How should I use these Introduction to Ethical Hacking practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Introduction to Ethical Hacking questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Introduction to Ethical Hacking domain.

CEH · topic practice

Introduction to Ethical Hacking practice questions

Practise Certified Ethical Hacker CEH Introduction to Ethical Hacking practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

13 questionsDomain: Introduction to Ethical Hacking

Practice 10 questions Browse domain →

What the exam tests

What to know about Introduction to Ethical Hacking

Introduction to Ethical Hacking questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Introduction to Ethical Hacking exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Introduction to Ethical Hacking questions

13 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Introduction to Ethical Hacking explanation →

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Trap 1: Cracking

"Cracking" is a specific technique, primarily associated with password guessing, brute-forcing, or cryptographic attacks, rather than a distinct, overarching phase of the ethical hacking methodology. While cracking passwords or breaking encryption might be employed during the "Gaining Access" or "Maintaining Access" phases to escalate privileges or access protected data, it is a tool or method utilized within those broader phases, not a separate, high-level stage in the penetration testing lifecycle.

Study all Introduction to Ethical Hacking common traps →

A
Maintaining Access
Maintaining Access is a critical phase following successful exploitation, where the ethical hacker focuses on establishing persistent control over the compromised system. This involves deploying backdoors, rootkits, or other persistent mechanisms to ensure re-entry is possible even if initial vulnerabilities are patched or system reboots occur. The primary objective is to retain control for future exploitation, data exfiltration, or further network pivoting without needing to re-exploit the initial entry point.
B
Scanning
While crucial for information gathering, Scanning is not recognized as a standalone primary phase within the standard ethical hacking methodology. It is a key sub-phase of Reconnaissance, specifically active reconnaissance, where tools like Nmap or vulnerability scanners are employed to identify live hosts, open ports, services, and potential vulnerabilities on the target network. Its purpose is to gather detailed technical information that directly informs subsequent exploitation attempts during the Gaining Access phase.
C
Reconnaissance
Reconnaissance is the initial and foundational phase of ethical hacking, involving the systematic gathering of information about the target system, network, or organization. This phase can be passive, utilizing open-source intelligence (OSINT), or active, involving direct interaction like network scanning, to understand the target's infrastructure, technologies, and potential vulnerabilities. It sets the strategic groundwork and informs all subsequent phases of the penetration test.
D
Hiding Evidence
"Hiding Evidence" is not the formally recognized term for this phase within the standard ethical hacking methodology; the correct and more comprehensive term is "Covering Tracks" or "Clearing Tracks." This phase involves systematically removing all traces of the penetration test, such as log entries, temporary files, and modified system configurations, to prevent detection. The goal is to restore the target system to its original state and mimic a real attacker's attempt to evade forensic analysis.
E
Cracking
Why wrong: "Cracking" is a specific technique, primarily associated with password guessing, brute-forcing, or cryptographic attacks, rather than a distinct, overarching phase of the ethical hacking methodology. While cracking passwords or breaking encryption might be employed during the "Gaining Access" or "Maintaining Access" phases to escalate privileges or access protected data, it is a tool or method utilized within those broader phases, not a separate, high-level stage in the penetration testing lifecycle.

Full breakdown with real-world context →

Question 2mediummatching

Read the full Introduction to Ethical Hacking explanation →

Match each network protocol to its well-known port number.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

443

3389

Trap 1: FTP: 22

This option is incorrect because FTP (File Transfer Protocol) primarily uses TCP port 21 for its control connection, not port 22. Port 21 manages commands and authentication, while data transfers occur over separate data ports, often port 20 or dynamic ports. Port 22 is specifically reserved for the Secure Shell (SSH) protocol, which provides secure remote access and command execution.

Trap 2: SSH: 21

This option is incorrect as SSH (Secure Shell) operates on TCP port 22, not port 21. SSH establishes secure, encrypted connections for remote command-line access, remote file transfer (SFTP), and tunneling services, offering a robust alternative to insecure protocols. Conversely, port 21 is the well-known port assigned to the control channel for the File Transfer Protocol (FTP).

