check against a database of known malware domains (e.g., from MalwareDomains.com). In a reverse shell, the internal host often resolves the attacker's domain via DNS before initiating the HTTPS connection, so this script can flag that domain without needing to inspect encrypted payloads. Real-world attackers frequently use HTTPS on port 443 to blend in with normal web traffic, making this script a practical first step in incident response.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:30:55.182+00:00","questionType":"multiple_choice"},{"id":"4c4824aa-8387-4223-8183-7af699577d27","slug":"a-company-uses-a-cloud-based-identity-provider-idp-for-sin-4w15y","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Enforce complex password policies.","explanation":"Does not stop credential stuffing.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Enable multi-factor authentication (MFA) for all users.","explanation":"MFA prevents credential stuffing.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Implement CAPTCHA on the login page.","explanation":"CAPTCHA can be bypassed or not present on SSO.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enable account lockout after 3 failed attempts.","explanation":"Attackers can use many accounts.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.","examTrap":"The trap here is that candidates often choose account lockout (Option D) thinking it stops brute-force attacks, but credential stuffing uses valid passwords from breaches, so lockout is ineffective and can be easily evaded with distributed IPs.","examTip":null,"technicalDeepDive":"Credential stuffing exploits the widespread reuse of passwords across services; attackers feed lists of username/password pairs from data breaches into automated login scripts against the target IdP. MFA, especially when using time-based one-time passwords (TOTP) per RFC 6238 or FIDO2 WebAuthn, ensures that possession of the password alone is insufficient. In a real-world scenario, even if an attacker has the correct password for a cloud SSO account (e.g., Azure AD or Okta), the second factor challenge stops the takeover cold.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:20:01.012+00:00","questionType":"multiple_choice"},{"id":"65b5ae7d-8baf-4ed3-83a4-b0502def1ddd","slug":"during-a-penetration-test-a-tester-runs-dnsrecon-d-exampl-7szj5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, a tester runs 'dnsrecon -d example.com -t axfr' and receives a full list of DNS records. What does this indicate about the target's DNS configuration?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The DNS server has DNSSEC enabled","explanation":"DNSSEC does not prevent zone transfers; it adds signatures.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The DNS server allows recursive queries","explanation":"Recursive queries are a separate concept from zone transfers.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The DNS server allows zone transfers from any host","explanation":"A successful axfr means the server is configured to allow zone transfers to unauthorized hosts.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The DNS server is authoritative for the domain","explanation":"Authoritative servers may still restrict zone transfers; success indicates a misconfiguration.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The 'dnsrecon -d example.com -t axfr' command performs a DNS zone transfer (AXFR) request. Receiving a full list of DNS records indicates that the target DNS server is misconfigured to allow zone transfers from any host, which exposes the entire DNS zone data (including internal hostnames and IP addresses) to unauthorized parties. This is a critical information disclosure vulnerability.","examTrap":"The trap here is that candidates confuse 'authoritative' with 'vulnerable' — being authoritative is normal, but allowing unrestricted zone transfers is the misconfiguration; EC-Council often tests this by making option D sound correct because the server is authoritative, but the real issue is the lack of access control on the AXFR query.","examTip":null,"technicalDeepDive":"A zone transfer (AXFR) is a mechanism defined in RFC 1034/1035 for replicating DNS zone data between primary and secondary authoritative servers. The 'dnsrecon' tool sends an AXFR query with the opcode 0 and QTYPE 252; if the target server's 'allow-transfer' ACL is misconfigured (e.g., set to 'any' or left at default on some platforms), it will return the full zone file. In real-world engagements, this often reveals internal network topology, server names, and even service records that aid further exploitation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.399+00:00","questionType":"multiple_choice"},{"id":"47b4bdb3-f5a6-47a0-95e5-df1d38f51c64","slug":"you-are-a-security-consultant-for-a-mid-sized-company-that-r-1o5s8","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.","explanation":"This restricts access to only authorized sources, closing the exposure.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.","explanation":"Logging does not block the open port.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enable deletion protection on the RDS instance to prevent accidental removal.","explanation":"Deletion protection does not affect network access.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enable encryption at rest for the RDS instance using AWS KMS.","explanation":"Encryption protects data if accessed, but the port remains open.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.","examTrap":"The trap here is that candidates may focus on encryption or logging as a quick fix, but the most critical and immediate action is to close the direct public network access to the database, as encryption and logging do not prevent an active attacker from connecting and stealing data.","examTip":null,"technicalDeepDive":"AWS security groups act as a stateful virtual firewall at the instance level. When a security group rule allows 0.0.0.0/0 on port 3306, any host on the internet can attempt a MySQL connection. The immediate fix is to replace that rule with a reference to the application servers' security group ID, which dynamically allows traffic only from instances in that group, even if their IPs change. This is a common misconfiguration in cloud environments where default 'allow all' rules are left in place after initial setup.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:05.772+00:00","questionType":"multiple_choice"},{"id":"fbd4f87d-55a0-4ab5-ac31-bcf772c49144","slug":"a-security-team-observes-repeated-nmap-scans-from-an-externa-drbpm","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Fragmentation","explanation":"Fragmentation splits packets to evade detection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Decoy scan","explanation":"Decoy scan uses fake source IPs.","masteryContext":""},{"key":"C","isCorrect":false,"text":"ACK scan","explanation":"ACK scan maps firewall rules, not evasion via fragmentation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Idle scan","explanation":"Idle scan uses a zombie host to spoof the scan source.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.","examTrap":"EC-Council often tests the distinction between fragmentation and decoy scans, as candidates may confuse 'splitting packets' with 'spoofing IPs' due to both being evasion techniques.","examTip":null,"technicalDeepDive":"Fragmentation works by splitting the TCP header across multiple IP fragments, so that the destination port number may appear in a later fragment, evading stateful inspection firewalls that only check the first fragment. Nmap's `-f` option sets the fragment size to 8 bytes (or 16 with `-ff`), forcing the IP layer to create small fragments. Some older IDS/IPS systems reassemble fragments in a linear fashion, but attackers can use overlapping fragments (e.g., with `--send-eth` and custom MTU) to cause reassembly confusion.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.537+00:00","questionType":"multiple_choice"},{"id":"ed50d107-6720-484f-aa1e-f699dfa0148b","slug":"which-two-of-the-following-are-characteristics-of-a-polymorp-m27ee","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Remains constant in code to ensure replication","explanation":"Polymorphic viruses change constantly.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Mutates its code to evade signature detection","explanation":"Polymorphic viruses change their code pattern each time they replicate.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Uses encryption with a variable key","explanation":"Polymorphic viruses often use a variable encryption key to change the decrypted code.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Spreads via network shares","explanation":"That is typical of worms, not specifically polymorphic viruses.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Resides in the boot sector of a hard drive","explanation":"That describes a boot sector virus.","masteryContext":""}],"correctOptionKey":"B,C","correctOptions":["B","C"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because a polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.","examTrap":"The trap here is that candidates often confuse 'polymorphic' with 'metamorphic' or assume that all viruses that use encryption are polymorphic, but the key distinction is that polymorphic viruses use a variable key and mutate the decryption routine, whereas simple encrypted viruses use a fixed key and do not change their decryptor.","examTip":null,"technicalDeepDive":"Under the hood, a polymorphic virus includes a mutation engine that generates new decryption routines and re-encrypts the virus body with a different key each time. This means the virus's binary pattern changes on every infection, but the decryption engine must remain functional—often using obfuscation techniques like garbage code insertion or instruction substitution. In real-world scenarios, advanced polymorphic malware like the 'Storm Worm' used this technique to evade early antivirus signatures, requiring heuristic or behavioral analysis to detect.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:07.453+00:00","questionType":"multi_select"},{"id":"0ba39262-372f-444b-9491-743e640b536b","slug":"a-security-analyst-receives-an-alert-that-an-external-ip-add-sld9q","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-sI","explanation":"-sI is for idle scan.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-D","explanation":"-D is for decoy scanning.","masteryContext":""},{"key":"C","isCorrect":false,"text":"--mtu","explanation":"--mtu sets a specific MTU size but is not the standard fragmentation flag.","masteryContext":""},{"key":"D","isCorrect":true,"text":"-f","explanation":"-f is the fragmentation flag.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.","examTrap":"EC-Council often tests the distinction between -f (fragmentation) and --mtu (custom MTU size), leading candidates to mistakenly choose --mtu because they associate it with packet size changes, but only -f triggers fragmentation by default.","examTip":null,"technicalDeepDive":"When Nmap uses -f, it splits the TCP header and payload into fragments of 8 bytes each (by default), which can bypass simple firewall rules that only inspect the first fragment. This technique exploits the IP fragmentation mechanism defined in RFC 791, where subsequent fragments lack the full transport-layer header, potentially evading stateful inspection. In real-world scenarios, some intrusion detection systems (e.g., Snort) can reassemble fragments using preprocessor rules, but older or misconfigured systems may miss the attack.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.217+00:00","questionType":"multiple_choice"},{"id":"d8bbb7a6-011c-433c-af17-8c6930927c38","slug":"during-a-penetration-test-an-ethical-hacker-finds-that-a-we-u11si","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Weak TLS cipher suite","explanation":"The issue is not about cipher strength; HTTPS is properly configured.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Lack of application-layer encryption","explanation":"The data is encrypted in transit but not at rest or before being sent; the application does not encrypt sensitive fields.","masteryContext":""},{"key":"C","isCorrect":false,"text":"SSL stripping attack","explanation":"There is no indication of an active downgrade attack.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"HTTPS prevents MITM; the issue is application-side.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.","examTrap":"The trap here is that candidates confuse 'encrypted in transit' (TLS) with 'encrypted at the application layer,' assuming HTTPS alone provides end-to-end data confidentiality, but the CEH exam tests the distinction between transport-layer and application-layer encryption.","examTip":null,"technicalDeepDive":"Under the hood, HTTPS provides transport-layer security via TLS, but the application payload (e.g., JSON, XML) remains in plaintext within the encrypted tunnel. If an attacker gains access to the server's memory, logs, or a TLS-terminating proxy, they can read the sensitive data directly. Real-world examples include credit card numbers sent in a POST body over HTTPS without additional encryption, which could be exposed in server logs or via a memory dump. Application-layer encryption, such as using a pre-shared key or asymmetric encryption on the payload before HTTPS, ensures that even if TLS is compromised, the data remains confidential.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:48.42+00:00","questionType":"multiple_choice"},{"id":"730c9ba6-effa-455e-996d-960c1182705f","slug":"what-is-the-primary-purpose-of-using-the-nmap-flag-ss-uc4rr","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"What is the primary purpose of using the Nmap flag -sS?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Enable OS detection","explanation":"OS detection uses -O.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Perform a SYN stealth scan","explanation":"-sS is the SYN stealth scan flag.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Perform a UDP scan","explanation":"UDP scan uses -sU.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a TCP connect scan","explanation":"TCP connect scan uses -sT.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.","examTrap":"EC-Council often tests the distinction between -sS (SYN stealth) and -sT (TCP connect), where candidates mistakenly think -sS completes the handshake or that -sT is the stealthier option.","examTip":null,"technicalDeepDive":"The SYN stealth scan works by sending a TCP packet with the SYN flag set (as defined in RFC 793). If the target responds with a SYN/ACK, the port is open; if it responds with an RST, the port is closed; if no response or an ICMP unreachable error is received, the port is filtered. A subtle behavior is that on modern firewalls and intrusion detection systems (IDS), the pattern of SYN packets followed by RST packets can still be detected, so the 'stealth' aspect is relative and not guaranteed.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.8+00:00","questionType":"multiple_choice"},{"id":"70fd0a6d-1a35-4e88-9a12-db09bce7cceb","slug":"which-three-of-the-following-are-essential-phases-in-the-eth-y8jeq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?","difficulty":"medium","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Maintaining Access","explanation":"Maintaining Access is a phase after gaining initial entry.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Scanning","explanation":"Scanning involves active probing of the target network.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enumeration","explanation":"Enumeration is a sub-phase within Scanning, not a separate phase.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Reconnaissance","explanation":"Reconnaissance is the first phase, involving information gathering.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Social Engineering","explanation":"Social Engineering is a technique used within phases, not a phase itself.","masteryContext":""}],"correctOptionKey":"A,B,D","correctOptions":["A","B","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.","examTrap":"The trap here is that candidates confuse enumeration as a distinct phase when it is actually a sub-component of the Scanning phase, and they mistake social engineering for a phase rather than recognizing it as a technique that can be used within Reconnaissance or Gaining Access.","examTip":null,"technicalDeepDive":"The EC-Council ethical hacking methodology follows a five-phase cycle: Reconnaissance (passive/information gathering), Scanning (active probing with tools like Nmap), Gaining Access (exploitation), Maintaining Access (persistence via cron jobs, registry run keys, or SSH tunnels), and Clearing Tracks (log deletion, timestamp manipulation). Maintaining Access is critical for post-exploitation activities such as lateral movement and data exfiltration, often leveraging Metasploit's persistence modules or custom backdoors that survive reboots.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:57.536+00:00","questionType":"multi_select"},{"id":"a037aed5-1b33-4090-af44-e38888e909ac","slug":"during-a-penetration-test-you-execute-the-following-command-twwbd","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The DNS server is using DNSSEC to secure zone transfers","explanation":"DNSSEC does not prevent AXFR; it provides data integrity and authentication but zone transfer restrictions are separate.","masteryContext":""},{"key":"B","isCorrect":true,"text":"The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file","explanation":"A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The DNS server is properly configured and only allows zone transfers to authorized secondary servers","explanation":"If only authorized, the AXFR request would have been denied.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The target uses a split-DNS configuration with internal and external views","explanation":"Split-DNS might restrict zone transfers, but a successful AXFR from an external perspective indicates a flaw.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.","examTrap":"The trap here is that candidates may confuse DNSSEC with access control mechanisms, or assume that a successful zone transfer implies proper authorization, when in fact the CEH exam emphasizes that any successful AXFR from an unauthorized client is a critical misconfiguration and vulnerability.","examTip":null,"technicalDeepDive":"Zone transfers (AXFR) are defined in RFC 1034 and RFC 5936, and are intended for replicating DNS data between primary and secondary servers. A common misconfiguration is leaving the `allow-transfer` directive unset or set to `any` in BIND or equivalent settings in other DNS software (e.g., Microsoft DNS). In a real-world scenario, an attacker can use the retrieved zone file to map the entire network infrastructure, identify high-value targets, and plan further attacks like social engineering or targeted exploitation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:24:11.101+00:00","questionType":"multiple_choice"},{"id":"a2f1482b-9898-4e62-810d-289e9119e959","slug":"during-a-penetration-test-an-ethical-hacker-needs-to-evade-yc7ak","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?","difficulty":"hard","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Use random source ports","explanation":"Random ports don't affect packet rate.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use a decoy scan","explanation":"Decoy scans can still generate high packet rates.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Slow down the scan rate","explanation":"Reducing packets per second avoids triggering rate-based IDS thresholds.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Use fragmented packets","explanation":"Fragmentation evades signature detection, not rate-based detection.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.","examTrap":"EC-Council often tests the misconception that fragmentation alone evades IDS, but candidates must remember that rate-based detection counts packets regardless of fragmentation, so slowing the scan is the direct countermeasure.","examTip":null,"technicalDeepDive":"Rate-based IDS detection relies on sliding window counters, often tracking packets per second over intervals like 1-5 seconds. Tools like Nmap's --scan-delay or -T0 (paranoid timing) can slow scans to as low as 0.5 packets per second, staying under typical thresholds (e.g., Snort's default portscan alert triggers at 5 pps). In real-world scenarios, attackers may also use random delays between probes to further mimic legitimate traffic patterns.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.485+00:00","questionType":"multiple_choice"},{"id":"b6f97906-d332-415c-a298-6e49e0da96a3","slug":"refer-to-the-exhibit-a-penetration-tester-executed-the-sql-be2y7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The attacker extracted hashed passwords that can be cracked offline","explanation":"The response contains username:hash pairs; the hash appears to be MD5, which is crackable.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The attacker successfully performed a blind SQL injection to enumerate the database structure","explanation":"The response shows actual data, not blind inference; the attacker sees the results directly.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The attacker caused a denial of service by sending an invalid query","explanation":"The query executed successfully (200 OK) and returned data; no denial of service.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The attacker modified the database records to update user passwords","explanation":"The payload uses UNION SELECT to retrieve data, not UPDATE to modify records.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.","examTrap":"EC-Council often tests the distinction between in-band (error-based/UNION) SQL injection, which returns data directly, and blind SQL injection, which does not return visible data; candidates mistakenly choose blind when the response clearly shows extracted values.","examTip":null,"technicalDeepDive":"In a typical SQL injection attack, the attacker injects a UNION SELECT statement to append results from other tables (e.g., `UNION SELECT username, password FROM users`). The database returns the concatenated result set, including hashed passwords, which are often stored as MD5, SHA-1, or bcrypt strings. Real-world scenarios often involve extracting `wp_users` tables in WordPress or `syslogins` in MSSQL, where offline cracking is the primary goal.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nGET /search?q=1 UNION SELECT username,password FROM users-- HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/5.0\n\nHTTP/1.1 200 OK\nDate: Mon, 04 Nov 2024 12:00:00 GMT\nServer: Apache/2.4.41 (Ubuntu)\nContent-Type: text/html\n\n<html><body><h1>Search Results</h1><p>admin:5f4dcc3b5aa765d61d8327deb882cf99</p><p>user1:5d41402abc4b2a76b9719d911017c592</p></body></html>","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.083+00:00","questionType":"multiple_choice"},{"id":"1a5cecaf-af39-4849-b2d5-2f4893c6df83","slug":"during-a-penetration-test-you-run-the-following-nmap-comman-wvb7g","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you run the following Nmap command: nmap -sS -sV -O -A -T4 --script=default 10.0.0.1. The scan results show that port 443 is open and the service is 'Apache httpd 2.4.29'. However, banner grabbing with Netcat shows 'Apache/2.4.41 (Ubuntu)'. What is the MOST likely explanation for the discrepancy?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The server is using a reverse proxy that presents a different version to Nmap","explanation":"If a reverse proxy were involved, Nmap might see the proxy's version, but banner grabbing from the same IP should match.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Netcat banner grabbing is more reliable because it reads the actual server response","explanation":"Netcat establishes a TCP connection and reads the service banner directly, while Nmap's -sV uses a database of signatures that may be incomplete or outdated.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The discrepancy is due to Nmap's OS fingerprinting conflicting with version detection","explanation":"OS fingerprinting (-O) does not affect service version detection (-sV). They are separate modules.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap is more accurate because it uses deep packet inspection","explanation":"Banner grabbing directly reads the server's response, which is typically more accurate for version detection.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because Netcat performs a direct TCP connection to the service and reads the raw banner as sent by the application, which is the most immediate and unfiltered version information. Nmap's version detection (-sV) relies on probe-response matching against its signature database, which can be outdated or misinterpret the service if the server uses banner obfuscation or if the Nmap database does not have an exact match for the newer version. In this case, Netcat reveals the actual server version (2.4.41), while Nmap's database may only have a signature for 2.4.29, leading to a false lower version.","examTrap":"The trap here is that candidates assume Nmap is always more accurate because it is a sophisticated scanning tool, but in version detection, a direct banner grab with Netcat is often more reliable when the service banner is not suppressed.","examTip":null,"technicalDeepDive":"Nmap's service version detection works by sending a series of probes (e.g., NULL, Generic, SSL/TLS) and comparing the responses to a database of known service fingerprints. If the server's response does not exactly match any fingerprint, Nmap may fall back to a generic match or an older version. Netcat, on the other hand, simply connects and reads the initial banner as defined in RFC 2616 for HTTP, which is the raw server string. In real-world scenarios, administrators may configure Apache to hide the exact version in the banner (e.g., ServerTokens Prod), but here the banner is explicit, making Netcat's result the ground truth.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:24:34.109+00:00","questionType":"multiple_choice"},{"id":"a296d504-ff67-45ad-9808-50515652f82f","slug":"which-two-vulnerabilities-are-associated-with-buffer-overflo-4u6tn","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO vulnerabilities are associated with buffer overflow attacks?","difficulty":"easy","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Arbitrary code execution","explanation":"Successful buffer overflow attacks often lead to arbitrary code execution.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Stack smashing","explanation":"Stack-based buffer overflows can overwrite return addresses, causing stack smashing.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Authentication bypass via SQL injection","explanation":"SQL injection is a separate vulnerability.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Cross-site scripting (XSS)","explanation":"XSS is a client-side injection, not buffer overflow.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Race condition","explanation":"Race conditions involve timing issues, not buffer overflows.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.","examTrap":"The trap here is that candidates often confuse buffer overflow with other injection or concurrency flaws, but the CEH exam specifically pairs arbitrary code execution and stack smashing as the two direct consequences of a buffer overflow.","examTip":null,"technicalDeepDive":"In a classic stack-based buffer overflow, the attacker overwrites the saved return address on the stack with a pointer to shellcode placed in the buffer. Modern mitigations like ASLR (Address Space Layout Randomization) and NX (No-Execute) bits make exploitation harder, but techniques such as ROP (Return-Oriented Programming) bypass these protections. Real-world examples include the Morris Worm (1988) exploiting a buffer overflow in fingerd and the EternalBlue exploit (2017) targeting SMBv1.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:06:26.882+00:00","questionType":"multi_select"},{"id":"50c55770-c61c-429b-9565-dba64d1835a8","slug":"a-company-deploys-iot-sensors-in-a-remote-facility-with-limi-0m0br","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"4G LTE","explanation":"Higher bandwidth and power consumption.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Wi-Fi 6","explanation":"Higher power and shorter range.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Bluetooth 5","explanation":"Short range and not ideal for remote sensors.","masteryContext":""},{"key":"D","isCorrect":true,"text":"LoRaWAN","explanation":"Optimized for low-power, long-range IoT.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.","examTrap":"The trap here is that candidates often confuse 'low power' and 'short range' technologies like Bluetooth 5 with the specific requirements of remote, long-range IoT, failing to recognize that LoRaWAN is the only option explicitly designed for low-power wide-area networks (LPWAN) with kilometer-scale range.","examTip":null,"technicalDeepDive":"LoRaWAN uses a star-of-stars topology where end devices communicate with gateways via LoRa modulation, which employs spread-spectrum technology to achieve long range (up to 15 km in rural areas) at the cost of low data rates. The Adaptive Data Rate (ADR) mechanism dynamically adjusts spreading factors and transmit power to optimize battery life and network capacity, a subtle behavior that ensures sensors can operate for years on a single AA battery. In a real-world scenario, a remote oil pipeline monitoring system uses LoRaWAN to transmit pressure and temperature readings every 10 seconds over 10 km, with gateways backhauling data via satellite or cellular.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:20:40.038+00:00","questionType":"multiple_choice"},{"id":"f7e3abef-2afd-4363-a1da-8606dbec7e23","slug":"a-security-analyst-wants-to-discover-all-dns-records-associa-vdpa3","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"theHarvester","explanation":"theHarvester gathers emails, subdomains, and IPs from public sources but does not directly perform DNS record enumeration.","masteryContext":""},{"key":"B","isCorrect":false,"text":"dig","explanation":"dig is a flexible DNS query tool but typically used for single queries; dnsrecon automates enumeration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"nslookup","explanation":"nslookup is a basic query tool but not specifically designed for enumeration across multiple record types and subdomain brute-forcing.","masteryContext":""},{"key":"D","isCorrect":true,"text":"dnsrecon","explanation":"dnsrecon is a powerful DNS enumeration script that can query multiple record types and perform subdomain brute-forcing.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"D (dnsrecon) is correct because it is a dedicated DNS enumeration tool that performs multiple types of DNS record queries (A, AAAA, CNAME, MX, NS, SOA, SRV, TXT, etc.) using techniques like brute‑forcing subdomains and performing SRV record enumeration, all without attempting a full zone transfer (AXFR). It is specifically designed for reconnaissance and can discover hidden or non‑obvious DNS records efficiently.","examTrap":"EC-Council often tests the misconception that nslookup or dig are sufficient for comprehensive DNS discovery, but the question specifically asks for a tool that discovers *all* DNS records without a zone transfer, which requires automated enumeration beyond single‑query tools.","examTip":null,"technicalDeepDive":"dnsrecon leverages Python’s dnspython library to send multiple DNS query types (e.g., ANY, AXFR, SRV, TXT) and can perform dictionary‑based subdomain brute‑forcing against the target domain. In real‑world engagements, it is often used to map out a target’s attack surface by discovering services like SIP (SRV records for VoIP) or Microsoft Exchange (SRV _autodiscover), which are not revealed by a simple A or MX query. The tool also supports DNSSEC zone walking (RFC 5155) to enumerate records when NSEC records are used.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.437+00:00","questionType":"multiple_choice"},{"id":"30cc1503-71bb-4e0a-9019-3cdd0a3aab56","slug":"during-a-penetration-test-you-need-to-identify-all-live-hos-v5kw2","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-O (OS fingerprinting)","explanation":"OS fingerprinting requires active probes that can be detected by IDS.","masteryContext":""},{"key":"B","isCorrect":true,"text":"-sn (ping sweep)","explanation":"Ping sweep only checks host availability, generating minimal traffic and avoiding full port scans.","masteryContext":""},{"key":"C","isCorrect":false,"text":"-sS (SYN scan)","explanation":"SYN scan is stealthier than connect scan but still actively probes ports, increasing detection risk.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-sV (version detection)","explanation":"Version detection connects to open ports and may trigger alerts.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.","examTrap":"The trap here is that candidates often confuse -sn (ping sweep) with -sS (SYN scan) because both involve TCP packets, but -sn is purely for host discovery without port scanning, whereas -sS is a port scanning technique that is much more intrusive and detectable.","examTip":null,"technicalDeepDive":"Nmap's -sn flag uses a multi-method discovery approach: by default on a local network, it sends an ARP request (which is non-IP and often not monitored by IDS), while on a remote network it sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests. This combination increases the chance of detecting live hosts even when firewalls block ICMP, but the lack of full connection establishment keeps the scan relatively low-profile compared to SYN or version scans.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:29:01.766+00:00","questionType":"multiple_choice"},{"id":"a183d697-bdc5-4971-98a0-cf5042a48a23","slug":"refer-to-the-exhibit-a-security-analyst-captured-the-http-r-hqacz","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Cross-Site Request Forgery (CSRF)","explanation":"No cross-origin request is shown.","masteryContext":""},{"key":"B","isCorrect":false,"text":"SQL Injection","explanation":"No database query is visible.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Reflected Cross-Site Scripting (XSS)","explanation":"The input is reflected in the response and executed as script.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Directory Traversal","explanation":"No file path manipulation is present.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=<script>alert('XSS')</script>` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.","examTrap":"EC-Council often tests the distinction between reflected XSS and stored XSS, but the trap here is confusing reflected XSS with CSRF because both involve crafted URLs, but CSRF does not execute JavaScript in the response—it forges a state-changing request using the victim's session.","examTip":null,"technicalDeepDive":"Reflected XSS occurs when user input is immediately included in the server's response without proper output encoding, typically via URL parameters or form submissions. Under the hood, the browser trusts the origin server, so any script injected into the response runs in the same origin context, allowing access to cookies, session tokens, and DOM manipulation. In real-world scenarios, attackers often craft a malicious link (e.g., via email or phishing) that includes the XSS payload; when the victim clicks it, the script executes and exfiltrates sensitive data to an attacker-controlled server.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\nGET /search?q=<script>alert('XSS')</script> HTTP/1.1\nHost: www.example.com\nUser-Agent: Mozilla/5.0\n\nHTTP/1.1 200 OK\nContent-Type: text/html\n\n<html><body>You searched for: <script>alert('XSS')</script></body></html>","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.204+00:00","questionType":"multiple_choice"},{"id":"07ce6100-49ad-4445-b7f5-7fc84a83c1b0","slug":"a-penetration-tester-discovers-that-an-nmap-syn-scan-against-g5w6y","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?","difficulty":"medium","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The target host has a host-based firewall that drops SYN packets but allows full connections.","explanation":"Host-based firewalls typically treat SYN packets the same as any other TCP packet; they don't distinguish half-open vs. full connection.","masteryContext":""},{"key":"B","isCorrect":true,"text":"A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.","explanation":"Stateful firewalls track connections; a SYN scan sends unsolicited SYN packets that may be dropped, while a connect scan completes the handshake and appears as a normal connection.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.","explanation":"ICMP filtering would affect ping sweeps, not TCP scans; Nmap uses TCP probes to determine host status regardless of ICMP.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap's SYN scan requires root privileges, and the tester ran it without sudo.","explanation":"If the tester ran SYN scan without root, Nmap would fall back to connect scan automatically, not return no open ports.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.","examTrap":"The trap here is that candidates often assume a host-based firewall is the cause, but stateful network firewalls specifically differentiate between incomplete SYN probes and full TCP handshakes, making option B the correct answer.","examTip":null,"technicalDeepDive":"Stateful firewalls maintain a connection table and enforce rules based on TCP state flags. A SYN scan sends only a SYN packet and expects a SYN-ACK; the firewall sees this as an unsolicited SYN and drops it. A connect scan uses the OS's TCP stack to complete the three-way handshake (SYN, SYN-ACK, ACK), which the firewall recognizes as a legitimate connection initiation, allowing the SYN-ACK to return. This is why Nmap's -sS (SYN scan) and -sT (connect scan) yield different results in such environments.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:47.055+00:00","questionType":"multiple_choice"},{"id":"c62a81bb-9ea0-4b7a-b61a-4085db236710","slug":"an-ethical-hacker-is-testing-a-web-application-that-uses-coo-ao6h5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SQL injection","explanation":"SQLi targets the database, not session cookies.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Cross-site request forgery (CSRF)","explanation":"CSRF exploits trust, not cookie theft.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Session hijacking via cross-site scripting (XSS)","explanation":"XSS can steal cookies if HttpOnly is not set.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Clickjacking","explanation":"Clickjacking tricks users into clicking hidden elements.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because the absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.","examTrap":"The trap here is that candidates often confuse CSRF with session hijacking, but CSRF does not require reading the cookie—it only requires the browser to automatically include it in requests, whereas XSS-based session hijacking directly steals the cookie value.","examTip":null,"technicalDeepDive":"The HttpOnly flag, defined in RFC 6265, prevents client-side scripts from accessing the cookie via `document.cookie`, mitigating XSS-based session theft. The Secure flag ensures the cookie is only sent over HTTPS, protecting against network-level interception. In a real-world scenario, an attacker could combine a stored XSS payload with a missing HttpOnly flag to exfiltrate session tokens even from authenticated users, leading to account takeover.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:10:29.642+00:00","questionType":"multiple_choice"},{"id":"427ee8e1-797d-4d2a-986a-58e5f5e22203","slug":"an-incident-responder-notices-unusual-outbound-traffic-from-yg3u7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An incident responder notices unusual outbound traffic from a host that is communicating with an external IP on port 4444. The traffic appears to be encrypted. Which tool could be used to initiate a connection to that external IP to gather a banner for service identification?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"traceroute","explanation":"traceroute shows path but no banner.","masteryContext":""},{"key":"B","isCorrect":false,"text":"nslookup","explanation":"nslookup is for DNS queries.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Telnet","explanation":"Telnet can connect to a TCP port and often receives a banner.","masteryContext":""},{"key":"D","isCorrect":false,"text":"ping","explanation":"ping uses ICMP, not TCP, and does not retrieve banners.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.","examTrap":"EC-Council often tests the misconception that Telnet is only for remote terminal access on port 23, but the exam expects you to know Telnet can connect to any TCP port for banner grabbing.","examTip":null,"technicalDeepDive":"When connecting to a service with Telnet, the client sends a TCP SYN to the target IP and port; if the port is open, a three-way handshake completes and the server often sends a banner string before any authentication. Even if the subsequent traffic is encrypted (e.g., TLS handshake), the initial banner may be transmitted in plaintext, allowing service identification. In real-world scenarios, attackers use Telnet to probe non-standard ports like 4444 to identify backdoors or custom services.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.498+00:00","questionType":"multiple_choice"},{"id":"55b853f8-4f6c-4c0b-8e82-32f3b940f06a","slug":"you-are-conducting-a-security-assessment-and-need-to-map-the-ya01x","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?","difficulty":"easy","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Traceroute","explanation":"Traceroute increments TTL to get ICMP time-exceeded messages from routers, revealing the path.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Banner grabbing","explanation":"Banner grabbing identifies services, not network topology.","masteryContext":""},{"key":"C","isCorrect":false,"text":"DNS enumeration","explanation":"DNS enumeration reveals hostnames and IPs but not the network path.","masteryContext":""},{"key":"D","isCorrect":false,"text":"SNMP walk","explanation":"SNMP walk retrieves MIB data, not routing paths.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.","examTrap":"The trap here is that candidates often confuse traceroute with ping (which only tests reachability and RTT, not hop-by-hop path discovery) or assume banner grabbing can reveal network topology, but only traceroute systematically identifies each intermediate device along the route.","examTip":null,"technicalDeepDive":"Traceroute works by sending packets with incrementing TTL values (starting at 1); the first router decrements TTL to 0 and replies with an ICMP Time Exceeded message (Type 11, Code 0), revealing its IP. On Windows, traceroute uses ICMP Echo Requests, while on Linux/macOS it typically uses UDP packets to high ports, causing routers to send ICMP Time Exceeded and the destination to send ICMP Port Unreachable. In real-world scenarios, firewalls may block ICMP or UDP traceroute, so TCP-based traceroute (e.g., using SYN packets to port 80) can bypass such filters to map the path.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:19.998+00:00","questionType":"multiple_choice"},{"id":"8300c338-9d3a-4512-a0e8-d494320cb6cf","slug":"a-security-analyst-wants-to-gather-information-about-a-targe-74o3z","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Vulnerability scanning","explanation":"Vulnerability scanning is an active technique that directly interacts with systems.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Social engineering","explanation":"Social engineering involves manipulating people, not just using public sources.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Active reconnaissance","explanation":"Active reconnaissance involves direct interaction with the target, such as scanning or probing.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Passive reconnaissance","explanation":"Passive reconnaissance uses publicly available information without direct interaction.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.","examTrap":"The trap here is confusing passive reconnaissance with active reconnaissance; candidates often think any information gathering is 'active' because it involves tools, but the key distinction is whether the target's systems are directly contacted (active) or not (passive).","examTip":null,"technicalDeepDive":"Passive reconnaissance leverages tools like the WHOIS protocol (RFC 3912) to query domain registration databases, DNS enumeration via `nslookup` or `dig` for non-recursive queries, and search engine dorking (e.g., Google dorks) to uncover indexed documents. In a real-world scenario, an attacker might use Shodan to find exposed services without ever sending a packet to the target, relying on Shodan's pre-collected data.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:34:31.702+00:00","questionType":"multiple_choice"},{"id":"d02dc657-e251-4dad-9b59-55e4f20b1ff7","slug":"a-penetration-tester-is-assessing-an-organization-s-physical-opbro","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Shoulder surfing the authorized user's fingerprint pattern","explanation":"Shoulder surfing is ineffective for capturing detailed fingerprint patterns needed for replication.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Picking the lock on the server room door","explanation":"Lockpicking targets the door lock, not the biometric scanner.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Using a gelatin mold of an authorized user's fingerprint","explanation":"Gelatin molds can create replicas of fingerprints that may be accepted by some scanners.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Tailgating behind an authorized employee","explanation":"Tailgating avoids the scanner but requires following someone in; it does not bypass the scanner mechanism.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.","examTrap":"The trap here is that candidates often choose tailgating (Option D) as the easiest social engineering method, but the question specifically asks for bypassing the biometric scanner, not the door lock or human controls.","examTip":null,"technicalDeepDive":"Fingerprint scanners typically use capacitive sensors that measure the electrical differences between ridges and valleys, or optical sensors that capture reflected light. A gelatin mold can replicate these physical features because gelatin has similar dielectric properties to human skin, allowing it to fool the sensor's capacitance or light reflection. In real-world attacks, attackers lift latent prints from surfaces using tape or powder, then cast them in gelatin to create a working spoof.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:40.496+00:00","questionType":"multiple_choice"},{"id":"bbde96f4-c804-4ddb-b242-488e4df61626","slug":"during-a-penetration-test-you-discover-that-the-target-orga-8s64o","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Perform a WHOIS lookup on the domain","explanation":"WHOIS provides registrar info, not individual emails.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Attempt a DNS zone transfer","explanation":"Zone transfers typically fail or return only DNS records, not emails.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Run an nmap scan against the mail server","explanation":"Nmap reveals open ports and services, not email addresses.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Use Google dorking to find publicly exposed email lists","explanation":"Google dorks can locate files containing email addresses.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.","examTrap":"The trap here is that candidates often confuse active reconnaissance techniques (like DNS zone transfer or nmap scanning) with passive information gathering, assuming they are the primary way to collect email addresses, when in fact publicly indexed documents via Google dorking are a simpler and more effective passive method.","examTip":null,"technicalDeepDive":"Google dorking leverages search operators like `site:target.com filetype:xlsx email` to find indexed spreadsheets or contact lists. Under the hood, Google's crawler stores the text content of these files, making email addresses searchable even if the file is not directly linked. In a real-world scenario, a penetration tester might discover a publicly shared 'org_chart.xlsx' containing full names, titles, and email addresses, revealing the entire reporting structure.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:05:56.592+00:00","questionType":"multiple_choice"},{"id":"1b44101e-545d-4ec4-9a79-728f7b7954ff","slug":"during-a-penetration-test-a-security-analyst-discovers-that-ht0th","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Implement password hashing with bcrypt on the server side.","explanation":"Hashing protects stored passwords from exposure if the database is compromised, but does not protect credentials in transit.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use digital signatures to sign the login request.","explanation":"Digital signatures ensure authenticity and integrity but do not encrypt the data; credentials would still be visible.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Enforce HTTPS using TLS 1.2 or higher.","explanation":"TLS encrypts the entire communication channel, protecting credentials from interception.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Encrypt the password field using AES-256 before sending via HTTP.","explanation":"Encrypting only the password field leaves other data exposed and requires secure key distribution without TLS.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.","examTrap":"The trap here is that candidates confuse encryption at rest (hashing) or partial encryption (AES on password field) with full-session encryption (TLS), or they think digital signatures provide confidentiality, when in fact they only ensure authenticity and integrity.","examTip":null,"technicalDeepDive":"TLS 1.2+ operates at the transport layer, encrypting all data between client and server using a handshake that negotiates cipher suites and exchanges ephemeral keys via Diffie-Hellman (ECDHE). A subtle behavior: even with HTTPS, if the login form is served over HTTP (mixed content), the initial page load can be tampered with, so HSTS (HTTP Strict Transport Security) should also be enforced to prevent downgrade attacks. In real-world scenarios, tools like Wireshark can capture plaintext credentials from HTTP POST requests, but with TLS, the entire TCP stream is encrypted.