CEH Introduction to Ethical Hacking Practice Question
You are an ethical hacker hired to assess the security of a mid-sized company's internal network. The company has three departments: Sales, Engineering, and HR, each on separate VLANs. The network uses a single firewall with default-deny rules, but inter-VLAN routing is allowed for specific ports (e.g., HR needs to access Sales database on TCP 1433). During reconnaissance, you discover that the Engineering VLAN has a web server running on port 80 that is accessible from all VLANs. You also find that the Sales VLAN has a file share (SMB) on port 445 that is accessible only from HR. The firewall logs show numerous failed SSH attempts from an external IP to the Engineering web server. Which action should you recommend as the most effective immediate step to reduce the attack surface?
⚠ Common exam trap
The trap here is that candidates focus on the external SSH attacks (which are irrelevant to internal VLAN exposure) and choose patching or authentication improvements, missing that the core issue is unnecessary network-level access from other internal segments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict access to the Engineering web server to only the Engineering VLAN.
The Engineering web server is unnecessarily exposed to all VLANs, including potentially compromised segments. By restricting access to only the Engineering VLAN, you eliminate the attack surface from the Sales and HR VLANs, which is the most immediate and effective reduction in exposure. This aligns with the principle of least privilege and network segmentation, directly mitigating the risk of lateral movement from other VLANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a password policy requiring complex passwords for all users.
Why it's wrong here
Implementing a strong password policy is a fundamental security practice that enhances user authentication by making brute-force and dictionary attacks more difficult. However, this measure primarily protects against unauthorized login attempts once an attacker has already established network connectivity to the server. It does not address the underlying issue of the web server being unnecessarily exposed and reachable from all VLANs across the network, which is a network access control problem.
- ✗
Enable two-factor authentication on the web server.
Why it's wrong here
Enabling two-factor authentication significantly strengthens the authentication process by requiring a second verification factor beyond just a password, thereby mitigating risks from compromised credentials. Nevertheless, 2FA operates at the application or service login layer and does not restrict the initial network access path to the web server itself. The server remains broadly accessible from every VLAN, allowing any device to attempt connection and potentially discover other vulnerabilities before authentication even occurs.
- ✗
Apply the latest security patches to the web server.
Why it's wrong here
Applying the latest security patches is crucial for mitigating known vulnerabilities within the web server's operating system and applications, preventing exploitation by attackers. While essential for maintaining a secure posture, patching does not inherently reduce the network exposure of the server. The server would still be broadly accessible from all VLANs, meaning any potential attacker on the network could still reach it and probe for zero-day exploits or misconfigurations, even if all known vulnerabilities are addressed.
- ✓
Restrict access to the Engineering web server to only the Engineering VLAN.
Why this is correct
Restricting access to the Engineering web server solely to the Engineering VLAN directly implements the principle of least privilege at the network layer. This action significantly reduces the attack surface by ensuring the server is only reachable by authorized clients within its designated operational segment. By preventing unnecessary network connectivity from other VLANs, it drastically limits the opportunities for unauthorized reconnaissance and exploitation attempts, regardless of the server's internal security controls.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.