Study all Introduction to Ethical Hacking common traps →

A
HTTP: 80
HTTP, the foundational protocol for data communication on the World Wide Web, exclusively utilizes TCP port 80 for unencrypted client-server interactions. This well-known port facilitates the transfer of HTML pages, images, and other web content, making it the default for standard web browsing. Without specifying a different port, web browsers automatically attempt to connect to port 80 when accessing an HTTP URL.
B
HTTPS: 443
HTTPS, the secure version of HTTP, encrypts web traffic using SSL/TLS protocols over TCP port 443. This dedicated port ensures that all data exchanged between a web browser and a server, including sensitive information like login credentials and financial details, remains confidential and protected from eavesdropping. Its use is critical for secure online transactions and privacy.
C
FTP: 22
Why wrong: This option is incorrect because FTP (File Transfer Protocol) primarily uses TCP port 21 for its control connection, not port 22. Port 21 manages commands and authentication, while data transfers occur over separate data ports, often port 20 or dynamic ports. Port 22 is specifically reserved for the Secure Shell (SSH) protocol, which provides secure remote access and command execution.
D
SSH: 21
Why wrong: This option is incorrect as SSH (Secure Shell) operates on TCP port 22, not port 21. SSH establishes secure, encrypted connections for remote command-line access, remote file transfer (SFTP), and tunneling services, offering a robust alternative to insecure protocols. Conversely, port 21 is the well-known port assigned to the control channel for the File Transfer Protocol (FTP).
E
DNS: 53
The Domain Name System (DNS) correctly utilizes port 53 for its critical function of translating human-readable domain names into machine-readable IP addresses. DNS queries typically use UDP port 53 for faster, connectionless lookups, while TCP port 53 is employed for zone transfers between DNS servers and for larger responses. This port is fundamental for virtually all internet communications.

Full breakdown with real-world context →

Question 3mediummatching

Read the full Introduction to Ethical Hacking explanation →

Select all that apply: Which of the following IDS/IPS terms are correctly matched to their meanings?

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Alert on benign activity

Failing to detect an actual attack

Detects known attack patterns

Detects deviations from normal behavior

Decoy system to attract attackers

Trap 1: False positive: When the IDS fails to detect an attack

The statement incorrectly defines a false positive. A false positive occurs when an Intrusion Detection System mistakenly identifies legitimate, benign network activity or system behavior as malicious or an attack. This leads to unnecessary alerts, consumes analyst time investigating non-threats, and can desensitize security teams to actual threats if the rate is too high, impacting operational efficiency.

Trap 2: True positive: When the IDS incorrectly flags benign activity

The provided definition for a true positive is incorrect. A true positive, in the context of an IDS, signifies the successful and accurate identification of a genuine malicious activity or attack by the system. This is the desired outcome, where the IDS correctly flags an actual threat, enabling security personnel to respond promptly and mitigate the risk effectively.

Study all Introduction to Ethical Hacking common traps →

A
Signature-based IDS: Uses predefined patterns of known attacks
Signature-based Intrusion Detection Systems operate by comparing network traffic against a comprehensive database of known attack patterns, often called signatures. These signatures are specific byte sequences, header values, or command strings associated with previously identified malware or exploit techniques. This method is highly effective at detecting known threats with low false positive rates, but it is inherently incapable of identifying novel or zero-day attacks for which no signature yet exists.
B
Anomaly-based IDS: Monitors traffic and compares to a baseline
Anomaly-based Intrusion Detection Systems establish a statistical baseline of normal network behavior, encompassing typical traffic volumes, protocol usage, and user activities over time. Any significant deviation from this established baseline is then flagged as a potential security incident, indicating unusual or suspicious activity. This approach offers the advantage of potentially detecting unknown or zero-day attacks that lack predefined signatures, though it often comes with a higher rate of false positives as legitimate new behaviors might initially be flagged.
C
False positive: When the IDS fails to detect an attack
Why wrong: The statement incorrectly defines a false positive. A false positive occurs when an Intrusion Detection System mistakenly identifies legitimate, benign network activity or system behavior as malicious or an attack. This leads to unnecessary alerts, consumes analyst time investigating non-threats, and can desensitize security teams to actual threats if the rate is too high, impacting operational efficiency.
D
False negative: When the IDS fails to detect an attack
A false negative represents a critical failure of an Intrusion Detection System, occurring when an actual malicious attack or security breach successfully evades detection by the system. This means the IDS fails to generate an alert for a genuine threat, allowing an attacker to potentially compromise systems without immediate notice. Such an oversight can have severe consequences, as the organization remains unaware of an ongoing intrusion, delaying response and increasing potential damage.
E
True positive: When the IDS incorrectly flags benign activity
Why wrong: The provided definition for a true positive is incorrect. A true positive, in the context of an IDS, signifies the successful and accurate identification of a genuine malicious activity or attack by the system. This is the desired outcome, where the IDS correctly flags an actual threat, enabling security personnel to respond promptly and mitigate the risk effectively.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Introduction to Ethical Hacking explanation →

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Trap 1: TCP connect scan

TCP connect scan completes the handshake, so SYN-ACK would be received from open ports.

Trap 2: UDP scan

UDP scans send UDP datagrams, not TCP SYN packets.

Trap 3: FIN scan

FIN scan sends FIN packets, not SYN.

Study all Introduction to Ethical Hacking common traps →

A
TCP connect scan
Why wrong: TCP connect scan completes the handshake, so SYN-ACK would be received from open ports.
B
UDP scan
Why wrong: UDP scans send UDP datagrams, not TCP SYN packets.
C
SYN scan
SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.
D
FIN scan
Why wrong: FIN scan sends FIN packets, not SYN.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Introduction to Ethical Hacking explanation →

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Trap 1: Use random source ports

Using random source ports primarily aims to bypass stateless firewall rules that might block specific source ports or to make traffic analysis slightly more complex by obscuring the origin application. However, this technique does not alter the total number of packets sent per unit of time from the scanning host. Therefore, it is ineffective against Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) that monitor and trigger alerts based on high packet rates originating from a single source IP address, regardless of the source port used.

Trap 2: Use a decoy scan

A decoy scan involves sending packets from multiple spoofed IP addresses in addition to the actual attacker's IP, making it harder for the target to identify the true source of the scan. While this technique can obscure the attacker's origin, it inherently increases the overall packet volume directed at the target. Each decoy IP, along with the real attacker's IP, contributes to the total packet rate observed by the target's IDS/IPS, potentially increasing the likelihood of triggering rate-based detection thresholds rather than evading them.

Trap 3: Use fragmented packets

Using fragmented packets involves splitting a single packet into multiple smaller fragments, forcing the target system to reassemble them. This technique is primarily effective against signature-based IDS/IPS that might fail to properly reassemble or inspect fragmented packets, thus missing specific attack signatures. However, fragmentation does not reduce the total number of packets sent over the network; in fact, it increases it for a given amount of data. Consequently, it offers no benefit against rate-based detection mechanisms that simply count the volume of packets arriving from a source within a specific timeframe.

Study all Introduction to Ethical Hacking common traps →

A
Use random source ports
Why wrong: Using random source ports primarily aims to bypass stateless firewall rules that might block specific source ports or to make traffic analysis slightly more complex by obscuring the origin application. However, this technique does not alter the total number of packets sent per unit of time from the scanning host. Therefore, it is ineffective against Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) that monitor and trigger alerts based on high packet rates originating from a single source IP address, regardless of the source port used.
B
Use a decoy scan
Why wrong: A decoy scan involves sending packets from multiple spoofed IP addresses in addition to the actual attacker's IP, making it harder for the target to identify the true source of the scan. While this technique can obscure the attacker's origin, it inherently increases the overall packet volume directed at the target. Each decoy IP, along with the real attacker's IP, contributes to the total packet rate observed by the target's IDS/IPS, potentially increasing the likelihood of triggering rate-based detection thresholds rather than evading them.
C
Slow down the scan rate
Slowing down the scan rate directly reduces the number of packets sent per second (PPS) or connections attempted per minute. This strategic reduction keeps the scanning activity below the predefined thresholds set by rate-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), which are designed to detect anomalous traffic volumes. By maintaining a low packet rate, the ethical hacker can conduct reconnaissance without triggering alerts that would otherwise flag the activity as a potential port scan or denial-of-service attempt, thus evading detection.
D
Use fragmented packets
Why wrong: Using fragmented packets involves splitting a single packet into multiple smaller fragments, forcing the target system to reassemble them. This technique is primarily effective against signature-based IDS/IPS that might fail to properly reassemble or inspect fragmented packets, thus missing specific attack signatures. However, fragmentation does not reduce the total number of packets sent over the network; in fact, it increases it for a given amount of data. Consequently, it offers no benefit against rate-based detection mechanisms that simply count the volume of packets arriving from a source within a specific timeframe.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Introduction to Ethical Hacking explanation →

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Trap 1: White-box test

A white-box test involves the tester having complete access to the application's internal workings, including source code, design documents, and infrastructure details. This comprehensive knowledge allows for in-depth analysis of code logic, configuration files, and potential internal vulnerabilities that might be missed by external testing. While thorough for identifying deep-seated flaws, it does not simulate an external attacker's perspective, which is what the company primarily seeks for web application security.

