CEH Practice Exam Part 3 – Certified Ethical Hacker Questions
Boost your CEH exam readiness with this practice test focusing on key Certified Ethical Hacker concepts. Follow CertPunch for more practice questions and visit certpunch.com for full courses.
Chapters:
00:00 Intro
00:17 Question 1 of 30
01:05 Question 2 of 30
02:48 Question 3 of 30
04:00 Question 4 of 30
05:01 Question 5 of 30
06:41 Question 6 of 30
08:17 Question 7 of 30
09:39 Question 8 of 30
11:17 Question 9 of 30
12:11 Question 10 of 30
13:53 Question 11 of 30
15:23 Question 12 of 30
16:52 Question 13 of 30
18:49 Question 14 of 30
20:31 Question 15 of 30
21:55 Question 16 of 30
23:04 Question 17 of 30
23:46 Question 18 of 30
24:58 Question 19 of 30
25:54 Question 20 of 30
26:58 Question 21 of 30
28:29 Question 22 of 30
29:31 Question 23 of 30
30:23 Question 24 of 30
31:45 Question 25 of 30
33:14 Question 26 of 30
34:32 Question 27 of 30
35:46 Question 28 of 30
36:23 Question 29 of 30
38:34 Question 30 of 30
What you will practice
- Which of the following is the structure designed to verify and authenticate the identity of individuals withi…
- While conducting a thorough reconnaissance operation on a potential threat actor's digital footprint, an ethi…
- While performing online banking using a Web browser, a user receives an email that contains a link to an inte…
- A cybersecurity analyst notices that a large number of plaintext-ciphertext pairs were used in an attempted a…
- You are a Certified Ethical Hacker hired by a financial institution to assess the robustness of its web appli…
- At DEF Corporation, as you dive deeper into the vulnerability analysis of their multi-tiered web applications…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?
Answer: D. PKI
The answer is correct because PKI uses certificates and keys to verify identities in a data exchange. The trap is confusing it with an authentication method like SSO.
Q2. While conducting a thorough reconnaissance operation on a potential threat actor's digital footprint, an ethical hacker working for a cybersecurity firm stumbled upon an interesting discovery. The threat actor appeared to have left a serie…
Answer: B. Directly interacting with the threat actor on the forums using a pseudonym to gain more information about their plans.
Direct interaction risks alerting the threat actor and compromising the investigation. Passive methods like archives and Tor are safer for reconnaissance.
Q3. While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a pian…
Answer: C. Cross-Site Request Forgery
CSRF forces an authenticated user to perform unwanted actions on a web application. Clickjacking involves a visible UI element, not a form submission.
Q4. A cybersecurity analyst notices that a large number of plaintext-ciphertext pairs were used in an attempted attack against a block cipher. The attacker applied statistical analysis to XOR combinations of specific plaintext and ciphertext b…
Answer: D. Deriving linear patterns from cipher behavior
Linear cryptanalysis exploits statistical patterns in cipher behavior. This is distinct from brute-forcing keys or analyzing input differences.
Q5. You are a Certified Ethical Hacker hired by a financial institution to assess the robustness of its web application security. In your penetration testing, you are particularly focused on exploiting vulnerabilities related to session manage…
Answer: A. Utilize Session Fixation to manipulate a user into utilizing a session ID that an attacker already has access to.
Session Fixation is correct because it manipulates a user into using an attacker-controlled session ID, bypassing advanced security like MFA and WAF.
Q6. At DEF Corporation, as you dive deeper into the vulnerability analysis of their multi-tiered web applications, you observe an anomaly. Some encrypted user session tokens appear to be much longer than others, hinting at possible variable en…
Answer: C. Implement uniform encryption strength across all user roles, eliminating disparities in session token lengths.
Uniform encryption strength eliminates token length disparities, preventing cryptographic attacks on privileged sessions, making C the best fix.
Q7. You are a new IT intern at a local tech company. The company has a strong focus on cybersecurity and regularly hires ethical hackers to maintain its security posture. You come across the term 'black box testing' in a company document. Unce…
Answer: D. It involves the ethical hacker trying to break into a system without any prior knowledge about the system.
Black box testing is correct because it simulates an attacker with no prior knowledge of the system, making option D accurate.
Q8. You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side…
Answer: D. Disable JavaScript in the browser and proceed to submit weaker passwords and invalid CAPTCHAs.
Disabling JavaScript bypasses client-side checks without server alerts. This tests client-side validation bypassing, a core hacking technique.
Q9. A cloud provider faced a situation where one customer's malicious activity affected the organization's reputation and service delivery. Which security control would have most effectively prevented this issue?
Answer: D. Assessing multi-tenant isolation techniques
Multi-tenant isolation prevents one customer's malicious activity from affecting others in the cloud. This is a fundamental cloud security principle.
Q10. During an internal security audit, the cybersecurity team at a large healthcare organization detects abnormal patterns in DNS resolution behavior on the corporate internal network. Several employees report that when they attempt to visit l…
Answer: C. Intranet DNS poisoning via local spoofed responses
Intranet DNS poisoning uses local spoofed responses to redirect internal traffic. The ARP spoofing and DNS response speeds confirm this attack vector.
Q11. In a healthcare organization, the network security team detects unusual network activity, indicating advanced sniffing techniques used by a potential attacker. Upon investigation, it's found that the attacker exploits vulnerabilities in me…
Answer: D. Exploiting MRI machine firmware vulnerabilities to intercept real-time patient scans.
Exploiting firmware vulnerabilities in medical devices is a sophisticated sniffing attack. This tests knowledge of medical device security and sniffing.
Q12. As a cybersecurity analyst working for a multinational corporation, you are tasked with the responsibility of conducting routine vulnerability scans. This time around, you decided to use a different strategy and opted to employ a FIN scan…
Answer: D. