How should I use these Introduction to Ethical Hacking practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Introduction to Ethical Hacking questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Introduction to Ethical Hacking domain.

CEH · topic practice

Introduction to Ethical Hacking practice questions

Practise Certified Ethical Hacker CEH Introduction to Ethical Hacking practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

13 questionsDomain: Introduction to Ethical Hacking

Practice 10 questions Browse domain →

What the exam tests

What to know about Introduction to Ethical Hacking

Introduction to Ethical Hacking questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Introduction to Ethical Hacking exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Introduction to Ethical Hacking questions

13 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Introduction to Ethical Hacking explanation →

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

Trap 1: TCP connect scan

TCP connect scan completes the handshake, so SYN-ACK would be received from open ports.

Trap 2: UDP scan

UDP scans send UDP datagrams, not TCP SYN packets.

Trap 3: FIN scan

FIN scan sends FIN packets, not SYN.

Study all Introduction to Ethical Hacking common traps →

A
TCP connect scan
Why wrong: TCP connect scan completes the handshake, so SYN-ACK would be received from open ports.
B
UDP scan
Why wrong: UDP scans send UDP datagrams, not TCP SYN packets.
C
SYN scan
SYN scan sends SYN packets; lack of SYN-ACK indicates filtered/closed ports.
D
FIN scan
Why wrong: FIN scan sends FIN packets, not SYN.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Introduction to Ethical Hacking explanation →

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

Trap 1: Use random source ports

Random ports don't affect packet rate.

Trap 2: Use a decoy scan

Decoy scans can still generate high packet rates.

Trap 3: Use fragmented packets

Fragmentation evades signature detection, not rate-based detection.

Study all Introduction to Ethical Hacking common traps →

A
Use random source ports
Why wrong: Random ports don't affect packet rate.
B
Use a decoy scan
Why wrong: Decoy scans can still generate high packet rates.
C
Slow down the scan rate
Reducing packets per second avoids triggering rate-based IDS thresholds.
D
Use fragmented packets
Why wrong: Fragmentation evades signature detection, not rate-based detection.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Introduction to Ethical Hacking explanation →

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Trap 1: White-box test

White-box test provides full knowledge of the system.

Trap 2: Red team engagement

Red team engagement is a full-scope adversarial simulation, not just a test type.

Trap 3: Gray-box test

Gray-box test provides partial knowledge.

Study all Introduction to Ethical Hacking common traps →

A
Black-box test
Black-box test simulates an external attacker with no prior knowledge.
B
White-box test
Why wrong: White-box test provides full knowledge of the system.
C
Red team engagement
Why wrong: Red team engagement is a full-scope adversarial simulation, not just a test type.
D
Gray-box test
Why wrong: Gray-box test provides partial knowledge.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Introduction to Ethical Hacking explanation →

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Trap 1: Scanning

Scanning is a sub-phase of Reconnaissance.

Trap 2: Hiding Evidence

Covering Tracks is the correct term, not Hiding Evidence.

Trap 3: Cracking

Cracking is not a recognized phase.

Study all Introduction to Ethical Hacking common traps →

A
Maintaining Access
Maintaining Access is a phase after gaining access.
B
Scanning
Why wrong: Scanning is a sub-phase of Reconnaissance.
C
Reconnaissance
Reconnaissance is the first phase of ethical hacking.
D
Hiding Evidence
Why wrong: Covering Tracks is the correct term, not Hiding Evidence.
E
Cracking
Why wrong: Cracking is not a recognized phase.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Introduction to Ethical Hacking explanation →

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Refer to the exhibit.
```
$ nmap -sS -T4 -p 22,80,443 192.168.1.10
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for 192.168.1.10
Host is up (0.0012s latency).

PORT    STATE    SERVICE
22/tcp  open     ssh
80/tcp  open     http
443/tcp closed   https

Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds
```

Trap 1: open

Open means a service is listening.

Trap 2: filtered

Filtered means the probe was blocked.