Trap 2: Red team engagement

A red team engagement is a comprehensive, goal-oriented adversarial simulation designed to test an organization's overall security posture, including people, processes, and technology, against a specific objective (e.g., data exfiltration). Unlike a focused web application test, it often involves multiple attack vectors, social engineering, and physical penetration, aiming to mimic a sophisticated, persistent threat actor across the entire enterprise. It's a broader, more extensive exercise than simply testing a single web application's security.

Trap 3: Gray-box test

A gray-box test is conducted with some limited knowledge of the application's internal structure or credentials, such as user accounts or API documentation, but not full source code access. This approach balances the realism of a black-box test with the efficiency of a white-box test, allowing testers to simulate an insider threat or a privileged user. However, for a company wanting to test its web application's security from an *external* attacker's perspective, a gray-box test provides too much initial information.

Study all Introduction to Ethical Hacking common traps →

A
Black-box test
A black-box test simulates an external attacker with no prior knowledge of the target system's internal architecture, source code, or credentials. Testers interact with the web application solely through its public interfaces, mimicking real-world threat actors attempting to exploit vulnerabilities from the outside. This approach is ideal for assessing the effectiveness of perimeter defenses and identifying externally exploitable flaws, directly aligning with a company's goal to test its web application's security from an external perspective.
B
White-box test
Why wrong: A white-box test involves the tester having complete access to the application's internal workings, including source code, design documents, and infrastructure details. This comprehensive knowledge allows for in-depth analysis of code logic, configuration files, and potential internal vulnerabilities that might be missed by external testing. While thorough for identifying deep-seated flaws, it does not simulate an external attacker's perspective, which is what the company primarily seeks for web application security.
C
Red team engagement
Why wrong: A red team engagement is a comprehensive, goal-oriented adversarial simulation designed to test an organization's overall security posture, including people, processes, and technology, against a specific objective (e.g., data exfiltration). Unlike a focused web application test, it often involves multiple attack vectors, social engineering, and physical penetration, aiming to mimic a sophisticated, persistent threat actor across the entire enterprise. It's a broader, more extensive exercise than simply testing a single web application's security.
D
Gray-box test
Why wrong: A gray-box test is conducted with some limited knowledge of the application's internal structure or credentials, such as user accounts or API documentation, but not full source code access. This approach balances the realism of a black-box test with the efficiency of a white-box test, allowing testers to simulate an insider threat or a privileged user. However, for a company wanting to test its web application's security from an *external* attacker's perspective, a gray-box test provides too much initial information.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Introduction to Ethical Hacking explanation →

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Refer to the exhibit.
```
$ nmap -sS -T4 -p 22,80,443 192.168.1.10
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for 192.168.1.10
Host is up (0.0012s latency).

PORT    STATE    SERVICE
22/tcp  open     ssh
80/tcp  open     http
443/tcp closed   https

Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds
```

Trap 1: open

An 'open' state signifies that a target port has an application actively listening for incoming connections. Nmap successfully completed a full TCP three-way handshake or received an expected response for UDP, confirming that the port is accessible and a service is ready to accept communication. This indicates a potential entry point for further enumeration and vulnerability assessment, but it is not the state depicted in the exhibit for the relevant port.

Trap 2: filtered

A 'filtered' state occurs when Nmap cannot definitively determine if a port is open or closed because a firewall, router, or other network security device is actively preventing the probe packets from reaching the target or blocking the response. This often results in Nmap receiving no response at all, or an ICMP unreachable error, indicating that the probe was dropped. This state suggests the presence of a protective mechanism, hindering direct port status assessment.

Trap 3: unfiltered

An 'unfiltered' state is primarily observed during an Nmap ACK scan, which is specifically designed to map firewall rulesets rather than ascertain if a service is listening. This state indicates that the port is accessible and not being blocked by a firewall, as the ACK probe successfully elicited an RST response. However, it provides no information about whether an application is actually listening on that port, making it distinct from 'open' or 'closed' states in terms of service availability.