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:13:12.635+00:00","questionType":"multiple_choice"},{"id":"d45c0a9c-e527-43f7-8f6e-93c10f885f1f","slug":"refer-to-the-exhibit-a-security-analyst-reviews-the-firewal-ctldy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Phishing","explanation":"Phishing usually occurs via email or messaging, not direct SMB connections.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Vishing","explanation":"Vishing is voice phishing, not related to network traffic.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Tailgating","explanation":"Tailgating allows an attacker to physically enter a secured area and connect to the internal network from an unauthorized IP.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Baiting","explanation":"Baiting involves physical media like USB drives, not network logs.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.","examTrap":"The trap here is that candidates see SMB and internal IP and immediately think of a technical attack like phishing or baiting, but the key clue is the physical access implied by the unusual subnet, which points to tailgating as the social engineering vector.","examTip":null,"technicalDeepDive":"SMB (Server Message Block) over port 445 is used for file sharing, printer access, and remote administration in Windows networks; an attacker who tailgates into a facility can plug a laptop into an open Ethernet port or connect to the internal Wi-Fi, then use tools like PsExec or SMBexec to move laterally. In real-world scenarios, tailgating is often combined with badge cloning or social engineering at reception desks, and the unusual source IP (10.0.0.45) outside the file server subnet is a classic indicator of an unauthorized device on the network. The CEH exam emphasizes that tailgating bypasses physical security controls, leading to direct network access and potential SMB-based attacks like pass-the-hash or SMB relay.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nFirewall Log:\nDate: 2023-10-12\nTime: 14:23:45\nSource IP: 10.0.0.45\nDestination IP: 192.168.1.100\nProtocol: TCP\nPort: 445\nAction: ALLOW\nUser: jdoe\nReason: Rule ID 3 (SMB access to file server)\n```\n\nExhibit:","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:50.286+00:00","questionType":"multiple_choice"},{"id":"51defb7c-b80b-4c0a-a233-d24c887af319","slug":"which-three-of-the-following-are-examples-of-osint-technique-vcvv7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are examples of OSINT techniques? (Choose 3)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nmap version detection","explanation":"Nmap is an active scanning tool.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Shodan search","explanation":"Shodan is an OSINT search engine for devices.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Maltego graph analysis","explanation":"Maltego uses public data sources for OSINT.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nessus vulnerability scan","explanation":"Nessus is an active vulnerability scanner.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Google dorking","explanation":"Google dorking uses search engines to find sensitive information.","masteryContext":""}],"correctOptionKey":"B,C,E","correctOptions":["B","C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.","examTrap":"EC-Council often tests the distinction between active and passive reconnaissance, and the trap here is that candidates confuse tools that can be used for both (like Nmap) with OSINT, forgetting that OSINT specifically excludes any direct interaction with the target system.","examTip":null,"technicalDeepDive":"OSINT relies entirely on publicly accessible data, such as Shodan's indexed banners from SYN scans, Maltego's aggregation of WHOIS, DNS, and social media data, and Google dorking's use of advanced search operators to find exposed files or directories. These techniques do not send packets to the target; they leverage third-party databases and search engine caches, which is why they are considered passive and legal for reconnaissance.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.937+00:00","questionType":"multi_select"},{"id":"70095d63-a286-40b3-84f2-b33d5747cded","slug":"which-of-the-following-is-the-best-defense-against-tailgatin-0mtgh","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following is the BEST defense against tailgating attacks in a secure facility?","difficulty":"easy","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Hiring security guards","explanation":"Guards can be socially engineered or distracted.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Reviewing keycard access logs","explanation":"Logs are for auditing, not prevention.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Installing CCTV cameras","explanation":"CCTV is for monitoring, not preventing in real-time.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Implementing a mantrap at the entrance","explanation":"Mantraps physically enforce one-person entry, preventing tailgating.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.","examTrap":"EC-Council often tests the distinction between preventive, detective, and corrective controls; the trap here is that candidates mistake surveillance (CCTV) or logging (access logs) for active prevention, when only a mantrap provides a physical barrier that stops tailgating in real time.","examTip":null,"technicalDeepDive":"A mantrap typically integrates with an electronic access control system (EACS) using sensors (e.g., weight pads, infrared beams) to detect the presence of a single person. In high-security environments, the mantrap may include biometric verification (e.g., fingerprint or iris scan) at each door, and if two people enter the vestibule, both doors lock and an alarm triggers. This aligns with the principle of 'defense in depth' where physical controls complement logical controls to enforce the 'no piggybacking' policy.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.985+00:00","questionType":"multiple_choice"},{"id":"359e2e2a-5704-4e8e-b186-dd172ec1ba72","slug":"an-ethical-hacker-is-assessing-a-linux-web-server-running-ap-013ky","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Craft a request with a local file inclusion parameter pointing to /etc/passwd","explanation":"This safely confirms RFI by reading a local file, proving the vulnerability.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use SQLMap to test for SQL injection","explanation":"SQLMap tests for SQLi, not RFI.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Scan the server with Nikto to detect known RFI signatures","explanation":"Nikto can detect potential RFI, but manual verification is needed.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Attempt to include a remote URL containing a web shell","explanation":"This could compromise the server and is not a safe test.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option A is correct because it uses a local file inclusion (LFI) parameter to test for file inclusion without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include files, which is a direct indicator of an RFI vulnerability if the server returns the file contents. This approach is safe and non-destructive, as it only reads a standard system file.","examTrap":"The trap here is that candidates may confuse RFI with LFI or think that using a web shell is acceptable for confirmation, but the CEH exam emphasizes non-destructive testing and ethical boundaries, making a local file inclusion test the correct first step.","examTip":null,"technicalDeepDive":"Remote file inclusion (RFI) vulnerabilities occur when an application dynamically includes external files based on user input without proper sanitization, often via PHP's include() or require() functions. Testing with a local file like /etc/passwd leverages the same underlying mechanism but uses a local resource, avoiding the need for an external server and reducing risk. In real-world scenarios, RFI can be chained with other vulnerabilities, such as log poisoning, to achieve code execution, but initial confirmation should always be non-destructive.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:10:57.805+00:00","questionType":"multiple_choice"},{"id":"02c48ff5-cf2d-40de-bdac-ec599dcedf9e","slug":"an-ethical-hacker-wants-to-discover-subdomains-of-a-target-d-3f9j3","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Run a traceroute to the main domain","explanation":"Traceroute shows path, not subdomains.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Check the WHOIS record for the domain","explanation":"WHOIS does not contain subdomain info.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Use the site: operator in search engines","explanation":"Search engines index subdomains.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a reverse DNS lookup on the target IP range","explanation":"Reverse lookup may not list all subdomains.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.","examTrap":"EC-Council often tests the misconception that WHOIS records contain subdomain information, but WHOIS only holds domain registration data, not DNS resource records like A or CNAME entries for subdomains.","examTip":null,"technicalDeepDive":"Search engines like Google use web crawlers to index pages and their subdomains; the `site:` operator filters results to a specific domain, and the wildcard `*` can match any subdomain prefix. This technique is part of OSINT (Open Source Intelligence) and can uncover subdomains that are not linked from the main site but are still indexed, such as staging or development subdomains. However, it may miss subdomains that are not crawled (e.g., those behind authentication or with noindex directives).","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.598+00:00","questionType":"multiple_choice"},{"id":"d25ae9d5-9ce6-4871-b18b-340d1d2d6df4","slug":"a-security-analyst-is-tasked-with-performing-passive-reconna-7x8g4","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Engage in social engineering via phone calls","explanation":"Social engineering is active and risky.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Use Shodan to search for target infrastructure","explanation":"Shodan indexes public data passively.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Initiate a DNS zone transfer request","explanation":"Zone transfer is active and often blocked.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a port scan with Nmap","explanation":"Active scanning generates traffic.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse Shodan (a passive, third-party data source) with active tools like Nmap or DNS zone transfers, which require direct interaction with the target's systems.","examTip":null,"technicalDeepDive":"Shodan works by continuously scanning the entire IPv4 address space and storing service banners (e.g., HTTP Server headers, SSH version strings) from responses to connection attempts. A subtle behavior is that Shodan's data may be hours or days old, so the analyst must consider that the target's technology stack could have changed since the last scan. In a real-world scenario, an analyst might combine Shodan with Censys or Google dorks to cross-reference passive data without ever touching the target's network.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.636+00:00","questionType":"multiple_choice"},{"id":"0a6e6e56-6d31-4e58-90f9-b669209204fc","slug":"which-two-of-the-following-are-examples-of-privilege-escalat-fzkos","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are examples of privilege escalation on Linux? (Select 2)","difficulty":"medium","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Pass-the-Hash","explanation":"Pass-the-Hash is for lateral movement, not privilege escalation.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Token impersonation","explanation":"Token impersonation is a Windows privilege escalation method.","masteryContext":""},{"key":"C","isCorrect":true,"text":"SUID bit abuse","explanation":"SUID programs run with the file owner's privileges.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Exploiting a local vulnerability in a setuid binary","explanation":"Local exploits can leverage vulnerabilities in setuid binaries for privilege escalation.","masteryContext":""},{"key":"E","isCorrect":false,"text":"DLL hijacking","explanation":"DLL hijacking is a Windows technique.","masteryContext":""}],"correctOptionKey":"C,D","correctOptions":["C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.","examTrap":"EC-Council often tests the distinction between Windows and Linux privilege escalation techniques, and the trap here is that candidates confuse cross-platform attacks like token impersonation or DLL hijacking as applicable to Linux, when they are strictly Windows-based.","examTip":null,"technicalDeepDive":"The SUID bit (chmod u+s) allows a binary to run with the effective UID of its owner; common targets include binaries like /usr/bin/passwd or custom scripts with the bit set. Exploiting a local vulnerability in a setuid binary (D) often involves buffer overflows or race conditions (e.g., CVE-2021-3156 in sudo) to gain a root shell. In real-world scenarios, misconfigured SUID binaries on penetration testing labs (e.g., /usr/bin/find with SUID) are frequently used to escalate privileges via command injection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.876+00:00","questionType":"multi_select"},{"id":"18c66b70-8f2b-454d-aa13-95ea14725cc8","slug":"a-security-analyst-wants-to-perform-passive-reconnaissance-o-m9n70","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"WHOIS lookup","explanation":"Queries public WHOIS databases without contacting the target.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Shodan search","explanation":"Shodan indexes Internet-facing devices; querying it is passive.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Telnet banner grab","explanation":"Connecting to a service via Telnet is active.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Ping sweep","explanation":"Ping sweep sends ICMP packets.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Nmap SYN scan","explanation":"SYN scan sends packets to the target.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance by including tools like Shodan (which is passive) alongside active scanning tools like Nmap, leading candidates to mistakenly classify Shodan as active because it involves a search engine rather than direct network interaction.","examTip":null,"technicalDeepDive":"Passive reconnaissance relies on publicly available information from third-party sources like WHOIS databases, DNS records (e.g., via nslookup or dig), search engines, and Shodan's indexed data. Shodan crawls the internet and stores banners from services, so querying Shodan is passive because it retrieves historical data without contacting the target. In contrast, active methods like SYN scans use raw sockets to send packets and can trigger firewall logs or IDS alerts, which is why they are avoided during stealthy initial reconnaissance.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.09+00:00","questionType":"multi_select"},{"id":"d6994ede-a432-4548-8d50-1f5d6af7734e","slug":"during-a-wireless-penetration-test-you-discover-that-the-ta-jjya0","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Decrypt the traffic using the captured handshake to get the credentials.","explanation":"You need the PMK to decrypt.","masteryContext":""},{"key":"B","isCorrect":false,"text":"WPS PIN brute-force to recover the PSK.","explanation":"WPS is not relevant to Enterprise.","masteryContext":""},{"key":"C","isCorrect":false,"text":"PMKID attack to crack the pre-shared key.","explanation":"PMKID is for Personal mode.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.","explanation":"Rogue RADIUS can capture hashes for cracking.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.","examTrap":"The trap here is that candidates confuse WPA2-Enterprise with WPA2-Personal and incorrectly apply attacks like PMKID or handshake decryption, not realizing that enterprise mode relies on RADIUS-based authentication and is vulnerable to rogue server attacks rather than PSK cracking.","examTip":null,"technicalDeepDive":"PEAP-MSCHAPv2 uses a TLS tunnel to protect the inner authentication, but the challenge and response are still exchanged within that tunnel; a rogue RADIUS server can terminate the TLS tunnel and capture the MSCHAPv2 challenge-response pair. The MSCHAPv2 response is a hash of the user's password, the challenge, and the peer challenge, which can be cracked offline using tools like asleap or john with a dictionary or brute-force attack. In real-world scenarios, this attack is often combined with a rogue access point to force clients to authenticate to the attacker's RADIUS server, bypassing the need for physical proximity to the legitimate network.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:19:40.031+00:00","questionType":"multiple_choice"},{"id":"d7144968-ff27-46ba-b091-c9938998af9f","slug":"a-penetration-tester-is-assessing-the-security-of-a-smart-bu-u21en","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Enable Zigbee security suite (AES-128 encryption) on all sensor devices.","explanation":"Zigbee supports encryption; enabling it protects data in transit.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Configure MQTT to use TLS 1.2 with mutual authentication between brokers and clients.","explanation":"TLS encrypts MQTT traffic, preventing sniffing.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Disable encryption on MQTT to reduce latency and improve performance.","explanation":"Disabling encryption increases vulnerability.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Implement device authentication using pre-shared keys only for Zigbee devices.","explanation":"Authentication alone does not encrypt the payload.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Segment the IoT devices into a separate VLAN and restrict access with ACLs.","explanation":"Segmentation limits exposure but does not encrypt the data.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option A is correct because Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.","examTrap":"The trap here is that candidates often confuse network segmentation (VLANs) with data encryption, thinking that isolating IoT devices on a separate VLAN alone protects the confidentiality of unencrypted wireless frames.","examTip":null,"technicalDeepDive":"Zigbee's security suite uses AES-128-CCM* (a variant of CCM) for both encryption and integrity, with a frame counter to prevent replay attacks. MQTT over TLS 1.2 uses the TLS handshake to negotiate a session key, and mutual authentication requires both the broker and client to present valid X.509 certificates, which is critical in IoT to prevent rogue devices from connecting. In real-world smart buildings, unencrypted Zigbee traffic can be captured with a simple USB dongle and tools like Wireshark or KillerBee, exposing sensor data and enabling device spoofing.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:07:48.664+00:00","questionType":"multi_select"},{"id":"a5574877-1ac6-4347-9008-1303b4e07815","slug":"a-penetration-tester-runs-the-following-nmap-command-nmap-e9e3k","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester runs the following Nmap command: nmap -sU -sS -p 53,161,162,500 10.0.0.1 and receives no responses for UDP scans but standard results for TCP. The tester suspects the target is dropping all UDP packets. Which Nmap option could help increase the likelihood of UDP responses by fragmenting the probe?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"-f","explanation":"-f fragments the probe packets, potentially helping to evade detection or filters that drop undifferentiated UDP traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-T4","explanation":"-T4 sets timing template to aggressive, but does not fragment packets.","masteryContext":""},{"key":"C","isCorrect":false,"text":"--reason","explanation":"--reason displays reasons for port states, not fragmentation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-Pn","explanation":"-Pn skips host discovery, but does not affect fragmentation.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -f option fragments the probe packets into smaller IP fragments. When a target drops unfragmented UDP packets, fragmenting the probes can sometimes bypass simple packet filters or IDS/IPS that drop larger or complete UDP datagrams, increasing the chance that the target will process and respond to the fragments.","examTrap":"The trap here is that candidates often confuse -f (fragmentation) with -T4 (timing) or -Pn (no ping), assuming any option that makes the scan 'faster' or 'more aggressive' will also bypass packet drops, when in fact fragmentation is the specific technique to alter packet structure.","examTip":null,"technicalDeepDive":"Nmap's -f option splits the UDP probe into 8-byte fragments (by default) at the IP layer. This can evade simple stateless firewalls that drop UDP packets based on size or pattern, as each fragment is a separate IP packet that must be reassembled by the target. In real-world scenarios, some network devices or hosts may respond to fragmented UDP probes when they would drop an equivalent unfragmented probe, especially if the target's UDP service expects small packets (e.g., DNS queries on port 53).","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:38:27.715+00:00","questionType":"multiple_choice"},{"id":"34b48029-e4df-4c0e-be67-8447b1c848f5","slug":"a-penetration-tester-is-attempting-to-evade-an-ids-ips-while-r20e6","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Idle scan, fragmentation, and MAC address spoofing","explanation":"Idle scan uses a zombie host (-sI), not used here. MAC spoofing is not part of Nmap's evasion.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Packet timing manipulation, decoy, and avoiding DNS resolution","explanation":"No timing manipulation is shown (e.g., -T). Avoiding DNS resolution is -n, not used.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Fragmentation, decoy, and using a random source IP","explanation":"-f fragments IP packets, --data-length adds random data, and -D RND:10 generates random decoy IPs. The source IP is not random; decoys are additional spoofed sources.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Fragmentation, decoy, and source port spoofing","explanation":"Source port spoofing is not used; -g can set source port, but not present.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because the Nmap command `-sS -f --data-length 20 -D RND:10` employs three evasion techniques: fragmentation (the `-f` flag splits the TCP SYN packet into smaller fragments to bypass simple packet inspection), decoy scanning (`-D RND:10` generates 10 random decoy source IP addresses to obscure the real scanning host), and using a random source IP (the `RND:10` mechanism effectively randomizes the source IP of the probes, making it harder for the IDS/IPS to attribute the scan to a single attacker).","examTrap":"The trap here is that candidates often confuse the `-D RND:10` decoy option with source IP spoofing or idle scanning, but the command does not include the `-sI` flag for idle scanning or `--source-port` for port spoofing, and the `RND:10` specifically randomizes decoy IPs, not the source IP of the attacker's machine.","examTip":null,"technicalDeepDive":"The `-f` flag in Nmap splits the TCP header across multiple IP fragments (typically 8-byte fragment sizes), which can evade IDS/IPS that only reassemble full packets or inspect only the first fragment. The `-D RND:10` option generates 10 random decoy IPs, but the real source IP is still sent among them; the IDS/IPS sees traffic from multiple IPs, making it difficult to isolate the true scanner. In practice, modern IDS/IPS can reassemble fragments and correlate decoy traffic, but these techniques remain effective against simpler or misconfigured systems.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:25:01.692+00:00","questionType":"multiple_choice"},{"id":"37418def-38f6-4281-8505-0a2623a3589d","slug":"during-a-penetration-test-you-are-tasked-with-performing-fo-q3k11","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you are tasked with performing footprinting on a target organization. You have identified the target's IP range 192.168.1.0/24. Which of the following techniques would provide the most comprehensive information about the target's network topology and potential entry points?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Conduct social engineering to gather information from employees about internal network structure.","explanation":"Social engineering collects human knowledge but is less reliable and systematic.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Use traceroute to map the network path and identify intermediate routers and firewalls.","explanation":"Traceroute shows the route packets take, revealing network topology and potential entry points.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Perform a WHOIS lookup to obtain domain registration details including administrative contacts.","explanation":"WHOIS provides registration info, not network topology.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform DNS enumeration to find all subdomains and associated IP addresses.","explanation":"DNS enumeration reveals subdomains and IPs but not the network topology or routers.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Traceroute (using ICMP, UDP, or TCP probes with incrementing TTL values) reveals the Layer 3 path from the tester to the target, identifying each hop (router, firewall, or other gateway) along the route. This directly maps the network topology and can expose intermediate security devices, ACLs, and potential choke points, which is the most comprehensive technique for understanding the target's network layout and entry points from the given options.","examTrap":"The trap here is that candidates confuse footprinting techniques that gather passive information (WHOIS, DNS) with active network path mapping (traceroute), assuming WHOIS or DNS enumeration will reveal network topology when they only reveal domain or host metadata.","examTip":null,"technicalDeepDive":"Traceroute works by sending packets with a Time-To-Live (TTL) starting at 1 and incrementing by 1 for each subsequent probe; each router that decrements the TTL to 0 sends back an ICMP Time Exceeded message, revealing its IP address. In modern networks, firewalls may block ICMP or UDP probes, so TCP SYN traceroute (e.g., using `tcptraceroute` or `nmap -sT -p 80 --traceroute`) is often required to bypass stateful inspection and still map the path. A real-world scenario: during a red team engagement, traceroute revealed a non-standard hop (a transparent proxy) that was not visible in any other footprinting data, providing a critical entry vector.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:23.706+00:00","questionType":"multiple_choice"},{"id":"8fcb6bb5-9cdb-44d2-b485-5d4e94b9354e","slug":"a-security-analyst-notices-a-large-number-of-incomplete-tcp-pw7x0","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"SYN scan (-sS)","explanation":"SYN scan sends SYN and stops after receiving SYN-ACK, leaving the connection half-open (SYN_RECV).","masteryContext":""},{"key":"B","isCorrect":false,"text":"Ping sweep (-sn)","explanation":"Ping sweep only sends ICMP or TCP pings, not SYN packets to ports.","masteryContext":""},{"key":"C","isCorrect":false,"text":"TCP Connect scan (-sT)","explanation":"TCP Connect scan completes the handshake, resulting in ESTABLISHED connections, not SYN_RECV.","masteryContext":""},{"key":"D","isCorrect":false,"text":"UDP scan (-sU)","explanation":"UDP scan uses UDP packets, not TCP, so it does not cause SYN_RECV states.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.","examTrap":"The trap here is that candidates confuse SYN scan with TCP Connect scan, assuming both complete the handshake, but SYN scan deliberately avoids the final ACK to remain stealthy, leaving the connection half-open in SYN_RECV.","examTip":null,"technicalDeepDive":"Under the hood, the SYN_RECV state indicates the server has received a SYN, sent a SYN/ACK, and is waiting for the final ACK to complete the handshake. In a SYN scan, the client sends a RST instead of the ACK, so the server's TCP stack keeps the connection in SYN_RECV until a timeout (typically 60-120 seconds per RFC 793). In real-world scenarios, an attacker might use a SYN flood to exhaust the server's backlog queue, causing denial of service, which is why this scan type is often detected by intrusion detection systems.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:28:43.111+00:00","questionType":"multiple_choice"},{"id":"4b5e9594-63dc-4b01-84da-b0a58be2cd6e","slug":"you-are-investigating-a-suspected-data-exfiltration-network-flrbx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"DNS amplification attack","explanation":"DNS amplification is a DDoS technique.","masteryContext":""},{"key":"B","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS cache poising injects false records, not exfiltration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"DNS zone transfer","explanation":"Zone transfer copies DNS records, not exfiltration.","masteryContext":""},{"key":"D","isCorrect":true,"text":"DNS tunneling","explanation":"DNS tunneling uses DNS queries to exfiltrate data.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.","examTrap":"The trap here is that candidates confuse DNS tunneling with DNS amplification attacks because both involve many DNS queries, but amplification is a DDoS technique focused on volume, not covert data exfiltration via subdomain encoding.","examTip":null,"technicalDeepDive":"DNS tunneling works by encoding arbitrary data into DNS query labels (e.g., base32 or base64 encoded chunks) and sending them to a malicious authoritative server. The server can then extract the data from the query names and respond with encoded commands or acknowledgments in the DNS response. Real-world tools like dnscat2 or Iodine implement this by using the full 255-byte limit of a fully qualified domain name and can even tunnel interactive shells over DNS.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:38:13.899+00:00","questionType":"multiple_choice"},{"id":"0b5f9586-6c48-4e32-af5c-134119c7414a","slug":"a-penetration-tester-obtains-password-hashes-from-a-windows-rxv0e","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)","difficulty":"hard","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Using RainbowCrack with precomputed rainbow tables for NTLM","explanation":"Rainbow tables for NTLM are huge and often impractical; brute-force/dictionary are preferred.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Performing an online brute-force against the SAM database","explanation":"Online attacks are against a live system, not offline against hashes.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Using Ophcrack with rainbow tables for NTLM","explanation":"Ophcrack is primarily for LM hashes, not NTLM (though can do both, but rainbow tables for NTLM are large and less effective).","masteryContext":""},{"key":"D","isCorrect":true,"text":"Using Hashcat with a brute-force attack on GPU","explanation":"Hashcat leverages GPU for high-speed cracking of NTLM hashes.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Using John the Ripper with a dictionary and rules","explanation":"John the Ripper with wordlist and mangling rules can crack many NTLM hashes.","masteryContext":""}],"correctOptionKey":"D,E","correctOptions":["D","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option D is correct because Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.","examTrap":"EC-Council often tests the distinction between tools optimized for LM vs. NTLM hashes, and candidates mistakenly choose Ophcrack (option C) because they confuse its LM rainbow table capability with NTLM support.","examTip":null,"technicalDeepDive":"NTLM hashes are unsalted MD4 digests of the Unicode password, making them vulnerable to precomputation attacks, but GPU-based tools like Hashcat leverage OpenCL or CUDA to parallelize the attack across thousands of cores. In real-world engagements, a hybrid approach using dictionary attacks with rules (option E) combined with brute-force for remaining characters is often the most effective strategy, as pure brute-force can be time-prohibitive for long passwords.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.689+00:00","questionType":"multi_select"},{"id":"1b077c0f-36e0-45d8-8a48-d4abd5d00d10","slug":"during-the-reconnaissance-phase-a-tester-discovers-that-the-o6fhx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS poisoning targets DNS servers.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Email enumeration","explanation":"DSN responses can confirm valid addresses.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"Requires intercepting traffic.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Phishing attack","explanation":"Phishing uses social engineering, not DSN.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.","examTrap":"EC-Council often tests the distinction between passive reconnaissance (like email enumeration via DSN) and active attacks (like MITM or phishing), so candidates mistakenly choose 'Phishing attack' because they associate email servers with phishing, but the question specifically asks what the DSN behavior facilitates during reconnaissance.","examTip":null,"technicalDeepDive":"Under the hood, DSNs are generated by the Mail Transfer Agent (MTA) using the SMTP VRFY or EXPN commands, or via bounce messages when a recipient is unknown. The tester can craft an email with a deliberately invalid recipient and analyze the DSN's status code (e.g., 5.1.1 for unknown user) versus a valid recipient that may return a 2.5.0 success. In real-world scenarios, tools like smtp-user-enum or Metasploit's smtp_enum module automate this by sending RCPT TO commands and parsing the server's response codes.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.524+00:00","questionType":"multiple_choice"},{"id":"407f19b2-a310-4409-a2cf-d6333814a1b3","slug":"you-are-the-lead-security-engineer-for-a-financial-technolog-1mcjz","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.","explanation":"This is a reactive measure and does not confirm the attack type.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.","explanation":"This can confirm a Layer 7 DDoS attack targeting a specific endpoint.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Increase the number of application servers to handle the load.","explanation":"This may alleviate symptoms but does not confirm the attack type.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Run a SQL injection scanner on the application.","explanation":"SQL injection does not typically cause high CPU and 503 errors.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because the symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.","examTrap":"The trap here is that candidates often jump to blocking IPs (Option A) or scaling horizontally (Option C) as immediate fixes, but the CEH exam emphasizes first confirming the attack vector through log analysis rather than taking reactive or misdirected actions.","examTip":null,"technicalDeepDive":"HTTP 503 errors from a reverse proxy (e.g., Nginx, HAProxy) typically indicate upstream server timeouts or resource exhaustion, often due to a Layer 7 DDoS like an HTTP flood targeting a slow API endpoint (e.g., /api/transactions). Under the hood, the reverse proxy queues requests until backend workers are saturated, causing CPU spikes on app servers while memory remains normal—a hallmark of CPU-bound attacks. In real-world scenarios, attackers use botnets to send thousands of legitimate-looking GET/POST requests to a single endpoint, bypassing traditional DDoS mitigation that focuses on bandwidth.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:42.46+00:00","questionType":"multiple_choice"},{"id":"3a02181a-1ecc-4d58-ba22-57d39003f5c2","slug":"a-security-analyst-is-conducting-passive-reconnaissance-on-a-3mccx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst is conducting passive reconnaissance on a target organization. Which THREE of the following are examples of passive reconnaissance techniques? (Select 3)","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Performing a WHOIS lookup on the target's domain","explanation":"WHOIS queries use public databases, no direct target interaction.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Querying a public DNS resolver cache for the target's mail server records","explanation":"DNS cache snooping uses public resolvers without contacting the target's DNS server directly.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Running an Nmap SYN scan against the target's web server","explanation":"SYN scan sends packets to the target; active reconnaissance.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Banner grabbing with Netcat on port 80","explanation":"Banner grabbing connects to the target to retrieve a banner; active reconnaissance.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Using Google dork queries to find exposed documents","explanation":"Google dorking uses search engine results, no direct target interaction.","masteryContext":""}],"correctOptionKey":"A,B,E","correctOptions":["A","B","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"WHOIS queries are a classic passive reconnaissance technique because they retrieve publicly registered domain ownership data from WHOIS databases (e.g., registrar, creation date, name servers) without sending any packets directly to the target's infrastructure. This information is stored by third-party registries and is accessible via standard WHOIS protocol (RFC 3912) or web-based lookup tools, making it completely non-intrusive.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance by including techniques that appear passive (like banner grabbing) but actually involve direct interaction with the target's services, leading candidates to mistakenly classify them as passive.","examTip":null,"technicalDeepDive":"Passive reconnaissance relies solely on publicly available information from third-party sources (e.g., WHOIS databases, DNS resolvers, search engine caches) and does not involve any direct interaction with the target's systems. For example, querying a public DNS resolver (like 8.8.8.8) for MX records is passive because the query is sent to a third-party server, not the target's own DNS server, and the resolver's cache may already contain the records from previous legitimate queries. Google dorking uses search engine indexes to find exposed documents without ever touching the target's servers.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.613+00:00","questionType":"multi_select"},{"id":"d666803e-e951-4f7b-a0ce-f3376bf74db5","slug":"which-three-of-the-following-are-valid-methods-for-enumerati-1q7sj","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)","difficulty":"hard","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Requesting a DNS zone transfer to obtain a list of user account names from the SRV records.","explanation":"DNS zone transfers provide hostnames and IPs, not user account names.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Performing an SMB null session and querying the SAM database.","explanation":"SMB null sessions are a known method for enumerating users on older Windows systems.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Using RID cycling to enumerate users by brute-forcing relative identifiers.","explanation":"RID cycling allows enumeration of user accounts by iterating through RIDs.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Performing an anonymous LDAP query to the domain controller for objectClass=user.","explanation":"LDAP anonymous queries can enumerate user objects if the DC does not restrict them.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Sending Kerberos AS-REQ packets and analyzing the error codes (e.g., KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN).","explanation":"This technique requires knowing a valid username to get a different error; it cannot enumerate unknown users.","masteryContext":""}],"correctOptionKey":"B,C,D","correctOptions":["B","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because an SMB null session (connecting to IPC$ without credentials) can be used to query the SAM database via the SAMR protocol, allowing an attacker to enumerate local user accounts and groups on a Windows system. This technique exploits the default configuration of older Windows versions or improperly secured systems where the null session is not restricted.","examTrap":"EC-Council often tests the distinction between enumeration techniques that require no prior credentials versus those that need a starting list of usernames, causing candidates to mistakenly select Kerberos-based enumeration (Option E) as a credential-less method when it actually requires a candidate username to test.","examTip":null,"technicalDeepDive":"RID cycling (Option C) works by connecting to the SAMR interface via SMB and brute-forcing relative identifiers (RIDs) starting from 500 (Administrator) to enumerate user accounts, as each user has a unique RID appended to the domain SID. Anonymous LDAP queries (Option D) are possible when the domain controller permits unauthenticated binds, allowing retrieval of user objects via filters like (objectClass=user), but this is often disabled in modern Active Directory environments by default.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.67+00:00","questionType":"multi_select"},{"id":"aaa8c0a2-b410-434a-bec1-0361c4df53f9","slug":"a-company-s-internal-pki-uses-an-offline-root-ca-and-an-onli-hskx1","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?","difficulty":"hard","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The CRL published by the certificate authority that signed the issuing CA's certificate","explanation":"That is the root CA, which does not issue end-entity certs.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The CRL published by the intermediate CA, if any","explanation":"There is no intermediate mentioned; the online CA is the issuing CA.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The CRL published by the online issuing CA","explanation":"The issuing CA is responsible for revoking certificates it issued.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The CRL published by the offline root CA","explanation":"The root CA does not issue end-entity certificates.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.","examTrap":"EC-Council often tests the misconception that the root CA must be involved in revocation of end-entity certificates, but in reality only the issuing CA that signed the certificate can revoke it and update its own CRL.","examTip":null,"technicalDeepDive":"In a PKI hierarchy, each CA maintains its own Certificate Revocation List (CRL) as defined in RFC 5280. The CRL Distribution Point (CDP) extension in an end-entity certificate contains URLs pointing to the CRL of the CA that issued that certificate. When a certificate is revoked, the issuing CA must generate a new CRL with the revoked certificate's serial number and update the CRL at the published distribution point. The offline root CA's CRL would only list revoked subordinate CA certificates, not end-entity certificates, because the root CA never directly issues end-entity certificates.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.91+00:00","questionType":"multiple_choice"},{"id":"2d867355-1f80-4e2d-a9d8-243724126011","slug":"refer-to-the-exhibit-a-security-analyst-reviews-a-cloudtrai-g72un","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The action was performed by the AWS root account, which should be avoided for routine tasks.","explanation":"Root should only be used for specific tasks.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The AMI ID (ami-0abcdef1234567890) is from a trusted source.","explanation":"Not a concern.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The source IP address (203.0.113.5) is suspicious.","explanation":"IP address is not inherently suspicious.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The instance type is t2.micro, which may be vulnerable.","explanation":"Instance type is not a security concern.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.","examTrap":"EC-Council often tests the concept that the root account should never be used for routine tasks, and candidates may mistakenly focus on the AMI ID, source IP, or instance type as potential threats, overlooking the critical security violation of root account usage.","examTip":null,"technicalDeepDive":"AWS CloudTrail logs capture API calls made to the AWS environment, including the user identity, source IP, and action details. The root account has unrestricted access to all resources, and if its credentials are leaked, an attacker can perform any action, including deleting all resources or creating backdoor accounts. AWS recommends enabling multi-factor authentication (MFA) on the root account and using IAM roles for daily operations, as the root account lacks fine-grained access control and audit trails for individual users.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nCloudTrail Log:\n{\n \"eventVersion\": \"1.08\",\n \"userIdentity\": {\n \"type\": \"Root\",\n \"arn\": \"arn:aws:iam::123456789012:root\",\n \"accountId\": \"123456789012\"\n },\n \"eventTime\": \"2025-03-15T14:30:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"sourceIPAddress\": \"203.0.113.5\",\n \"userAgent\": \"console.amazonaws.com\",\n \"requestParameters\": {\n \"instanceType\": \"t2.micro\",\n \"imageId\": \"ami-0abcdef1234567890\",\n \"keyName\": \"test-key\"\n },\n \"responseElements\": {\n \"instancesSet\": {\n \"items\": [\n {\n \"instanceId\": \"i-0a1b2c3d4e5f67890\"\n }\n ]\n }\n },\n \"eventType\": \"AwsApiCall\"\n}\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.933+00:00","questionType":"multiple_choice"},{"id":"26170fdb-36ce-4dc0-a03f-7db8c0f2be9c","slug":"which-of-the-following-google-dorks-would-an-attacker-most-l-p4d5i","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"intitle:login","explanation":"This dork returns pages where the title contains 'login', often used to find login portals.","masteryContext":""},{"key":"B","isCorrect":false,"text":"inurl:robots.txt","explanation":"This finds robots.txt files, not login pages.","masteryContext":""},{"key":"C","isCorrect":false,"text":"filetype:pdf","explanation":"This searches for PDF files, not login pages.","masteryContext":""},{"key":"D","isCorrect":false,"text":"cache:example.com","explanation":"This shows cached version of a page, not a search for login pages.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.","examTrap":"EC-Council often tests the distinction between operators that find specific page content (like 'intitle:') versus those that find file types or cached data, leading candidates to confuse 'inurl:robots.txt' (which finds a specific file) with finding login pages.","examTip":null,"technicalDeepDive":"Google dorks leverage advanced search operators that interact with Google's index. The 'intitle:' operator restricts results to pages where the search term appears in the <title> tag, which is a standard HTML element defined in the HTML specification. Attackers often combine 'intitle:login' with other operators like 'inurl:admin' to narrow results, and they may use tools like 'GoogDork' or 'dorkbot' to automate queries against Google's search API, though this violates Google's ToS.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.374+00:00","questionType":"multiple_choice"},{"id":"571463a3-bc73-430f-a3aa-c258bd5da37b","slug":"a-penetration-tester-runs-the-following-command-masscan-10-nsvug","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Masscan can scan a large number of hosts and ports at very high speed","explanation":"Masscan's main advantage is its speed. It can scan large ranges quickly, as indicated by the high rate.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Masscan provides more detailed service version detection than Nmap","explanation":"Masscan is primarily a port scanner; it does not have version detection capabilities like Nmap's -sV.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Masscan is stealthier than Nmap and less likely to be detected","explanation":"Masscan's high-speed scanning can actually be more noisy and easier to detect. Nmap's decoy and timing options can be stealthier.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Masscan can scan all 65535 ports faster than Nmap","explanation":"While Masscan is faster, the command only scans three ports, not all ports. The statement is true but not specific to this command.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.","examTrap":"EC-Council often tests the misconception that Masscan is stealthier than Nmap, but in reality, its high packet rate makes it more detectable, and the trap here is that candidates confuse speed with stealth.","examTip":null,"technicalDeepDive":"Masscan uses a custom TCP/IP stack and asynchronous I/O to send packets without waiting for responses, achieving speeds that can saturate a 10 Gbps link. It operates at the raw socket level, bypassing the kernel's TCP stack, which allows it to maintain state for millions of concurrent connections. In real-world penetration tests, Masscan is often used for initial broad reconnaissance to quickly identify live hosts and open ports, followed by Nmap for detailed service enumeration on the discovered targets.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.342+00:00","questionType":"multiple_choice"},{"id":"1fc7ab9f-3078-44a6-ac95-925b364e4b13","slug":"which-two-of-the-following-nmap-flags-are-used-for-evasion-o-ahfcm","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-sV","explanation":"-sV is for version detection, not evasion.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-O","explanation":"-O is for OS detection.","masteryContext":""},{"key":"C","isCorrect":true,"text":"-D","explanation":"Decoy scan uses multiple source IPs to confuse IDS.","masteryContext":""},{"key":"D","isCorrect":true,"text":"-f","explanation":"Fragment packets to evade signature detection.","masteryContext":""},{"key":"E","isCorrect":false,"text":"-sT","explanation":"-sT is a connect scan, not evasion.","masteryContext":""}],"correctOptionKey":"C,D","correctOptions":["C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C (-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.","examTrap":"EC-Council often tests the misconception that -sV or -O are evasion techniques because they are 'stealthy' in some contexts, but the CEH exam specifically requires knowing that decoys (-D) and fragmentation (-f) are the standard Nmap evasion flags.","examTip":null,"technicalDeepDive":"The -D flag works by sending packets from decoy IPs (up to 16) alongside the real source IP; the IDS/IPS must correlate all traffic to identify the true scanner, which is computationally expensive and often fails. The -f flag splits the TCP header (typically 20 bytes) into multiple 8-byte fragments, causing the IDS/IPS to reassemble them before inspection—many signature-based systems drop fragments or fail to reassemble correctly, allowing the scan to pass undetected. In real-world scenarios, combining -D with -f (e.g., nmap -D RND:10 -f 192.168.1.1) creates a layered evasion strategy that overwhelms both stateful inspection and pattern matching.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.143+00:00","questionType":"multi_select"},{"id":"07cf9d30-6429-458a-9243-2f48e7fece4b","slug":"refer-to-the-exhibit-an-attacker-gains-access-to-the-user-s-5eetq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?","difficulty":"easy","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"User profile (C:\\Users\\jdoe)","explanation":"User profile is a folder, not a specific file.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Home directory on \\\\fileserver\\home\\jdoe","explanation":"Home directory is a network share, not a specific file.","masteryContext":""},{"key":"C","isCorrect":true,"text":"logon.bat script","explanation":"Logon scripts may contain credentials for network resources.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Active Directory database (NTDS.dit)","explanation":"NTDS.dit is on the domain controller, not the workstation.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because logon.bat scripts are commonly used in Windows environments to map network drives or perform startup tasks, and administrators often embed plaintext credentials in such scripts for automation. An attacker who compromises the workstation can read this batch file to extract stored passwords, making it a high-value target for credential theft.","examTrap":"EC-Council often tests the misconception that credentials are always stored in system databases like NTDS.dit or SAM, but the trap here is that attackers target easily accessible, plaintext files like logon scripts that users or administrators create for convenience.","examTip":null,"technicalDeepDive":"Logon scripts like logon.bat are executed via Group Policy or local startup settings, and they often include net use commands with embedded passwords for drive mappings. Under the hood, these scripts are stored in locations such as C:\\Windows\\System32\\GroupPolicy\\Machine\\Scripts or the user's startup folder, and they can be read by any user with local access. In real-world attacks, penetration testers frequently find domain admin credentials in such scripts, leading to full domain compromise.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nExhibit:\nC:\\Users\\jdoe> net user jdoe /domain\nThe request will be processed at a domain controller for domain corp.xyz.com.\n\nUser name jdoe\nFull Name John Doe\nComment\nUser's comment\nCountry code 001 (United States)\nAccount active Yes\nAccount expires Never\n\nPassword last set 6/15/2024 9:30:00 AM\nPassword expires 9/13/2024 9:30:00 AM\nPassword changeable 6/16/2024 9:30:00 AM\nPassword required Yes\nUser may change password Yes\n\nWorkstations allowed All\nLogon script logon.bat\nUser profile\nHome directory \\\\fileserver\\home\\jdoe\nLast logon 7/10/2024 2:15:00 PM\n\nLogon hours allowed All\n\nLocal Group Memberships *Domain Users\nGlobal Group memberships *Domain Users\nThe command completed successfully.","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.761+00:00","questionType":"multiple_choice"},{"id":"48442be4-4d53-476b-a4a9-06ac388be421","slug":"which-of-the-following-tools-is-specifically-designed-to-per-wecga","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"hping3","explanation":"hping3 is a packet crafting tool, not optimized for internet-wide scanning.","masteryContext":""},{"key":"B","isCorrect":false,"text":"OpenVAS","explanation":"OpenVAS is a vulnerability scanner, not a port scanner.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Masscan","explanation":"Masscan is designed for high-speed scanning of large address spaces.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap","explanation":"Nmap is versatile but slower on large ranges than Masscan.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.","examTrap":"The trap here is that candidates often choose Nmap because it is the most famous scanning tool, but the question specifically asks for a tool designed for 'fast internet-wide scanning,' which is Masscan's unique selling point over Nmap's slower, more thorough approach.","examTip":null,"technicalDeepDive":"Masscan uses a custom TCP/IP stack and asynchronous raw sockets to send and receive packets without per-packet system call overhead, achieving scan rates of 10 million packets per second on a 10 Gbps link. It supports the same nmap-style port specification and can output results in formats compatible with Nmap, but its stateless scanning approach means it cannot perform service version detection or OS fingerprinting during the scan itself.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:37:52.121+00:00","questionType":"multiple_choice"},{"id":"b6b88410-7754-460d-89b5-5b79dd4e167d","slug":"which-three-of-the-following-are-common-indicators-of-a-soci-1gw7d","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are common indicators of a social engineering attack? (Choose three.)","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The communication includes verifiable contact information","explanation":"Legitimate communications often include verifiable info.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The sender uses a generic greeting like 'Dear Customer'","explanation":"Generic greetings are common in mass phishing but not definitive.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The communication creates a sense of urgency","explanation":"Attackers often pressure targets to act quickly.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The message contains spelling or grammatical errors","explanation":"Errors can indicate a fake message.","masteryContext":""},{"key":"E","isCorrect":true,"text":"The request comes from someone claiming to be in authority","explanation":"Impersonating authority figures is common.","masteryContext":""}],"correctOptionKey":"C,D,E","correctOptions":["C","D","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C is correct because social engineers frequently fabricate a sense of urgency to bypass the victim's rational decision-making. By claiming an immediate deadline or threat (e.g., 'Your account will be locked in 24 hours'), the attacker pressures the target into acting without verifying the request, a tactic rooted in the psychological principle of scarcity.","examTrap":"The trap here is that candidates mistake generic greetings (Option B) as a definitive indicator, when in fact the CEH emphasizes that urgency, authority, and errors are the three most reliable technical indicators of a social engineering attempt.","examTip":null,"technicalDeepDive":"Social engineering exploits cognitive biases such as authority (Milgram's obedience experiments) and urgency (scarcity heuristic). In a real-world scenario, an attacker might spoof the CEO's email display name (but not the actual SMTP envelope) to request an urgent wire transfer, relying on the victim's deference to authority and time pressure to bypass normal verification procedures like callback confirmation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:45.968+00:00","questionType":"multi_select"},{"id":"51713f58-f2c4-43c1-9d88-3b6c4cea3e39","slug":"which-three-of-the-following-are-valid-dns-record-types-that-o78xq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"FTP (file transfer)","explanation":"FTP is a service, not a DNS record type.","masteryContext":""},{"key":"B","isCorrect":true,"text":"A (IPv4 address)","explanation":"A records map hostnames to IP addresses, revealing the target's IP.","masteryContext":""},{"key":"C","isCorrect":true,"text":"NS (name server)","explanation":"NS records identify authoritative name servers, crucial for zone transfer attempts.","masteryContext":""},{"key":"D","isCorrect":false,"text":"HTTP (hypertext transfer)","explanation":"HTTP is a protocol, not a DNS record type.","masteryContext":""},{"key":"E","isCorrect":true,"text":"MX (mail exchange)","explanation":"MX records reveal mail server hostnames, useful for email enumeration.","masteryContext":""}],"correctOptionKey":"B,C,E","correctOptions":["B","C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. This is a standard DNS query type defined in RFC 1035.","examTrap":"EC-Council often tests the distinction between DNS record types and application-layer protocols, so candidates mistakenly select FTP or HTTP because they are common network services, but they are not valid DNS resource records.","examTip":null,"technicalDeepDive":"DNS A records are stored in zone files and are queried using tools like `nslookup` or `dig A example.com`. Attackers often use A records to map a domain to its IP address, then perform reverse DNS lookups or scan the IP for open ports. In real-world reconnaissance, enumerating A records can reveal load-balanced or CDN-backed IPs, which may require additional probing to identify the origin server.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.182+00:00","questionType":"multi_select"},{"id":"f555813f-bbe4-45e0-9b7d-2cbde9cc4db8","slug":"a-penetration-tester-wants-to-identify-live-hosts-on-a-large-0wfr5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Masscan","explanation":"Masscan is designed for high-speed scanning of large address spaces.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Maltego","explanation":"Maltego is an OSINT and graphing tool, not a network scanner.","masteryContext":""},{"key":"C","isCorrect":false,"text":"dnsenum","explanation":"dnsenum is for DNS enumeration, not host discovery.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nessus","explanation":"Nessus is a vulnerability scanner, not optimized for fast host discovery.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.","examTrap":"The trap here is that candidates confuse 'host discovery' with 'vulnerability scanning' or 'OSINT gathering', leading them to choose Nessus or Maltego, but the question specifically asks for minimal traffic and speed, which only Masscan's asynchronous SYN scan achieves.","examTip":null,"technicalDeepDive":"Masscan operates by sending raw TCP SYN packets with a custom IP header, using a user-defined rate (e.g., --rate=100000) and a random source IP to avoid detection. It uses a technique called 'asynchronous scanning' where it sends packets and listens for responses without maintaining state per connection, allowing it to scale to millions of packets per second. In real-world engagements, this is critical for quickly mapping a /8 subnet (16 million IPs) in minutes, whereas Nmap would take hours at default speeds.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:27:58.904+00:00","questionType":"multiple_choice"},{"id":"ea7d7f54-1983-4253-83a8-e9aa25f5f958","slug":"refer-to-the-exhibit-an-analyst-runs-an-nmap-scan-and-finds-ex-euhi","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"CVE-2021-41773 (Apache Path Traversal)","explanation":"Apache 2.4.49 is vulnerable to CVE-2021-41773, a path traversal and remote code execution vulnerability.","masteryContext":""},{"key":"B","isCorrect":false,"text":"CVE-2017-5638 (Struts2 RCE)","explanation":"Struts2 vulnerability is for Java applications, not Apache HTTPD.","masteryContext":""},{"key":"C","isCorrect":false,"text":"CVE-2014-0160 (Heartbleed)","explanation":"Heartbleed affects OpenSSL, not Apache version 2.4.49 specifically.","masteryContext":""},{"key":"D","isCorrect":false,"text":"CVE-2020-1472 (Zerologon)","explanation":"Zerologon affects Windows Netlogon, not Linux Apache or MySQL.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"nmap -sV -p 80,443,3306 192.168.1.100\n\nStarting Nmap 7.80 ( https://nmap.org ) at 2023-01-20 10:30\nNmap scan report for 192.168.1.100\nHost is up (0.0012s latency).\n\nPORT STATE SERVICE VERSION\n80/tcp open http Apache httpd 2.4.49\n443/tcp open ssl/http Apache httpd 2.4.49\n3306/tcp open mysql MySQL 5.7.35","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-25T06:19:10.204037+00:00","questionType":"multiple_choice"},{"id":"23778411-05c3-4867-afc3-9fcef123f421","slug":"an-incident-responder-analyzes-logs-and-finds-repeated-faile-5dgc7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"NS records","explanation":"NS records specify authoritative name servers; they do not control zone transfer permissions.","masteryContext":""},{"key":"B","isCorrect":true,"text":"AXFR","explanation":"AXFR is the DNS query type for zone transfers. Allowing AXFR from unauthorized hosts is a misconfiguration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"MX records","explanation":"MX records specify mail servers; they are not related to zone transfers.","masteryContext":""},{"key":"D","isCorrect":false,"text":"SOA records","explanation":"SOA records contain administrative information but do not control zone transfer permissions.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.","examTrap":"The trap here is that candidates confuse the DNS record type (e.g., NS, SOA) with the protocol or query type (AXFR) used to perform the zone transfer, leading them to select a record type instead of recognizing AXFR as the specific misconfiguration that enables the attack.","examTip":null,"technicalDeepDive":"Under the hood, DNS zone transfers use TCP port 53 (not UDP) and are initiated with an AXFR query; a properly secured DNS server should restrict AXFR to trusted secondary DNS servers via IP allow lists or TSIG (Transaction Signatures, RFC 2845). In real-world scenarios, misconfigured DNS servers on internal networks or cloud environments have been exploited to leak internal hostnames, IP addresses, and network topology, aiding further reconnaissance like subdomain enumeration or targeted attacks.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:36:40.257+00:00","questionType":"multiple_choice"},{"id":"f3e4deb0-0ef7-444d-b95d-a07c36c2ba58","slug":"during-a-vulnerability-scan-with-nessus-you-find-that-port-8empd","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a vulnerability scan with Nessus, you find that port 445/TCP is open on a Windows server. Which of the following is the MOST likely associated risk?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SNMP community string brute-forcing","explanation":"SNMP uses UDP ports 161/162.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Remote code execution via SMB vulnerabilities","explanation":"SMB on port 445 has known RCE vulnerabilities.","masteryContext":""},{"key":"C","isCorrect":false,"text":"HTTP directory traversal","explanation":"HTTP uses port 80/443.","masteryContext":""},{"key":"D","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS uses port 53.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Port 445/TCP is used by Microsoft SMB (Server Message Block) over a direct TCP connection, commonly known as SMB over TCP. SMB has historically been plagued by critical remote code execution vulnerabilities, most notably EternalBlue (MS17-010) exploited by WannaCry. Therefore, an open SMB port on a Windows server presents a high risk of remote code execution if unpatched.","examTrap":"The trap here is that candidates may associate port 445 with file sharing only and overlook its history of critical remote code execution vulnerabilities, instead choosing a more generic or unrelated attack vector like HTTP directory traversal.","examTip":null,"technicalDeepDive":"SMB operates as a network file sharing protocol that uses named pipes and authenticated sessions. The SMBv1 protocol, which lacks proper session security, allowed the EternalBlue exploit to send specially crafted packets that triggered a buffer overflow in the SMB driver (srv2.sys), enabling arbitrary code execution with SYSTEM privileges. Even in modern environments, misconfigured SMB shares or unpatched systems remain a common entry point for lateral movement.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:25:43.198+00:00","questionType":"multiple_choice"},{"id":"33521746-4bf1-49ea-9891-cf5208f10613","slug":"refer-to-the-exhibit-a-penetration-tester-sends-a-soap-requ-ex-ku2u","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"SQL injection in SOAP service","explanation":"The userId parameter contains '1 OR 1=1', which results in returning all users, indicating SQL injection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"XML External Entity (XXE) injection","explanation":"XXE exploits external entity parsing to read files or perform SSRF, not SQL injection via SOAP.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Cross-site scripting (XSS)","explanation":"XSS involves client-side script injection, not server-side SQL injection.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Command injection","explanation":"Command injection involves OS commands, not SQL queries.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Body>\n <getUserInfo>\n <userId>1 OR 1=1</userId>\n </getUserInfo>\n </soap:Body>\n</soap:Envelope>\n\nResponse:\n<soap:Envelope>\n <soap:Body>\n <getUserInfoResponse>\n <user>\n <id>1</id>\n <name>admin</name>\n <email>admin@test.com</email>\n </user>\n <user>\n <id>2</id>\n <name>user</name>\n <email>user@test.com</email>\n </user>\n </getUserInfoResponse>\n </soap:Body>\n</soap:Envelope>","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-25T06:19:10.382746+00:00","questionType":"multiple_choice"},{"id":"eea60fc6-d577-4504-b189-ea964e807079","slug":"a-penetration-tester-discovers-that-a-target-windows-system-2e41h","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?","difficulty":"easy","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nikto","explanation":"Nikto is a web vulnerability scanner, not for SMB.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Hydra","explanation":"Hydra is for password brute-forcing, not enumeration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Nmap","explanation":"Nmap scans ports but does not perform detailed SMB enumeration.","masteryContext":""},{"key":"D","isCorrect":true,"text":"enum4linux","explanation":"Correct: enum4linux extracts SMB information like users, shares, and OS details.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.","examTrap":"The trap here is that candidates may choose Nmap because it is a versatile tool that can perform SMB enumeration with scripts, but the CEH exam expects the specialized tool (enum4linux) for this specific task, as Nmap is primarily a port scanner and not the dedicated enumeration tool.","examTip":null,"technicalDeepDive":"enum4linux uses the SMB RPC (Remote Procedure Call) interface to query the target system, specifically calling functions like NetShareEnum, NetUserEnum, and NetServerGetInfo via the SMB protocol. It can also retrieve the OS version by parsing the SMB negotiation response, which includes the OS major and minor version numbers. In a real-world scenario, an attacker might use enum4linux to identify a legacy Windows system (e.g., Windows 2000) that is vulnerable to EternalBlue, then pivot to exploitation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:11:28.846+00:00","questionType":"multiple_choice"},{"id":"8c7089ef-58da-4f17-ab38-2e0d9badabe5","slug":"a-company-wants-to-secure-its-email-communications-using-dig-g2v0a","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Sender's public key","explanation":"Public key is used by others to verify, not to sign.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Sender's private key","explanation":"The sender signs with their private key.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Recipient's private key","explanation":"Recipient's private key is for decryption.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Recipient's public key","explanation":"Recipient's public key is for encryption.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).","examTrap":"The trap here is that candidates confuse the roles of keys in encryption vs. signing, often selecting the sender's public key because they associate 'public' with sharing, but signing requires the private key to prove the sender's identity.","examTip":null,"technicalDeepDive":"Under the hood, the sender's private key generates a hash of the email content and encrypts that hash to create the digital signature. The recipient decrypts the hash with the sender's public key and compares it to a freshly computed hash of the email; a match confirms integrity and sender identity. In S/MIME, the sender's certificate containing the public key is often attached to the signed message for seamless verification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:53.901+00:00","questionType":"multiple_choice"},{"id":"3625dac7-beac-4910-a33b-c789038fad9e","slug":"which-two-of-the-following-are-common-security-risks-associa-xh3ss","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are common security risks associated with bring-your-own-device (BYOD) policies in a corporate environment?","difficulty":"medium","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Lack of visibility into device security posture","explanation":"IT may not know if devices are compromised.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Data leakage through personal apps","explanation":"Personal apps may not follow corporate security policies.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enhanced network segmentation","explanation":"Segmentation is a security measure, not a risk.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Stronger encryption of corporate data","explanation":"Encryption is a protection, not a risk.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Increased control over device configurations","explanation":"BYOD usually reduces control.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option A is correct because BYOD devices are personally owned and not under direct corporate management, leading to a lack of visibility into their security posture. Without a Mobile Device Management (MDM) or Unified Endpoint Management (UEM) solution, the organization cannot assess patch levels, antivirus status, or jailbreak/root status, leaving the network exposed to compromised devices.","examTrap":"EC-Council often tests the distinction between risks and controls; the trap here is that candidates confuse security mitigations (like segmentation or encryption) with inherent risks, leading them to select options C, D, or E instead of recognizing them as countermeasures.","examTip":null,"technicalDeepDive":"Under the hood, BYOD risks stem from the lack of a trusted platform module (TPM) or hardware-backed keystore enforcement on personal devices. For example, a user’s personal app with weak permissions (e.g., an Android app targeting API level 23 without runtime permission checks) can exfiltrate corporate email attachments via the shared storage, bypassing Data Loss Prevention (DLP) policies. Real-world scenarios include the 'Stagefright' vulnerability on unpatched Android devices allowing remote code execution through MMS, which a corporate IT team cannot remediate without device control.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.28+00:00","questionType":"multi_select"},{"id":"c5f98d60-1b7d-426a-8ae1-7cf736366621","slug":"an-employee-receives-an-email-that-appears-to-be-from-the-ce-tuvuy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Pharming","explanation":"Pharming redirects users to fraudulent websites.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Spear phishing","explanation":"Spear phishing targets a specific person, but does not necessarily impersonate a high-level executive.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Whaling","explanation":"Whaling targets senior executives or impersonates them.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Vishing","explanation":"Vishing uses phone calls, not email.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.","examTrap":"EC-Council often tests the distinction between spear phishing and whaling by emphasizing that whaling specifically targets senior executives, while spear phishing can target any individual or role within an organization.","examTip":null,"technicalDeepDive":"Whaling often leverages social engineering to bypass technical controls like email filters by using lookalike domains (e.g., ceo@cornpany.com instead of ceo@company.com) or spoofed display names. Attackers may also research the target's organizational hierarchy and communication patterns to craft a believable request, exploiting the trust placed in executive authority. In real-world scenarios, such attacks have led to significant financial losses, as employees are conditioned to obey urgent requests from leadership without verification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.029+00:00","questionType":"multiple_choice"},{"id":"d35d877d-8b0d-4095-ac28-e347f5a80e72","slug":"a-penetration-tester-uses-the-following-nmap-command-nmap-ffe44","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"It confirms the OS is Linux 2.6.x","explanation":"OS detection already identified the OS; -sV is for service versions.","masteryContext":""},{"key":"B","isCorrect":false,"text":"It checks if the port is filtered by a firewall","explanation":"Version scanning does not determine filtering; it only identifies the service version.","masteryContext":""},{"key":"C","isCorrect":true,"text":"It identifies the version of the SSH service running","explanation":"-sV performs version detection on the specified port.","masteryContext":""},{"key":"D","isCorrect":false,"text":"It performs a UDP scan on port 22","explanation":"UDP scan requires -sU; -sV on a TCP port is still TCP.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.","examTrap":"The trap here is confusing OS detection (`-O`) with service version detection (`-sV`), leading candidates to think `-sV` confirms the OS when it actually identifies the application version running on the port.","examTip":null,"technicalDeepDive":"Under the hood, `-sV` works by completing a TCP three-way handshake (if the port is open) and then sending a series of probes (e.g., NULL, FIN, or application-specific payloads) to elicit a response from the service. Nmap compares the response against a database of service fingerprints (nmap-service-probes) to identify the exact version. In real-world scenarios, knowing the SSH version helps identify vulnerable software (e.g., OpenSSH < 7.4 with CVE-2016-10009) or misconfigurations, which is critical for penetration testing.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:31:33.372+00:00","questionType":"multiple_choice"}],"countMismatch":null}] </article></body></html>

26:["$","$L34",null,{"vendorSlug":"ec-council","examSlug":"ec-ceh","examName":"Certified Ethical Hacker CEH","examCode":"CEH","mode":"timed","requestedCount":120,"questions":[{"id":"28a172d0-707f-4595-abcf-16914d8e46b7","slug":"refer-to-the-exhibit-a-security-analyst-runs-netstat-on-a-c-h8o1v","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst runs netstat on a compromised Windows machine. Based on the output, which process is most likely associated with the malicious activity?","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The process with PID 1234 is not identified","explanation":"It is identified as explorer.exe from the last line.","masteryContext":""},{"key":"B","isCorrect":true,"text":"explorer.exe (PID 1234)","explanation":"Explorer.exe is making connections to a suspicious IP on port 4444, which is abnormal.","masteryContext":""},{"key":"C","isCorrect":false,"text":"svchost.exe (PID 5678)","explanation":"svchost.exe connection is to port 80 (HTTP) and is in TIME_WAIT, less suspicious.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The process with PID 5678 is not identified","explanation":"It is identified as svchost.exe.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because netstat output showing a suspicious external connection (e.g., to an unknown IP on port 4444) associated with PID 1234, which is identified as explorer.exe, indicates that the Windows shell process has been hijacked or injected with malicious code. Explorer.exe is not a typical network-listening process; its involvement in outbound connections to a non-standard port strongly suggests malware has injected a reverse shell or beacon into this legitimate system process to evade detection.","examTrap":"EC-Council often tests the misconception that svchost.exe is always the malicious process because it hosts many services, but the trap here is that explorer.exe can be hijacked for persistence and network communication, and candidates fail to recognize that a legitimate-looking process name does not guarantee it is benign.","examTip":null,"technicalDeepDive":"Netstat with the -b or -o flag displays the executable name and PID for each active connection; in this scenario, explorer.exe (PID 1234) shows an established TCP connection to a remote IP on port 4444, a common port for reverse shells (e.g., Metasploit payloads). Under the hood, malware often performs DLL injection or process hollowing into explorer.exe to blend in with normal system activity, as security tools may overlook network connections from trusted processes. In real-world investigations, analysts use 'netstat -ano' to find anomalous PIDs, then cross-reference with Task Manager or 'tasklist /svc' to identify injected processes.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nC:\\Users\\Admin>netstat -anob\n\nActive Connections\n\n Proto Local Address Foreign Address State PID\n TCP 192.168.1.10:49152 203.0.113.5:4444 ESTABLISHED 1234\n TCP 192.168.1.10:49153 198.51.100.20:80 TIME_WAIT 5678\n [svchost.exe]\n TCP 192.168.1.10:49154 203.0.113.5:4444 ESTABLISHED 1234\n [explorer.exe]","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.123+00:00","questionType":"multiple_choice"},{"id":"1c3c42bd-30ac-4f22-9a25-6a03d36bf75e","slug":"based-on-the-exhibit-which-service-should-be-targeted-first-7t2b3","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Based on the exhibit, which service should be targeted first to gain initial access with the highest chance of success?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"HTTP (80) - exploit Apache vulnerability","explanation":"CVE-2015-0228 is a mod_lua DoS, not RCE; low severity.","masteryContext":""},{"key":"B","isCorrect":false,"text":"SSH (22) - brute force user credentials","explanation":"CVE-2016-6210 is a user enumeration flaw, not remote code execution; brute force is noisy and time-consuming.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Proxy (8080) - exploit Squid vulnerability","explanation":"CVE-2019-12524 is a DoS or cache poisoning, not direct RCE; less effective for initial access.","masteryContext":""},{"key":"D","isCorrect":true,"text":"MySQL (3306) - exploit CVE-2016-6662","explanation":"This critical vulnerability allows remote code execution without authentication, making it the best initial vector.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"MySQL (3306) is the correct target because CVE-2016-6662 is a critical remote code execution vulnerability in MySQL that allows an attacker to inject malicious configuration directives via a crafted `my.cnf` file, leading to arbitrary code execution with the privileges of the MySQL daemon (typically root). This provides a reliable, high-impact initial access vector without requiring authentication or brute-forcing, making it the highest-chance option among the listed services.","examTrap":"EC-Council often tests the misconception that HTTP or SSH are always the easiest initial footholds, but in this scenario the MySQL CVE-2016-6662 exploit is a known, high-success-rate vector that requires no brute-forcing or version guessing, making it the most reliable choice for initial access.","examTip":null,"technicalDeepDive":"CVE-2016-6662 exploits MySQL's ability to write configuration files via the `SELECT ... INTO OUTFILE` or `INTO DUMPFILE` commands, combined with a symlink attack or direct file write to overwrite `my.cnf`. When MySQL is restarted (or via a trigger), the malicious config loads a shared library that executes arbitrary code. This attack works even with low-privileged MySQL users if file write permissions are lax, and it bypasses authentication because the exploit occurs before the MySQL authentication layer is fully initialized.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nTarget: 192.168.1.10\nPort scanning results:\nPORT STATE SERVICE\n22/tcp open ssh\n80/tcp open http\n443/tcp open https\n3306/tcp open mysql\n8080/tcp open http-proxy\n\nVulnerability scan summary:\n- SSH: OpenSSH 7.2p2 (CVE-2016-6210 - High)\n- HTTP: Apache 2.4.7 (CVE-2015-0228 - Medium)\n- MySQL: MySQL 5.5.52 (CVE-2016-6662 - Critical)\n- Proxy: Squid 3.5.23 (CVE-2019-12524 - High)","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.971+00:00","questionType":"multiple_choice"},{"id":"90039ab2-2aa8-4854-8ee8-4ba108caf1cd","slug":"an-organization-is-implementing-a-social-engineering-defense-stlrd","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An organization is implementing a social engineering defense program. Which TWO measures are most effective in reducing the risk of phishing attacks? (Choose two.)","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Implement strong password policies with multi-factor authentication.","explanation":"Passwords do not prevent users from clicking malicious links.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Enforce regular software updates and patch management.","explanation":"Patching addresses technical vulnerabilities, not social engineering.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Conduct regular security awareness training for all employees.","explanation":"Training helps users identify and report phishing attempts.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Deploy network segmentation and access control lists.","explanation":"Segmentation limits damage but does not prevent phishing.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Install advanced email filtering and anti-malware solutions.","explanation":"Filters block many phishing emails before reaching users.","masteryContext":""}],"correctOptionKey":"C,E","correctOptions":["C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C is correct because regular security awareness training directly addresses the human factor in phishing attacks. Employees learn to identify suspicious emails, avoid clicking malicious links, and report incidents promptly, which is critical since technical controls alone cannot prevent all phishing attempts. This training reinforces behaviors like verifying sender addresses and not bypassing security protocols, reducing the likelihood of successful social engineering.","examTrap":"The trap here is that candidates often confuse technical controls (like MFA or patching) with social engineering defenses, failing to recognize that phishing primarily exploits human behavior, not system vulnerabilities, so the most effective measures are those that address the human element and the delivery channel (email).","examTip":null,"technicalDeepDive":"Phishing attacks often leverage email spoofing techniques like SMTP without SPF/DKIM/DMARC validation, or use lookalike domains (e.g., 'rnicrosoft.com' instead of 'microsoft.com'). Advanced email filtering (Option E) uses machine learning models and reputation scoring to detect such anomalies, while security awareness training teaches users to inspect email headers and hover over links before clicking. In a real-world scenario, a spear-phishing email targeting an executive might bypass filters by using a compromised legitimate account, making user vigilance the last line of defense.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:40.808+00:00","questionType":"multi_select"},{"id":"7b02fe6e-ee0b-4fa8-a4c6-52ed8be2631c","slug":"a-penetration-tester-uses-theharvester-to-gather-information-5we9r","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester uses theHarvester to gather information about a target domain. Which of the following data types is theHarvester PRIMARILY designed to collect?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Live network traffic captures","explanation":"theHarvester does not capture network traffic; it uses public sources.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Passwords hashes","explanation":"theHarvester does not collect passwords.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Email addresses and subdomains","explanation":"Its primary purpose is to gather emails and subdomains associated with a domain.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Vulnerability scan results","explanation":"Vulnerability scanning is done by tools like Nessus, not theHarvester.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"theHarvester is an open-source intelligence (OSINT) tool designed to perform passive reconnaissance by querying public sources such as search engines (Google, Bing), PGP key servers, and the Shodan API. Its primary function is to collect email addresses, subdomains, IP addresses, and virtual hosts associated with a target domain, aiding in the footprinting phase of a penetration test.","examTrap":"The trap here is that candidates confuse theHarvester's passive OSINT collection with active scanning or exploitation tools, leading them to select options related to network traffic, password cracking, or vulnerability scanning.","examTip":null,"technicalDeepDive":"theHarvester leverages APIs and search engine scraping to gather data without directly interacting with the target infrastructure, making it a stealthy reconnaissance tool. It supports multiple data sources (e.g., Google, Bing, Yahoo, Baidu, Shodan, and DNS brute-forcing) and can output results in HTML, XML, or JSON formats. In a real-world engagement, theHarvester's collected email addresses are often used to build a target list for phishing campaigns, while subdomains help map the external attack surface.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:35:00.938+00:00","questionType":"multiple_choice"},{"id":"9e2ef589-1926-4320-9ce4-832fb6c327cf","slug":"an-analyst-wants-to-perform-a-syn-flood-attack-test-against-hpbjb","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An analyst wants to perform a SYN flood attack test against a server to evaluate its resilience. Which of the following tools would be the MOST appropriate for this task?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nmap","explanation":"Nmap is primarily a port scanner, not designed for high-rate packet generation for DoS testing, though it can send some raw packets.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Shodan","explanation":"Shodan is a search engine for internet-connected devices, not a tool for generating network traffic.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Wireshark","explanation":"Wireshark is a packet analyzer, not a packet generator. It captures but does not send packets.","masteryContext":""},{"key":"D","isCorrect":true,"text":"hping3","explanation":"hping3 can generate a high volume of SYN packets with spoofed IPs, ideal for simulating SYN flood attacks.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"hping3 is the most appropriate tool because it is a command-line packet crafting tool that allows the user to generate custom TCP SYN packets with spoofed source IP addresses, making it ideal for simulating a SYN flood attack. Unlike other tools, hping3 can send a high volume of SYN packets without completing the three-way handshake, which is the core mechanism of a SYN flood that exhausts the server's connection queue.","examTrap":"EC-Council often tests the misconception that Nmap's SYN scan (-sS) is equivalent to a SYN flood attack, but Nmap is designed for stealthy reconnaissance with low packet rates, not for overwhelming a target with high-volume traffic.","examTip":null,"technicalDeepDive":"A SYN flood exploits the TCP three-way handshake by sending a flood of SYN packets to a target server, causing it to allocate memory for half-open connections in its backlog queue until it can no longer accept legitimate connections. hping3 allows fine-grained control over flags, sequence numbers, and source IP spoofing, enabling the attacker to bypass simple source-based rate limiting. In real-world scenarios, modern operating systems use SYN cookies (RFC 4987) to mitigate this attack, but older or misconfigured servers remain vulnerable.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.222+00:00","questionType":"multiple_choice"},{"id":"5cf45648-da90-4f2f-87f8-e314ef2abcb4","slug":"which-of-the-following-nmap-flags-would-an-attacker-use-to-e-q7cd9","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following Nmap flags would an attacker use to evade IDS by sending fragmented IP packets?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-D","explanation":"-D is for decoy scans, not fragmentation.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-g","explanation":"-g specifies a source port, not fragmentation.","masteryContext":""},{"key":"C","isCorrect":false,"text":"-sS","explanation":"-sS is for SYN scan, not fragmentation.","masteryContext":""},{"key":"D","isCorrect":true,"text":"-f","explanation":"-f causes packet fragmentation to evade detection.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -f flag in Nmap instructs the tool to fragment the transmitted packets into smaller pieces (typically 8-byte fragments). This fragmentation is used to evade Intrusion Detection Systems (IDS) that rely on signature matching against complete, unfragmented packets, as the IDS may not reassemble the fragments before inspection or may fail to detect the malicious payload when spread across multiple fragments.","examTrap":"The trap here is that candidates often confuse the -f flag with the -D (decoy) flag, thinking both are used for evasion, but -f specifically targets packet fragmentation to bypass IDS, while -D hides the source IP.","examTip":null,"technicalDeepDive":"When Nmap uses -f, it sets the IP header's 'More Fragments' (MF) bit and splits the TCP/UDP payload into fragments of 8 bytes or a multiple thereof (controlled by the --mtu option). Some IDS/IPS devices only reassemble fragments in kernel space or have a limited fragment reassembly timeout, allowing an attacker to bypass detection by sending fragments slowly or out of order. In real-world scenarios, combining -f with --data-length can further obscure payloads by padding packets to avoid trivial pattern matching.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:28:31.121+00:00","questionType":"multiple_choice"},{"id":"15d5f3ad-976a-4dc1-905b-3bd0f3339c42","slug":"during-a-penetration-test-of-a-corporate-wireless-network-y-u4n2s","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Perform a PMKID attack on the WPA3 client to capture the handshake.","explanation":"PMKID attack is for WPA2.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use a WPS PIN brute-force attack against the WPA3 client.","explanation":"WPS is separate from WPA3.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Send deauthentication packets to the WPA3 client and capture the reconnection handshake.","explanation":"Deauth alone does not downgrade.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.","explanation":"Rogue AP can entice client to downgrade.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.","examTrap":"EC-Council often tests the misconception that deauthentication alone can force a protocol downgrade, but in WPA3, deauthentication only triggers a reconnection using the same security protocol unless the AP changes its capabilities.","examTip":null,"technicalDeepDive":"WPA3-Personal uses Simultaneous Authentication of Equals (SAE) handshake, which is resistant to offline dictionary attacks, but many clients implement a transition mode where they will connect to a WPA2 network with the same SSID if WPA3 is unavailable. The attack exploits this by creating a rogue AP that only offers WPA2, causing the client to perform a 4-way handshake that can be captured and cracked offline if the PSK is shared between the two modes. In real-world scenarios, enterprise networks often use the same passphrase for both WPA2 and WPA3 to maintain backward compatibility, making this downgrade attack effective.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.751+00:00","questionType":"multiple_choice"},{"id":"992cc8bd-bacc-47be-8a87-1a1863b23024","slug":"during-a-penetration-test-a-tester-wants-to-gather-email-ad-4d8zg","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Wireshark","explanation":"Wireshark is a packet analyzer, primarily used for network traffic capture and analysis, not for passive OSINT gathering.","masteryContext":""},{"key":"B","isCorrect":true,"text":"theHarvester","explanation":"theHarvester performs passive reconnaissance by querying public sources for emails, subdomains, and other information.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Metasploit","explanation":"Metasploit is an exploitation framework, not a passive reconnaissance tool.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap","explanation":"Nmap is an active scanning tool, not a passive OSINT tool. It sends packets to the target.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse theHarvester with active tools like Nmap or Wireshark because they all involve network data, but only theHarvester gathers OSINT from third-party public sources without sending packets to the target.","examTip":null,"technicalDeepDive":"theHarvester leverages APIs and web scraping to query public sources such as Google Custom Search, Bing, and LinkedIn without sending direct probes to the target's infrastructure. It can also extract subdomains via DNS brute-forcing using a wordlist, but in its default passive mode it relies on cached search engine results, avoiding any direct contact with the target's DNS servers. In a real-world engagement, this tool helps testers build a target list before any active scanning, reducing the risk of detection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.259+00:00","questionType":"multiple_choice"},{"id":"2c61bd82-d269-4c33-8fc8-f96471fa5898","slug":"which-of-the-following-tools-is-specifically-designed-to-per-xppc6","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following tools is specifically designed to perform password cracking using rainbow tables?","difficulty":"medium","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"John the Ripper","explanation":"John the Ripper is a general password cracking tool that supports multiple attack modes, but it is not exclusively for rainbow tables.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Ophcrack","explanation":"Ophcrack cracks Windows passwords using rainbow tables, but it is a specific implementation; RainbowCrack is the general tool.","masteryContext":""},{"key":"C","isCorrect":true,"text":"RainbowCrack","explanation":"RainbowCrack is specifically designed to perform password cracking using rainbow tables.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Hashcat","explanation":"Hashcat is a fast password cracker supporting various attack types, but rainbow tables are not its primary focus.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"RainbowCrack is specifically designed to perform password cracking using precomputed rainbow tables, which are time-memory trade-off structures that allow hashes to be reversed quickly without brute-forcing each password. Unlike other tools that rely on brute force, dictionary attacks, or hybrid methods, RainbowCrack's core functionality is built around generating and using rainbow tables to crack LM, NTLM, MD5, SHA1, and other hash types.","examTrap":"EC-Council often tests the distinction between tools that use rainbow tables (RainbowCrack) versus tools that use brute-force or dictionary methods (John the Ripper, Hashcat), and candidates mistakenly associate Ophcrack with general rainbow table cracking when it is actually limited to LM hashes.","examTip":null,"technicalDeepDive":"Rainbow tables implement the Hellman time-memory trade-off, where chains of reduction functions are applied to hashes to compress the search space; RainbowCrack generates these tables with a specific chain length and number of chains, then uses a lookup algorithm to find the plaintext in O(1) time per hash. A subtle behavior is that rainbow tables are effective only for a fixed keyspace (e.g., all 7-character alphanumeric passwords), and if the password is outside that keyspace, the table fails entirely, unlike brute-force tools that can adapt. In a real-world penetration test, RainbowCrack is often used offline against captured NTLM hashes when the password policy is known to be weak and within the table's coverage.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.649+00:00","questionType":"multiple_choice"},{"id":"f96bfb50-f4ef-4817-bec0-1b572e7f4806","slug":"an-organization-deploys-a-fleet-of-iot-cameras-that-communic-pebrp","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An organization deploys a fleet of IoT cameras that communicate with a central server over the internet. The cameras use HTTP to send video streams. What is the most critical security improvement to protect the video data in transit?","difficulty":"medium","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Require strong passwords on the camera web interface.","explanation":"Does not encrypt traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use a site-to-site VPN between the cameras and the server.","explanation":"IoT devices may not support VPN.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Use certificate pinning to prevent man-in-the-middle attacks.","explanation":"Still requires TLS.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Implement TLS/SSL encryption for all camera communications.","explanation":"Encrypts video streams.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The most critical security improvement is to implement TLS/SSL encryption (HTTPS) for all camera communications. HTTP transmits video data in plaintext, allowing any attacker on the network path to capture and view the video stream. TLS/SSL provides encryption, integrity, and authentication, directly protecting the confidentiality of the video data in transit.","examTrap":"EC-Council often tests the distinction between authentication/access controls (passwords, certificate pinning) and encryption (TLS/SSL), leading candidates to choose a security measure that does not actually protect data in transit.","examTip":null,"technicalDeepDive":"TLS 1.2 or 1.3 (RFC 5246, RFC 8446) uses a handshake to negotiate symmetric encryption keys (e.g., AES-256-GCM) and authenticate the server via X.509 certificates. In IoT deployments, using TLS with mutual authentication (mTLS) can also verify the camera's identity, preventing unauthorized devices from sending data. A real-world scenario is the Mirai botnet, which exploited default credentials and unencrypted HTTP on IoT cameras to compromise them.