Trap 3: unfiltered

Unfiltered is not shown in this output.

Study all Introduction to Ethical Hacking common traps →

A
open
Why wrong: Open means a service is listening.
B
closed
Closed means reachable but no service listening.
C
filtered
Why wrong: Filtered means the probe was blocked.
D
unfiltered
Why wrong: Unfiltered is not shown in this output.

Full breakdown with real-world context →

Question 6mediummultiple choice

Open the full VLAN trunking answer →

You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?

Trap 1: Implement a password policy requiring complex passwords for all…

Password policy does not address the immediate exposure of the web server to all VLANs.

Trap 2: Enable two-factor authentication on the web server.

Two-factor does not remove the unnecessary access path.

Trap 3: Apply the latest security patches to the web server.

Patching is good but does not reduce the immediate exposure from broad access.

Study all Introduction to Ethical Hacking common traps →

A
Implement a password policy requiring complex passwords for all users.
Why wrong: Password policy does not address the immediate exposure of the web server to all VLANs.
B
Enable two-factor authentication on the web server.
Why wrong: Two-factor does not remove the unnecessary access path.
C
Apply the latest security patches to the web server.
Why wrong: Patching is good but does not reduce the immediate exposure from broad access.
D
Restrict access to the Engineering web server to only the Engineering VLAN.
This immediately reduces the attack surface by limiting unnecessary access.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Introduction to Ethical Hacking explanation →

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Trap 1: Enumeration

Enumeration is a sub-phase within Scanning, not a separate phase.

Trap 2: Social Engineering

Social Engineering is a technique used within phases, not a phase itself.

Study all Introduction to Ethical Hacking common traps →

A
Maintaining Access
Maintaining Access is a phase after gaining initial entry.
B
Scanning
Scanning involves active probing of the target network.
C
Enumeration
Why wrong: Enumeration is a sub-phase within Scanning, not a separate phase.
D
Reconnaissance
Reconnaissance is the first phase, involving information gathering.
E
Social Engineering
Why wrong: Social Engineering is a technique used within phases, not a phase itself.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Introduction to Ethical Hacking explanation →

Based on the exhibit, what type of attack is being attempted?

Exhibit

Refer to the exhibit.

192.168.1.10   - - [01/Oct/2023:13:55:36 -0400] "GET /index.html HTTP/1.1" 200 2326
192.168.1.10   - - [01/Oct/2023:13:55:37 -0400] "GET /admin/login.php HTTP/1.1" 404 169
192.168.1.10   - - [01/Oct/2023:13:55:38 -0400] "GET /admin/ HTTP/1.1" 403 195
192.168.1.10   - - [01/Oct/2023:13:55:39 -0400] "GET /images/..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1" 200 523
192.168.1.10   - - [01/Oct/2023:13:55:40 -0400] "GET /cgi-bin/test.cgi HTTP/1.1" 200 89

Trap 1: Command Injection

No command syntax observed.

Trap 2: SQL Injection

No SQL syntax observed.

Trap 3: Cross-Site Scripting

No script tags or malicious HTML.

Study all Introduction to Ethical Hacking common traps →

A
Directory Traversal
The encoded path attempts to access /etc/passwd via traversal.
B
Command Injection
Why wrong: No command syntax observed.
C
SQL Injection
Why wrong: No SQL syntax observed.
D
Cross-Site Scripting
Why wrong: No script tags or malicious HTML.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Introduction to Ethical Hacking explanation →

You are a penetration tester hired by a financial services company to assess the security of their external web application. The application is a customer portal hosted on a Linux server with Apache 2.4.6 and PHP 7.2. During reconnaissance, you discover that the server responds to HTTP OPTIONS requests and the Allow header includes PUT and DELETE methods. The application uses a MySQL database backend. You also find a file upload feature in the profile section that accepts JPEG images. While testing, you notice that uploading a file with a .php extension returns a '403 Forbidden' error, but uploading a file with .php5 or .phtml extension succeeds. The uploaded files are stored in /uploads/ directory. What should be your next step to escalate the attack?