Study all Introduction to Ethical Hacking common traps →

A
open
Why wrong: An 'open' state signifies that a target port has an application actively listening for incoming connections. Nmap successfully completed a full TCP three-way handshake or received an expected response for UDP, confirming that the port is accessible and a service is ready to accept communication. This indicates a potential entry point for further enumeration and vulnerability assessment, but it is not the state depicted in the exhibit for the relevant port.
B
closed
A 'closed' port indicates that the target host is reachable and received Nmap's probe, but no application is currently listening on that specific port. For TCP scans, the target typically responds with an RST (reset) packet, confirming the port's accessibility while explicitly stating that no service is active there. This state is crucial as it differentiates between an inactive port and one that is blocked by a firewall, accurately reflecting the scenario where the host is up but the service is not running.
C
filtered
Why wrong: A 'filtered' state occurs when Nmap cannot definitively determine if a port is open or closed because a firewall, router, or other network security device is actively preventing the probe packets from reaching the target or blocking the response. This often results in Nmap receiving no response at all, or an ICMP unreachable error, indicating that the probe was dropped. This state suggests the presence of a protective mechanism, hindering direct port status assessment.
D
unfiltered
Why wrong: An 'unfiltered' state is primarily observed during an Nmap ACK scan, which is specifically designed to map firewall rulesets rather than ascertain if a service is listening. This state indicates that the port is accessible and not being blocked by a firewall, as the ACK probe successfully elicited an RST response. However, it provides no information about whether an application is actually listening on that port, making it distinct from 'open' or 'closed' states in terms of service availability.

Full breakdown with real-world context →

Question 8mediummultiple choice

Open the full VLAN trunking answer →

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Trap 1: Implement a password policy requiring complex passwords for all…

Implementing a strong password policy is a fundamental security practice that enhances user authentication by making brute-force and dictionary attacks more difficult. However, this measure primarily protects against unauthorized login attempts once an attacker has already established network connectivity to the server. It does not address the underlying issue of the web server being unnecessarily exposed and reachable from all VLANs across the network, which is a network access control problem.

Trap 2: Enable two-factor authentication on the web server.

Enabling two-factor authentication significantly strengthens the authentication process by requiring a second verification factor beyond just a password, thereby mitigating risks from compromised credentials. Nevertheless, 2FA operates at the application or service login layer and does not restrict the initial network access path to the web server itself. The server remains broadly accessible from every VLAN, allowing any device to attempt connection and potentially discover other vulnerabilities before authentication even occurs.

Trap 3: Apply the latest security patches to the web server.

Applying the latest security patches is crucial for mitigating known vulnerabilities within the web server's operating system and applications, preventing exploitation by attackers. While essential for maintaining a secure posture, patching does not inherently reduce the network exposure of the server. The server would still be broadly accessible from all VLANs, meaning any potential attacker on the network could still reach it and probe for zero-day exploits or misconfigurations, even if all known vulnerabilities are addressed.

Study all Introduction to Ethical Hacking common traps →

A
Implement a password policy requiring complex passwords for all users.
Why wrong: Implementing a strong password policy is a fundamental security practice that enhances user authentication by making brute-force and dictionary attacks more difficult. However, this measure primarily protects against unauthorized login attempts once an attacker has already established network connectivity to the server. It does not address the underlying issue of the web server being unnecessarily exposed and reachable from all VLANs across the network, which is a network access control problem.
B
Enable two-factor authentication on the web server.
Why wrong: Enabling two-factor authentication significantly strengthens the authentication process by requiring a second verification factor beyond just a password, thereby mitigating risks from compromised credentials. Nevertheless, 2FA operates at the application or service login layer and does not restrict the initial network access path to the web server itself. The server remains broadly accessible from every VLAN, allowing any device to attempt connection and potentially discover other vulnerabilities before authentication even occurs.
C
Apply the latest security patches to the web server.
Why wrong: Applying the latest security patches is crucial for mitigating known vulnerabilities within the web server's operating system and applications, preventing exploitation by attackers. While essential for maintaining a secure posture, patching does not inherently reduce the network exposure of the server. The server would still be broadly accessible from all VLANs, meaning any potential attacker on the network could still reach it and probe for zero-day exploits or misconfigurations, even if all known vulnerabilities are addressed.
D
Restrict access to the Engineering web server to only the Engineering VLAN.
Restricting access to the Engineering web server solely to the Engineering VLAN directly implements the principle of least privilege at the network layer. This action significantly reduces the attack surface by ensuring the server is only reachable by authorized clients within its designated operational segment. By preventing unnecessary network connectivity from other VLANs, it drastically limits the opportunities for unauthorized reconnaissance and exploitation attempts, regardless of the server's internal security controls.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Introduction to Ethical Hacking explanation →

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Trap 1: Enumeration

Enumeration is a sub-phase within Scanning, not a separate phase.

Trap 2: Social Engineering

Social Engineering is a technique used within phases, not a phase itself.