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.56+00:00","questionType":"multiple_choice"},{"id":"85fea158-729e-4917-9d0d-cb290751e8ff","slug":"a-security-analyst-receives-an-alert-from-the-ids-indicating-7fm57","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst receives an alert from the IDS indicating a port scan originating from IP 10.0.0.5. Upon investigation, the analyst finds that 10.0.0.5 is a legitimate internal server. Which type of scan is the attacker likely using to evade detection?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SYN scan","explanation":"SYN scan does not spoof IP; the source IP is the attacker's real IP.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Idle scan","explanation":"Idle scan uses a zombie host and spoofed IP, but the zombie's IP would appear, not necessarily a legitimate server unless chosen.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Decoy scan","explanation":"Decoy scan includes multiple fake source IPs to hide the real attacker. The IDS may flag a decoy IP.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Fragmentation scan","explanation":"Fragmentation splits packets to evade detection, but does not spoof IP.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A decoy scan (option C) is the correct answer because it allows the attacker to blend their real IP address with multiple spoofed IP addresses, making it appear as though the scan originates from several hosts. In this scenario, the IDS alerts on IP 10.0.0.5, which is a legitimate internal server, indicating that the attacker is using that server's IP as a decoy to evade detection and misdirect the analyst's investigation.","examTrap":"The trap here is that candidates often confuse a decoy scan with an idle scan, mistakenly thinking that using a legitimate internal server as a decoy is the same as using a zombie host, but idle scans rely on IP ID side-channel analysis and do not involve spoofing the attacker's own traffic.","examTip":null,"technicalDeepDive":"In a decoy scan, the attacker sends packets from their real IP interleaved with packets from spoofed decoy IPs, often using tools like Nmap with the -D option. The IDS or firewall sees multiple IPs scanning the target, making it difficult to identify the true source. A subtle behavior is that the decoy IPs must be live (or at least routable) to avoid confusing the target's responses, and the attacker's real IP is typically placed in the middle of the decoy list to reduce suspicion.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:26:42.238+00:00","questionType":"multiple_choice"},{"id":"26ddf129-34be-412f-98e8-0ecbee42278d","slug":"a-security-analyst-suspects-that-an-attacker-is-scanning-the-nz7nc","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?","difficulty":"medium","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"TCP connect scan","explanation":"TCP connect scan completes the handshake, so SYN-ACK would be received from open ports.","masteryContext":""},{"key":"B","isCorrect":false,"text":"UDP scan","explanation":"UDP scans send UDP datagrams, not TCP SYN packets.","masteryContext":""},{"key":"C","isCorrect":true,"text":"SYN scan","explanation":"SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.","masteryContext":""},{"key":"D","isCorrect":false,"text":"FIN scan","explanation":"FIN scan sends FIN packets, not SYN.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.","examTrap":"The trap here is that candidates often confuse SYN scan with TCP connect scan, thinking that any TCP scan must complete the handshake, but the key distinction is that SYN scan never sends the final ACK, making it half-open and stealthier.","examTip":null,"technicalDeepDive":"In a SYN scan, the attacker sends a SYN packet and if the port is open, the target responds with SYN-ACK; the attacker then sends a RST to tear down the connection, never completing the handshake. If no SYN-ACK is received, it could mean the port is filtered by a firewall, the host is down, or the packet was dropped. This scan is defined in RFC 793 and is commonly used in tools like Nmap with the -sS flag, but modern intrusion detection systems (IDS) can detect the pattern of multiple SYN packets without subsequent ACKs.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:35.298+00:00","questionType":"multiple_choice"},{"id":"8427da4a-6234-4fba-b4ca-148bab00a2ff","slug":"which-three-of-the-following-are-correct-statements-about-dn-oaxvf","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are correct statements about DNS zone transfers?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"A successful zone transfer reveals all DNS records for the domain","explanation":"Zone transfers provide a complete copy of the zone data.","masteryContext":""},{"key":"B","isCorrect":true,"text":"The tool dnsrecon can attempt a zone transfer","explanation":"dnsrecon has a zone transfer check feature.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Zone transfers are encrypted by default","explanation":"Standard zone transfers are not encrypted; TSIG can be used for authentication.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Zone transfers should be restricted to authorized secondary DNS servers","explanation":"This is a security best practice.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Zone transfers use UDP port 53","explanation":"Zone transfers use TCP port 53 for reliability.","masteryContext":""}],"correctOptionKey":"A,B,D","correctOptions":["A","B","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"A successful DNS zone transfer (AXFR) returns the complete zone file, which contains all DNS records for the domain, including A, AAAA, MX, CNAME, NS, and TXT records. This is why it is a critical information-gathering step during reconnaissance.","examTrap":"The trap here is that candidates confuse DNS query transport (UDP 53) with zone transfer transport (TCP 53), and assume zone transfers are encrypted by default when they are not.","examTip":null,"technicalDeepDive":"Zone transfers are initiated using the AXFR query type over TCP port 53, as UDP cannot handle the packet size and reliability needed for full zone replication. The secondary DNS server sends an AXFR request, and the primary responds with the entire zone in multiple TCP segments. Misconfigured servers that allow unrestricted AXFR are a common security flaw, leaking all domain records to attackers.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:32:18.992+00:00","questionType":"multi_select"},{"id":"fa6b8853-5d45-4457-ae6c-c6b95688aca8","slug":"a-network-switch-starts-behaving-like-a-hub-broadcasting-al-5qvl5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A network switch starts behaving like a hub, broadcasting all traffic to all ports. The security team suspects an attack that floods the switch with fake MAC addresses. Which attack is this?","difficulty":"medium","domain":"Malware, Social Engineering and Network Attacks","domainSlug":"ceh-malware-social-network","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"MAC flooding","explanation":"MAC flooding fills the CAM table with fake MACs.","masteryContext":""},{"key":"B","isCorrect":false,"text":"ARP poisoning","explanation":"ARP poisoning targets the ARP cache.","masteryContext":""},{"key":"C","isCorrect":false,"text":"STP attack","explanation":"STP attacks manipulate spanning tree protocol.","masteryContext":""},{"key":"D","isCorrect":false,"text":"DNS spoofing","explanation":"DNS spoofing corrupts DNS.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"MAC flooding exploits the limited size of a switch's Content Addressable Memory (CAM) table. By sending thousands of packets with unique, fake source MAC addresses, the attacker fills the CAM table, forcing the switch to fail open and broadcast all incoming frames to every port, effectively behaving like a hub. This allows the attacker to capture traffic not originally destined for their port.","examTrap":"EC-Council often tests the distinction between MAC flooding (layer 2 CAM table exhaustion) and ARP poisoning (layer 2/3 cache manipulation), so candidates mistakenly choose ARP poisoning because both involve MAC addresses, but only MAC flooding causes the switch to broadcast traffic like a hub.","examTip":null,"technicalDeepDive":"Under the hood, a switch's CAM table maps MAC addresses to specific port numbers and has a fixed size (e.g., 8,192 entries on older Cisco Catalyst switches). When the table is full, the switch enters a fail-open state, flooding frames out all ports in the same VLAN. In a real-world scenario, an attacker can use tools like macof (part of the dsniff suite) to generate 8,000+ random MAC addresses per minute, overwhelming the CAM table within seconds and enabling traffic sniffing on a switched network.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.064+00:00","questionType":"multiple_choice"},{"id":"9b80a69e-ca00-42bc-8525-c1b62a894a2f","slug":"a-security-analyst-is-using-nmap-to-scan-a-network-segment-1-31ir0","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst is using Nmap to scan a network segment 192.168.1.0/24 and wants to identify live hosts without sending packets to every IP. Which scan type should the analyst use to minimize network traffic while discovering active hosts?","difficulty":"easy","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"TCP SYN scan using `nmap -sS`","explanation":"SYN scan probes ports, not just host discovery; generates more traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"ARP scan using `nmap -PR`","explanation":"ARP scan is fast but sends ARP requests to every IP, which is still per-IP traffic.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Ping sweep using `nmap -sn`","explanation":"`-sn` disables port scan and sends only ICMP echo, TCP SYN to port 443, etc., minimizing traffic.","masteryContext":""},{"key":"D","isCorrect":false,"text":"UDP scan using `nmap -sU`","explanation":"UDP scan is slow and often unreliable for host discovery.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because `nmap -sn` (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default, allowing the analyst to discover live hosts without scanning every port or sending packets to every IP individually. This minimizes network traffic compared to full port scans while still efficiently identifying active devices on the 192.168.1.0/24 subnet.","examTrap":"The trap here is that candidates often confuse 'minimizing network traffic' with using a stealth scan like `-sS`, but the question specifically asks for host discovery, not port scanning, and `-sn` is the correct low-traffic option for that purpose.","examTip":null,"technicalDeepDive":"The `-sn` flag in Nmap uses a multi-method discovery approach: it sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests, then considers a host alive if any response is received. This behavior is defined in Nmap's host discovery algorithm, which can be customized with options like `-PE`, `-PP`, or `-PM` to override defaults. In real-world scenarios, firewalls may block ICMP, but the TCP probes often bypass such filters, making `-sn` more reliable than a simple ping sweep.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:16:49.525+00:00","questionType":"multiple_choice"},{"id":"31575019-0d81-44fd-9ec2-0180394163de","slug":"a-cloud-security-engineer-notices-that-an-s3-bucket-containi-6agnz","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A cloud security engineer notices that an S3 bucket containing sensitive customer data is configured with a bucket policy that allows 'Principal': '*' and 'Action': 's3:GetObject'. The bucket is not publicly accessible via the AWS Management Console, but the engineer is concerned about data exposure. What is the most likely risk?","difficulty":"medium","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Anyone on the internet can read objects in the bucket if they know the object URL.","explanation":"Public read access is granted to all objects.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The data is encrypted at rest, so no exposure risk exists.","explanation":"Encryption does not control access.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The bucket policy is misconfigured but only affects objects with server-side encryption.","explanation":"The policy applies to all objects.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Only authenticated AWS users can access the bucket, so the risk is limited.","explanation":"The policy allows anonymous access.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The bucket policy allows 'Principal': '*' with 'Action': 's3:GetObject', which grants anonymous read access to any object in the bucket. Even if the bucket is not publicly listed in the AWS Management Console, anyone on the internet who knows or guesses the object URL can retrieve the object directly via HTTP/HTTPS. This is a classic data exposure risk because the policy overrides any console-level restrictions.","examTrap":"The trap here is that candidates confuse 'not publicly accessible via the AWS Management Console' with 'not publicly accessible via direct object URLs,' but S3 bucket policies control access at the API level, not just the console UI.","examTip":null,"technicalDeepDive":"S3 bucket policies with 'Principal': '*' and 'Action': 's3:GetObject' effectively make objects publicly readable, even if the bucket is not listed in the console. The AWS S3 service evaluates the bucket policy before any IAM user or role permissions, so anonymous requests are granted access directly. In real-world incidents, attackers often discover such buckets via enumeration tools (e.g., bucket-stream) or by guessing predictable object keys, leading to data breaches.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:19:53.643+00:00","questionType":"multiple_choice"},{"id":"8ab9cccc-e896-45d2-8e84-d79facdac578","slug":"what-can-be-inferred-from-the-output-emfoo","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"What can be inferred from the output?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The domain has two mail servers with different priority levels.","explanation":"MX records with preferences 10 and 20 indicate two mail servers.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The command failed because the DNS server is unreachable.","explanation":"The command succeeded as it returned MX records.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The domain uses SPF records to prevent email spoofing.","explanation":"No SPF records are shown in the output.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The domain's web server IP address is 192.168.1.1.","explanation":"The IP 192.168.1.1 is the DNS server, not the web server.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.","examTrap":"The trap here is that candidates may confuse MX records with other DNS record types (like A or TXT) and incorrectly infer unrelated information such as SPF usage or web server IPs, or assume the command failed when it clearly succeeded.","examTip":null,"technicalDeepDive":"MX records are defined in RFC 1035 and RFC 7505, and their priority values (0–65535) determine the order of mail delivery: lower values are preferred. When a sending mail server performs an MX lookup, it sorts the records by priority and attempts delivery to the lowest-priority server first; if that fails, it tries the next. This redundancy is critical for email reliability, and a common misconfiguration is setting all MX records to the same priority, which defeats the failover mechanism.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n```\nC:\\Users\\test>nslookup -type=MX example.com\nServer: dns.company.com\nAddress: 192.168.1.1\n\nexample.com MX preference = 10, mail exchanger = mail1.example.com\nexample.com MX preference = 20, mail exchanger = mail2.example.com\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:14.114+00:00","questionType":"multiple_choice"},{"id":"07ca372f-6827-4eaf-957b-045c1f19ac7a","slug":"which-three-of-the-following-are-valid-nmap-flags-that-can-b-1ndtk","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid Nmap flags that can be used to evade detection by an IDS? (Select exactly 3.)","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-O","explanation":"OS detection is a feature, not evasion.","masteryContext":""},{"key":"B","isCorrect":true,"text":"-D","explanation":"Decoy scan hides the real source among multiple IPs.","masteryContext":""},{"key":"C","isCorrect":true,"text":"-f","explanation":"Fragments packets to evade signature-based detection.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-sS","explanation":"SYN scan is a scan type, not an evasion technique.","masteryContext":""},{"key":"E","isCorrect":true,"text":"--data-length","explanation":"Adds random data to packets to confuse IDS.","masteryContext":""}],"correctOptionKey":"B,C,E","correctOptions":["B","C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B (-D) is correct because the decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for an IDS to distinguish the real scanning host from the decoys. This technique floods the target with scan traffic from many IPs, obscuring the true origin and evading detection.","examTrap":"EC-Council often tests the misconception that -sS is an evasion technique, but it is actually a stealth scan that reduces connection logging, not IDS evasion; the real evasion flags are those that alter packet structure or source identity.","examTip":null,"technicalDeepDive":"The -f flag fragments IP packets into smaller 8-byte fragments, forcing the IDS to reassemble them, which can cause evasion if the IDS lacks proper reassembly logic. The --data-length flag appends random data to packets, altering their size and making them appear less like standard scan probes, which can bypass signature-based detection. In practice, combining these flags with decoys is common in penetration testing to avoid triggering alerts.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.298+00:00","questionType":"multi_select"},{"id":"057654b3-89ef-4404-a106-a60b6269aa6b","slug":"refer-to-the-exhibit-a-security-analyst-notices-multiple-es-ex-an7m","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst notices multiple ESTABLISHED connections on port 443 from different external IPs to the same process ID. What type of attack is most likely occurring?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Distributed denial-of-service (DDoS) attack","explanation":"Multiple external IPs establishing connections to the same server process on port 443 indicates a volumetric DDoS attack, especially if the server is overwhelmed.","masteryContext":""},{"key":"B","isCorrect":false,"text":"SSL/TLS renegotiation DoS","explanation":"SSL renegotiation DoS involves repeated renegotiation of SSL sessions, but the exhibit shows established connections without indication of renegotiation.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Slowloris attack","explanation":"Slowloris keeps many connections open but does not send complete requests; however, it typically targets port 80 and uses low bandwidth, not multiple IPs establishing connections on 443.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"A MITM attack would intercept traffic between two parties, not cause multiple connections from different IPs to a single server.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"C:\\Users\\admin>netstat -ano | findstr :80\n TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 1234\n TCP 10.1.1.5:443 10.2.2.3:54321 ESTABLISHED 5678\n TCP 10.1.1.5:443 10.2.2.4:12345 TIME_WAIT 0\n TCP 10.1.1.5:443 10.2.2.5:9876 ESTABLISHED 5678\nC:\\Users\\admin>tasklist | findstr 5678\npid.exe 5678 Console 1 2,456 K","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-25T06:19:09.630056+00:00","questionType":"multiple_choice"},{"id":"4fc51273-4748-40e2-944c-358f515407cd","slug":"during-a-security-assessment-you-execute-dnsenum-enum-ex-2ypoz","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The DNS server is not running","explanation":"If the server were not running, dnsenum would not have retrieved NS and MX records.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The zone transfer requires TCP port 443","explanation":"DNS zone transfers use TCP port 53, not 443.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The DNS server is configured to deny zone transfers from unauthorized hosts","explanation":"This is the standard security configuration for DNS servers.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The domain does not exist","explanation":"If the domain did not exist, dnsenum would not return any records.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.","examTrap":"The trap here is that candidates may confuse the port used for zone transfers (TCP 53) with the standard DNS query port (UDP 53) or mistakenly think a failed zone transfer implies the server is down or the domain is invalid, rather than recognizing it as a deliberate security control.","examTip":null,"technicalDeepDive":"Zone transfers (AXFR) use TCP port 53 to ensure reliable delivery of the full zone data, while standard DNS queries typically use UDP. The `dnsenum` tool sends an AXFR request after enumerating records; a failure due to ACL restrictions is the most common outcome in production environments, as administrators explicitly limit transfers to secondary DNS servers only. In a real-world scenario, a successful zone transfer would expose all DNS records, including hidden subdomains, making it a critical information-gathering vector.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:32:02.607+00:00","questionType":"multiple_choice"},{"id":"da9f29b3-8f96-4184-b90b-4bfc41f94db2","slug":"which-two-of-the-following-are-recognized-phases-of-the-ethi-1jo69","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)","difficulty":"medium","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Maintaining Access","explanation":"Maintaining Access is a phase after gaining access.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Scanning","explanation":"Scanning is a sub-phase of Reconnaissance.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Reconnaissance","explanation":"Reconnaissance is the first phase of ethical hacking.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Hiding Evidence","explanation":"Covering Tracks is the correct term, not Hiding Evidence.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Cracking","explanation":"Cracking is not a recognized phase.","masteryContext":""}],"correctOptionKey":"A,C","correctOptions":["A","C"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.","examTrap":"EC-Council often tests the distinction between 'Scanning' and 'Reconnaissance' as separate phases, but the CEH methodology treats Scanning as part of the Reconnaissance phase, not a standalone phase; the trap here is that candidates may incorrectly select Scanning as a separate phase because it is a distinct activity, but the official CEH phases list Reconnaissance as the first phase, encompassing both passive and active scanning.","examTip":null,"technicalDeepDive":"The CEH ethical hacking process follows a structured methodology: Reconnaissance (passive/active information gathering), Scanning & Enumeration (network mapping, port scanning, service detection), Gaining Access (exploitation, privilege escalation), Maintaining Access (backdoors, persistence mechanisms like cron jobs or registry run keys), Clearing Tracks (log deletion, timestamp manipulation, anti-forensics), and Reporting. Maintaining Access often involves using tools like Netcat, Meterpreter, or custom scripts to create reverse shells or bind shells, ensuring the attacker can reconnect even after system reboots. In real-world scenarios, advanced persistent threats (APTs) rely heavily on this phase to maintain long-term access without detection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.675+00:00","questionType":"multi_select"},{"id":"57c600c0-3b1e-4ad6-be5b-e6b688c33572","slug":"an-attacker-has-gained-access-to-a-system-and-wants-to-erase-wgphh","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An attacker has gained access to a system and wants to erase evidence of their activities. Which of the following actions is MOST effective for covering tracks on a Windows system?","difficulty":"medium","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Disabling the Windows Firewall","explanation":"Does not erase logs.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Installing a rootkit","explanation":"Rootkit hides presence but does not erase existing logs.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Clearing the Security event log","explanation":"Event logs contain evidence of logins and activities.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Changing the administrator password","explanation":"Does not cover tracks.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Clearing the Security event log (C) is the most effective action for covering tracks on a Windows system because it removes all logged security events, such as logon attempts, privilege use, and audit failures, which are the primary records that would reveal an attacker's activities. The Security log is maintained by the Windows Event Log service and is the default location for audit records under the Local Security Policy; deleting it eliminates forensic evidence of unauthorized access or changes.","examTrap":"EC-Council often tests the distinction between covering tracks (erasing evidence) and maintaining access or evading detection; the trap here is that candidates confuse installing a rootkit (which hides ongoing activity) with clearing logs (which removes past evidence), leading them to choose B instead of C.","examTip":null,"technicalDeepDive":"The Windows Event Log service stores logs in .evtx files under %SystemRoot%\\System32\\winevt\\Logs, with the Security log specifically at Security.evtx. Clearing this log via the Event Viewer or the wevtutil cli command (e.g., wevtutil cl Security) removes all entries, but it also generates a new Event ID 1102 (The audit log was cleared), which itself becomes a forensic artifact. In real-world scenarios, sophisticated attackers may selectively delete individual event records using tools like Invoke-Phantom or by directly manipulating the .evtx file with a hex editor to avoid triggering the 1102 event.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.797+00:00","questionType":"multiple_choice"},{"id":"267224d7-1cc7-4884-8cbb-b9bbdc525829","slug":"which-of-the-following-tools-would-be-best-to-use-for-identi-z03qp","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following tools would be BEST to use for identifying all live hosts in a large IP range (e.g., 10.0.0.0/8) quickly?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Masscan","explanation":"Masscan is optimized for speed and can scan large ranges quickly.","masteryContext":""},{"key":"B","isCorrect":false,"text":"OpenVAS","explanation":"OpenVAS is a vulnerability scanner, not designed for rapid host discovery.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Nmap with -sL flag","explanation":"-sL is a list scan that does not send packets, so it cannot identify live hosts.","masteryContext":""},{"key":"D","isCorrect":false,"text":"hping3","explanation":"hping3 is useful for custom packet crafting but is slower for large ranges.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is the best choice because it is designed for high-speed scanning across large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. It uses asynchronous transmission and raw sockets to quickly identify live hosts by sending SYN probes and analyzing responses, making it ideal for scanning a /8 subnet (16.7 million addresses) in minutes.","examTrap":"EC-Council often tests the distinction between scanning speed and functionality, where candidates mistakenly choose Nmap (a versatile tool) for large-range host discovery without recognizing that its default scanning modes are too slow for a /8 subnet, whereas Masscan is purpose-built for speed.","examTip":null,"technicalDeepDive":"Masscan operates by sending SYN packets to random ports (default port 80) and uses a custom TCP/IP stack to handle responses asynchronously, allowing it to scan the entire IPv4 internet in under 5 minutes under optimal conditions. It supports output formats compatible with Nmap, enabling further analysis of discovered hosts. In real-world scenarios, penetration testers use Masscan for initial reconnaissance to quickly map large internal networks (e.g., 10.0.0.0/8) before performing detailed scans with tools like Nmap.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.173+00:00","questionType":"multiple_choice"},{"id":"f4613a31-fc87-410f-8ddf-f1bbd458c892","slug":"refer-to-the-exhibit-an-attacker-runs-the-nslookup-command-ishf2","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An attacker runs the nslookup command shown. What information has been gathered?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Mail server addresses and priority","explanation":"MX records show mail servers and their priority.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Name server records","explanation":"NS records require -type=NS query.","masteryContext":""},{"key":"C","isCorrect":false,"text":"IP addresses of the web server","explanation":"A records are needed for web server IPs.","masteryContext":""},{"key":"D","isCorrect":false,"text":"SPF records for email authentication","explanation":"SPF is retrieved via TXT records.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The nslookup command with the -type=MX query returns mail exchange (MX) records for the domain. The output shows mail server hostnames and their associated priority values (e.g., 10, 20), which indicate the order in which mail servers should be used. This directly reveals the mail server addresses and their priority, making option A correct.","examTrap":"The trap here is that candidates confuse DNS record types—specifically, they may think MX records return IP addresses or SPF data, when in fact MX only returns mail server hostnames and priorities.","examTip":null,"technicalDeepDive":"MX records are defined in RFC 1035 and use a 16-bit preference value (priority) to specify the order of mail servers; lower numbers are tried first. When an attacker performs MX reconnaissance, they can identify the mail infrastructure (e.g., Exchange, Google Workspace) and potentially target mail servers for phishing or spoofing attacks. The nslookup interactive mode shown here queries the default DNS resolver, but the same data can be gathered via dig or host commands.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nC:\\>nslookup -type=MX example.com\nServer: dns.example.com\nAddress: 192.0.2.10\n\nexample.com MX preference = 10, mail exchanger = mail1.example.com\nexample.com MX preference = 20, mail exchanger = mail2.example.com","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:06:03.816+00:00","questionType":"multiple_choice"},{"id":"e5d20566-fedb-473d-b6a4-ec4462647d6a","slug":"refer-to-the-exhibit-a-security-analyst-runs-ping-and-arp-c-kpi9c","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Distributed denial of service (DDoS) attack","explanation":"No indication of multiple sources or high traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"MAC flooding attack","explanation":"MAC flooding fills switch CAM table, not ARP table.","masteryContext":""},{"key":"C","isCorrect":true,"text":"ARP spoofing attack","explanation":"Duplicate MAC addresses for different IPs indicate ARP spoofing.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Ping flood attack","explanation":"Ping flood is a DoS attack, not indicated by ARP anomalies.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The correct answer is C because the combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.","examTrap":"The trap here is that candidates confuse MAC flooding (which targets switch CAM tables) with ARP spoofing (which targets host ARP caches), but the exhibit's `arp -a` output showing multiple IPs for one MAC is the definitive sign of ARP cache poisoning, not a switch-level attack.","examTip":null,"technicalDeepDive":"ARP spoofing exploits the stateless nature of ARP (RFC 826), where hosts accept unsolicited ARP replies without authentication. An attacker sends forged ARP packets to associate their MAC address with the default gateway's IP, causing all victim traffic to be forwarded through the attacker's machine for man-in-the-middle interception. Tools like Ettercap or Cain & Abel automate this, and detection requires static ARP entries or dynamic ARP inspection (DAI) on managed switches.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nC:\\Users\\Admin>ping 10.0.0.1\nPinging 10.0.0.1 with 32 bytes of data:\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nPing statistics for 10.0.0.1:\n Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\nApproximate round trip time in milli-seconds:\n Minimum = 0ms, Maximum = 0ms, Average = 0ms\n\nC:\\Users\\Admin>arp -a\nInterface: 192.168.1.101 --- 0x4\n Internet Address Physical Address Type\n 192.168.1.1 aa-bb-cc-11-22-33 dynamic\n 10.0.0.1 aa-bb-cc-11-22-33 dynamic\n 192.168.1.102 dd-ee-ff-44-55-66 dynamic","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:23:00.777+00:00","questionType":"multiple_choice"},{"id":"33ed0d65-1b4f-4efa-8988-e50efc4666cc","slug":"which-two-of-the-following-are-valid-techniques-for-password-yj7a4","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are valid techniques for password cracking?","difficulty":"hard","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Brute-force attack","explanation":"Tries all possible passwords until correct.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Phishing","explanation":"Phishing tricks users into revealing passwords.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"MITM intercepts communications, not cracking passwords.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Rainbow table attack","explanation":"Uses precomputed hash chains to reverse hashes.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Keylogging","explanation":"Keylogging captures keystrokes, not cracking.","masteryContext":""}],"correctOptionKey":"A,D","correctOptions":["A","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"A brute-force attack is a valid password cracking technique that systematically tries every possible combination of characters until the correct password is found. It is computationally intensive but guaranteed to succeed given enough time, making it a fundamental method in password auditing and recovery.","examTrap":"The trap here is that candidates often confuse passive or indirect credential theft methods (phishing, keylogging, MITM) with active password cracking techniques that directly derive plaintext from hashes or encrypted data.","examTip":null,"technicalDeepDive":"Rainbow table attacks precompute hash chains for a given hash algorithm (e.g., LM, NTLM, MD5) and store them in a compressed lookup table, enabling rapid reversal of hashes without recomputing each candidate. This technique is highly effective against unsalted hashes, but modern systems use salts (e.g., in /etc/shadow with SHA-512) to render precomputed tables useless, forcing attackers to fall back to brute-force or dictionary attacks.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:11:35.557+00:00","questionType":"multi_select"},{"id":"27007842-4abe-4faa-a969-5ee2f1dd4cb1","slug":"during-a-penetration-test-the-tester-wants-to-discover-all-rzigb","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, the tester wants to discover all subdomains of a target domain using an OSINT technique. Which tool is specifically designed for subdomain enumeration via search engines and public records?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"theHarvester","explanation":"theHarvester is designed to gather emails, subdomains, and other information from public sources.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Maltego","explanation":"Maltego is a data mining tool but not specifically designed for subdomain enumeration; it is a general OSINT and link analysis tool.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Shodan","explanation":"Shodan is a search engine for internet-connected devices, not subdomain enumeration.","masteryContext":""},{"key":"D","isCorrect":false,"text":"dnsrecon","explanation":"dnsrecon is a DNS enumeration tool, but it actively queries DNS servers, not passive OSINT.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"theHarvester is specifically designed to perform OSINT-based subdomain enumeration by querying search engines (e.g., Google, Bing) and public data sources (e.g., PGP key servers, DNSDumpster). It collects email addresses, subdomains, IPs, and virtual hosts without direct interaction with the target's infrastructure, making it ideal for passive reconnaissance.","examTrap":"EC-Council often tests the distinction between passive OSINT tools (theHarvester) and active reconnaissance tools (dnsrecon), so candidates mistakenly choose dnsrecon because it is a DNS tool, but the question explicitly requires an OSINT technique using search engines and public records.","examTip":null,"technicalDeepDive":"theHarvester uses APIs and web scraping to query sources like Google, Bing, Yahoo, and PGP key servers. It parses the returned HTML or JSON for patterns matching subdomains (e.g., *.target.com) and email addresses. In a real-world scenario, a tester might use theHarvester with the '-b google' flag to passively map a target's digital footprint without triggering IDS alerts, unlike active tools like dnsrecon that generate DNS queries.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.512+00:00","questionType":"multiple_choice"},{"id":"5aeadd22-0760-474e-8588-8f63af1d2759","slug":"refer-to-the-exhibit-an-ethical-hacker-runs-the-shown-nmap-etlqk","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?","difficulty":"hard","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"open","explanation":"Open means a service is listening.","masteryContext":""},{"key":"B","isCorrect":true,"text":"closed","explanation":"Closed means reachable but no service listening.","masteryContext":""},{"key":"C","isCorrect":false,"text":"filtered","explanation":"Filtered means the probe was blocked.","masteryContext":""},{"key":"D","isCorrect":false,"text":"unfiltered","explanation":"Unfiltered is not shown in this output.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because a 'closed' port in Nmap indicates that the target host responded with a TCP RST (Reset) packet, meaning the port is reachable and the host is alive, but no application is listening on that port. This state confirms the port is accessible (not filtered by a firewall) yet no service is bound to it.","examTrap":"The trap here is that candidates often confuse 'closed' with 'filtered' or 'unfiltered', not realizing that a closed port specifically means the host responded with a TCP RST, proving reachability without a listening service.","examTip":null,"technicalDeepDive":"Nmap determines port states based on TCP/IP stack responses: a closed port replies with an RST packet per RFC 793, while an open port sends a SYN-ACK. In real-world scenarios, closed ports can be used to detect live hosts during reconnaissance, as a firewall that allows RST responses indicates the host is up and the port is not filtered.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n```\n$ nmap -sS -T4 -p 22,80,443 192.168.1.10\nStarting Nmap 7.80 ( https://nmap.org )\nNmap scan report for 192.168.1.10\nHost is up (0.0012s latency).\n\nPORT STATE SERVICE\n22/tcp open ssh\n80/tcp open http\n443/tcp closed https\n\nNmap done: 1 IP address (1 host up) scanned in 2.45 seconds\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:16:14.518+00:00","questionType":"multiple_choice"},{"id":"02a17901-03af-48f9-a449-f3ab6c7b8e48","slug":"which-of-the-following-techniques-involves-sending-crafted-p-h5tth","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following techniques involves sending crafted packets to a target to elicit responses that reveal the operating system?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Passive OS fingerprinting","explanation":"Passive fingerprinting observes traffic without sending packets.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Banner grabbing","explanation":"Banner grabbing retrieves service banners, not necessarily OS identification.","masteryContext":""},{"key":"C","isCorrect":false,"text":"DNS enumeration","explanation":"DNS enumeration gathers DNS records, not OS information.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Active OS fingerprinting","explanation":"Active fingerprinting sends probes to infer the OS.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Active OS fingerprinting involves sending crafted packets (e.g., TCP SYN, FIN, or ICMP probes) to a target and analyzing the responses to deduce the operating system. Unlike passive methods, it actively interacts with the target, leveraging subtle differences in how various OSes implement TCP/IP stack behaviors (e.g., initial TTL values, window sizes, or TCP option ordering). This technique is commonly used by tools like Nmap with its `-O` flag.","examTrap":"The trap here is that candidates often confuse 'active OS fingerprinting' with 'banner grabbing' because both involve sending packets, but banner grabbing targets application-layer banners (e.g., HTTP, FTP) and not the OS-level TCP/IP stack responses that fingerprinting analyzes.","examTip":null,"technicalDeepDive":"Active OS fingerprinting exploits RFC non-compliance and implementation quirks in TCP/IP stacks; for example, sending a TCP SYN packet to a closed port may elicit an RST with a specific window size or IP ID pattern unique to Windows vs. Linux. Tools like Nmap use a database of over 2,000 signatures, comparing responses to probes like T2 (TCP NULL) or T3 (TCP FIN with no flags) to narrow down the OS. In real-world pentests, this helps tailor exploits to the target's OS, such as selecting a Linux-specific kernel exploit over a Windows one.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:30:00.192+00:00","questionType":"multiple_choice"},{"id":"f88af5a9-7ac2-4e4c-92c7-853b49dc81ba","slug":"which-of-the-following-tools-is-specifically-designed-to-aut-xkfap","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?","difficulty":"easy","domain":"Web Application and Injection Attacks","domainSlug":"ceh-web-injection","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Burp Suite","explanation":"Burp Suite is a web proxy and testing platform, but it does not automate SQL injection like SQLMap does.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Metasploit","explanation":"Metasploit is a penetration testing framework, but for SQL injection specifically, SQLMap is more focused.","masteryContext":""},{"key":"C","isCorrect":true,"text":"SQLMap","explanation":"SQLMap is the standard tool for automated SQL injection detection and exploitation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap","explanation":"Nmap is a network scanning tool, not specialized for SQL injection.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.","examTrap":"EC-Council often tests the distinction between general-purpose security tools (like Burp Suite or Metasploit) and specialized automation tools (like SQLMap), leading candidates to choose a tool they recognize for web testing rather than the one specifically designed for SQL injection automation.","examTip":null,"technicalDeepDive":"SQLMap works by fingerprinting the database backend (e.g., MySQL, PostgreSQL, MSSQL) through error-based, blind, time-based, and UNION query techniques, then automating the extraction of data via crafted payloads. A subtle behavior is its ability to use '--os-shell' to gain a remote shell on the database server if the DBMS has sufficient privileges, which is often overlooked in basic assessments. In a real-world scenario, SQLMap can bypass weak WAF rules using tamper scripts that encode or obfuscate payloads.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.023+00:00","questionType":"multiple_choice"},{"id":"1910888c-8ccb-4dd8-8b17-f54e66aa23b0","slug":"which-of-the-following-best-describes-the-difference-between-l4e32","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following best describes the difference between active and passive reconnaissance?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Active reconnaissance is legal, while passive reconnaissance is not","explanation":"Both can be legal or illegal depending on authorization.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Active reconnaissance involves direct interaction with the target, whereas passive reconnaissance does not","explanation":"This is the core difference between the two approaches.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Passive reconnaissance uses tools like Nmap, while active reconnaissance uses Google dorks","explanation":"Nmap is active; Google dorks are passive.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Passive reconnaissance is used only during the exploitation phase","explanation":"Passive reconnaissance typically occurs during the footprinting phase.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Active reconnaissance involves direct interaction with the target system, such as sending packets, probes, or connection requests (e.g., using Nmap scans, ping sweeps, or banner grabbing) that can be logged or detected by the target. Passive reconnaissance, in contrast, gathers information without engaging the target directly, relying on publicly available sources (e.g., WHOIS lookups, DNS records, social media, or search engines) and does not generate traffic that reaches the target's network. This distinction is fundamental in the CEH methodology because active techniques carry a higher risk of alerting the target, while passive techniques are stealthier and often used first to avoid detection.","examTrap":"EC-Council often tests the misconception that passive reconnaissance is 'safer' or 'always legal,' but the trap here is confusing the method of interaction (direct vs. indirect) with legality or tool assignment, leading candidates to pick Option A or C instead of the correct definition based on target interaction.","examTip":null,"technicalDeepDive":"Under the hood, active reconnaissance relies on the target's network stack responding to crafted packets—for example, an Nmap SYN scan sends TCP SYN packets to ports and analyzes SYN-ACK or RST responses, which are logged by the target's firewall or IDS. Passive reconnaissance leverages OSINT (Open Source Intelligence) sources like ARIN WHOIS for IP ownership, DNS zone transfers (if misconfigured), or Shodan for exposed services—none of which require sending a single packet to the target. In a real-world penetration test, a tester might start with passive reconnaissance to map the target's attack surface (e.g., discovering subdomains via Certificate Transparency logs) before switching to active scanning to verify live hosts and open ports, minimizing the chance of early detection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.129+00:00","questionType":"multiple_choice"},{"id":"e2e7087f-988e-4473-864f-b6231de7fd6f","slug":"as-a-network-defender-you-notice-an-unusually-high-number-o-m310w","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"UDP flood","explanation":"UDP flood uses UDP packets, not TCP SYN packets.","masteryContext":""},{"key":"B","isCorrect":true,"text":"SYN flood","explanation":"SYN flood sends many SYN packets without completing handshake.","masteryContext":""},{"key":"C","isCorrect":false,"text":"ARP spoofing","explanation":"ARP spoofing operates at layer 2, not TCP handshake.","masteryContext":""},{"key":"D","isCorrect":false,"text":"ICMP flood","explanation":"ICMP flood uses ping requests, not TCP handshake packets.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.","examTrap":"EC-Council often tests the distinction between a SYN flood and a UDP flood, where candidates mistakenly choose UDP flood because they associate 'flood' with any high-volume attack, but the key clue is the incomplete TCP three-way handshake, which is specific to SYN floods.","examTip":null,"technicalDeepDive":"Under the hood, a SYN flood sends a barrage of SYN packets with spoofed source IP addresses, causing the target to allocate Transmission Control Blocks (TCBs) for each half-open connection. The target's backlog queue (defined by the `tcp_max_syn_backlog` kernel parameter) fills up, preventing new legitimate connections. In real-world scenarios, attackers often randomize source IPs to evade simple IP-based blocking, making mitigation techniques like SYN cookies (RFC 4987) or rate-limiting essential.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.359+00:00","questionType":"multiple_choice"},{"id":"4db5204c-7630-44dd-89a8-fbdad43a2c6f","slug":"a-network-administrator-needs-to-identify-all-devices-on-a-l-sogw9","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A network administrator needs to identify all devices on a large corporate network that are running a specific vulnerable version of OpenSSH. The administrator has network access and can use scanning tools. However, scanning the entire network might disrupt operations. Which approach minimizes disruption while accurately identifying the vulnerable hosts?","difficulty":"medium","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Conduct a full TCP port scan of the entire network using SYN scan.","explanation":"Full port scans are noisy and may cause performance issues on network devices.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Run a TCP SYN scan on port 22 only, with version detection enabled, across the target IP range.","explanation":"Scanning only the relevant port with version detection minimizes traffic and focuses on the vulnerable service.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Use a ping sweep to identify live hosts, then perform a version scan on each.","explanation":"Ping sweep is less disruptive but still requires probing each live host; version scan still needed.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform an ARP scan of the entire subnet and then check each host manually.","explanation":"Manual checking is inefficient and still requires direct interaction with each host.