Trap 1: Use the PUT method to upload a malicious file directly to the web…

PUT may be disabled or restricted; the Allow header may be misleading.

Trap 2: Exploit the IIS WebDAV vulnerability to execute commands.

The server is Apache, not IIS.

Trap 3: Attempt SQL injection in the login form to extract database…

No evidence of SQL injection vulnerability yet.

Study all Introduction to Ethical Hacking common traps →

A
Use the PUT method to upload a malicious file directly to the web root.
Why wrong: PUT may be disabled or restricted; the Allow header may be misleading.
B
Upload a PHP web shell with .phtml extension and access it via the /uploads/ directory to execute commands.
This leverages the upload bypass to achieve code execution.
C
Exploit the IIS WebDAV vulnerability to execute commands.
Why wrong: The server is Apache, not IIS.
D
Attempt SQL injection in the login form to extract database credentials.
Why wrong: No evidence of SQL injection vulnerability yet.

Full breakdown with real-world context →

Question 10mediumdrag order

Read the full Introduction to Ethical Hacking explanation →

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediumdrag order

Read the full Introduction to Ethical Hacking explanation →

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Read the full Introduction to Ethical Hacking explanation →

Match each network protocol to its well-known port number.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

443

3389

Question 13mediummatching

Read the full Introduction to Ethical Hacking explanation →

Match each IDS/IPS term to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Alert on benign activity

Failing to detect an actual attack

Detects known attack patterns

Detects deviations from normal behavior

Decoy system to attract attackers

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Introduction to Ethical Hacking sessions

Start a Introduction to Ethical Hacking only practice session

Every question in these sessions is drawn from the Introduction to Ethical Hacking domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Introduction to Ethical Hacking questions →Mixed CEH session

Frequently asked questions

What does the CEH exam test about Introduction to Ethical Hacking?: Introduction to Ethical Hacking questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Introduction to Ethical Hacking questions in a focused session?: Yes — the session launcher on this page draws every question from the Introduction to Ethical Hacking domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CEH topics?: Use the topic links above to move to related areas, or go back to the CEH question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CEH exam covers. They are not copied from any real exam or dump site.

Introduction to Ethical Hacking only

10 questions 20 questions 30 questions 50 questions

Mixed CEH session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CEH questions Introduction to Ethical Hacking domain overview CEH exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Introduction to Ethical Hacking practice questions

What to know about Introduction to Ethical Hacking

Common Introduction to Ethical Hacking exam traps

Introduction to Ethical Hacking questions

A security analyst suspects that an attacker is scanning their network. They notice a large number of TCP SYN packets being sent to various ports on a single host, but no SYN-ACK responses are returned. Which type of scan is most likely being used?

During a penetration test, an ethical hacker needs to evade an IDS that detects port scans based on the number of packets per second. Which technique would be most effective to avoid detection?

A company wants to test the security of its web application by simulating attacks from an external perspective. They have no prior knowledge of the internal network or application architecture. Which type of test should they perform?

Which TWO of the following are recognized phases of the Ethical Hacking process? (Select TWO.)

Refer to the exhibit. An ethical hacker runs the shown Nmap scan against a target. Which port state indicates that the port is reachable but no service is listening?

Exhibit

Which THREE of the following are essential phases in the ethical hacking methodology as defined by EC-Council?

Based on the exhibit, what type of attack is being attempted?

Exhibit

Drag and drop the steps to perform a TCP three-way handshake into the correct order.

Drag and drop the steps to set up a reverse shell using Netcat into the correct order.

Match each network protocol to its well-known port number.

Match each IDS/IPS term to its meaning.

Track your progress over time

Start a Introduction to Ethical Hacking only practice session

Related CEH topic practice pages

Footprinting, Reconnaissance and Scanning practice questions

Enumeration and System Hacking practice questions

Malware, Social Engineering and Network Attacks practice questions

Web Application and Injection Attacks practice questions