Study all Introduction to Ethical Hacking common traps →

A
Maintaining Access
Maintaining Access is a phase after gaining initial entry.
B
Scanning
Scanning involves active probing of the target network.
C
Enumeration
Why wrong: Enumeration is a sub-phase within Scanning, not a separate phase.
D
Reconnaissance
Reconnaissance is the first phase, involving information gathering.
E
Social Engineering
Why wrong: Social Engineering is a technique used within phases, not a phase itself.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full Introduction to Ethical Hacking explanation →

Based on the exhibit, what type of attack is being attempted?

Exhibit

Refer to the exhibit.

192.168.1.10   - - [01/Oct/2023:13:55:36 -0400] "GET /index.html HTTP/1.1" 200 2326
192.168.1.10   - - [01/Oct/2023:13:55:37 -0400] "GET /admin/login.php HTTP/1.1" 404 169
192.168.1.10   - - [01/Oct/2023:13:55:38 -0400] "GET /admin/ HTTP/1.1" 403 195
192.168.1.10   - - [01/Oct/2023:13:55:39 -0400] "GET /images/..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1" 200 523
192.168.1.10   - - [01/Oct/2023:13:55:40 -0400] "GET /cgi-bin/test.cgi HTTP/1.1" 200 89

Trap 1: Command Injection

Command Injection involves injecting and executing arbitrary operating system commands through an application. The provided exhibit does not contain any typical command separators like semicolons (`;`), ampersands (`&`), pipes (`|`), or backticks (`` ` ``), nor does it show common command utilities such as `ls`, `cat`, or `whoami`. Therefore, there is no indication that the attacker is attempting to execute system-level commands on the server.

Trap 2: SQL Injection

SQL Injection exploits vulnerabilities in an application's database layer by inserting malicious SQL code into input fields. The exhibit lacks any characteristic SQL syntax, such as single quotes (`'`), double dashes (`--`) for comments, or keywords like `UNION`, `SELECT`, `OR`, or `AND`, which are typically used to manipulate database queries. Without these elements, the attempt does not align with the patterns of an SQL injection attack targeting a backend database.

Trap 3: Cross-Site Scripting

Cross-Site Scripting (XSS) attacks involve injecting malicious client-side scripts, typically JavaScript, into web pages viewed by other users. The exhibit does not display any HTML tags like `<script>`, `<img>` with `onerror` attributes, or `javascript:` pseudo-protocols commonly used to embed or execute scripts within a web browser. The observed input is focused on file path manipulation rather than browser-side script execution.

Study all Introduction to Ethical Hacking common traps →

A
Directory Traversal
The exhibit clearly shows an attempt to manipulate a file path using `..%2f` sequences, which are URL-encoded representations of `../`. This technique aims to navigate outside of an intended directory and access restricted files, such as `/etc/passwd`, which stores user account information on Unix-like systems. Such an attack exploits inadequate input validation on user-supplied file paths, allowing an attacker to read or potentially write to arbitrary files on the server's file system.
B
Command Injection
Why wrong: Command Injection involves injecting and executing arbitrary operating system commands through an application. The provided exhibit does not contain any typical command separators like semicolons (`;`), ampersands (`&`), pipes (`|`), or backticks (`` ` ``), nor does it show common command utilities such as `ls`, `cat`, or `whoami`. Therefore, there is no indication that the attacker is attempting to execute system-level commands on the server.
C
SQL Injection
Why wrong: SQL Injection exploits vulnerabilities in an application's database layer by inserting malicious SQL code into input fields. The exhibit lacks any characteristic SQL syntax, such as single quotes (`'`), double dashes (`--`) for comments, or keywords like `UNION`, `SELECT`, `OR`, or `AND`, which are typically used to manipulate database queries. Without these elements, the attempt does not align with the patterns of an SQL injection attack targeting a backend database.
D
Cross-Site Scripting
Why wrong: Cross-Site Scripting (XSS) attacks involve injecting malicious client-side scripts, typically JavaScript, into web pages viewed by other users. The exhibit does not display any HTML tags like `<script>`, `<img>` with `onerror` attributes, or `javascript:` pseudo-protocols commonly used to embed or execute scripts within a web browser. The observed input is focused on file path manipulation rather than browser-side script execution.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Introduction to Ethical Hacking explanation →

You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?

Trap 1: Use the PUT method to upload a malicious file directly to the web…

While the HTTP PUT method can theoretically be used to upload files, it is frequently disabled or heavily restricted on production web servers, especially for sensitive directories like the web root. Even if the 'Allow' header indicates PUT is supported, server-side configurations often prevent arbitrary file creation, making this a low-probability initial attack vector for direct web root compromise without prior authentication or a specific vulnerability.