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because it targets only TCP port 22 (the default SSH port) with a SYN scan, which is stealthier and faster than a full connect scan, and enables version detection to identify the specific vulnerable OpenSSH version. This minimizes disruption by avoiding scanning unnecessary ports and reduces network load, while accurately pinpointing vulnerable hosts.","examTrap":"The trap here is that candidates often choose a ping sweep (Option C) thinking it reduces disruption, but they overlook that ICMP may be blocked, and the subsequent version scan on each host still requires port-level scanning, making Option B more efficient and accurate.","examTip":null,"technicalDeepDive":"A SYN scan (half-open scan) sends a TCP SYN packet to port 22; if a SYN-ACK is received, the host is listening, and the scanner sends an RST to avoid completing the handshake, reducing log noise. Version detection uses banner grabbing or SSH protocol negotiation to extract the exact OpenSSH version string (e.g., 'SSH-2.0-OpenSSH_7.4'), allowing precise identification of vulnerable builds without requiring a full connection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:04.498+00:00","questionType":"multiple_choice"},{"id":"f203f7d3-54df-459f-82f7-78cc886f0cb0","slug":"refer-to-the-exhibit-during-a-wireless-audit-you-capture-a-gspr9","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The pairwise cipher is CCMP, which is outdated.","explanation":"CCMP is secure and current.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The network uses WPA2-PSK, which is easily cracked.","explanation":"PSK is not inherently vulnerable.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The beacon frame reveals the BSSID, which is a security risk.","explanation":"BSSID is publicly broadcast.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The group cipher is TKIP, which is deprecated and vulnerable.","explanation":"TKIP should not be used.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option D is correct because TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.","examTrap":"The trap here is that candidates often assume WPA2-PSK is inherently insecure (Option B) or that revealing the BSSID is a risk (Option C), but the real security flaw in this scenario is the use of TKIP as the group cipher, which is deprecated and known to be broken.","examTip":null,"technicalDeepDive":"TKIP uses a 128-bit per-packet key mixing mechanism and a 64-bit Michael Message Integrity Check (MIC), but both have known weaknesses. The Michael algorithm can be exploited via a 'MIC failure' attack, and an attacker can recover the MIC key after observing about 10,000 packets. In a mixed-mode WPA2 network (TKIP + CCMP), the group cipher is used for broadcast and multicast traffic, so if TKIP is the group cipher, all broadcast traffic is vulnerable even if unicast uses CCMP.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nWireless Capture: Beacon Frame\nSSID: CorpNet\nSecurity: WPA2-PSK\nBSSID: 00:11:22:33:44:55\nChannel: 6\nRSN Information:\n Pairwise Ciphers: CCMP\n Group Cipher: TKIP\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:20:31.196+00:00","questionType":"multiple_choice"},{"id":"8fc94f7f-8a58-4b0f-bf9a-0d03132fd7d3","slug":"a-cloud-security-engineer-wants-to-ensure-that-only-authoriz-qwaub","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A cloud security engineer wants to ensure that only authorized users can access an S3 bucket containing sensitive data. Which AWS service should be used to enforce fine-grained access control?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"AWS Key Management Service (KMS)","explanation":"KMS manages encryption keys, not access control.","masteryContext":""},{"key":"B","isCorrect":false,"text":"AWS CloudTrail","explanation":"CloudTrail logs API calls, it does not control access.","masteryContext":""},{"key":"C","isCorrect":false,"text":"AWS CloudFront","explanation":"CloudFront is for content delivery, not access control.","masteryContext":""},{"key":"D","isCorrect":true,"text":"AWS Identity and Access Management (IAM)","explanation":"IAM policies define permissions for users and roles.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"AWS Identity and Access Management (IAM) is the correct service because it allows the cloud security engineer to define fine-grained permissions using IAM policies that specify which users, groups, or roles can perform specific actions (e.g., s3:GetObject, s3:PutObject) on the S3 bucket. IAM integrates directly with S3 to enforce access control based on the principle of least privilege, ensuring only authorized users can access sensitive data.","examTrap":"The trap here is that candidates often confuse encryption services (KMS) or logging services (CloudTrail) with access control, but only IAM provides the fine-grained authorization policies needed to control user actions on S3 resources.","examTip":null,"technicalDeepDive":"IAM policies are JSON documents that include Effect, Action, Resource, and Condition elements; for S3, you can use condition keys like aws:SourceIp or aws:SecureTransport to enforce context-aware access. Under the hood, when a request is made to S3, the service evaluates the applicable IAM policies (along with bucket policies and ACLs) to determine if the principal has the required permissions, using a deny-by-default model. In a real-world scenario, a security engineer might combine IAM with S3 bucket policies to restrict access to a specific VPC endpoint, preventing data exfiltration over the public internet.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:50.07+00:00","questionType":"multiple_choice"},{"id":"88486405-ddad-4fc7-812f-d41c5cc119b1","slug":"which-three-of-the-following-are-effective-countermeasures-a-0r50i","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are effective countermeasures against DNS poisoning attacks? (Select exactly 3)","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Use a single DNS server for all queries","explanation":"Single server is a single point of failure.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Restrict recursive queries to trusted sources","explanation":"Limiting recursion prevents unauthorized use.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Disable DNS caching","explanation":"Disabling caching reduces performance and does not prevent poisoning.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Use a split DNS architecture","explanation":"Split DNS separates internal and external zones.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Implement DNSSEC","explanation":"DNSSEC digitally signs DNS records to ensure authenticity.","masteryContext":""}],"correctOptionKey":"B,D,E","correctOptions":["B","D","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because restricting recursive queries to trusted sources prevents attackers from using your DNS server as an open resolver to cache forged responses. By limiting recursion to authorized clients only, the server will not accept and cache DNS data from external, potentially malicious queries, which is a primary vector for DNS cache poisoning.","examTrap":"The trap here is that candidates may think disabling DNS caching (Option C) is a valid countermeasure, but CEH expects you to recognize that it is not a security best practice and that DNSSEC, split DNS, and restricting recursion are the standard, effective defenses.","examTip":null,"technicalDeepDive":"DNS cache poisoning exploits the lack of authentication in DNS responses, allowing an attacker to inject false A or NS records into a resolver's cache. DNSSEC (Option E) mitigates this by digitally signing DNS records using RRSIG and DNSKEY records, enabling resolvers to verify authenticity. Split DNS (Option D) separates internal and external DNS zones, preventing external attackers from poisoning internal resolution paths, often implemented with separate authoritative servers and views in BIND.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:14:00.596+00:00","questionType":"multi_select"},{"id":"f75088b4-5071-4402-ac1a-b57bc53743ee","slug":"during-a-reconnaissance-phase-a-penetration-tester-uses-sho-ogu2g","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a reconnaissance phase, a penetration tester uses Shodan to search for devices with a specific open port. Which of the following BEST describes what Shodan provides beyond a simple port scan?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Real-time network traffic analysis","explanation":"Shodan does not perform real-time traffic analysis; it relies on periodic scans.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Passive DNS records and domain registration details","explanation":"Passive DNS and domain registration are provided by tools like WHOIS and SecurityTrails, not Shodan.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Banner information and service metadata from internet-connected devices","explanation":"Shodan's main feature is gathering banner information and metadata from scanned services.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Historical vulnerability data for each device","explanation":"Shodan does not maintain historical vulnerability data; it provides current service banners.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Shodan is a search engine for internet-connected devices that actively probes IP addresses and collects banner information—the metadata that services (e.g., HTTP, SSH, FTP) return upon connection. This includes server headers, version strings, default credentials, and other service fingerprints, which goes far beyond a simple port scan that only reports whether a port is open or closed.","examTrap":"The trap here is that candidates confuse Shodan's banner-grabbing capability with a vulnerability scanner, assuming it provides historical CVE data, when in fact Shodan only shows the current service fingerprint and does not automatically map it to vulnerabilities.","examTip":null,"technicalDeepDive":"Shodan works by sending specially crafted probes (e.g., HTTP GET, SSH banner grab, FTP greeting) to every IPv4 address and parsing the response banners using a custom fingerprinting engine. The service metadata it collects—such as the exact 'Server' header in HTTP responses or the SSH version string—can reveal unpatched software, default configurations, or even embedded device models, enabling attackers to target specific CVEs without needing a live vulnerability scan.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:35:47.278+00:00","questionType":"multiple_choice"},{"id":"33f8535b-00c0-436d-8a83-c761c1098121","slug":"a-security-analyst-runs-the-nmap-command-nmap-si-192-168-1-6o2ac","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst runs the Nmap command: nmap -sI 192.168.1.50 -p 80 10.0.0.1. The scan completes, but the target shows no open ports. What is the MOST likely explanation?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The analyst used the wrong port number","explanation":"If the port were wrong, the scan would still complete; the issue is with the zombie's idle state.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The target has a firewall blocking the decoy packets","explanation":"In an idle scan, the target sees packets from the zombie, not the attacker; a firewall would likely drop them, but the result would still indicate filtered.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The target host is offline","explanation":"The scan used a zombie; the target may be online but the result is unreliable due to zombie activity.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The zombie host is not truly idle, causing false results","explanation":"Idle scan relies on the zombie's IP ID being predictable; if the zombie is active, the IP ID increments unpredictably, leading to false negatives.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -sI flag in Nmap performs an idle scan, which relies on a zombie host (192.168.1.50) with a globally predictable IP ID sequence to probe the target. If the zombie host is not truly idle—meaning it is sending or receiving other traffic during the scan—its IP ID values will increment unpredictably, corrupting the side-channel analysis and causing Nmap to report all ports as filtered or closed. This is the most likely reason for the false 'no open ports' result.","examTrap":"The trap here is that candidates often assume a firewall or offline target is the cause, but the idle scan's success hinges entirely on the zombie's idle state, not on target-side filtering or host availability.","examTip":null,"technicalDeepDive":"Idle scan (RFC 793-based) works by sending a SYN/ACK to the zombie to obtain its initial IP ID, then spoofing a SYN packet from the zombie to the target; if the target port is open, it sends a SYN/ACK back to the zombie, causing the zombie's IP ID to increment by 2 (or more if other traffic occurs). Nmap then checks the zombie's final IP ID; an increment of 2 indicates the port is open, while no increment (or an unexpected value) suggests the port is closed/filtered or the zombie was not idle. Real-world scenarios where this fails include zombie hosts behind NAT, using randomized IP IDs, or being actively used during the scan.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:33:45.394+00:00","questionType":"multiple_choice"},{"id":"26e1440a-accb-428e-926d-6554b0ea3993","slug":"a-penetration-tester-calls-an-employee-claiming-to-be-from-t-sia0d","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Pretexting","explanation":"Pretexting uses a fabricated scenario to obtain information.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Tailgating","explanation":"Tailgating requires physical following, not a phone call.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Quid pro quo","explanation":"Quid pro quo involves offering a service or benefit in exchange for information.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Phishing","explanation":"Phishing is usually via email or fake websites.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The attacker is fabricating a scenario (IT help desk performing a security update) to manipulate the target into revealing sensitive information. This is the essence of pretexting, where the attacker creates a false identity or situation to gain trust and extract data. Unlike phishing, which typically uses malicious links or attachments, this attack relies purely on verbal impersonation and social manipulation.","examTrap":"The trap here is that candidates confuse pretexting with phishing because both involve deception, but phishing specifically uses electronic channels (email, fake login pages) while pretexting can occur over voice or in person without any technical payload.","examTip":null,"technicalDeepDive":"Pretexting often leverages caller ID spoofing to display a legitimate IT help desk number, increasing the victim's trust. In real-world engagements, attackers may research the target's organization structure (e.g., via LinkedIn) to use real names and department references, making the pretext more convincing. The CEH exam emphasizes that pretexting is distinct from phishing because it relies on a fabricated narrative rather than a technical lure.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:15:18.092+00:00","questionType":"multiple_choice"},{"id":"175cd971-a8b8-4733-a8d3-0310071e6955","slug":"a-security-analyst-reviews-the-iptables-firewall-configurati-cgh9i","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst reviews the iptables firewall configuration on a Linux server acting as a gateway for a small office. The server has two interfaces: eth0 (external) and eth1 (internal, 192.168.1.0/24). Based on the exhibit, which of the following is a valid security concern?","difficulty":"medium","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"All traffic to the loopback interface is accepted, which could allow local attacks to bypass firewall rules.","explanation":"Loopback acceptance can be exploited if local services are vulnerable.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The OUTPUT chain policy is set to ACCEPT, which allows any outbound traffic.","explanation":"ACCEPT on OUTPUT is typical; the concern is not about outbound.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The FORWARD chain only allows traffic from 192.168.1.0/24 to any destination, which is too permissive.","explanation":"That is proper for internal users to reach the internet.","masteryContext":""},{"key":"D","isCorrect":false,"text":"UDP port 53 is allowed, which could permit DNS tunneling attacks.","explanation":"DNS is necessary; tunneling would require additional controls.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option A is correct because the iptables rules show that all traffic to the loopback interface (lo) is accepted in the INPUT chain. This means any process on the local host can send packets to 127.0.0.1 without being filtered, potentially allowing local privilege escalation or local attacks to bypass firewall restrictions. In a gateway configuration, this can be exploited if an attacker gains local access and uses the loopback to communicate with services that should be protected.","examTrap":"The trap here is that candidates often overlook the loopback interface rules and focus on external-facing chains, assuming that only external interfaces matter for security, while the question specifically tests awareness of local attack vectors through the loopback interface.","examTip":null,"technicalDeepDive":"The loopback interface (lo) is a virtual network interface used for local communication within the host. In iptables, if the INPUT chain accepts all traffic on lo, any process can send packets to 127.0.0.1 without inspection, which can be leveraged by malware to communicate with local services (e.g., a local DNS resolver or a database) that might have weaker authentication. This is a common oversight in firewall hardening, as administrators often focus on external interfaces and forget to restrict loopback traffic. In real-world scenarios, this can be part of a local privilege escalation attack where an attacker uses loopback to bypass network-based controls.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n# iptables -L -n -v\nChain INPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination\n 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0\n 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443\n 0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53\n 100 5400 DROP all -- eth0 * 0.0.0.0/0 0.0.0.0/0\n\nChain FORWARD (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination\n 0 0 ACCEPT all -- eth0 eth1 192.168.1.0/24 0.0.0.0/0\n 0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0 192.168.1.0/24\n\nChain OUTPUT (policy ACCEPT 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:07:58.058+00:00","questionType":"multiple_choice"},{"id":"a89fb97a-74f5-4085-aef5-2a1e5dd00e20","slug":"refer-to-the-exhibit-an-analyst-suspects-that-the-downloade-knq2y","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An analyst suspects that the downloaded file 'update.exe' may have been tampered with. The vendor's official website lists the SHA256 hash as 4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f. What should the analyst conclude?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The file has been tampered with because the hash is from a different file.","explanation":"The hash actually matches the official hash, indicating no tampering.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The SHA256 hash is not reliable; the analyst should use MD5 instead.","explanation":"SHA256 is cryptographically stronger than MD5 and is reliable for integrity verification.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The file is authentic and has not been tampered with.","explanation":"The hash matches the official value, confirming integrity.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The file is malicious because the hash is too long.","explanation":"Hash length is not an indicator of maliciousness; the hash matches the expected value.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because the SHA256 hash provided by the vendor exactly matches the hash of the downloaded file. SHA256 is a cryptographically strong hash function that produces a fixed 256-bit (64-character hexadecimal) output. A matching hash confirms the file's integrity and authenticity, indicating it has not been tampered with.","examTrap":"The trap here is that candidates may mistakenly think a hash that matches is suspicious or that SHA256 is unreliable, when in fact a matching hash is the definitive proof of file integrity; the exam tests whether you understand that hash length and format are fixed and correct for SHA256.","examTip":null,"technicalDeepDive":"SHA256 is part of the SHA-2 family, producing a 256-bit digest that is computationally infeasible to reverse or find collisions for in practice. In real-world malware analysis, verifying a file's SHA256 hash against the vendor's published value is a standard first step to detect tampering, as even a single bit change in the file produces a completely different hash (avalanche effect). Tools like `certutil -hashfile` on Windows or `sha256sum` on Linux are commonly used for this purpose.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n---\nC:\\> certutil -hashfile C:\\Users\\Admin\\Downloads\\update.exe SHA256\nSHA256 hash of C:\\Users\\Admin\\Downloads\\update.exe:\n4e7c2a8f9b3d1e5f6a0c8b7d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f\n---","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:57.252+00:00","questionType":"multiple_choice"},{"id":"94523d2a-a9f6-466c-907a-aac792b5fe7f","slug":"which-two-of-the-following-are-passive-reconnaissance-techni-cof90","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are passive reconnaissance techniques? (Select 2)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Performing a WHOIS lookup","explanation":"WHOIS queries public registration databases without sending traffic to the target's infrastructure.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Banner grabbing with Netcat","explanation":"Banner grabbing connects to the target's open port to retrieve a banner, which is active.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Running a TCP SYN scan with Nmap","explanation":"Nmap sends packets to the target, making it an active scan.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Using Shodan to search for exposed devices","explanation":"Shodan indexes banner information from previous scans; querying it does not involve direct interaction with the target.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Performing a ping sweep","explanation":"Ping sweep sends ICMP packets to hosts, actively probing for responses.","masteryContext":""}],"correctOptionKey":"A,D","correctOptions":["A","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"A WHOIS lookup queries public databases (e.g., whois.arin.net) to retrieve registration details for domains or IP blocks, such as registrar, creation date, and administrative contacts. This is passive because it relies on publicly available information without sending any packets directly to the target system. The CEH defines passive reconnaissance as gathering data without interacting with the target's network or services.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance by including banner grabbing (which is active because it requires a direct connection) as a distractor, leading candidates to mistakenly classify it as passive since it only reads server responses.","examTip":null,"technicalDeepDive":"Passive reconnaissance techniques like WHOIS and Shodan leverage third-party data sources: WHOIS relies on RIR databases (ARIN, RIPE, APNIC) governed by RFC 3912, while Shodan crawls the internet by sending its own probes and storing banners, so querying Shodan does not touch the target. A subtle behavior: WHOIS responses can include private registration data, but the query itself is logged by the WHOIS server, not the target organization. Shodan's data may be hours or days old, but the query is still passive from the attacker's perspective.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.416+00:00","questionType":"multi_select"},{"id":"7ed1e7b4-2eff-4a8e-b853-0c8a357865cb","slug":"a-penetration-tester-is-performing-a-footprinting-exercise-o-hx9ax","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is performing a footprinting exercise on a target company. The tester wants to identify the network range and ISP of the target. Which of the following tools or techniques is MOST appropriate for this purpose?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Query the Netcraft site for the domain","explanation":"Netcraft gives technology stack, not ISP.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Perform a WHOIS lookup against the domain","explanation":"WHOIS provides IP range and ISP info.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Use nslookup to query the authoritative name servers","explanation":"nslookup only resolves DNS records.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Run a traceroute to the target web server","explanation":"Shows path, not ISP ownership.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A WHOIS lookup against the target domain returns registration details that include the organization's network range (via the 'NetRange' or 'CIDR' fields) and the ISP (via the 'OrgName' or 'descr' fields). This directly maps to the footprinting goal of identifying the target's IP address block and upstream provider, as defined in RFC 3912 and common WHOIS database schemas.","examTrap":"The trap here is that candidates confuse DNS resolution (nslookup) or path tracing (traceroute) with ownership data, but only WHOIS provides the authoritative registration records for network blocks and ISPs.","examTip":null,"technicalDeepDive":"WHOIS data is stored in distributed registries (RIRs like ARIN, RIPE, APNIC) and queried via port 43 (whois protocol) or web interfaces. The returned 'NetRange' field contains the exact CIDR block assigned to the organization, while 'OrgName' identifies the ISP or entity. In real-world engagements, a tester might combine WHOIS with BGP looking glass queries to verify the ISP's ASN, but WHOIS remains the direct source for network range and ISP identification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:44.085+00:00","questionType":"multiple_choice"},{"id":"00e4536f-8ace-4b97-a7ea-a399370f429c","slug":"you-are-performing-a-web-application-security-assessment-and-mcasv","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Directory traversal","explanation":"Directory traversal accesses files, not form parameters.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Parameter tampering","explanation":"Parameter tampering modifies hidden fields or URL parameters.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Cross-Site Scripting (XSS)","explanation":"XSS injects scripts, not modifies form values.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Cross-Site Request Forgery (CSRF)","explanation":"CSRF makes unauthorized requests, but does not modify the price.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.","examTrap":"The trap here is that candidates often confuse parameter tampering with CSRF, but CSRF does not allow modifying the request body; it only reuses existing parameters from a forged request, whereas parameter tampering directly alters the parameter value.","examTip":null,"technicalDeepDive":"Under the hood, hidden form fields are stored in the HTML DOM as and are submitted as part of the HTTP POST body. Tools like Burp Suite's Repeater or a simple browser extension can intercept and modify the POST request before it reaches the server. In a real-world scenario, this vulnerability is common in e-commerce applications where price validation is only performed client-side via JavaScript, and the server blindly trusts the submitted value, leading to financial loss.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:33.857+00:00","questionType":"multiple_choice"},{"id":"52c8039e-55e5-4697-9968-4e2192ba0b94","slug":"a-network-administrator-wants-to-prevent-an-attacker-from-us-ovn55","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SNMP","explanation":"SNMP is for network management, not web traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"FTP","explanation":"FTP is unencrypted.","masteryContext":""},{"key":"C","isCorrect":true,"text":"HTTPS","explanation":"HTTPS encrypts data with TLS.","masteryContext":""},{"key":"D","isCorrect":false,"text":"HTTP","explanation":"HTTP is unencrypted.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.","examTrap":"The trap here is that candidates often confuse encryption with authentication or assume that any protocol with 'secure' in its name (like SNMPv3) is suitable for web traffic, when the question specifically requires a protocol that encrypts client-to-web-server communication — only HTTPS directly fulfills that role.","examTip":null,"technicalDeepDive":"HTTPS uses TLS handshake to negotiate a symmetric session key via asymmetric cryptography (e.g., RSA or ECDHE), then encrypts all application-layer data with ciphers like AES-GCM. A subtle behavior: even if an attacker captures the encrypted traffic, they cannot decrypt it without the session key, but they can still observe metadata such as server IP, domain (via SNI), and traffic volume — a limitation known as traffic analysis. In real-world scenarios, tools like Wireshark can capture HTTPS traffic, but the payload remains unreadable unless the attacker has the private key or performs a man-in-the-middle attack with a rogue certificate.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:11:13.662+00:00","questionType":"multiple_choice"},{"id":"0d32b540-8d74-4599-8c0d-f8e602245a3e","slug":"which-of-the-following-is-an-example-of-passive-os-fingerpri-c6a5h","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following is an example of passive OS fingerprinting?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Performing a TCP SYN scan","explanation":"SYN scan is active.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Nmap -O scan","explanation":"-O sends probes, making it active.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Sending ICMP echo requests","explanation":"ICMP echo requests are active probes.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Analyzing TTL values from captured packets","explanation":"TTL can indicate OS type passively.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.","examTrap":"EC-Council often tests the distinction between active and passive techniques, and the trap here is that candidates confuse 'analyzing captured data' (passive) with 'sending probes and analyzing responses' (active), leading them to pick options like Nmap -O scan or TCP SYN scan.","examTip":null,"technicalDeepDive":"Passive fingerprinting relies on subtle differences in how OS stacks implement TCP/IP, such as initial TTL, window size, DF flag, and TCP options like MSS and SACK. For example, a captured packet with TTL 128 and a window size of 65535 strongly suggests a Windows system, while TTL 64 with a window of 5840 points to a Linux kernel. This technique is stealthy because it never generates traffic to the target, making it ideal for initial reconnaissance in penetration testing.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.482+00:00","questionType":"multiple_choice"},{"id":"cce167b6-996c-467b-8da9-3d8ebf62ef37","slug":"which-three-of-the-following-are-types-of-cryptanalytic-atta-5knbu","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are types of cryptanalytic attacks? (Choose three.)","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Differential cryptanalysis","explanation":"Analyzes how differences in plaintext affect differences in ciphertext.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Rainbow table attack","explanation":"Rainbow tables are used to reverse hash functions, not cryptanalysis of encryption.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Linear cryptanalysis","explanation":"Finds linear approximations to the cipher's behavior.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Brute-force attack","explanation":"Tries all possible keys to decrypt.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Replay attack","explanation":"Replay attacks retransmit valid data, not a cryptanalytic technique.","masteryContext":""}],"correctOptionKey":"A,C,D","correctOptions":["A","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Differential cryptanalysis is a chosen-plaintext attack that analyzes how differences in plaintext pairs affect the resulting ciphertext differences, exploiting statistical biases to recover the encryption key. It is a fundamental cryptanalytic technique, particularly effective against block ciphers like DES.","examTrap":"EC-Council often tests the distinction between cryptanalytic attacks (which target the cipher's mathematical structure) and other attack types like hash precomputation or protocol-level attacks, so candidates mistakenly classify rainbow table or replay attacks as cryptanalytic.","examTip":null,"technicalDeepDive":"Differential cryptanalysis works by tracking the propagation of XOR differences through the cipher's rounds, using high-probability differential characteristics to reduce the key space. Linear cryptanalysis, another correct answer, uses linear approximations of the cipher's nonlinear components (S-boxes) to derive key bits. Both are statistical attacks that require many plaintext-ciphertext pairs, typically millions for modern ciphers like AES.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.948+00:00","questionType":"multi_select"},{"id":"b265031f-fce3-40a1-8fc8-31a462fc7f58","slug":"based-on-the-nmap-scan-output-which-service-is-most-likely-jl3xa","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?","difficulty":"hard","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"MAC Address 00:1A:2B:3C:4D:5E","explanation":"MAC address is not a service.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Apache httpd 2.4.18","explanation":"Apache 2.4.18 has vulnerabilities but not typically RCE.","masteryContext":""},{"key":"C","isCorrect":false,"text":"OpenSSH 7.2p2","explanation":"OpenSSH 7.2p2 has vulnerabilities but not commonly RCE.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Apache Tomcat 8.5.5","explanation":"Tomcat 8.5.5 is vulnerable to Ghostcat (CVE-2020-1938) which allows RCE.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.","examTrap":"EC-Council often tests the misconception that a common service like Apache httpd or OpenSSH is the most vulnerable, but the trap here is that the AJP connector on Tomcat (port 8009) is frequently overlooked, yet it provides a direct path to RCE via Ghostcat.","examTip":null,"technicalDeepDive":"The Ghostcat vulnerability (CVE-2020-1938) in Apache Tomcat 8.5.5 leverages the AJP (Apache JServ Protocol) connector, which by default listens on TCP port 8009. An attacker can send a crafted AJP request with a manipulated 'javax.servlet.include.request_uri' attribute to read or execute files outside the web root, including web application configuration files or even deploy malicious code. This attack does not require authentication and can be executed with tools like Metasploit or custom Python scripts, making it a critical risk in internal network scans.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\n$ nmap -sV -p 22,80,443,8080 192.168.1.10\nStarting Nmap 7.80 ( https://nmap.org ) at 2025-01-15 10:00 UTC\nNmap scan report for 192.168.1.10\nHost is up (0.0010s latency).\n\nPORT STATE SERVICE VERSION\n22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10\n80/tcp open http Apache httpd 2.4.18 ((Ubuntu))\n443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))\n8080/tcp open http Apache Tomcat 8.5.5\nMAC Address: 00:1A:2B:3C:4D:5E (Unknown)\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/\nNmap done: 1 IP address (1 host up) scanned in 12.34 seconds\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.166+00:00","questionType":"multiple_choice"},{"id":"ab853ae0-bd21-4df3-84b7-4748ed92443b","slug":"which-of-the-following-osint-techniques-would-be-most-effect-nsi5o","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following OSINT techniques would be MOST effective for discovering email addresses and employee names associated with a target organization?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nmap scan","explanation":"Nmap is for active scanning, not passive OSINT for emails.","masteryContext":""},{"key":"B","isCorrect":true,"text":"theHarvester","explanation":"theHarvester aggregates emails and names from public sources.","masteryContext":""},{"key":"C","isCorrect":false,"text":"WHOIS lookup","explanation":"WHOIS provides domain registration info, but may not contain employee emails.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Shodan search","explanation":"Shodan finds internet-connected devices, not employee information.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"theHarvester is specifically designed to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-21T15:01:02.88558+00:00","questionType":"multiple_choice"},{"id":"b476f0c3-bb39-455a-b18b-6b0ba10f7502","slug":"during-a-penetration-test-you-run-the-following-command-nm-r2qpi","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you run the following command: nmap -sV -p 80 --script http-title 192.168.1.10. The output shows that port 80 is open and the HTTP title is 'Login Portal'. Which phase of the penetration testing methodology does this activity represent?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Exploitation","explanation":"Exploitation involves actively compromising systems, not just gathering service information.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Post-exploitation","explanation":"Post-exploitation occurs after gaining access, not during initial scanning.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Footprinting","explanation":"Footprinting is passive information gathering without direct interaction; Nmap scanning is active.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Scanning and enumeration","explanation":"Scanning involves actively probing systems to discover open ports, services, and other details. This aligns with the scanning and enumeration phase.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The nmap command with -sV (service version detection) and --script http-title performs service fingerprinting and banner grabbing on port 80, which is a core activity of the scanning and enumeration phase. This phase follows footprinting and involves actively probing target systems to discover open ports, running services, and application details like the HTTP title 'Login Portal'. It does not involve exploiting vulnerabilities (exploitation) or maintaining access (post-exploitation), nor is it passive information gathering (footprinting).","examTrap":"EC-Council often tests the distinction between footprinting and scanning/enumeration, where candidates mistakenly classify any information-gathering activity as footprinting, but the key differentiator is whether the activity involves direct interaction with the target system (scanning) versus passive collection (footprinting).","examTip":null,"technicalDeepDive":"The -sV flag in nmap sends probes to open ports and compares responses against a database of service fingerprints (e.g., nmap-service-probes) to determine the application name and version, while --script http-title specifically fetches the tag from the HTTP response body. In a real-world scenario, discovering 'Login Portal' as the title could indicate a web application login page, which an attacker would then target with credential brute-forcing or vulnerability scanning during the exploitation phase. The distinction between footprinting and scanning is critical: footprinting uses public data (e.g., DNS records), whereas scanning involves direct interaction with the target system.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.881+00:00","questionType":"multiple_choice"},{"id":"71e230ab-014f-4c2b-99e3-266944b9adbf","slug":"which-three-of-the-following-are-valid-pieces-of-information-10fpy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Internal IP addresses of the servers","explanation":"Netcraft shows public IP.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Hosting provider and country","explanation":"Netcraft shows hosting location.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Site's first seen date and uptime history","explanation":"Netcraft tracks history.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Web server software and version","explanation":"Netcraft identifies server info.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Employee email addresses","explanation":"Netcraft does not provide emails.","masteryContext":""}],"correctOptionKey":"B,C,D","correctOptions":["B","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.","examTrap":"EC-Council often tests the distinction between passive reconnaissance (which yields only public information) and active reconnaissance (which might reveal internal details), leading candidates to mistakenly assume that internal IPs or employee emails are obtainable from a public site report.","examTip":null,"technicalDeepDive":"Netcraft's 'Site Report' tool performs a series of passive probes, including an HTTP GET request to capture the Server header (e.g., 'Apache/2.4.41') and a DNS lookup to resolve the domain to its public IP. The 'first seen' date is derived from Netcraft's historical crawl database, which tracks when the site was first observed, while uptime history is calculated from periodic availability checks. This data is invaluable for identifying technology stacks and infrastructure changes over time.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.84+00:00","questionType":"multi_select"},{"id":"a2a7fcba-8605-4f73-a6e1-10e4763759ef","slug":"a-penetration-tester-is-analyzing-a-windows-10-system-and-ru-9xkyr","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is analyzing a Windows 10 system and runs the following command to dump password hashes from the SAM database. The output shows hashes for local users but some are missing. Which step is most likely missing?","difficulty":"hard","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Run the tool as Administrator","explanation":"Administrator privileges are required but not sufficient to read the locked SAM file directly.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use reg.exe save to export SAM hive","explanation":"The SAM hive is locked when the OS is running; reg save may fail without admin privileges or VSS.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Create a Volume Shadow Copy to access SAM file","explanation":"VSS provides a read-only snapshot of the SAM file, bypassing the OS lock.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enable SeDebugPrivilege for the current process","explanation":"SeDebugPrivilege is needed for process injection but does not unlock the SAM file.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"On Windows 10, the SAM file is locked by the operating system while the system is running, preventing direct read access even with Administrator privileges. Creating a Volume Shadow Copy (VSS) allows the penetration tester to access a point-in-time snapshot of the SAM file, bypassing the lock. This is the standard technique for dumping password hashes from a live system without rebooting or using a boot disk.","examTrap":"The trap here is that candidates assume Administrator privileges alone are sufficient to read the SAM file, overlooking the fact that Windows locks the file even for administrators, and that VSS is the required bypass.","examTip":null,"technicalDeepDive":"The Volume Shadow Copy Service (VSS) creates a read-only snapshot of the volume at a specific point in time, allowing access to files that are otherwise locked. Tools like vssadmin or wmic can create the shadow copy, and then the SAM, SYSTEM, and SECURITY hives can be copied from the shadow copy path (e.g., \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM). This technique is commonly used in penetration testing and forensic acquisitions to extract password hashes without altering the live system.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:06:20.004+00:00","questionType":"multiple_choice"},{"id":"e3c984e3-af96-467d-bb11-1afad26987f8","slug":"which-of-the-following-is-the-best-defense-against-brute-for-5vyyb","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following is the BEST defense against brute-force attacks on a login form?","difficulty":"easy","domain":"Web Application and Injection Attacks","domainSlug":"ceh-web-injection","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Rate limiting on the login endpoint","explanation":"Rate limiting reduces the speed of brute-force attempts, but account lockout is a more specific defense.","masteryContext":""},{"key":"B","isCorrect":true,"text":"CAPTCHA","explanation":"CAPTCHA can deter automated attacks but can be bypassed; lockout is more reliable.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Complex password policy","explanation":"Complex passwords make brute-force harder but do not prevent automated attempts; lockout is more effective.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Account lockout after 5 failed attempts","explanation":"Account lockout directly prevents further attempts after a threshold, effectively stopping brute-force.","masteryContext":""}],"correctOptionKey":"A,B,D","correctOptions":["A","B","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Rate limiting on the login endpoint is the best defense because it directly restricts the number of requests an attacker can send over a given time window, making brute-force attacks impractical. Unlike reactive measures like account lockout, rate limiting proactively throttles traffic at the network or application layer, preventing the attacker from even attempting many guesses. This approach is effective against distributed brute-force attacks where lockout policies can be bypassed by rotating IP addresses.","examTrap":"EC-Council often tests the misconception that account lockout is the strongest defense, but the trap here is that lockout can be circumvented by distributed attacks or cause denial of service, whereas rate limiting is a proactive, scalable control that works at the protocol level.","examTip":null,"technicalDeepDive":"Rate limiting is typically implemented using token bucket or leaky bucket algorithms at the web server or reverse proxy (e.g., Nginx's `limit_req_zone` or Apache's `mod_evasive`). In a real-world scenario, an attacker using a botnet with thousands of IPs can bypass account lockout, but rate limiting per IP or per session still caps the overall attempt rate, making the attack take years to complete. The OWASP recommendation for brute-force prevention emphasizes rate limiting as a primary control because it works regardless of the number of accounts targeted.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.554+00:00","questionType":"multiple_choice"},{"id":"4d9ee012-0394-47cf-9bc4-619d19c0842e","slug":"which-nmap-flag-is-used-to-perform-a-tcp-syn-scan-without-co-c0m5k","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which Nmap flag is used to perform a TCP SYN scan without completing the three-way handshake?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"-sS","explanation":"-sS is the SYN stealth scan.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-sT","explanation":"-sT performs a full TCP Connect scan.","masteryContext":""},{"key":"C","isCorrect":false,"text":"-sU","explanation":"-sU performs a UDP scan.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-sA","explanation":"-sA sends ACK packets to map firewall rules.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -sS flag instructs Nmap to perform a TCP SYN scan, which sends a SYN packet to the target port and, upon receiving a SYN/ACK response, sends an RST packet instead of completing the three-way handshake with an ACK. This allows the scanner to determine port states without establishing a full TCP connection, making it faster and less detectable than a full connect scan.","examTrap":"The trap here is that candidates often confuse -sS (SYN scan) with -sT (TCP connect scan), mistakenly thinking that -sT also avoids completing the handshake, when in fact -sT completes the full three-way handshake and is logged by the target system.","examTip":null,"technicalDeepDive":"The TCP SYN scan leverages the fact that a SYN/ACK response indicates an open port, while an RST response indicates a closed port; the scanner immediately sends an RST to abort the handshake, preventing the target from logging a full connection. This technique is often referred to as 'half-open scanning' and is the default scan type when Nmap is run with root privileges because it requires raw packet crafting via libpcap. In real-world scenarios, SYN scans can bypass some stateless firewalls but may be detected by intrusion detection systems (IDS) that monitor for rapid RST packets after SYN/ACK responses.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:34:02.956+00:00","questionType":"multiple_choice"},{"id":"db34dd9f-387e-47b3-979e-977b9974b54c","slug":"a-security-analyst-observes-unusual-outbound-traffic-from-an-g51ob","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst observes unusual outbound traffic from an internal host to an external IP on port 443. The analyst suspects a reverse shell where the internal host initiates an HTTPS connection to the attacker. Which Nmap script would be MOST useful to confirm the nature of this traffic if the analyst can run a scan on the internal host?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"tls-nextprotoneg","explanation":"This script enumerates TLS next protocol negotiation, not useful for reverse shell detection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"smb-enum-shares","explanation":"This script enumerates SMB shares and is unrelated to HTTPS traffic.","masteryContext":""},{"key":"C","isCorrect":true,"text":"http-malware-host","explanation":"This script checks if the target domain is listed as malicious, which could indicate a command-and-control server.","masteryContext":""},{"key":"D","isCorrect":false,"text":"ssh2-enum-algos","explanation":"This script enumerates SSH algorithms and does not help identify reverse shells.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C (http-malware-host) is correct because it checks the internal host's DNS cache or HTTP traffic against known malware domains, which can reveal if the outbound HTTPS connection is to a command-and-control server. Since the traffic is on port 443 (HTTPS), this script can identify malicious destinations without decrypting the traffic, making it ideal for confirming a reverse shell scenario.","examTrap":"The trap here is that candidates may choose tls-nextprotoneg (Option A) thinking it analyzes HTTPS traffic, but it only checks protocol negotiation, not malicious destinations, while http-malware-host directly correlates outbound connections with known threat intelligence.","examTip":null,"technicalDeepDive":"The http-malware-host script queries the host's DNS resolver cache or performs HTTP requests to check against a database of known malware domains (e.g., from MalwareDomains.com). In a reverse shell, the internal host often resolves the attacker's domain via DNS before initiating the HTTPS connection, so this script can flag that domain without needing to inspect encrypted payloads. Real-world attackers frequently use HTTPS on port 443 to blend in with normal web traffic, making this script a practical first step in incident response.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:30:55.182+00:00","questionType":"multiple_choice"},{"id":"4c4824aa-8387-4223-8183-7af699577d27","slug":"a-company-uses-a-cloud-based-identity-provider-idp-for-sin-4w15y","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company uses a cloud-based identity provider (IdP) for single sign-on (SSO). Which security control is most effective in preventing account takeover due to credential stuffing?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Enforce complex password policies.","explanation":"Does not stop credential stuffing.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Enable multi-factor authentication (MFA) for all users.","explanation":"MFA prevents credential stuffing.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Implement CAPTCHA on the login page.","explanation":"CAPTCHA can be bypassed or not present on SSO.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enable account lockout after 3 failed attempts.","explanation":"Attackers can use many accounts.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Multi-factor authentication (MFA) is the most effective control against credential stuffing because it requires an additional verification factor beyond the password. Even if an attacker obtains valid credentials through a previous breach, they cannot complete authentication without the second factor (e.g., a one-time passcode from an authenticator app or a hardware token). This directly neutralizes the core attack vector of credential stuffing, which relies solely on reused passwords.","examTrap":"The trap here is that candidates often choose account lockout (Option D) thinking it stops brute-force attacks, but credential stuffing uses valid passwords from breaches, so lockout is ineffective and can be easily evaded with distributed IPs.","examTip":null,"technicalDeepDive":"Credential stuffing exploits the widespread reuse of passwords across services; attackers feed lists of username/password pairs from data breaches into automated login scripts against the target IdP. MFA, especially when using time-based one-time passwords (TOTP) per RFC 6238 or FIDO2 WebAuthn, ensures that possession of the password alone is insufficient. In a real-world scenario, even if an attacker has the correct password for a cloud SSO account (e.g., Azure AD or Okta), the second factor challenge stops the takeover cold.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:20:01.012+00:00","questionType":"multiple_choice"},{"id":"65b5ae7d-8baf-4ed3-83a4-b0502def1ddd","slug":"during-a-penetration-test-a-tester-runs-dnsrecon-d-exampl-7szj5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, a tester runs 'dnsrecon -d example.com -t axfr' and receives a full list of DNS records. What does this indicate about the target's DNS configuration?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The DNS server has DNSSEC enabled","explanation":"DNSSEC does not prevent zone transfers; it adds signatures.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The DNS server allows recursive queries","explanation":"Recursive queries are a separate concept from zone transfers.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The DNS server allows zone transfers from any host","explanation":"A successful axfr means the server is configured to allow zone transfers to unauthorized hosts.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The DNS server is authoritative for the domain","explanation":"Authoritative servers may still restrict zone transfers; success indicates a misconfiguration.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The 'dnsrecon -d example.com -t axfr' command performs a DNS zone transfer (AXFR) request. Receiving a full list of DNS records indicates that the target DNS server is misconfigured to allow zone transfers from any host, which exposes the entire DNS zone data (including internal hostnames and IP addresses) to unauthorized parties. This is a critical information disclosure vulnerability.","examTrap":"The trap here is that candidates confuse 'authoritative' with 'vulnerable' — being authoritative is normal, but allowing unrestricted zone transfers is the misconfiguration; EC-Council often tests this by making option D sound correct because the server is authoritative, but the real issue is the lack of access control on the AXFR query.","examTip":null,"technicalDeepDive":"A zone transfer (AXFR) is a mechanism defined in RFC 1034/1035 for replicating DNS zone data between primary and secondary authoritative servers. The 'dnsrecon' tool sends an AXFR query with the opcode 0 and QTYPE 252; if the target server's 'allow-transfer' ACL is misconfigured (e.g., set to 'any' or left at default on some platforms), it will return the full zone file. In real-world engagements, this often reveals internal network topology, server names, and even service records that aid further exploitation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.399+00:00","questionType":"multiple_choice"},{"id":"47b4bdb3-f5a6-47a0-95e5-df1d38f51c64","slug":"you-are-a-security-consultant-for-a-mid-sized-company-that-r-1o5s8","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are a security consultant for a mid-sized company that recently migrated its customer relationship management (CRM) system to a public cloud provider (AWS). The CRM is a web application behind an Application Load Balancer (ALB) with WAF enabled. The application stores sensitive customer data in an RDS MySQL database. The security team has configured security groups to allow only HTTPS (443) from the internet to the ALB, and from the ALB to the application servers on port 8080. The application servers can connect to the database on port 3306. During a routine vulnerability scan, you discover that the database is publicly accessible from the internet on port 3306, which contradicts the intended design. You verify that the security group for the database allows inbound traffic from 0.0.0.0/0 on port 3306. The database contains unencrypted personal identifiable information (PII). What is the most effective immediate action to remediate this vulnerability?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Modify the database security group to remove the 0.0.0.0/0 inbound rule and add a rule allowing only the application servers' security group on port 3306.","explanation":"This restricts access to only authorized sources, closing the exposure.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Enable RDS Enhanced Monitoring and log all connections to the database for forensic analysis.","explanation":"Logging does not block the open port.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enable deletion protection on the RDS instance to prevent accidental removal.","explanation":"Deletion protection does not affect network access.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enable encryption at rest for the RDS instance using AWS KMS.","explanation":"Encryption protects data if accessed, but the port remains open.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The most effective immediate action is to restrict the database security group to allow inbound traffic only from the application servers' security group on port 3306. This directly removes the public exposure (0.0.0.0/0) and enforces the principle of least privilege, ensuring only the intended application tier can communicate with the database. Since the database contains unencrypted PII, closing the public access is the highest priority remediation to prevent data exfiltration.","examTrap":"The trap here is that candidates may focus on encryption or logging as a quick fix, but the most critical and immediate action is to close the direct public network access to the database, as encryption and logging do not prevent an active attacker from connecting and stealing data.","examTip":null,"technicalDeepDive":"AWS security groups act as a stateful virtual firewall at the instance level. When a security group rule allows 0.0.0.0/0 on port 3306, any host on the internet can attempt a MySQL connection. The immediate fix is to replace that rule with a reference to the application servers' security group ID, which dynamically allows traffic only from instances in that group, even if their IPs change. This is a common misconfiguration in cloud environments where default 'allow all' rules are left in place after initial setup.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:05.772+00:00","questionType":"multiple_choice"},{"id":"fbd4f87d-55a0-4ab5-ac31-bcf772c49144","slug":"a-security-team-observes-repeated-nmap-scans-from-an-externa-drbpm","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security team observes repeated Nmap scans from an external IP address. The scans show fragmented IP packets. Which evasion technique is the attacker using?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Fragmentation","explanation":"Fragmentation splits packets to evade detection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Decoy scan","explanation":"Decoy scan uses fake source IPs.","masteryContext":""},{"key":"C","isCorrect":false,"text":"ACK scan","explanation":"ACK scan maps firewall rules, not evasion via fragmentation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Idle scan","explanation":"Idle scan uses a zombie host to spoof the scan source.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The attacker is using fragmentation to evade detection by splitting the Nmap probe packets into smaller fragments. This technique bypasses simple packet filters and intrusion detection systems (IDS) that lack IP fragment reassembly capabilities, as the fragments are typically allowed through individually. Nmap's `-f` flag or `--mtu` option is used to send fragmented IP packets, making the scan less conspicuous.","examTrap":"EC-Council often tests the distinction between fragmentation and decoy scans, as candidates may confuse 'splitting packets' with 'spoofing IPs' due to both being evasion techniques.","examTip":null,"technicalDeepDive":"Fragmentation works by splitting the TCP header across multiple IP fragments, so that the destination port number may appear in a later fragment, evading stateful inspection firewalls that only check the first fragment. Nmap's `-f` option sets the fragment size to 8 bytes (or 16 with `-ff`), forcing the IP layer to create small fragments. Some older IDS/IPS systems reassemble fragments in a linear fashion, but attackers can use overlapping fragments (e.g., with `--send-eth` and custom MTU) to cause reassembly confusion.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.537+00:00","questionType":"multiple_choice"},{"id":"ed50d107-6720-484f-aa1e-f699dfa0148b","slug":"which-two-of-the-following-are-characteristics-of-a-polymorp-m27ee","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Remains constant in code to ensure replication","explanation":"Polymorphic viruses change constantly.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Mutates its code to evade signature detection","explanation":"Polymorphic viruses change their code pattern each time they replicate.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Uses encryption with a variable key","explanation":"Polymorphic viruses often use a variable encryption key to change the decrypted code.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Spreads via network shares","explanation":"That is typical of worms, not specifically polymorphic viruses.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Resides in the boot sector of a hard drive","explanation":"That describes a boot sector virus.","masteryContext":""}],"correctOptionKey":"B,C","correctOptions":["B","C"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because a polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.","examTrap":"The trap here is that candidates often confuse 'polymorphic' with 'metamorphic' or assume that all viruses that use encryption are polymorphic, but the key distinction is that polymorphic viruses use a variable key and mutate the decryption routine, whereas simple encrypted viruses use a fixed key and do not change their decryptor.","examTip":null,"technicalDeepDive":"Under the hood, a polymorphic virus includes a mutation engine that generates new decryption routines and re-encrypts the virus body with a different key each time. This means the virus's binary pattern changes on every infection, but the decryption engine must remain functional—often using obfuscation techniques like garbage code insertion or instruction substitution. In real-world scenarios, advanced polymorphic malware like the 'Storm Worm' used this technique to evade early antivirus signatures, requiring heuristic or behavioral analysis to detect.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:07.453+00:00","questionType":"multi_select"},{"id":"0ba39262-372f-444b-9491-743e640b536b","slug":"a-security-analyst-receives-an-alert-that-an-external-ip-add-sld9q","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst receives an alert that an external IP address is sending fragmented packets to the company's web server on port 80. The analyst suspects the attacker is using Nmap with fragmentation. Which Nmap flag is being used to fragment the probe packets?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-sI","explanation":"-sI is for idle scan.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-D","explanation":"-D is for decoy scanning.","masteryContext":""},{"key":"C","isCorrect":false,"text":"--mtu","explanation":"--mtu sets a specific MTU size but is not the standard fragmentation flag.","masteryContext":""},{"key":"D","isCorrect":true,"text":"-f","explanation":"-f is the fragmentation flag.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -f flag in Nmap instructs the tool to fragment the probe packets into 8-byte or smaller fragments, making it harder for packet filters and intrusion detection systems to detect the scan. This matches the scenario where fragmented packets are sent to the web server on port 80, confirming that -f is the correct flag.","examTrap":"EC-Council often tests the distinction between -f (fragmentation) and --mtu (custom MTU size), leading candidates to mistakenly choose --mtu because they associate it with packet size changes, but only -f triggers fragmentation by default.","examTip":null,"technicalDeepDive":"When Nmap uses -f, it splits the TCP header and payload into fragments of 8 bytes each (by default), which can bypass simple firewall rules that only inspect the first fragment. This technique exploits the IP fragmentation mechanism defined in RFC 791, where subsequent fragments lack the full transport-layer header, potentially evading stateful inspection. In real-world scenarios, some intrusion detection systems (e.g., Snort) can reassemble fragments using preprocessor rules, but older or misconfigured systems may miss the attack.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.217+00:00","questionType":"multiple_choice"},{"id":"d8bbb7a6-011c-433c-af17-8c6930927c38","slug":"during-a-penetration-test-an-ethical-hacker-finds-that-a-we-u11si","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Weak TLS cipher suite","explanation":"The issue is not about cipher strength; HTTPS is properly configured.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Lack of application-layer encryption","explanation":"The data is encrypted in transit but not at rest or before being sent; the application does not encrypt sensitive fields.","masteryContext":""},{"key":"C","isCorrect":false,"text":"SSL stripping attack","explanation":"There is no indication of an active downgrade attack.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"HTTPS prevents MITM; the issue is application-side.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.","examTrap":"The trap here is that candidates confuse 'encrypted in transit' (TLS) with 'encrypted at the application layer,' assuming HTTPS alone provides end-to-end data confidentiality, but the CEH exam tests the distinction between transport-layer and application-layer encryption.","examTip":null,"technicalDeepDive":"Under the hood, HTTPS provides transport-layer security via TLS, but the application payload (e.g., JSON, XML) remains in plaintext within the encrypted tunnel. If an attacker gains access to the server's memory, logs, or a TLS-terminating proxy, they can read the sensitive data directly. Real-world examples include credit card numbers sent in a POST body over HTTPS without additional encryption, which could be exposed in server logs or via a memory dump. Application-layer encryption, such as using a pre-shared key or asymmetric encryption on the payload before HTTPS, ensures that even if TLS is compromised, the data remains confidential.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:48.42+00:00","questionType":"multiple_choice"},{"id":"730c9ba6-effa-455e-996d-960c1182705f","slug":"what-is-the-primary-purpose-of-using-the-nmap-flag-ss-uc4rr","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"What is the primary purpose of using the Nmap flag -sS?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Enable OS detection","explanation":"OS detection uses -O.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Perform a SYN stealth scan","explanation":"-sS is the SYN stealth scan flag.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Perform a UDP scan","explanation":"UDP scan uses -sU.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a TCP connect scan","explanation":"TCP connect scan uses -sT.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The Nmap flag -sS instructs Nmap to perform a SYN stealth scan, also known as a half-open scan. It sends a TCP SYN packet to the target port and, if a SYN/ACK is received, the port is considered open; the scanner then sends a RST to tear down the connection before the full TCP three-way handshake completes. This technique avoids completing the connection, making it less likely to be logged by the target's application layer and is the default scan type when run with root privileges.","examTrap":"EC-Council often tests the distinction between -sS (SYN stealth) and -sT (TCP connect), where candidates mistakenly think -sS completes the handshake or that -sT is the stealthier option.","examTip":null,"technicalDeepDive":"The SYN stealth scan works by sending a TCP packet with the SYN flag set (as defined in RFC 793). If the target responds with a SYN/ACK, the port is open; if it responds with an RST, the port is closed; if no response or an ICMP unreachable error is received, the port is filtered. A subtle behavior is that on modern firewalls and intrusion detection systems (IDS), the pattern of SYN packets followed by RST packets can still be detected, so the 'stealth' aspect is relative and not guaranteed.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.8+00:00","questionType":"multiple_choice"},{"id":"70fd0a6d-1a35-4e88-9a12-db09bce7cceb","slug":"which-three-of-the-following-are-essential-phases-in-the-eth-y8jeq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?","difficulty":"medium","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Maintaining Access","explanation":"Maintaining Access is a phase after gaining initial entry.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Scanning","explanation":"Scanning involves active probing of the target network.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enumeration","explanation":"Enumeration is a sub-phase within Scanning, not a separate phase.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Reconnaissance","explanation":"Reconnaissance is the first phase, involving information gathering.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Social Engineering","explanation":"Social Engineering is a technique used within phases, not a phase itself.","masteryContext":""}],"correctOptionKey":"A,B,D","correctOptions":["A","B","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Maintaining Access is a core phase in the EC-Council ethical hacking methodology because after gaining initial access, the attacker must ensure persistent control over the target system. This involves installing backdoors, rootkits, or creating privileged user accounts to bypass re-authentication. Without this phase, the penetration test would not simulate a real-world advanced persistent threat (APT) scenario.","examTrap":"The trap here is that candidates confuse enumeration as a distinct phase when it is actually a sub-component of the Scanning phase, and they mistake social engineering for a phase rather than recognizing it as a technique that can be used within Reconnaissance or Gaining Access.","examTip":null,"technicalDeepDive":"The EC-Council ethical hacking methodology follows a five-phase cycle: Reconnaissance (passive/information gathering), Scanning (active probing with tools like Nmap), Gaining Access (exploitation), Maintaining Access (persistence via cron jobs, registry run keys, or SSH tunnels), and Clearing Tracks (log deletion, timestamp manipulation). Maintaining Access is critical for post-exploitation activities such as lateral movement and data exfiltration, often leveraging Metasploit's persistence modules or custom backdoors that survive reboots.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:57.536+00:00","questionType":"multi_select"},{"id":"a037aed5-1b33-4090-af44-e38888e909ac","slug":"during-a-penetration-test-you-execute-the-following-command-twwbd","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you execute the following command: dnsrecon -d example.com -t axfr. The output shows 'AXFR record received' followed by a list of all DNS records. What does this indicate about the target's DNS configuration?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The DNS server is using DNSSEC to secure zone transfers","explanation":"DNSSEC does not prevent AXFR; it provides data integrity and authentication but zone transfer restrictions are separate.","masteryContext":""},{"key":"B","isCorrect":true,"text":"The DNS server is vulnerable to zone transfer attacks, allowing unauthorized users to retrieve the entire zone file","explanation":"A successful AXFR to an unauthenticated client indicates a misconfiguration that exposes internal network details.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The DNS server is properly configured and only allows zone transfers to authorized secondary servers","explanation":"If only authorized, the AXFR request would have been denied.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The target uses a split-DNS configuration with internal and external views","explanation":"Split-DNS might restrict zone transfers, but a successful AXFR from an external perspective indicates a flaw.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The successful execution of `dnsrecon -d example.com -t axfr` and the receipt of an AXFR (full zone transfer) response indicates that the target DNS server is misconfigured to allow zone transfers from any host. A properly secured DNS server should restrict AXFR queries to only authorized secondary (slave) servers, typically by IP address or TSIG (Transaction Signature) keys. Since the command was run from an unauthorized client, this confirms a zone transfer vulnerability, allowing an attacker to retrieve the entire DNS zone file, which reveals all hostnames, IP addresses, and service records.","examTrap":"The trap here is that candidates may confuse DNSSEC with access control mechanisms, or assume that a successful zone transfer implies proper authorization, when in fact the CEH exam emphasizes that any successful AXFR from an unauthorized client is a critical misconfiguration and vulnerability.","examTip":null,"technicalDeepDive":"Zone transfers (AXFR) are defined in RFC 1034 and RFC 5936, and are intended for replicating DNS data between primary and secondary servers. A common misconfiguration is leaving the `allow-transfer` directive unset or set to `any` in BIND or equivalent settings in other DNS software (e.g., Microsoft DNS). In a real-world scenario, an attacker can use the retrieved zone file to map the entire network infrastructure, identify high-value targets, and plan further attacks like social engineering or targeted exploitation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:24:11.101+00:00","questionType":"multiple_choice"},{"id":"a2f1482b-9898-4e62-810d-289e9119e959","slug":"during-a-penetration-test-an-ethical-hacker-needs-to-evade-yc7ak","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?","difficulty":"hard","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Use random source ports","explanation":"Random ports don't affect packet rate.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use a decoy scan","explanation":"Decoy scans can still generate high packet rates.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Slow down the scan rate","explanation":"Reducing packets per second avoids triggering rate-based IDS thresholds.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Use fragmented packets","explanation":"Fragmentation evades signature detection, not rate-based detection.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because slowing down the scan rate reduces the number of packets sent per second below the IDS threshold, allowing the scan to blend in with normal traffic. IDS systems like Snort use packet-per-second (pps) counters to detect port scans; by spacing out packets over a longer period, the scan avoids triggering these rate-based alerts.","examTrap":"EC-Council often tests the misconception that fragmentation alone evades IDS, but candidates must remember that rate-based detection counts packets regardless of fragmentation, so slowing the scan is the direct countermeasure.","examTip":null,"technicalDeepDive":"Rate-based IDS detection relies on sliding window counters, often tracking packets per second over intervals like 1-5 seconds. Tools like Nmap's --scan-delay or -T0 (paranoid timing) can slow scans to as low as 0.5 packets per second, staying under typical thresholds (e.g., Snort's default portscan alert triggers at 5 pps). In real-world scenarios, attackers may also use random delays between probes to further mimic legitimate traffic patterns.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.485+00:00","questionType":"multiple_choice"},{"id":"b6f97906-d332-415c-a298-6e49e0da96a3","slug":"refer-to-the-exhibit-a-penetration-tester-executed-the-sql-be2y7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A penetration tester executed the SQL injection payload and received the response shown. What is the most likely outcome of this attack?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The attacker extracted hashed passwords that can be cracked offline","explanation":"The response contains username:hash pairs; the hash appears to be MD5, which is crackable.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The attacker successfully performed a blind SQL injection to enumerate the database structure","explanation":"The response shows actual data, not blind inference; the attacker sees the results directly.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The attacker caused a denial of service by sending an invalid query","explanation":"The query executed successfully (200 OK) and returned data; no denial of service.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The attacker modified the database records to update user passwords","explanation":"The payload uses UNION SELECT to retrieve data, not UPDATE to modify records.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The response shows a successful SQL injection that returned password hashes (likely from the `password` column) in the output. This indicates the attacker exploited a vulnerable parameter to extract hashed credentials from the database, which can then be cracked offline using tools like Hashcat or John the Ripper. The presence of hash strings in the response confirms data extraction, not modification or denial of service.","examTrap":"EC-Council often tests the distinction between in-band (error-based/UNION) SQL injection, which returns data directly, and blind SQL injection, which does not return visible data; candidates mistakenly choose blind when the response clearly shows extracted values.","examTip":null,"technicalDeepDive":"In a typical SQL injection attack, the attacker injects a UNION SELECT statement to append results from other tables (e.g., `UNION SELECT username, password FROM users`). The database returns the concatenated result set, including hashed passwords, which are often stored as MD5, SHA-1, or bcrypt strings. Real-world scenarios often involve extracting `wp_users` tables in WordPress or `syslogins` in MSSQL, where offline cracking is the primary goal.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nGET /search?q=1 UNION SELECT username,password FROM users-- HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/5.0\n\nHTTP/1.1 200 OK\nDate: Mon, 04 Nov 2024 12:00:00 GMT\nServer: Apache/2.4.41 (Ubuntu)\nContent-Type: text/html\n\n<html><body><h1>Search Results</h1><p>admin:5f4dcc3b5aa765d61d8327deb882cf99</p><p>user1:5d41402abc4b2a76b9719d911017c592</p></body></html>","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.083+00:00","questionType":"multiple_choice"},{"id":"1a5cecaf-af39-4849-b2d5-2f4893c6df83","slug":"during-a-penetration-test-you-run-the-following-nmap-comman-wvb7g","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you run the following Nmap command: nmap -sS -sV -O -A -T4 --script=default 10.0.0.1. The scan results show that port 443 is open and the service is 'Apache httpd 2.4.29'. However, banner grabbing with Netcat shows 'Apache/2.4.41 (Ubuntu)'. What is the MOST likely explanation for the discrepancy?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The server is using a reverse proxy that presents a different version to Nmap","explanation":"If a reverse proxy were involved, Nmap might see the proxy's version, but banner grabbing from the same IP should match.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Netcat banner grabbing is more reliable because it reads the actual server response","explanation":"Netcat establishes a TCP connection and reads the service banner directly, while Nmap's -sV uses a database of signatures that may be incomplete or outdated.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The discrepancy is due to Nmap's OS fingerprinting conflicting with version detection","explanation":"OS fingerprinting (-O) does not affect service version detection (-sV). They are separate modules.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap is more accurate because it uses deep packet inspection","explanation":"Banner grabbing directly reads the server's response, which is typically more accurate for version detection.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because Netcat performs a direct TCP connection to the service and reads the raw banner as sent by the application, which is the most immediate and unfiltered version information. Nmap's version detection (-sV) relies on probe-response matching against its signature database, which can be outdated or misinterpret the service if the server uses banner obfuscation or if the Nmap database does not have an exact match for the newer version. In this case, Netcat reveals the actual server version (2.4.41), while Nmap's database may only have a signature for 2.4.29, leading to a false lower version.","examTrap":"The trap here is that candidates assume Nmap is always more accurate because it is a sophisticated scanning tool, but in version detection, a direct banner grab with Netcat is often more reliable when the service banner is not suppressed.","examTip":null,"technicalDeepDive":"Nmap's service version detection works by sending a series of probes (e.g., NULL, Generic, SSL/TLS) and comparing the responses to a database of known service fingerprints. If the server's response does not exactly match any fingerprint, Nmap may fall back to a generic match or an older version. Netcat, on the other hand, simply connects and reads the initial banner as defined in RFC 2616 for HTTP, which is the raw server string. In real-world scenarios, administrators may configure Apache to hide the exact version in the banner (e.g., ServerTokens Prod), but here the banner is explicit, making Netcat's result the ground truth.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:24:34.109+00:00","questionType":"multiple_choice"},{"id":"a296d504-ff67-45ad-9808-50515652f82f","slug":"which-two-vulnerabilities-are-associated-with-buffer-overflo-4u6tn","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO vulnerabilities are associated with buffer overflow attacks?","difficulty":"easy","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Arbitrary code execution","explanation":"Successful buffer overflow attacks often lead to arbitrary code execution.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Stack smashing","explanation":"Stack-based buffer overflows can overwrite return addresses, causing stack smashing.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Authentication bypass via SQL injection","explanation":"SQL injection is a separate vulnerability.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Cross-site scripting (XSS)","explanation":"XSS is a client-side injection, not buffer overflow.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Race condition","explanation":"Race conditions involve timing issues, not buffer overflows.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Buffer overflow attacks occur when a program writes more data to a buffer than it can hold, overwriting adjacent memory. This can corrupt the stack and allow an attacker to inject and execute arbitrary code (option A) by overwriting the return address or function pointers. Stack smashing (option B) is a specific technique that deliberately corrupts the call stack to hijack control flow, often as part of a buffer overflow exploit.","examTrap":"The trap here is that candidates often confuse buffer overflow with other injection or concurrency flaws, but the CEH exam specifically pairs arbitrary code execution and stack smashing as the two direct consequences of a buffer overflow.","examTip":null,"technicalDeepDive":"In a classic stack-based buffer overflow, the attacker overwrites the saved return address on the stack with a pointer to shellcode placed in the buffer. Modern mitigations like ASLR (Address Space Layout Randomization) and NX (No-Execute) bits make exploitation harder, but techniques such as ROP (Return-Oriented Programming) bypass these protections. Real-world examples include the Morris Worm (1988) exploiting a buffer overflow in fingerd and the EternalBlue exploit (2017) targeting SMBv1.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:06:26.882+00:00","questionType":"multi_select"},{"id":"50c55770-c61c-429b-9565-dba64d1835a8","slug":"a-company-deploys-iot-sensors-in-a-remote-facility-with-limi-0m0br","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company deploys IoT sensors in a remote facility with limited bandwidth. The sensors send small data packets every few seconds. Which wireless technology is most appropriate for this application?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"4G LTE","explanation":"Higher bandwidth and power consumption.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Wi-Fi 6","explanation":"Higher power and shorter range.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Bluetooth 5","explanation":"Short range and not ideal for remote sensors.","masteryContext":""},{"key":"D","isCorrect":true,"text":"LoRaWAN","explanation":"Optimized for low-power, long-range IoT.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"LoRaWAN is designed for low-power, long-range communication with small data payloads, making it ideal for IoT sensors in remote facilities with limited bandwidth. It operates in sub-GHz ISM bands (e.g., 868 MHz or 915 MHz) and supports data rates from 0.3 kbps to 50 kbps, perfectly matching the requirement of sending small packets every few seconds over kilometers.","examTrap":"The trap here is that candidates often confuse 'low power' and 'short range' technologies like Bluetooth 5 with the specific requirements of remote, long-range IoT, failing to recognize that LoRaWAN is the only option explicitly designed for low-power wide-area networks (LPWAN) with kilometer-scale range.","examTip":null,"technicalDeepDive":"LoRaWAN uses a star-of-stars topology where end devices communicate with gateways via LoRa modulation, which employs spread-spectrum technology to achieve long range (up to 15 km in rural areas) at the cost of low data rates. The Adaptive Data Rate (ADR) mechanism dynamically adjusts spreading factors and transmit power to optimize battery life and network capacity, a subtle behavior that ensures sensors can operate for years on a single AA battery. In a real-world scenario, a remote oil pipeline monitoring system uses LoRaWAN to transmit pressure and temperature readings every 10 seconds over 10 km, with gateways backhauling data via satellite or cellular.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:20:40.038+00:00","questionType":"multiple_choice"},{"id":"f7e3abef-2afd-4363-a1da-8606dbec7e23","slug":"a-security-analyst-wants-to-discover-all-dns-records-associa-vdpa3","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst wants to discover all DNS records associated with a domain without triggering a full zone transfer. Which tool is BEST suited for this task?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"theHarvester","explanation":"theHarvester gathers emails, subdomains, and IPs from public sources but does not directly perform DNS record enumeration.","masteryContext":""},{"key":"B","isCorrect":false,"text":"dig","explanation":"dig is a flexible DNS query tool but typically used for single queries; dnsrecon automates enumeration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"nslookup","explanation":"nslookup is a basic query tool but not specifically designed for enumeration across multiple record types and subdomain brute-forcing.","masteryContext":""},{"key":"D","isCorrect":true,"text":"dnsrecon","explanation":"dnsrecon is a powerful DNS enumeration script that can query multiple record types and perform subdomain brute-forcing.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"D (dnsrecon) is correct because it is a dedicated DNS enumeration tool that performs multiple types of DNS record queries (A, AAAA, CNAME, MX, NS, SOA, SRV, TXT, etc.) using techniques like brute‑forcing subdomains and performing SRV record enumeration, all without attempting a full zone transfer (AXFR). It is specifically designed for reconnaissance and can discover hidden or non‑obvious DNS records efficiently.","examTrap":"EC-Council often tests the misconception that nslookup or dig are sufficient for comprehensive DNS discovery, but the question specifically asks for a tool that discovers *all* DNS records without a zone transfer, which requires automated enumeration beyond single‑query tools.","examTip":null,"technicalDeepDive":"dnsrecon leverages Python’s dnspython library to send multiple DNS query types (e.g., ANY, AXFR, SRV, TXT) and can perform dictionary‑based subdomain brute‑forcing against the target domain. In real‑world engagements, it is often used to map out a target’s attack surface by discovering services like SIP (SRV records for VoIP) or Microsoft Exchange (SRV _autodiscover), which are not revealed by a simple A or MX query. The tool also supports DNSSEC zone walking (RFC 5155) to enumerate records when NSEC records are used.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.437+00:00","questionType":"multiple_choice"},{"id":"30cc1503-71bb-4e0a-9019-3cdd0a3aab56","slug":"during-a-penetration-test-you-need-to-identify-all-live-hos-v5kw2","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you need to identify all live hosts on a target network without being detected by intrusion detection systems. Which Nmap flag would BEST achieve this?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-O (OS fingerprinting)","explanation":"OS fingerprinting requires active probes that can be detected by IDS.","masteryContext":""},{"key":"B","isCorrect":true,"text":"-sn (ping sweep)","explanation":"Ping sweep only checks host availability, generating minimal traffic and avoiding full port scans.","masteryContext":""},{"key":"C","isCorrect":false,"text":"-sS (SYN scan)","explanation":"SYN scan is stealthier than connect scan but still actively probes ports, increasing detection risk.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-sV (version detection)","explanation":"Version detection connects to open ports and may trigger alerts.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -sn flag (ping sweep) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if a host is alive. This is the best choice for stealthy host discovery because it does not complete a full TCP handshake or send application-layer probes, minimizing the chance of triggering IDS signatures that look for port scans or OS fingerprinting.","examTrap":"The trap here is that candidates often confuse -sn (ping sweep) with -sS (SYN scan) because both involve TCP packets, but -sn is purely for host discovery without port scanning, whereas -sS is a port scanning technique that is much more intrusive and detectable.","examTip":null,"technicalDeepDive":"Nmap's -sn flag uses a multi-method discovery approach: by default on a local network, it sends an ARP request (which is non-IP and often not monitored by IDS), while on a remote network it sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests. This combination increases the chance of detecting live hosts even when firewalls block ICMP, but the lack of full connection establishment keeps the scan relatively low-profile compared to SYN or version scans.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:29:01.766+00:00","questionType":"multiple_choice"},{"id":"a183d697-bdc5-4971-98a0-cf5042a48a23","slug":"refer-to-the-exhibit-a-security-analyst-captured-the-http-r-hqacz","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst captured the HTTP request and response shown. What type of vulnerability is present?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Cross-Site Request Forgery (CSRF)","explanation":"No cross-origin request is shown.","masteryContext":""},{"key":"B","isCorrect":false,"text":"SQL Injection","explanation":"No database query is visible.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Reflected Cross-Site Scripting (XSS)","explanation":"The input is reflected in the response and executed as script.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Directory Traversal","explanation":"No file path manipulation is present.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The HTTP response contains the search query parameter directly reflected in the HTML body without proper sanitization or encoding. Specifically, the request includes `?search=<script>alert('XSS')</script>` and the response echoes this payload verbatim in the page content, allowing the browser to execute the injected JavaScript. This is the classic signature of a reflected cross-site scripting (XSS) vulnerability, where the malicious script is immediately reflected off the web server and executed in the user's browser.","examTrap":"EC-Council often tests the distinction between reflected XSS and stored XSS, but the trap here is confusing reflected XSS with CSRF because both involve crafted URLs, but CSRF does not execute JavaScript in the response—it forges a state-changing request using the victim's session.","examTip":null,"technicalDeepDive":"Reflected XSS occurs when user input is immediately included in the server's response without proper output encoding, typically via URL parameters or form submissions. Under the hood, the browser trusts the origin server, so any script injected into the response runs in the same origin context, allowing access to cookies, session tokens, and DOM manipulation. In real-world scenarios, attackers often craft a malicious link (e.g., via email or phishing) that includes the XSS payload; when the victim clicks it, the script executes and exfiltrates sensitive data to an attacker-controlled server.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\nGET /search?q=<script>alert('XSS')</script> HTTP/1.1\nHost: www.example.com\nUser-Agent: Mozilla/5.0\n\nHTTP/1.1 200 OK\nContent-Type: text/html\n\n<html><body>You searched for: <script>alert('XSS')</script></body></html>","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.204+00:00","questionType":"multiple_choice"},{"id":"07ce6100-49ad-4445-b7f5-7fc84a83c1b0","slug":"a-penetration-tester-discovers-that-an-nmap-syn-scan-against-g5w6y","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?","difficulty":"medium","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The target host has a host-based firewall that drops SYN packets but allows full connections.","explanation":"Host-based firewalls typically treat SYN packets the same as any other TCP packet; they don't distinguish half-open vs. full connection.","masteryContext":""},{"key":"B","isCorrect":true,"text":"A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.","explanation":"Stateful firewalls track connections; a SYN scan sends unsolicited SYN packets that may be dropped, while a connect scan completes the handshake and appears as a normal connection.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.","explanation":"ICMP filtering would affect ping sweeps, not TCP scans; Nmap uses TCP probes to determine host status regardless of ICMP.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap's SYN scan requires root privileges, and the tester ran it without sudo.","explanation":"If the tester ran SYN scan without root, Nmap would fall back to connect scan automatically, not return no open ports.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.","examTrap":"The trap here is that candidates often assume a host-based firewall is the cause, but stateful network firewalls specifically differentiate between incomplete SYN probes and full TCP handshakes, making option B the correct answer.","examTip":null,"technicalDeepDive":"Stateful firewalls maintain a connection table and enforce rules based on TCP state flags. A SYN scan sends only a SYN packet and expects a SYN-ACK; the firewall sees this as an unsolicited SYN and drops it. A connect scan uses the OS's TCP stack to complete the three-way handshake (SYN, SYN-ACK, ACK), which the firewall recognizes as a legitimate connection initiation, allowing the SYN-ACK to return. This is why Nmap's -sS (SYN scan) and -sT (connect scan) yield different results in such environments.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:47.055+00:00","questionType":"multiple_choice"},{"id":"c62a81bb-9ea0-4b7a-b61a-4085db236710","slug":"an-ethical-hacker-is-testing-a-web-application-that-uses-coo-ao6h5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker is testing a web application that uses cookies for session management. The tester notices that the session cookie does not have the HttpOnly or Secure flags set. Which attack is most likely to succeed due to this misconfiguration?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SQL injection","explanation":"SQLi targets the database, not session cookies.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Cross-site request forgery (CSRF)","explanation":"CSRF exploits trust, not cookie theft.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Session hijacking via cross-site scripting (XSS)","explanation":"XSS can steal cookies if HttpOnly is not set.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Clickjacking","explanation":"Clickjacking tricks users into clicking hidden elements.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because the absence of the HttpOnly flag allows JavaScript to access the session cookie via `document.cookie`. An attacker can exploit a cross-site scripting (XSS) vulnerability to steal the cookie and perform session hijacking. The missing Secure flag further exposes the cookie to interception over unencrypted HTTP connections, making the attack easier to execute.","examTrap":"The trap here is that candidates often confuse CSRF with session hijacking, but CSRF does not require reading the cookie—it only requires the browser to automatically include it in requests, whereas XSS-based session hijacking directly steals the cookie value.","examTip":null,"technicalDeepDive":"The HttpOnly flag, defined in RFC 6265, prevents client-side scripts from accessing the cookie via `document.cookie`, mitigating XSS-based session theft. The Secure flag ensures the cookie is only sent over HTTPS, protecting against network-level interception. In a real-world scenario, an attacker could combine a stored XSS payload with a missing HttpOnly flag to exfiltrate session tokens even from authenticated users, leading to account takeover.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:10:29.642+00:00","questionType":"multiple_choice"},{"id":"427ee8e1-797d-4d2a-986a-58e5f5e22203","slug":"an-incident-responder-notices-unusual-outbound-traffic-from-yg3u7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An incident responder notices unusual outbound traffic from a host that is communicating with an external IP on port 4444. The traffic appears to be encrypted. Which tool could be used to initiate a connection to that external IP to gather a banner for service identification?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"traceroute","explanation":"traceroute shows path but no banner.","masteryContext":""},{"key":"B","isCorrect":false,"text":"nslookup","explanation":"nslookup is for DNS queries.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Telnet","explanation":"Telnet can connect to a TCP port and often receives a banner.","masteryContext":""},{"key":"D","isCorrect":false,"text":"ping","explanation":"ping uses ICMP, not TCP, and does not retrieve banners.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Telnet can be used to connect to any TCP port, including port 4444, to manually interact with a service and retrieve its banner. Banners often reveal the service name, version, and other identifying information, which is critical for footprinting and reconnaissance. Even though the traffic is encrypted, the initial banner may be sent in cleartext before encryption begins, or the connection attempt itself can reveal the service type.","examTrap":"EC-Council often tests the misconception that Telnet is only for remote terminal access on port 23, but the exam expects you to know Telnet can connect to any TCP port for banner grabbing.","examTip":null,"technicalDeepDive":"When connecting to a service with Telnet, the client sends a TCP SYN to the target IP and port; if the port is open, a three-way handshake completes and the server often sends a banner string before any authentication. Even if the subsequent traffic is encrypted (e.g., TLS handshake), the initial banner may be transmitted in plaintext, allowing service identification. In real-world scenarios, attackers use Telnet to probe non-standard ports like 4444 to identify backdoors or custom services.