Trap 2: Exploit the IIS WebDAV vulnerability to execute commands.

Exploiting an IIS WebDAV vulnerability would be ineffective in this scenario because the target server is explicitly stated or implied to be running Apache, not Microsoft's Internet Information Services (IIS). WebDAV vulnerabilities are specific to the IIS architecture and its implementation of the Web Distributed Authoring and Versioning protocol, making them irrelevant for an Apache-based environment.

Trap 3: Attempt SQL injection in the login form to extract database…

While SQL injection is a critical vulnerability often found in login forms, there is no evidence provided in the question stem to suggest its presence or exploitability in this specific context. Prioritizing an unconfirmed SQL injection attempt over a known or implied file upload vulnerability, which directly leads to remote code execution, would be an inefficient and less certain approach for initial compromise.

Study all Introduction to Ethical Hacking common traps →

A
Use the PUT method to upload a malicious file directly to the web root.
Why wrong: While the HTTP PUT method can theoretically be used to upload files, it is frequently disabled or heavily restricted on production web servers, especially for sensitive directories like the web root. Even if the 'Allow' header indicates PUT is supported, server-side configurations often prevent arbitrary file creation, making this a low-probability initial attack vector for direct web root compromise without prior authentication or a specific vulnerability.
B
Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.
This approach leverages a common file upload vulnerability bypass technique. By using a '.phtml' extension, which Apache servers often interpret as PHP, the attacker can circumvent typical blacklist filters that block '.php' files. Once uploaded to an accessible directory like '/uploads/', the web shell can be requested, allowing the attacker to execute arbitrary commands on the server, achieving remote code execution.
C
Exploit the IIS WebDAV vulnerability to execute commands.
Why wrong: Exploiting an IIS WebDAV vulnerability would be ineffective in this scenario because the target server is explicitly stated or implied to be running Apache, not Microsoft's Internet Information Services (IIS). WebDAV vulnerabilities are specific to the IIS architecture and its implementation of the Web Distributed Authoring and Versioning protocol, making them irrelevant for an Apache-based environment.
D
Attempt SQL injection in the login form to extract database credentials.
Why wrong: While SQL injection is a critical vulnerability often found in login forms, there is no evidence provided in the question stem to suggest its presence or exploitability in this specific context. Prioritizing an unconfirmed SQL injection attempt over a known or implied file upload vulnerability, which directly leads to remote code execution, would be an inefficient and less certain approach for initial compromise.

Full breakdown with real-world context →

Question 12mediumdrag order

Read the full Introduction to Ethical Hacking explanation →

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Send SYN-ACK, then send SYN, then send ACK

Sending a SYN-ACK as the initial packet is fundamentally flawed because a SYN-ACK is a response, not an initiation. It signifies acknowledgment of a received SYN and synchronization request from the server. The TCP three-way handshake must always commence with an unacknowledged SYN packet from the client to propose a connection, making this sequence illogical.

Trap 2: Send SYN, then send ACK, then send SYN-ACK

This sequence is incorrect because the server's immediate response to a client's SYN packet must be a SYN-ACK, not merely an ACK. The SYN-ACK serves to acknowledge the client's synchronization request while simultaneously sending its own synchronization request to the client. Sending only an ACK would fail to establish the server's initial sequence number with the client, preventing proper connection setup.

Trap 3: Send ACK, then send SYN, then send SYN-ACK

Initiating the TCP handshake with an ACK packet is impossible, as an ACK's purpose is to acknowledge previously received data or a synchronization request. At the very beginning of a connection attempt, there is nothing to acknowledge. The first packet must be a SYN to propose a connection and establish initial sequence numbers, making this sequence logically invalid.

Study all Introduction to Ethical Hacking common traps →

A
Send SYN, then receive SYN-ACK, then send ACK
This is the correct order because the TCP three-way handshake starts with the client sending a SYN packet to initiate synchronization, the server responds with SYN-ACK to acknowledge and synchronize, and finally the client sends an ACK to confirm the connection establishment.
B
Send SYN-ACK, then send SYN, then send ACK
Why wrong: Sending a SYN-ACK as the initial packet is fundamentally flawed because a SYN-ACK is a response, not an initiation. It signifies acknowledgment of a received SYN and synchronization request from the server. The TCP three-way handshake must always commence with an unacknowledged SYN packet from the client to propose a connection, making this sequence illogical.
C
Send SYN, then send ACK, then send SYN-ACK
Why wrong: This sequence is incorrect because the server's immediate response to a client's SYN packet must be a SYN-ACK, not merely an ACK. The SYN-ACK serves to acknowledge the client's synchronization request while simultaneously sending its own synchronization request to the client. Sending only an ACK would fail to establish the server's initial sequence number with the client, preventing proper connection setup.
D
Send ACK, then send SYN, then send SYN-ACK
Why wrong: Initiating the TCP handshake with an ACK packet is impossible, as an ACK's purpose is to acknowledge previously received data or a synchronization request. At the very beginning of a connection attempt, there is nothing to acknowledge. The first packet must be a SYN to propose a connection and establish initial sequence numbers, making this sequence logically invalid.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full Introduction to Ethical Hacking explanation →