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.498+00:00","questionType":"multiple_choice"},{"id":"55b853f8-4f6c-4c0b-8e82-32f3b940f06a","slug":"you-are-conducting-a-security-assessment-and-need-to-map-the-ya01x","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?","difficulty":"easy","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Traceroute","explanation":"Traceroute increments TTL to get ICMP time-exceeded messages from routers, revealing the path.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Banner grabbing","explanation":"Banner grabbing identifies services, not network topology.","masteryContext":""},{"key":"C","isCorrect":false,"text":"DNS enumeration","explanation":"DNS enumeration reveals hostnames and IPs but not the network path.","masteryContext":""},{"key":"D","isCorrect":false,"text":"SNMP walk","explanation":"SNMP walk retrieves MIB data, not routing paths.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.","examTrap":"The trap here is that candidates often confuse traceroute with ping (which only tests reachability and RTT, not hop-by-hop path discovery) or assume banner grabbing can reveal network topology, but only traceroute systematically identifies each intermediate device along the route.","examTip":null,"technicalDeepDive":"Traceroute works by sending packets with incrementing TTL values (starting at 1); the first router decrements TTL to 0 and replies with an ICMP Time Exceeded message (Type 11, Code 0), revealing its IP. On Windows, traceroute uses ICMP Echo Requests, while on Linux/macOS it typically uses UDP packets to high ports, causing routers to send ICMP Time Exceeded and the destination to send ICMP Port Unreachable. In real-world scenarios, firewalls may block ICMP or UDP traceroute, so TCP-based traceroute (e.g., using SYN packets to port 80) can bypass such filters to map the path.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:19.998+00:00","questionType":"multiple_choice"},{"id":"8300c338-9d3a-4512-a0e8-d494320cb6cf","slug":"a-security-analyst-wants-to-gather-information-about-a-targe-74o3z","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst wants to gather information about a target domain using publicly available sources without directly interacting with the target’s systems. Which type of reconnaissance is being performed?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Vulnerability scanning","explanation":"Vulnerability scanning is an active technique that directly interacts with systems.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Social engineering","explanation":"Social engineering involves manipulating people, not just using public sources.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Active reconnaissance","explanation":"Active reconnaissance involves direct interaction with the target, such as scanning or probing.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Passive reconnaissance","explanation":"Passive reconnaissance uses publicly available information without direct interaction.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Passive reconnaissance involves collecting information about a target from publicly available sources without sending any packets or making direct contact with the target's systems. This approach relies on open-source intelligence (OSINT) such as WHOIS records, DNS lookups, search engines, and social media, ensuring no footprint is left on the target's network.","examTrap":"The trap here is confusing passive reconnaissance with active reconnaissance; candidates often think any information gathering is 'active' because it involves tools, but the key distinction is whether the target's systems are directly contacted (active) or not (passive).","examTip":null,"technicalDeepDive":"Passive reconnaissance leverages tools like the WHOIS protocol (RFC 3912) to query domain registration databases, DNS enumeration via `nslookup` or `dig` for non-recursive queries, and search engine dorking (e.g., Google dorks) to uncover indexed documents. In a real-world scenario, an attacker might use Shodan to find exposed services without ever sending a packet to the target, relying on Shodan's pre-collected data.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:34:31.702+00:00","questionType":"multiple_choice"},{"id":"d02dc657-e251-4dad-9b59-55e4f20b1ff7","slug":"a-penetration-tester-is-assessing-an-organization-s-physical-opbro","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is assessing an organization's physical security. The tester wants to gain unauthorized access to a secured server room that uses a biometric fingerprint scanner. Which of the following techniques would be MOST effective for bypassing the biometric scanner?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Shoulder surfing the authorized user's fingerprint pattern","explanation":"Shoulder surfing is ineffective for capturing detailed fingerprint patterns needed for replication.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Picking the lock on the server room door","explanation":"Lockpicking targets the door lock, not the biometric scanner.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Using a gelatin mold of an authorized user's fingerprint","explanation":"Gelatin molds can create replicas of fingerprints that may be accepted by some scanners.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Tailgating behind an authorized employee","explanation":"Tailgating avoids the scanner but requires following someone in; it does not bypass the scanner mechanism.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because gelatin molds can replicate the exact ridge and valley patterns of a fingerprint, which many capacitive and optical fingerprint scanners read. This bypasses the biometric authentication without requiring the user's cooperation, making it the most direct method to defeat the scanner itself.","examTrap":"The trap here is that candidates often choose tailgating (Option D) as the easiest social engineering method, but the question specifically asks for bypassing the biometric scanner, not the door lock or human controls.","examTip":null,"technicalDeepDive":"Fingerprint scanners typically use capacitive sensors that measure the electrical differences between ridges and valleys, or optical sensors that capture reflected light. A gelatin mold can replicate these physical features because gelatin has similar dielectric properties to human skin, allowing it to fool the sensor's capacitance or light reflection. In real-world attacks, attackers lift latent prints from surfaces using tape or powder, then cast them in gelatin to create a working spoof.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:40.496+00:00","questionType":"multiple_choice"},{"id":"bbde96f4-c804-4ddb-b242-488e4df61626","slug":"during-a-penetration-test-you-discover-that-the-target-orga-8s64o","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Perform a WHOIS lookup on the domain","explanation":"WHOIS provides registrar info, not individual emails.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Attempt a DNS zone transfer","explanation":"Zone transfers typically fail or return only DNS records, not emails.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Run an nmap scan against the mail server","explanation":"Nmap reveals open ports and services, not email addresses.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Use Google dorking to find publicly exposed email lists","explanation":"Google dorks can locate files containing email addresses.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.","examTrap":"The trap here is that candidates often confuse active reconnaissance techniques (like DNS zone transfer or nmap scanning) with passive information gathering, assuming they are the primary way to collect email addresses, when in fact publicly indexed documents via Google dorking are a simpler and more effective passive method.","examTip":null,"technicalDeepDive":"Google dorking leverages search operators like `site:target.com filetype:xlsx email` to find indexed spreadsheets or contact lists. Under the hood, Google's crawler stores the text content of these files, making email addresses searchable even if the file is not directly linked. In a real-world scenario, a penetration tester might discover a publicly shared 'org_chart.xlsx' containing full names, titles, and email addresses, revealing the entire reporting structure.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:05:56.592+00:00","questionType":"multiple_choice"},{"id":"1b44101e-545d-4ec4-9a79-728f7b7954ff","slug":"during-a-penetration-test-a-security-analyst-discovers-that-ht0th","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, a security analyst discovers that an organization's web application uses HTTP for login forms, potentially exposing credentials to interception. Which of the following is the BEST cryptographic control to implement to protect credentials in transit?","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Implement password hashing with bcrypt on the server side.","explanation":"Hashing protects stored passwords from exposure if the database is compromised, but does not protect credentials in transit.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use digital signatures to sign the login request.","explanation":"Digital signatures ensure authenticity and integrity but do not encrypt the data; credentials would still be visible.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Enforce HTTPS using TLS 1.2 or higher.","explanation":"TLS encrypts the entire communication channel, protecting credentials from interception.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Encrypt the password field using AES-256 before sending via HTTP.","explanation":"Encrypting only the password field leaves other data exposed and requires secure key distribution without TLS.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"HTTPS with TLS 1.2 or higher encrypts the entire HTTP session, including login credentials, preventing interception and man-in-the-middle attacks. This is the standard cryptographic control for protecting data in transit, as mandated by RFC 2818 and PCI DSS. TLS 1.2+ uses strong cipher suites like ECDHE-RSA-AES256-GCM-SHA384 to ensure forward secrecy and confidentiality.","examTrap":"The trap here is that candidates confuse encryption at rest (hashing) or partial encryption (AES on password field) with full-session encryption (TLS), or they think digital signatures provide confidentiality, when in fact they only ensure authenticity and integrity.","examTip":null,"technicalDeepDive":"TLS 1.2+ operates at the transport layer, encrypting all data between client and server using a handshake that negotiates cipher suites and exchanges ephemeral keys via Diffie-Hellman (ECDHE). A subtle behavior: even with HTTPS, if the login form is served over HTTP (mixed content), the initial page load can be tampered with, so HSTS (HTTP Strict Transport Security) should also be enforced to prevent downgrade attacks. In real-world scenarios, tools like Wireshark can capture plaintext credentials from HTTP POST requests, but with TLS, the entire TCP stream is encrypted.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:13:12.635+00:00","questionType":"multiple_choice"},{"id":"d45c0a9c-e527-43f7-8f6e-93c10f885f1f","slug":"refer-to-the-exhibit-a-security-analyst-reviews-the-firewal-ctldy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Phishing","explanation":"Phishing usually occurs via email or messaging, not direct SMB connections.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Vishing","explanation":"Vishing is voice phishing, not related to network traffic.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Tailgating","explanation":"Tailgating allows an attacker to physically enter a secured area and connect to the internal network from an unauthorized IP.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Baiting","explanation":"Baiting involves physical media like USB drives, not network logs.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.","examTrap":"The trap here is that candidates see SMB and internal IP and immediately think of a technical attack like phishing or baiting, but the key clue is the physical access implied by the unusual subnet, which points to tailgating as the social engineering vector.","examTip":null,"technicalDeepDive":"SMB (Server Message Block) over port 445 is used for file sharing, printer access, and remote administration in Windows networks; an attacker who tailgates into a facility can plug a laptop into an open Ethernet port or connect to the internal Wi-Fi, then use tools like PsExec or SMBexec to move laterally. In real-world scenarios, tailgating is often combined with badge cloning or social engineering at reception desks, and the unusual source IP (10.0.0.45) outside the file server subnet is a classic indicator of an unauthorized device on the network. The CEH exam emphasizes that tailgating bypasses physical security controls, leading to direct network access and potential SMB-based attacks like pass-the-hash or SMB relay.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nFirewall Log:\nDate: 2023-10-12\nTime: 14:23:45\nSource IP: 10.0.0.45\nDestination IP: 192.168.1.100\nProtocol: TCP\nPort: 445\nAction: ALLOW\nUser: jdoe\nReason: Rule ID 3 (SMB access to file server)\n```\n\nExhibit:","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:50.286+00:00","questionType":"multiple_choice"},{"id":"51defb7c-b80b-4c0a-a233-d24c887af319","slug":"which-three-of-the-following-are-examples-of-osint-technique-vcvv7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are examples of OSINT techniques? (Choose 3)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nmap version detection","explanation":"Nmap is an active scanning tool.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Shodan search","explanation":"Shodan is an OSINT search engine for devices.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Maltego graph analysis","explanation":"Maltego uses public data sources for OSINT.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nessus vulnerability scan","explanation":"Nessus is an active vulnerability scanner.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Google dorking","explanation":"Google dorking uses search engines to find sensitive information.","masteryContext":""}],"correctOptionKey":"B,C,E","correctOptions":["B","C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Shodan is a search engine for internet-connected devices, allowing users to discover open ports, services, and banners without directly interacting with the target. This is a classic OSINT technique because it gathers publicly available information from external sources, not from active scanning of the target's own infrastructure.","examTrap":"EC-Council often tests the distinction between active and passive reconnaissance, and the trap here is that candidates confuse tools that can be used for both (like Nmap) with OSINT, forgetting that OSINT specifically excludes any direct interaction with the target system.","examTip":null,"technicalDeepDive":"OSINT relies entirely on publicly accessible data, such as Shodan's indexed banners from SYN scans, Maltego's aggregation of WHOIS, DNS, and social media data, and Google dorking's use of advanced search operators to find exposed files or directories. These techniques do not send packets to the target; they leverage third-party databases and search engine caches, which is why they are considered passive and legal for reconnaissance.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.937+00:00","questionType":"multi_select"},{"id":"70095d63-a286-40b3-84f2-b33d5747cded","slug":"which-of-the-following-is-the-best-defense-against-tailgatin-0mtgh","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following is the BEST defense against tailgating attacks in a secure facility?","difficulty":"easy","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Hiring security guards","explanation":"Guards can be socially engineered or distracted.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Reviewing keycard access logs","explanation":"Logs are for auditing, not prevention.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Installing CCTV cameras","explanation":"CCTV is for monitoring, not preventing in real-time.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Implementing a mantrap at the entrance","explanation":"Mantraps physically enforce one-person entry, preventing tailgating.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A mantrap is a physical security access control system consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, and authentication (e.g., keycard + biometric) is required to pass through both. This design physically prevents an unauthorized person from following an authorized person into the facility, directly mitigating tailgating attacks by enforcing strict one-person-per-authentication entry.","examTrap":"EC-Council often tests the distinction between preventive, detective, and corrective controls; the trap here is that candidates mistake surveillance (CCTV) or logging (access logs) for active prevention, when only a mantrap provides a physical barrier that stops tailgating in real time.","examTip":null,"technicalDeepDive":"A mantrap typically integrates with an electronic access control system (EACS) using sensors (e.g., weight pads, infrared beams) to detect the presence of a single person. In high-security environments, the mantrap may include biometric verification (e.g., fingerprint or iris scan) at each door, and if two people enter the vestibule, both doors lock and an alarm triggers. This aligns with the principle of 'defense in depth' where physical controls complement logical controls to enforce the 'no piggybacking' policy.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.985+00:00","questionType":"multiple_choice"},{"id":"359e2e2a-5704-4e8e-b186-dd172ec1ba72","slug":"an-ethical-hacker-is-assessing-a-linux-web-server-running-ap-013ky","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Craft a request with a local file inclusion parameter pointing to /etc/passwd","explanation":"This safely confirms RFI by reading a local file, proving the vulnerability.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use SQLMap to test for SQL injection","explanation":"SQLMap tests for SQLi, not RFI.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Scan the server with Nikto to detect known RFI signatures","explanation":"Nikto can detect potential RFI, but manual verification is needed.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Attempt to include a remote URL containing a web shell","explanation":"This could compromise the server and is not a safe test.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option A is correct because it uses a local file inclusion (LFI) parameter to test for file inclusion without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include files, which is a direct indicator of an RFI vulnerability if the server returns the file contents. This approach is safe and non-destructive, as it only reads a standard system file.","examTrap":"The trap here is that candidates may confuse RFI with LFI or think that using a web shell is acceptable for confirmation, but the CEH exam emphasizes non-destructive testing and ethical boundaries, making a local file inclusion test the correct first step.","examTip":null,"technicalDeepDive":"Remote file inclusion (RFI) vulnerabilities occur when an application dynamically includes external files based on user input without proper sanitization, often via PHP's include() or require() functions. Testing with a local file like /etc/passwd leverages the same underlying mechanism but uses a local resource, avoiding the need for an external server and reducing risk. In real-world scenarios, RFI can be chained with other vulnerabilities, such as log poisoning, to achieve code execution, but initial confirmation should always be non-destructive.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:10:57.805+00:00","questionType":"multiple_choice"},{"id":"02c48ff5-cf2d-40de-bdac-ec599dcedf9e","slug":"an-ethical-hacker-wants-to-discover-subdomains-of-a-target-d-3f9j3","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Run a traceroute to the main domain","explanation":"Traceroute shows path, not subdomains.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Check the WHOIS record for the domain","explanation":"WHOIS does not contain subdomain info.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Use the site: operator in search engines","explanation":"Search engines index subdomains.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a reverse DNS lookup on the target IP range","explanation":"Reverse lookup may not list all subdomains.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.","examTrap":"EC-Council often tests the misconception that WHOIS records contain subdomain information, but WHOIS only holds domain registration data, not DNS resource records like A or CNAME entries for subdomains.","examTip":null,"technicalDeepDive":"Search engines like Google use web crawlers to index pages and their subdomains; the `site:` operator filters results to a specific domain, and the wildcard `*` can match any subdomain prefix. This technique is part of OSINT (Open Source Intelligence) and can uncover subdomains that are not linked from the main site but are still indexed, such as staging or development subdomains. However, it may miss subdomains that are not crawled (e.g., those behind authentication or with noindex directives).","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.598+00:00","questionType":"multiple_choice"},{"id":"d25ae9d5-9ce6-4871-b18b-340d1d2d6df4","slug":"a-security-analyst-is-tasked-with-performing-passive-reconna-7x8g4","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst is tasked with performing passive reconnaissance on a target organization. Which of the following is the BEST approach to gather information about the target's technology stack without directly interacting with the target's systems?","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Engage in social engineering via phone calls","explanation":"Social engineering is active and risky.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Use Shodan to search for target infrastructure","explanation":"Shodan indexes public data passively.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Initiate a DNS zone transfer request","explanation":"Zone transfer is active and often blocked.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a port scan with Nmap","explanation":"Active scanning generates traffic.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Shodan is a search engine that indexes banners from internet-connected devices, allowing an analyst to discover a target's exposed services, open ports, and technology stack (e.g., web servers, SSH versions, IoT devices) without sending any packets to the target's systems. This makes it a purely passive reconnaissance technique, as it relies on Shodan's pre-collected data rather than direct interaction.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse Shodan (a passive, third-party data source) with active tools like Nmap or DNS zone transfers, which require direct interaction with the target's systems.","examTip":null,"technicalDeepDive":"Shodan works by continuously scanning the entire IPv4 address space and storing service banners (e.g., HTTP Server headers, SSH version strings) from responses to connection attempts. A subtle behavior is that Shodan's data may be hours or days old, so the analyst must consider that the target's technology stack could have changed since the last scan. In a real-world scenario, an analyst might combine Shodan with Censys or Google dorks to cross-reference passive data without ever touching the target's network.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.636+00:00","questionType":"multiple_choice"},{"id":"0a6e6e56-6d31-4e58-90f9-b669209204fc","slug":"which-two-of-the-following-are-examples-of-privilege-escalat-fzkos","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are examples of privilege escalation on Linux? (Select 2)","difficulty":"medium","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Pass-the-Hash","explanation":"Pass-the-Hash is for lateral movement, not privilege escalation.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Token impersonation","explanation":"Token impersonation is a Windows privilege escalation method.","masteryContext":""},{"key":"C","isCorrect":true,"text":"SUID bit abuse","explanation":"SUID programs run with the file owner's privileges.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Exploiting a local vulnerability in a setuid binary","explanation":"Local exploits can leverage vulnerabilities in setuid binaries for privilege escalation.","masteryContext":""},{"key":"E","isCorrect":false,"text":"DLL hijacking","explanation":"DLL hijacking is a Windows technique.","masteryContext":""}],"correctOptionKey":"C,D","correctOptions":["C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.","examTrap":"EC-Council often tests the distinction between Windows and Linux privilege escalation techniques, and the trap here is that candidates confuse cross-platform attacks like token impersonation or DLL hijacking as applicable to Linux, when they are strictly Windows-based.","examTip":null,"technicalDeepDive":"The SUID bit (chmod u+s) allows a binary to run with the effective UID of its owner; common targets include binaries like /usr/bin/passwd or custom scripts with the bit set. Exploiting a local vulnerability in a setuid binary (D) often involves buffer overflows or race conditions (e.g., CVE-2021-3156 in sudo) to gain a root shell. In real-world scenarios, misconfigured SUID binaries on penetration testing labs (e.g., /usr/bin/find with SUID) are frequently used to escalate privileges via command injection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.876+00:00","questionType":"multi_select"},{"id":"18c66b70-8f2b-454d-aa13-95ea14725cc8","slug":"a-security-analyst-wants-to-perform-passive-reconnaissance-o-m9n70","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst wants to perform passive reconnaissance on a target domain. Which TWO of the following methods are considered passive? (Choose 2)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"WHOIS lookup","explanation":"Queries public WHOIS databases without contacting the target.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Shodan search","explanation":"Shodan indexes Internet-facing devices; querying it is passive.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Telnet banner grab","explanation":"Connecting to a service via Telnet is active.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Ping sweep","explanation":"Ping sweep sends ICMP packets.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Nmap SYN scan","explanation":"SYN scan sends packets to the target.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"WHOIS lookup is passive because it queries public registration databases (e.g., ARIN, RIPE) via the WHOIS protocol (RFC 3912) to retrieve domain ownership, registrar, and name server information without sending any packets to the target's own infrastructure. This data is publicly available and does not interact with the target's servers or network, making it a classic passive reconnaissance technique.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance by including tools like Shodan (which is passive) alongside active scanning tools like Nmap, leading candidates to mistakenly classify Shodan as active because it involves a search engine rather than direct network interaction.","examTip":null,"technicalDeepDive":"Passive reconnaissance relies on publicly available information from third-party sources like WHOIS databases, DNS records (e.g., via nslookup or dig), search engines, and Shodan's indexed data. Shodan crawls the internet and stores banners from services, so querying Shodan is passive because it retrieves historical data without contacting the target. In contrast, active methods like SYN scans use raw sockets to send packets and can trigger firewall logs or IDS alerts, which is why they are avoided during stealthy initial reconnaissance.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.09+00:00","questionType":"multi_select"},{"id":"d6994ede-a432-4548-8d50-1f5d6af7734e","slug":"during-a-wireless-penetration-test-you-discover-that-the-ta-jjya0","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a wireless penetration test, you discover that the target network uses WPA2-Enterprise with PEAP-MSCHAPv2. You capture the authentication traffic of a legitimate user. Which attack can you perform to recover the user's domain credentials?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Decrypt the traffic using the captured handshake to get the credentials.","explanation":"You need the PMK to decrypt.","masteryContext":""},{"key":"B","isCorrect":false,"text":"WPS PIN brute-force to recover the PSK.","explanation":"WPS is not relevant to Enterprise.","masteryContext":""},{"key":"C","isCorrect":false,"text":"PMKID attack to crack the pre-shared key.","explanation":"PMKID is for Personal mode.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Set up a rogue RADIUS server to capture the challenge-response and perform an offline brute-force attack.","explanation":"Rogue RADIUS can capture hashes for cracking.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"In WPA2-Enterprise with PEAP-MSCHAPv2, the authentication is based on a challenge-response mechanism between the client and a RADIUS server. By setting up a rogue RADIUS server, you can capture the challenge and the client's encrypted response, then perform an offline brute-force attack against the MSCHAPv2 hash to recover the user's domain credentials. This works because the MSCHAPv2 response is derived from the user's password and can be cracked offline.","examTrap":"The trap here is that candidates confuse WPA2-Enterprise with WPA2-Personal and incorrectly apply attacks like PMKID or handshake decryption, not realizing that enterprise mode relies on RADIUS-based authentication and is vulnerable to rogue server attacks rather than PSK cracking.","examTip":null,"technicalDeepDive":"PEAP-MSCHAPv2 uses a TLS tunnel to protect the inner authentication, but the challenge and response are still exchanged within that tunnel; a rogue RADIUS server can terminate the TLS tunnel and capture the MSCHAPv2 challenge-response pair. The MSCHAPv2 response is a hash of the user's password, the challenge, and the peer challenge, which can be cracked offline using tools like asleap or john with a dictionary or brute-force attack. In real-world scenarios, this attack is often combined with a rogue access point to force clients to authenticate to the attacker's RADIUS server, bypassing the need for physical proximity to the legitimate network.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:19:40.031+00:00","questionType":"multiple_choice"},{"id":"d7144968-ff27-46ba-b091-c9938998af9f","slug":"a-penetration-tester-is-assessing-the-security-of-a-smart-bu-u21en","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is assessing the security of a smart building's IoT infrastructure. The building uses Zigbee sensors for temperature and motion detection, and some devices communicate using MQTT over Wi-Fi. During the assessment, the tester captures traffic and notices that some Zigbee devices are sending unencrypted frames containing sensor IDs and values. Which TWO actions should the tester recommend to mitigate the identified vulnerabilities? (Choose two.)","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Enable Zigbee security suite (AES-128 encryption) on all sensor devices.","explanation":"Zigbee supports encryption; enabling it protects data in transit.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Configure MQTT to use TLS 1.2 with mutual authentication between brokers and clients.","explanation":"TLS encrypts MQTT traffic, preventing sniffing.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Disable encryption on MQTT to reduce latency and improve performance.","explanation":"Disabling encryption increases vulnerability.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Implement device authentication using pre-shared keys only for Zigbee devices.","explanation":"Authentication alone does not encrypt the payload.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Segment the IoT devices into a separate VLAN and restrict access with ACLs.","explanation":"Segmentation limits exposure but does not encrypt the data.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option A is correct because Zigbee's security suite uses AES-128 encryption to protect over-the-air frames, preventing eavesdropping on sensor IDs and values. Enabling this suite ensures that captured unencrypted frames are no longer readable, directly mitigating the observed vulnerability. Option B is correct because MQTT over Wi-Fi without TLS exposes all communication in plaintext; configuring TLS 1.2 with mutual authentication encrypts the payload and verifies both broker and client identities, preventing man-in-the-middle attacks.","examTrap":"The trap here is that candidates often confuse network segmentation (VLANs) with data encryption, thinking that isolating IoT devices on a separate VLAN alone protects the confidentiality of unencrypted wireless frames.","examTip":null,"technicalDeepDive":"Zigbee's security suite uses AES-128-CCM* (a variant of CCM) for both encryption and integrity, with a frame counter to prevent replay attacks. MQTT over TLS 1.2 uses the TLS handshake to negotiate a session key, and mutual authentication requires both the broker and client to present valid X.509 certificates, which is critical in IoT to prevent rogue devices from connecting. In real-world smart buildings, unencrypted Zigbee traffic can be captured with a simple USB dongle and tools like Wireshark or KillerBee, exposing sensor data and enabling device spoofing.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:07:48.664+00:00","questionType":"multi_select"},{"id":"a5574877-1ac6-4347-9008-1303b4e07815","slug":"a-penetration-tester-runs-the-following-nmap-command-nmap-e9e3k","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester runs the following Nmap command: nmap -sU -sS -p 53,161,162,500 10.0.0.1 and receives no responses for UDP scans but standard results for TCP. The tester suspects the target is dropping all UDP packets. Which Nmap option could help increase the likelihood of UDP responses by fragmenting the probe?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"-f","explanation":"-f fragments the probe packets, potentially helping to evade detection or filters that drop undifferentiated UDP traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-T4","explanation":"-T4 sets timing template to aggressive, but does not fragment packets.","masteryContext":""},{"key":"C","isCorrect":false,"text":"--reason","explanation":"--reason displays reasons for port states, not fragmentation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"-Pn","explanation":"-Pn skips host discovery, but does not affect fragmentation.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The -f option fragments the probe packets into smaller IP fragments. When a target drops unfragmented UDP packets, fragmenting the probes can sometimes bypass simple packet filters or IDS/IPS that drop larger or complete UDP datagrams, increasing the chance that the target will process and respond to the fragments.","examTrap":"The trap here is that candidates often confuse -f (fragmentation) with -T4 (timing) or -Pn (no ping), assuming any option that makes the scan 'faster' or 'more aggressive' will also bypass packet drops, when in fact fragmentation is the specific technique to alter packet structure.","examTip":null,"technicalDeepDive":"Nmap's -f option splits the UDP probe into 8-byte fragments (by default) at the IP layer. This can evade simple stateless firewalls that drop UDP packets based on size or pattern, as each fragment is a separate IP packet that must be reassembled by the target. In real-world scenarios, some network devices or hosts may respond to fragmented UDP probes when they would drop an equivalent unfragmented probe, especially if the target's UDP service expects small packets (e.g., DNS queries on port 53).","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:38:27.715+00:00","questionType":"multiple_choice"},{"id":"34b48029-e4df-4c0e-be67-8447b1c848f5","slug":"a-penetration-tester-is-attempting-to-evade-an-ids-ips-while-r20e6","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is attempting to evade an IDS/IPS while performing a port scan. They use the Nmap command: nmap -sS -f --data-length 20 -D RND:10 10.0.0.1. Which techniques are being employed to evade detection?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Idle scan, fragmentation, and MAC address spoofing","explanation":"Idle scan uses a zombie host (-sI), not used here. MAC spoofing is not part of Nmap's evasion.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Packet timing manipulation, decoy, and avoiding DNS resolution","explanation":"No timing manipulation is shown (e.g., -T). Avoiding DNS resolution is -n, not used.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Fragmentation, decoy, and using a random source IP","explanation":"-f fragments IP packets, --data-length adds random data, and -D RND:10 generates random decoy IPs. The source IP is not random; decoys are additional spoofed sources.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Fragmentation, decoy, and source port spoofing","explanation":"Source port spoofing is not used; -g can set source port, but not present.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because the Nmap command `-sS -f --data-length 20 -D RND:10` employs three evasion techniques: fragmentation (the `-f` flag splits the TCP SYN packet into smaller fragments to bypass simple packet inspection), decoy scanning (`-D RND:10` generates 10 random decoy source IP addresses to obscure the real scanning host), and using a random source IP (the `RND:10` mechanism effectively randomizes the source IP of the probes, making it harder for the IDS/IPS to attribute the scan to a single attacker).","examTrap":"The trap here is that candidates often confuse the `-D RND:10` decoy option with source IP spoofing or idle scanning, but the command does not include the `-sI` flag for idle scanning or `--source-port` for port spoofing, and the `RND:10` specifically randomizes decoy IPs, not the source IP of the attacker's machine.","examTip":null,"technicalDeepDive":"The `-f` flag in Nmap splits the TCP header across multiple IP fragments (typically 8-byte fragment sizes), which can evade IDS/IPS that only reassemble full packets or inspect only the first fragment. The `-D RND:10` option generates 10 random decoy IPs, but the real source IP is still sent among them; the IDS/IPS sees traffic from multiple IPs, making it difficult to isolate the true scanner. In practice, modern IDS/IPS can reassemble fragments and correlate decoy traffic, but these techniques remain effective against simpler or misconfigured systems.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:25:01.692+00:00","questionType":"multiple_choice"},{"id":"37418def-38f6-4281-8505-0a2623a3589d","slug":"during-a-penetration-test-you-are-tasked-with-performing-fo-q3k11","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you are tasked with performing footprinting on a target organization. You have identified the target's IP range 192.168.1.0/24. Which of the following techniques would provide the most comprehensive information about the target's network topology and potential entry points?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Conduct social engineering to gather information from employees about internal network structure.","explanation":"Social engineering collects human knowledge but is less reliable and systematic.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Use traceroute to map the network path and identify intermediate routers and firewalls.","explanation":"Traceroute shows the route packets take, revealing network topology and potential entry points.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Perform a WHOIS lookup to obtain domain registration details including administrative contacts.","explanation":"WHOIS provides registration info, not network topology.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform DNS enumeration to find all subdomains and associated IP addresses.","explanation":"DNS enumeration reveals subdomains and IPs but not the network topology or routers.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Traceroute (using ICMP, UDP, or TCP probes with incrementing TTL values) reveals the Layer 3 path from the tester to the target, identifying each hop (router, firewall, or other gateway) along the route. This directly maps the network topology and can expose intermediate security devices, ACLs, and potential choke points, which is the most comprehensive technique for understanding the target's network layout and entry points from the given options.","examTrap":"The trap here is that candidates confuse footprinting techniques that gather passive information (WHOIS, DNS) with active network path mapping (traceroute), assuming WHOIS or DNS enumeration will reveal network topology when they only reveal domain or host metadata.","examTip":null,"technicalDeepDive":"Traceroute works by sending packets with a Time-To-Live (TTL) starting at 1 and incrementing by 1 for each subsequent probe; each router that decrements the TTL to 0 sends back an ICMP Time Exceeded message, revealing its IP address. In modern networks, firewalls may block ICMP or UDP probes, so TCP SYN traceroute (e.g., using `tcptraceroute` or `nmap -sT -p 80 --traceroute`) is often required to bypass stateful inspection and still map the path. A real-world scenario: during a red team engagement, traceroute revealed a non-standard hop (a transparent proxy) that was not visible in any other footprinting data, providing a critical entry vector.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:23.706+00:00","questionType":"multiple_choice"},{"id":"8fcb6bb5-9cdb-44d2-b485-5d4e94b9354e","slug":"a-security-analyst-notices-a-large-number-of-incomplete-tcp-pw7x0","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"SYN scan (-sS)","explanation":"SYN scan sends SYN and stops after receiving SYN-ACK, leaving the connection half-open (SYN_RECV).","masteryContext":""},{"key":"B","isCorrect":false,"text":"Ping sweep (-sn)","explanation":"Ping sweep only sends ICMP or TCP pings, not SYN packets to ports.","masteryContext":""},{"key":"C","isCorrect":false,"text":"TCP Connect scan (-sT)","explanation":"TCP Connect scan completes the handshake, resulting in ESTABLISHED connections, not SYN_RECV.","masteryContext":""},{"key":"D","isCorrect":false,"text":"UDP scan (-sU)","explanation":"UDP scan uses UDP packets, not TCP, so it does not cause SYN_RECV states.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.","examTrap":"The trap here is that candidates confuse SYN scan with TCP Connect scan, assuming both complete the handshake, but SYN scan deliberately avoids the final ACK to remain stealthy, leaving the connection half-open in SYN_RECV.","examTip":null,"technicalDeepDive":"Under the hood, the SYN_RECV state indicates the server has received a SYN, sent a SYN/ACK, and is waiting for the final ACK to complete the handshake. In a SYN scan, the client sends a RST instead of the ACK, so the server's TCP stack keeps the connection in SYN_RECV until a timeout (typically 60-120 seconds per RFC 793). In real-world scenarios, an attacker might use a SYN flood to exhaust the server's backlog queue, causing denial of service, which is why this scan type is often detected by intrusion detection systems.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:28:43.111+00:00","questionType":"multiple_choice"},{"id":"4b5e9594-63dc-4b01-84da-b0a58be2cd6e","slug":"you-are-investigating-a-suspected-data-exfiltration-network-flrbx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are investigating a suspected data exfiltration. Network logs show an internal host performing numerous DNS queries to a domain that does not exist in any organization records. The queries use various subdomains. Which technique is the attacker MOST likely using?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"DNS amplification attack","explanation":"DNS amplification is a DDoS technique.","masteryContext":""},{"key":"B","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS cache poising injects false records, not exfiltration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"DNS zone transfer","explanation":"Zone transfer copies DNS records, not exfiltration.","masteryContext":""},{"key":"D","isCorrect":true,"text":"DNS tunneling","explanation":"DNS tunneling uses DNS queries to exfiltrate data.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The attacker is most likely using DNS tunneling, which encodes data from exfiltrated information into DNS queries and responses. By making numerous DNS queries to a domain they control, with data encoded in the subdomain labels, the attacker can bypass network security controls that do not inspect DNS traffic deeply. The fact that the domain does not exist in organization records and uses various subdomains is a classic indicator of DNS tunneling.","examTrap":"The trap here is that candidates confuse DNS tunneling with DNS amplification attacks because both involve many DNS queries, but amplification is a DDoS technique focused on volume, not covert data exfiltration via subdomain encoding.","examTip":null,"technicalDeepDive":"DNS tunneling works by encoding arbitrary data into DNS query labels (e.g., base32 or base64 encoded chunks) and sending them to a malicious authoritative server. The server can then extract the data from the query names and respond with encoded commands or acknowledgments in the DNS response. Real-world tools like dnscat2 or Iodine implement this by using the full 255-byte limit of a fully qualified domain name and can even tunnel interactive shells over DNS.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:38:13.899+00:00","questionType":"multiple_choice"},{"id":"0b5f9586-6c48-4e32-af5c-134119c7414a","slug":"a-penetration-tester-obtains-password-hashes-from-a-windows-rxv0e","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester obtains password hashes from a Windows system. Which TWO methods would be most efficient for cracking NTLM hashes offline? (Choose two.)","difficulty":"hard","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Using RainbowCrack with precomputed rainbow tables for NTLM","explanation":"Rainbow tables for NTLM are huge and often impractical; brute-force/dictionary are preferred.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Performing an online brute-force against the SAM database","explanation":"Online attacks are against a live system, not offline against hashes.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Using Ophcrack with rainbow tables for NTLM","explanation":"Ophcrack is primarily for LM hashes, not NTLM (though can do both, but rainbow tables for NTLM are large and less effective).","masteryContext":""},{"key":"D","isCorrect":true,"text":"Using Hashcat with a brute-force attack on GPU","explanation":"Hashcat leverages GPU for high-speed cracking of NTLM hashes.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Using John the Ripper with a dictionary and rules","explanation":"John the Ripper with wordlist and mangling rules can crack many NTLM hashes.","masteryContext":""}],"correctOptionKey":"D,E","correctOptions":["D","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option D is correct because Hashcat, when used with a GPU, can perform massively parallel brute-force attacks against NTLM hashes, achieving billions of hash calculations per second. This makes it one of the most efficient tools for offline password cracking of NTLM hashes, especially when the password is not in a dictionary.","examTrap":"EC-Council often tests the distinction between tools optimized for LM vs. NTLM hashes, and candidates mistakenly choose Ophcrack (option C) because they confuse its LM rainbow table capability with NTLM support.","examTip":null,"technicalDeepDive":"NTLM hashes are unsalted MD4 digests of the Unicode password, making them vulnerable to precomputation attacks, but GPU-based tools like Hashcat leverage OpenCL or CUDA to parallelize the attack across thousands of cores. In real-world engagements, a hybrid approach using dictionary attacks with rules (option E) combined with brute-force for remaining characters is often the most effective strategy, as pure brute-force can be time-prohibitive for long passwords.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.689+00:00","questionType":"multi_select"},{"id":"1b077c0f-36e0-45d8-8a48-d4abd5d00d10","slug":"during-the-reconnaissance-phase-a-tester-discovers-that-the-o6fhx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS poisoning targets DNS servers.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Email enumeration","explanation":"DSN responses can confirm valid addresses.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"Requires intercepting traffic.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Phishing attack","explanation":"Phishing uses social engineering, not DSN.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.","examTrap":"EC-Council often tests the distinction between passive reconnaissance (like email enumeration via DSN) and active attacks (like MITM or phishing), so candidates mistakenly choose 'Phishing attack' because they associate email servers with phishing, but the question specifically asks what the DSN behavior facilitates during reconnaissance.","examTip":null,"technicalDeepDive":"Under the hood, DSNs are generated by the Mail Transfer Agent (MTA) using the SMTP VRFY or EXPN commands, or via bounce messages when a recipient is unknown. The tester can craft an email with a deliberately invalid recipient and analyze the DSN's status code (e.g., 5.1.1 for unknown user) versus a valid recipient that may return a 2.5.0 success. In real-world scenarios, tools like smtp-user-enum or Metasploit's smtp_enum module automate this by sending RCPT TO commands and parsing the server's response codes.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.524+00:00","questionType":"multiple_choice"},{"id":"407f19b2-a310-4409-a2cf-d6333814a1b3","slug":"you-are-the-lead-security-engineer-for-a-financial-technolog-1mcjz","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are the lead security engineer for a financial technology company that hosts a critical web application on three load-balanced servers behind a reverse proxy. The application uses a REST API to process transactions. Recently, the company has experienced intermittent service outages during peak hours. Upon reviewing logs, you find that the reverse proxy is returning HTTP 503 errors for legitimate API requests, and the application servers show high CPU usage but normal memory. The network team reports no bandwidth issues. The application team claims no code changes were made. You suspect a specific type of attack is causing the outages. Which action should you take first to confirm the attack type?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Configure the firewall to block all incoming traffic from the IPs that appear most frequently in logs.","explanation":"This is a reactive measure and does not confirm the attack type.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Analyze the incoming request patterns in the reverse proxy logs to identify if there is a high volume of requests to a specific API endpoint.","explanation":"This can confirm a Layer 7 DDoS attack targeting a specific endpoint.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Increase the number of application servers to handle the load.","explanation":"This may alleviate symptoms but does not confirm the attack type.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Run a SQL injection scanner on the application.","explanation":"SQL injection does not typically cause high CPU and 503 errors.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option B is correct because the symptoms—HTTP 503 errors, high CPU usage on application servers, normal memory, and no bandwidth issues—strongly suggest a Layer 7 DDoS attack, specifically an HTTP flood targeting a resource-intensive API endpoint. By analyzing reverse proxy logs for a high volume of requests to a specific endpoint, you can confirm the attack type (e.g., a slow loris or GET flood) before taking mitigation steps. This aligns with the CEH methodology of first identifying the attack vector through log analysis.","examTrap":"The trap here is that candidates often jump to blocking IPs (Option A) or scaling horizontally (Option C) as immediate fixes, but the CEH exam emphasizes first confirming the attack vector through log analysis rather than taking reactive or misdirected actions.","examTip":null,"technicalDeepDive":"HTTP 503 errors from a reverse proxy (e.g., Nginx, HAProxy) typically indicate upstream server timeouts or resource exhaustion, often due to a Layer 7 DDoS like an HTTP flood targeting a slow API endpoint (e.g., /api/transactions). Under the hood, the reverse proxy queues requests until backend workers are saturated, causing CPU spikes on app servers while memory remains normal—a hallmark of CPU-bound attacks. In real-world scenarios, attackers use botnets to send thousands of legitimate-looking GET/POST requests to a single endpoint, bypassing traditional DDoS mitigation that focuses on bandwidth.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:42.46+00:00","questionType":"multiple_choice"},{"id":"3a02181a-1ecc-4d58-ba22-57d39003f5c2","slug":"a-security-analyst-is-conducting-passive-reconnaissance-on-a-3mccx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst is conducting passive reconnaissance on a target organization. Which THREE of the following are examples of passive reconnaissance techniques? (Select 3)","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Performing a WHOIS lookup on the target's domain","explanation":"WHOIS queries use public databases, no direct target interaction.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Querying a public DNS resolver cache for the target's mail server records","explanation":"DNS cache snooping uses public resolvers without contacting the target's DNS server directly.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Running an Nmap SYN scan against the target's web server","explanation":"SYN scan sends packets to the target; active reconnaissance.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Banner grabbing with Netcat on port 80","explanation":"Banner grabbing connects to the target to retrieve a banner; active reconnaissance.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Using Google dork queries to find exposed documents","explanation":"Google dorking uses search engine results, no direct target interaction.","masteryContext":""}],"correctOptionKey":"A,B,E","correctOptions":["A","B","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"WHOIS queries are a classic passive reconnaissance technique because they retrieve publicly registered domain ownership data from WHOIS databases (e.g., registrar, creation date, name servers) without sending any packets directly to the target's infrastructure. This information is stored by third-party registries and is accessible via standard WHOIS protocol (RFC 3912) or web-based lookup tools, making it completely non-intrusive.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance by including techniques that appear passive (like banner grabbing) but actually involve direct interaction with the target's services, leading candidates to mistakenly classify them as passive.","examTip":null,"technicalDeepDive":"Passive reconnaissance relies solely on publicly available information from third-party sources (e.g., WHOIS databases, DNS resolvers, search engine caches) and does not involve any direct interaction with the target's systems. For example, querying a public DNS resolver (like 8.8.8.8) for MX records is passive because the query is sent to a third-party server, not the target's own DNS server, and the resolver's cache may already contain the records from previous legitimate queries. Google dorking uses search engine indexes to find exposed documents without ever touching the target's servers.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.613+00:00","questionType":"multi_select"},{"id":"d666803e-e951-4f7b-a0ce-f3376bf74db5","slug":"which-three-of-the-following-are-valid-methods-for-enumerati-1q7sj","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid methods for enumerating users on a Windows domain without prior credentials? (Select exactly 3.)","difficulty":"hard","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Requesting a DNS zone transfer to obtain a list of user account names from the SRV records.","explanation":"DNS zone transfers provide hostnames and IPs, not user account names.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Performing an SMB null session and querying the SAM database.","explanation":"SMB null sessions are a known method for enumerating users on older Windows systems.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Using RID cycling to enumerate users by brute-forcing relative identifiers.","explanation":"RID cycling allows enumeration of user accounts by iterating through RIDs.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Performing an anonymous LDAP query to the domain controller for objectClass=user.","explanation":"LDAP anonymous queries can enumerate user objects if the DC does not restrict them.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Sending Kerberos AS-REQ packets and analyzing the error codes (e.g., KDC_ERR_PREAUTH_REQUIRED vs KDC_ERR_C_PRINCIPAL_UNKNOWN).","explanation":"This technique requires knowing a valid username to get a different error; it cannot enumerate unknown users.","masteryContext":""}],"correctOptionKey":"B,C,D","correctOptions":["B","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because an SMB null session (connecting to IPC$ without credentials) can be used to query the SAM database via the SAMR protocol, allowing an attacker to enumerate local user accounts and groups on a Windows system. This technique exploits the default configuration of older Windows versions or improperly secured systems where the null session is not restricted.","examTrap":"EC-Council often tests the distinction between enumeration techniques that require no prior credentials versus those that need a starting list of usernames, causing candidates to mistakenly select Kerberos-based enumeration (Option E) as a credential-less method when it actually requires a candidate username to test.","examTip":null,"technicalDeepDive":"RID cycling (Option C) works by connecting to the SAMR interface via SMB and brute-forcing relative identifiers (RIDs) starting from 500 (Administrator) to enumerate user accounts, as each user has a unique RID appended to the domain SID. Anonymous LDAP queries (Option D) are possible when the domain controller permits unauthenticated binds, allowing retrieval of user objects via filters like (objectClass=user), but this is often disabled in modern Active Directory environments by default.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.67+00:00","questionType":"multi_select"},{"id":"aaa8c0a2-b410-434a-bec1-0361c4df53f9","slug":"a-company-s-internal-pki-uses-an-offline-root-ca-and-an-onli-hskx1","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company's internal PKI uses an offline root CA and an online issuing CA. A security engineer needs to revoke a compromised certificate issued by the online CA. Which CRL distribution point should the engineer update?","difficulty":"hard","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The CRL published by the certificate authority that signed the issuing CA's certificate","explanation":"That is the root CA, which does not issue end-entity certs.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The CRL published by the intermediate CA, if any","explanation":"There is no intermediate mentioned; the online CA is the issuing CA.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The CRL published by the online issuing CA","explanation":"The issuing CA is responsible for revoking certificates it issued.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The CRL published by the offline root CA","explanation":"The root CA does not issue end-entity certificates.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The compromised certificate was issued by the online issuing CA, so only that CA has the authority to revoke it and publish the updated CRL. Clients validating the certificate will check the CRL distribution point (CDP) embedded in the certificate, which points to the issuing CA's CRL. Updating the CRL on the online issuing CA ensures that revocation status is immediately available to relying parties.","examTrap":"EC-Council often tests the misconception that the root CA must be involved in revocation of end-entity certificates, but in reality only the issuing CA that signed the certificate can revoke it and update its own CRL.","examTip":null,"technicalDeepDive":"In a PKI hierarchy, each CA maintains its own Certificate Revocation List (CRL) as defined in RFC 5280. The CRL Distribution Point (CDP) extension in an end-entity certificate contains URLs pointing to the CRL of the CA that issued that certificate. When a certificate is revoked, the issuing CA must generate a new CRL with the revoked certificate's serial number and update the CRL at the published distribution point. The offline root CA's CRL would only list revoked subordinate CA certificates, not end-entity certificates, because the root CA never directly issues end-entity certificates.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.91+00:00","questionType":"multiple_choice"},{"id":"2d867355-1f80-4e2d-a9d8-243724126011","slug":"refer-to-the-exhibit-a-security-analyst-reviews-a-cloudtrai-g72un","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The action was performed by the AWS root account, which should be avoided for routine tasks.","explanation":"Root should only be used for specific tasks.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The AMI ID (ami-0abcdef1234567890) is from a trusted source.","explanation":"Not a concern.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The source IP address (203.0.113.5) is suspicious.","explanation":"IP address is not inherently suspicious.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The instance type is t2.micro, which may be vulnerable.","explanation":"Instance type is not a security concern.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.","examTrap":"EC-Council often tests the concept that the root account should never be used for routine tasks, and candidates may mistakenly focus on the AMI ID, source IP, or instance type as potential threats, overlooking the critical security violation of root account usage.","examTip":null,"technicalDeepDive":"AWS CloudTrail logs capture API calls made to the AWS environment, including the user identity, source IP, and action details. The root account has unrestricted access to all resources, and if its credentials are leaked, an attacker can perform any action, including deleting all resources or creating backdoor accounts. AWS recommends enabling multi-factor authentication (MFA) on the root account and using IAM roles for daily operations, as the root account lacks fine-grained access control and audit trails for individual users.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nCloudTrail Log:\n{\n \"eventVersion\": \"1.08\",\n \"userIdentity\": {\n \"type\": \"Root\",\n \"arn\": \"arn:aws:iam::123456789012:root\",\n \"accountId\": \"123456789012\"\n },\n \"eventTime\": \"2025-03-15T14:30:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"sourceIPAddress\": \"203.0.113.5\",\n \"userAgent\": \"console.amazonaws.com\",\n \"requestParameters\": {\n \"instanceType\": \"t2.micro\",\n \"imageId\": \"ami-0abcdef1234567890\",\n \"keyName\": \"test-key\"\n },\n \"responseElements\": {\n \"instancesSet\": {\n \"items\": [\n {\n \"instanceId\": \"i-0a1b2c3d4e5f67890\"\n }\n ]\n }\n },\n \"eventType\": \"AwsApiCall\"\n}\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.933+00:00","questionType":"multiple_choice"},{"id":"26170fdb-36ce-4dc0-a03f-7db8c0f2be9c","slug":"which-of-the-following-google-dorks-would-an-attacker-most-l-p4d5i","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following Google dorks would an attacker MOST likely use to find login pages of web applications that are publicly accessible?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"intitle:login","explanation":"This dork returns pages where the title contains 'login', often used to find login portals.","masteryContext":""},{"key":"B","isCorrect":false,"text":"inurl:robots.txt","explanation":"This finds robots.txt files, not login pages.","masteryContext":""},{"key":"C","isCorrect":false,"text":"filetype:pdf","explanation":"This searches for PDF files, not login pages.","masteryContext":""},{"key":"D","isCorrect":false,"text":"cache:example.com","explanation":"This shows cached version of a page, not a search for login pages.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The Google dork 'intitle:login' is most effective for finding login pages because it searches for the word 'login' in the HTML title tag of web pages. Attackers use this to quickly identify publicly accessible authentication portals, which are common entry points for brute-force or credential-stuffing attacks. This dork directly targets the page title, a standard HTML element that often contains the word 'login' on authentication pages.","examTrap":"EC-Council often tests the distinction between operators that find specific page content (like 'intitle:') versus those that find file types or cached data, leading candidates to confuse 'inurl:robots.txt' (which finds a specific file) with finding login pages.","examTip":null,"technicalDeepDive":"Google dorks leverage advanced search operators that interact with Google's index. The 'intitle:' operator restricts results to pages where the search term appears in the <title> tag, which is a standard HTML element defined in the HTML specification. Attackers often combine 'intitle:login' with other operators like 'inurl:admin' to narrow results, and they may use tools like 'GoogDork' or 'dorkbot' to automate queries against Google's search API, though this violates Google's ToS.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.374+00:00","questionType":"multiple_choice"},{"id":"571463a3-bc73-430f-a3aa-c258bd5da37b","slug":"a-penetration-tester-runs-the-following-command-masscan-10-nsvug","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Masscan can scan a large number of hosts and ports at very high speed","explanation":"Masscan's main advantage is its speed. It can scan large ranges quickly, as indicated by the high rate.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Masscan provides more detailed service version detection than Nmap","explanation":"Masscan is primarily a port scanner; it does not have version detection capabilities like Nmap's -sV.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Masscan is stealthier than Nmap and less likely to be detected","explanation":"Masscan's high-speed scanning can actually be more noisy and easier to detect. Nmap's decoy and timing options can be stealthier.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Masscan can scan all 65535 ports faster than Nmap","explanation":"While Masscan is faster, the command only scans three ports, not all ports. The statement is true but not specific to this command.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.","examTrap":"EC-Council often tests the misconception that Masscan is stealthier than Nmap, but in reality, its high packet rate makes it more detectable, and the trap here is that candidates confuse speed with stealth.","examTip":null,"technicalDeepDive":"Masscan uses a custom TCP/IP stack and asynchronous I/O to send packets without waiting for responses, achieving speeds that can saturate a 10 Gbps link. It operates at the raw socket level, bypassing the kernel's TCP stack, which allows it to maintain state for millions of concurrent connections. In real-world penetration tests, Masscan is often used for initial broad reconnaissance to quickly identify live hosts and open ports, followed by Nmap for detailed service enumeration on the discovered targets.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.342+00:00","questionType":"multiple_choice"},{"id":"1fc7ab9f-3078-44a6-ac95-925b364e4b13","slug":"which-two-of-the-following-nmap-flags-are-used-for-evasion-o-ahfcm","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following Nmap flags are used for evasion of IDS/IPS? (Choose two.)","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"-sV","explanation":"-sV is for version detection, not evasion.","masteryContext":""},{"key":"B","isCorrect":false,"text":"-O","explanation":"-O is for OS detection.","masteryContext":""},{"key":"C","isCorrect":true,"text":"-D","explanation":"Decoy scan uses multiple source IPs to confuse IDS.","masteryContext":""},{"key":"D","isCorrect":true,"text":"-f","explanation":"Fragment packets to evade signature detection.","masteryContext":""},{"key":"E","isCorrect":false,"text":"-sT","explanation":"-sT is a connect scan, not evasion.","masteryContext":""}],"correctOptionKey":"C,D","correctOptions":["C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C (-D) is correct because the Nmap decoy scan flag allows you to spoof multiple source IP addresses, making it difficult for IDS/IPS to distinguish the real scanning host from decoys. Option D (-f) is correct because fragmenting packets (e.g., using -f to split TCP headers into 8-byte fragments) evades signature-based detection by bypassing pattern-matching rules that expect complete packet headers.","examTrap":"EC-Council often tests the misconception that -sV or -O are evasion techniques because they are 'stealthy' in some contexts, but the CEH exam specifically requires knowing that decoys (-D) and fragmentation (-f) are the standard Nmap evasion flags.","examTip":null,"technicalDeepDive":"The -D flag works by sending packets from decoy IPs (up to 16) alongside the real source IP; the IDS/IPS must correlate all traffic to identify the true scanner, which is computationally expensive and often fails. The -f flag splits the TCP header (typically 20 bytes) into multiple 8-byte fragments, causing the IDS/IPS to reassemble them before inspection—many signature-based systems drop fragments or fail to reassemble correctly, allowing the scan to pass undetected. In real-world scenarios, combining -D with -f (e.g., nmap -D RND:10 -f 192.168.1.1) creates a layered evasion strategy that overwhelms both stateful inspection and pattern matching.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.143+00:00","questionType":"multi_select"},{"id":"07cf9d30-6429-458a-9243-2f48e7fece4b","slug":"refer-to-the-exhibit-an-attacker-gains-access-to-the-user-s-5eetq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An attacker gains access to the user's workstation and wants to find a file containing passwords. Which file is most likely to contain credentials?","difficulty":"easy","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"User profile (C:\\Users\\jdoe)","explanation":"User profile is a folder, not a specific file.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Home directory on \\\\fileserver\\home\\jdoe","explanation":"Home directory is a network share, not a specific file.","masteryContext":""},{"key":"C","isCorrect":true,"text":"logon.bat script","explanation":"Logon scripts may contain credentials for network resources.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Active Directory database (NTDS.dit)","explanation":"NTDS.dit is on the domain controller, not the workstation.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because logon.bat scripts are commonly used in Windows environments to map network drives or perform startup tasks, and administrators often embed plaintext credentials in such scripts for automation. An attacker who compromises the workstation can read this batch file to extract stored passwords, making it a high-value target for credential theft.","examTrap":"EC-Council often tests the misconception that credentials are always stored in system databases like NTDS.dit or SAM, but the trap here is that attackers target easily accessible, plaintext files like logon scripts that users or administrators create for convenience.","examTip":null,"technicalDeepDive":"Logon scripts like logon.bat are executed via Group Policy or local startup settings, and they often include net use commands with embedded passwords for drive mappings. Under the hood, these scripts are stored in locations such as C:\\Windows\\System32\\GroupPolicy\\Machine\\Scripts or the user's startup folder, and they can be read by any user with local access. In real-world attacks, penetration testers frequently find domain admin credentials in such scripts, leading to full domain compromise.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nExhibit:\nC:\\Users\\jdoe> net user jdoe /domain\nThe request will be processed at a domain controller for domain corp.xyz.com.\n\nUser name jdoe\nFull Name John Doe\nComment\nUser's comment\nCountry code 001 (United States)\nAccount active Yes\nAccount expires Never\n\nPassword last set 6/15/2024 9:30:00 AM\nPassword expires 9/13/2024 9:30:00 AM\nPassword changeable 6/16/2024 9:30:00 AM\nPassword required Yes\nUser may change password Yes\n\nWorkstations allowed All\nLogon script logon.bat\nUser profile\nHome directory \\\\fileserver\\home\\jdoe\nLast logon 7/10/2024 2:15:00 PM\n\nLogon hours allowed All\n\nLocal Group Memberships *Domain Users\nGlobal Group memberships *Domain Users\nThe command completed successfully.","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.761+00:00","questionType":"multiple_choice"},{"id":"48442be4-4d53-476b-a4a9-06ac388be421","slug":"which-of-the-following-tools-is-specifically-designed-to-per-wecga","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following tools is specifically designed to perform fast internet-wide scanning, often used in the reconnaissance phase to discover open ports across large IP ranges?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"hping3","explanation":"hping3 is a packet crafting tool, not optimized for internet-wide scanning.","masteryContext":""},{"key":"B","isCorrect":false,"text":"OpenVAS","explanation":"OpenVAS is a vulnerability scanner, not a port scanner.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Masscan","explanation":"Masscan is designed for high-speed scanning of large address spaces.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap","explanation":"Nmap is versatile but slower on large ranges than Masscan.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is specifically designed for high-speed, asynchronous scanning of large IP ranges, capable of transmitting packets at rates exceeding 10 million packets per second. This makes it the optimal tool for internet-wide reconnaissance to discover open ports across vast address spaces, a task for which Nmap is too slow and hping3 is too manual.","examTrap":"The trap here is that candidates often choose Nmap because it is the most famous scanning tool, but the question specifically asks for a tool designed for 'fast internet-wide scanning,' which is Masscan's unique selling point over Nmap's slower, more thorough approach.","examTip":null,"technicalDeepDive":"Masscan uses a custom TCP/IP stack and asynchronous raw sockets to send and receive packets without per-packet system call overhead, achieving scan rates of 10 million packets per second on a 10 Gbps link. It supports the same nmap-style port specification and can output results in formats compatible with Nmap, but its stateless scanning approach means it cannot perform service version detection or OS fingerprinting during the scan itself.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:37:52.121+00:00","questionType":"multiple_choice"},{"id":"b6b88410-7754-460d-89b5-5b79dd4e167d","slug":"which-three-of-the-following-are-common-indicators-of-a-soci-1gw7d","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are common indicators of a social engineering attack? (Choose three.)","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The communication includes verifiable contact information","explanation":"Legitimate communications often include verifiable info.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The sender uses a generic greeting like 'Dear Customer'","explanation":"Generic greetings are common in mass phishing but not definitive.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The communication creates a sense of urgency","explanation":"Attackers often pressure targets to act quickly.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The message contains spelling or grammatical errors","explanation":"Errors can indicate a fake message.","masteryContext":""},{"key":"E","isCorrect":true,"text":"The request comes from someone claiming to be in authority","explanation":"Impersonating authority figures is common.","masteryContext":""}],"correctOptionKey":"C,D,E","correctOptions":["C","D","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C is correct because social engineers frequently fabricate a sense of urgency to bypass the victim's rational decision-making. By claiming an immediate deadline or threat (e.g., 'Your account will be locked in 24 hours'), the attacker pressures the target into acting without verifying the request, a tactic rooted in the psychological principle of scarcity.","examTrap":"The trap here is that candidates mistake generic greetings (Option B) as a definitive indicator, when in fact the CEH emphasizes that urgency, authority, and errors are the three most reliable technical indicators of a social engineering attempt.","examTip":null,"technicalDeepDive":"Social engineering exploits cognitive biases such as authority (Milgram's obedience experiments) and urgency (scarcity heuristic). In a real-world scenario, an attacker might spoof the CEO's email display name (but not the actual SMTP envelope) to request an urgent wire transfer, relying on the victim's deference to authority and time pressure to bypass normal verification procedures like callback confirmation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:45.968+00:00","questionType":"multi_select"},{"id":"51713f58-f2c4-43c1-9d88-3b6c4cea3e39","slug":"which-three-of-the-following-are-valid-dns-record-types-that-o78xq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid DNS record types that an attacker might query during reconnaissance to gather information about a target domain? (Select 3)","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"FTP (file transfer)","explanation":"FTP is a service, not a DNS record type.","masteryContext":""},{"key":"B","isCorrect":true,"text":"A (IPv4 address)","explanation":"A records map hostnames to IP addresses, revealing the target's IP.","masteryContext":""},{"key":"C","isCorrect":true,"text":"NS (name server)","explanation":"NS records identify authoritative name servers, crucial for zone transfer attempts.","masteryContext":""},{"key":"D","isCorrect":false,"text":"HTTP (hypertext transfer)","explanation":"HTTP is a protocol, not a DNS record type.","masteryContext":""},{"key":"E","isCorrect":true,"text":"MX (mail exchange)","explanation":"MX records reveal mail server hostnames, useful for email enumeration.","masteryContext":""}],"correctOptionKey":"B,C,E","correctOptions":["B","C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"The A record maps a domain name to an IPv4 address, which is fundamental for locating a target server. During reconnaissance, querying A records reveals the IP address of the target domain, enabling further scanning and attack planning. This is a standard DNS query type defined in RFC 1035.","examTrap":"EC-Council often tests the distinction between DNS record types and application-layer protocols, so candidates mistakenly select FTP or HTTP because they are common network services, but they are not valid DNS resource records.","examTip":null,"technicalDeepDive":"DNS A records are stored in zone files and are queried using tools like `nslookup` or `dig A example.com`. Attackers often use A records to map a domain to its IP address, then perform reverse DNS lookups or scan the IP for open ports. In real-world reconnaissance, enumerating A records can reveal load-balanced or CDN-backed IPs, which may require additional probing to identify the origin server.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.182+00:00","questionType":"multi_select"},{"id":"f555813f-bbe4-45e0-9b7d-2cbde9cc4db8","slug":"a-penetration-tester-wants-to-identify-live-hosts-on-a-large-0wfr5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester wants to identify live hosts on a large IP range without generating excessive network traffic. Which tool is BEST suited for fast host discovery?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Masscan","explanation":"Masscan is designed for high-speed scanning of large address spaces.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Maltego","explanation":"Maltego is an OSINT and graphing tool, not a network scanner.","masteryContext":""},{"key":"C","isCorrect":false,"text":"dnsenum","explanation":"dnsenum is for DNS enumeration, not host discovery.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nessus","explanation":"Nessus is a vulnerability scanner, not optimized for fast host discovery.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is the best tool for fast host discovery across large IP ranges because it uses asynchronous transmission and can scan the entire IPv4 address space in under 10 minutes at a rate of 10 million packets per second. It minimizes network traffic by sending only SYN packets and not completing the TCP handshake, making it ideal for rapid live host detection without overwhelming the network.","examTrap":"The trap here is that candidates confuse 'host discovery' with 'vulnerability scanning' or 'OSINT gathering', leading them to choose Nessus or Maltego, but the question specifically asks for minimal traffic and speed, which only Masscan's asynchronous SYN scan achieves.","examTip":null,"technicalDeepDive":"Masscan operates by sending raw TCP SYN packets with a custom IP header, using a user-defined rate (e.g., --rate=100000) and a random source IP to avoid detection. It uses a technique called 'asynchronous scanning' where it sends packets and listens for responses without maintaining state per connection, allowing it to scale to millions of packets per second. In real-world engagements, this is critical for quickly mapping a /8 subnet (16 million IPs) in minutes, whereas Nmap would take hours at default speeds.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:27:58.904+00:00","questionType":"multiple_choice"},{"id":"ea7d7f54-1983-4253-83a8-e9aa25f5f958","slug":"refer-to-the-exhibit-an-analyst-runs-an-nmap-scan-and-finds-ex-euhi","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An analyst runs an Nmap scan and finds these services. Which known vulnerability is most likely to be successfully exploited?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"CVE-2021-41773 (Apache Path Traversal)","explanation":"Apache 2.4.49 is vulnerable to CVE-2021-41773, a path traversal and remote code execution vulnerability.","masteryContext":""},{"key":"B","isCorrect":false,"text":"CVE-2017-5638 (Struts2 RCE)","explanation":"Struts2 vulnerability is for Java applications, not Apache HTTPD.","masteryContext":""},{"key":"C","isCorrect":false,"text":"CVE-2014-0160 (Heartbleed)","explanation":"Heartbleed affects OpenSSL, not Apache version 2.4.49 specifically.","masteryContext":""},{"key":"D","isCorrect":false,"text":"CVE-2020-1472 (Zerologon)","explanation":"Zerologon affects Windows Netlogon, not Linux Apache or MySQL.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"nmap -sV -p 80,443,3306 192.168.1.100\n\nStarting Nmap 7.80 ( https://nmap.org ) at 2023-01-20 10:30\nNmap scan report for 192.168.1.100\nHost is up (0.0012s latency).\n\nPORT STATE SERVICE VERSION\n80/tcp open http Apache httpd 2.4.49\n443/tcp open ssl/http Apache httpd 2.4.49\n3306/tcp open mysql MySQL 5.7.35","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-25T06:19:10.204037+00:00","questionType":"multiple_choice"},{"id":"23778411-05c3-4867-afc3-9fcef123f421","slug":"an-incident-responder-analyzes-logs-and-finds-repeated-faile-5dgc7","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An incident responder analyzes logs and finds repeated failed zone transfer attempts from an external IP. The zone transfer requests are targeting the domain example.com. Which DNS record type, if misconfigured, would allow this attack to succeed?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"NS records","explanation":"NS records specify authoritative name servers; they do not control zone transfer permissions.","masteryContext":""},{"key":"B","isCorrect":true,"text":"AXFR","explanation":"AXFR is the DNS query type for zone transfers. Allowing AXFR from unauthorized hosts is a misconfiguration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"MX records","explanation":"MX records specify mail servers; they are not related to zone transfers.","masteryContext":""},{"key":"D","isCorrect":false,"text":"SOA records","explanation":"SOA records contain administrative information but do not control zone transfer permissions.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"B is correct because AXFR (Asynchronous Full Transfer) is the DNS zone transfer protocol that, if misconfigured (i.e., allowing unrestricted AXFR queries from any IP), permits an external attacker to request and receive the entire DNS zone file for example.com. The repeated failed attempts indicate the attacker is probing for an open AXFR service, which would succeed if the DNS server is configured to allow zone transfers to any host without restriction.","examTrap":"The trap here is that candidates confuse the DNS record type (e.g., NS, SOA) with the protocol or query type (AXFR) used to perform the zone transfer, leading them to select a record type instead of recognizing AXFR as the specific misconfiguration that enables the attack.","examTip":null,"technicalDeepDive":"Under the hood, DNS zone transfers use TCP port 53 (not UDP) and are initiated with an AXFR query; a properly secured DNS server should restrict AXFR to trusted secondary DNS servers via IP allow lists or TSIG (Transaction Signatures, RFC 2845). In real-world scenarios, misconfigured DNS servers on internal networks or cloud environments have been exploited to leak internal hostnames, IP addresses, and network topology, aiding further reconnaissance like subdomain enumeration or targeted attacks.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:36:40.257+00:00","questionType":"multiple_choice"},{"id":"f3e4deb0-0ef7-444d-b95d-a07c36c2ba58","slug":"during-a-vulnerability-scan-with-nessus-you-find-that-port-8empd","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a vulnerability scan with Nessus, you find that port 445/TCP is open on a Windows server. Which of the following is the MOST likely associated risk?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SNMP community string brute-forcing","explanation":"SNMP uses UDP ports 161/162.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Remote code execution via SMB vulnerabilities","explanation":"SMB on port 445 has known RCE vulnerabilities.","masteryContext":""},{"key":"C","isCorrect":false,"text":"HTTP directory traversal","explanation":"HTTP uses port 80/443.","masteryContext":""},{"key":"D","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS uses port 53.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Port 445/TCP is used by Microsoft SMB (Server Message Block) over a direct TCP connection, commonly known as SMB over TCP. SMB has historically been plagued by critical remote code execution vulnerabilities, most notably EternalBlue (MS17-010) exploited by WannaCry. Therefore, an open SMB port on a Windows server presents a high risk of remote code execution if unpatched.","examTrap":"The trap here is that candidates may associate port 445 with file sharing only and overlook its history of critical remote code execution vulnerabilities, instead choosing a more generic or unrelated attack vector like HTTP directory traversal.","examTip":null,"technicalDeepDive":"SMB operates as a network file sharing protocol that uses named pipes and authenticated sessions. The SMBv1 protocol, which lacks proper session security, allowed the EternalBlue exploit to send specially crafted packets that triggered a buffer overflow in the SMB driver (srv2.sys), enabling arbitrary code execution with SYSTEM privileges. Even in modern environments, misconfigured SMB shares or unpatched systems remain a common entry point for lateral movement.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:25:43.198+00:00","questionType":"multiple_choice"},{"id":"33521746-4bf1-49ea-9891-cf5208f10613","slug":"refer-to-the-exhibit-a-penetration-tester-sends-a-soap-requ-ex-ku2u","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"SQL injection in SOAP service","explanation":"The userId parameter contains '1 OR 1=1', which results in returning all users, indicating SQL injection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"XML External Entity (XXE) injection","explanation":"XXE exploits external entity parsing to read files or perform SSRF, not SQL injection via SOAP.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Cross-site scripting (XSS)","explanation":"XSS involves client-side script injection, not server-side SQL injection.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Command injection","explanation":"Command injection involves OS commands, not SQL queries.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n <soap:Body>\n <getUserInfo>\n <userId>1 OR 1=1</userId>\n </getUserInfo>\n </soap:Body>\n</soap:Envelope>\n\nResponse:\n<soap:Envelope>\n <soap:Body>\n <getUserInfoResponse>\n <user>\n <id>1</id>\n <name>admin</name>\n <email>admin@test.com</email>\n </user>\n <user>\n <id>2</id>\n <name>user</name>\n <email>user@test.com</email>\n </user>\n </getUserInfoResponse>\n </soap:Body>\n</soap:Envelope>","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-25T06:19:10.382746+00:00","questionType":"multiple_choice"},{"id":"eea60fc6-d577-4504-b189-ea964e807079","slug":"a-penetration-tester-discovers-that-a-target-windows-system-2e41h","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester discovers that a target Windows system has port 445 open and responds to SMB requests. Which tool should the tester use to enumerate users, shares, and OS information from this system?","difficulty":"easy","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nikto","explanation":"Nikto is a web vulnerability scanner, not for SMB.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Hydra","explanation":"Hydra is for password brute-forcing, not enumeration.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Nmap","explanation":"Nmap scans ports but does not perform detailed SMB enumeration.","masteryContext":""},{"key":"D","isCorrect":true,"text":"enum4linux","explanation":"Correct: enum4linux extracts SMB information like users, shares, and OS details.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"enum4linux is a tool specifically designed to enumerate information from Windows and Samba systems via SMB. It leverages the SMB protocol to extract users, shares, OS details, and other system information from a target with port 445 open, making it the correct choice for this scenario.","examTrap":"The trap here is that candidates may choose Nmap because it is a versatile tool that can perform SMB enumeration with scripts, but the CEH exam expects the specialized tool (enum4linux) for this specific task, as Nmap is primarily a port scanner and not the dedicated enumeration tool.","examTip":null,"technicalDeepDive":"enum4linux uses the SMB RPC (Remote Procedure Call) interface to query the target system, specifically calling functions like NetShareEnum, NetUserEnum, and NetServerGetInfo via the SMB protocol. It can also retrieve the OS version by parsing the SMB negotiation response, which includes the OS major and minor version numbers. In a real-world scenario, an attacker might use enum4linux to identify a legacy Windows system (e.g., Windows 2000) that is vulnerable to EternalBlue, then pivot to exploitation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:11:28.846+00:00","questionType":"multiple_choice"},{"id":"8c7089ef-58da-4f17-ab38-2e0d9badabe5","slug":"a-company-wants-to-secure-its-email-communications-using-dig-g2v0a","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company wants to secure its email communications using digital signatures. Which cryptographic key does the sender use to sign the email?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Sender's public key","explanation":"Public key is used by others to verify, not to sign.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Sender's private key","explanation":"The sender signs with their private key.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Recipient's private key","explanation":"Recipient's private key is for decryption.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Recipient's public key","explanation":"Recipient's public key is for encryption.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient then verifies the signature using the sender's public key, ensuring authenticity and non-repudiation. This is defined in standards like S/MIME (RFC 5751) and OpenPGP (RFC 4880).","examTrap":"The trap here is that candidates confuse the roles of keys in encryption vs. signing, often selecting the sender's public key because they associate 'public' with sharing, but signing requires the private key to prove the sender's identity.","examTip":null,"technicalDeepDive":"Under the hood, the sender's private key generates a hash of the email content and encrypts that hash to create the digital signature. The recipient decrypts the hash with the sender's public key and compares it to a freshly computed hash of the email; a match confirms integrity and sender identity. In S/MIME, the sender's certificate containing the public key is often attached to the signed message for seamless verification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:53.901+00:00","questionType":"multiple_choice"},{"id":"3625dac7-beac-4910-a33b-c789038fad9e","slug":"which-two-of-the-following-are-common-security-risks-associa-xh3ss","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are common security risks associated with bring-your-own-device (BYOD) policies in a corporate environment?","difficulty":"medium","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Lack of visibility into device security posture","explanation":"IT may not know if devices are compromised.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Data leakage through personal apps","explanation":"Personal apps may not follow corporate security policies.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Enhanced network segmentation","explanation":"Segmentation is a security measure, not a risk.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Stronger encryption of corporate data","explanation":"Encryption is a protection, not a risk.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Increased control over device configurations","explanation":"BYOD usually reduces control.","masteryContext":""}],"correctOptionKey":"A,B","correctOptions":["A","B"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option A is correct because BYOD devices are personally owned and not under direct corporate management, leading to a lack of visibility into their security posture. Without a Mobile Device Management (MDM) or Unified Endpoint Management (UEM) solution, the organization cannot assess patch levels, antivirus status, or jailbreak/root status, leaving the network exposed to compromised devices.","examTrap":"EC-Council often tests the distinction between risks and controls; the trap here is that candidates confuse security mitigations (like segmentation or encryption) with inherent risks, leading them to select options C, D, or E instead of recognizing them as countermeasures.","examTip":null,"technicalDeepDive":"Under the hood, BYOD risks stem from the lack of a trusted platform module (TPM) or hardware-backed keystore enforcement on personal devices. For example, a user’s personal app with weak permissions (e.g., an Android app targeting API level 23 without runtime permission checks) can exfiltrate corporate email attachments via the shared storage, bypassing Data Loss Prevention (DLP) policies. Real-world scenarios include the 'Stagefright' vulnerability on unpatched Android devices allowing remote code execution through MMS, which a corporate IT team cannot remediate without device control.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.28+00:00","questionType":"multi_select"},{"id":"c5f98d60-1b7d-426a-8ae1-7cf736366621","slug":"an-employee-receives-an-email-that-appears-to-be-from-the-ce-tuvuy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Pharming","explanation":"Pharming redirects users to fraudulent websites.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Spear phishing","explanation":"Spear phishing targets a specific person, but does not necessarily impersonate a high-level executive.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Whaling","explanation":"Whaling targets senior executives or impersonates them.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Vishing","explanation":"Vishing uses phone calls, not email.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.","examTrap":"EC-Council often tests the distinction between spear phishing and whaling by emphasizing that whaling specifically targets senior executives, while spear phishing can target any individual or role within an organization.","examTip":null,"technicalDeepDive":"Whaling often leverages social engineering to bypass technical controls like email filters by using lookalike domains (e.g., ceo@cornpany.com instead of ceo@company.com) or spoofed display names. Attackers may also research the target's organizational hierarchy and communication patterns to craft a believable request, exploiting the trust placed in executive authority. In real-world scenarios, such attacks have led to significant financial losses, as employees are conditioned to obey urgent requests from leadership without verification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.029+00:00","questionType":"multiple_choice"},{"id":"d35d877d-8b0d-4095-ac28-e347f5a80e72","slug":"a-penetration-tester-uses-the-following-nmap-command-nmap-ffe44","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester uses the following Nmap command: nmap -sS -O -p 1-1000 10.0.0.1. The output shows port 22 as open, and OS detection suggests 'Linux 2.6.x'. The tester then runs: nmap -sV -p 22 10.0.0.1. What additional information does the second scan provide?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"It confirms the OS is Linux 2.6.x","explanation":"OS detection already identified the OS; -sV is for service versions.","masteryContext":""},{"key":"B","isCorrect":false,"text":"It checks if the port is filtered by a firewall","explanation":"Version scanning does not determine filtering; it only identifies the service version.","masteryContext":""},{"key":"C","isCorrect":true,"text":"It identifies the version of the SSH service running","explanation":"-sV performs version detection on the specified port.","masteryContext":""},{"key":"D","isCorrect":false,"text":"It performs a UDP scan on port 22","explanation":"UDP scan requires -sU; -sV on a TCP port is still TCP.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The second scan uses the `-sV` flag, which enables version detection. Nmap probes the open port 22 (SSH) to determine the exact service version (e.g., OpenSSH 5.3p1). This is distinct from OS detection (`-O`), which guesses the operating system based on TCP/IP stack fingerprinting. The `-sV` scan provides granular service version information, not OS confirmation or firewall status.","examTrap":"The trap here is confusing OS detection (`-O`) with service version detection (`-sV`), leading candidates to think `-sV` confirms the OS when it actually identifies the application version running on the port.","examTip":null,"technicalDeepDive":"Under the hood, `-sV` works by completing a TCP three-way handshake (if the port is open) and then sending a series of probes (e.g., NULL, FIN, or application-specific payloads) to elicit a response from the service. Nmap compares the response against a database of service fingerprints (nmap-service-probes) to identify the exact version. In real-world scenarios, knowing the SSH version helps identify vulnerable software (e.g., OpenSSH < 7.4 with CVE-2016-10009) or misconfigurations, which is critical for penetration testing.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-24T21:31:33.372+00:00","questionType":"multiple_choice"}],"countMismatch":null}] </article></body></html>