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Victim connects back first, then set up listener, then attacker…

This order is fundamentally incorrect because a victim machine cannot successfully connect to a listener that has not yet been established. The TCP handshake requires an active listening socket on the specified port to complete. Any attempt by the victim to connect before the listener is running would result in a "Connection refused" error, preventing any shell from being established.

Trap 2: Set up listener, then victim connects back, then cleanup, then…

This sequence is flawed because inserting "cleanup" immediately after the victim connects would prematurely terminate the network session. Cleanup typically involves closing the connection, which would occur before the attacker has had any opportunity to gain interactive shell access or execute a single command. The session would be closed before its intended purpose could be fulfilled.

Trap 3: Set up listener, then attacker gains shell access, then victim…

This order is incorrect because the attacker cannot "gain shell access" until the victim machine has successfully connected to the listener. The attacker's netcat listener simply waits passively for an incoming connection. Shell access is only granted when the victim actively connects and redirects its shell's input/output streams over the established TCP tunnel, not before.

Study all Introduction to Ethical Hacking common traps →

A
Set up listener on attacker machine, then victim connects back, then attacker gains shell access, then execute commands, then cleanup
This sequence correctly outlines the establishment of a reverse shell using Netcat. The attacker's machine must first set up a listener (e.g., `nc -lvnp <port>`) to await an incoming connection. Once active, the victim machine initiates an outbound connection to the attacker, piping a shell process. This establishes the communication channel, granting the attacker interactive shell access to execute commands, followed by proper session cleanup.
B
Victim connects back first, then set up listener, then attacker gains shell access, then execute commands, then cleanup
Why wrong: This order is fundamentally incorrect because a victim machine cannot successfully connect to a listener that has not yet been established. The TCP handshake requires an active listening socket on the specified port to complete. Any attempt by the victim to connect before the listener is running would result in a "Connection refused" error, preventing any shell from being established.
C
Set up listener, then victim connects back, then cleanup, then attacker gains shell access, then execute commands
Why wrong: This sequence is flawed because inserting "cleanup" immediately after the victim connects would prematurely terminate the network session. Cleanup typically involves closing the connection, which would occur before the attacker has had any opportunity to gain interactive shell access or execute a single command. The session would be closed before its intended purpose could be fulfilled.
D
Set up listener, then attacker gains shell access, then victim connects back, then execute commands, then cleanup
Why wrong: This order is incorrect because the attacker cannot "gain shell access" until the victim machine has successfully connected to the listener. The attacker's netcat listener simply waits passively for an incoming connection. Shell access is only granted when the victim actively connects and redirects its shell's input/output streams over the established TCP tunnel, not before.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Introduction to Ethical Hacking sessions

Start a Introduction to Ethical Hacking only practice session

Every question in these sessions is drawn from the Introduction to Ethical Hacking domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Introduction to Ethical Hacking questions →Mixed CEH session

Frequently asked questions

What does the CEH exam test about Introduction to Ethical Hacking?: Introduction to Ethical Hacking questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Introduction to Ethical Hacking questions in a focused session?: Yes — the session launcher on this page draws every question from the Introduction to Ethical Hacking domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CEH topics?: Use the topic links above to move to related areas, or go back to the CEH question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CEH exam covers. They are not copied from any real exam or dump site.

Introduction to Ethical Hacking only

10 questions 20 questions 30 questions 50 questions

Mixed CEH session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CEH questions Introduction to Ethical Hacking domain overview CEH exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Introduction to Ethical Hacking practice questions

What to know about Introduction to Ethical Hacking

Common Introduction to Ethical Hacking exam traps

Introduction to Ethical Hacking questions

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Match each network protocol to its well-known port number.

Select all that apply: Which of the following IDS/IPS terms are correctly matched to their meanings?

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Based on the exhibit, what type of attack is being attempted?

Exhibit

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Track your progress over time

Start a Introduction to Ethical Hacking only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions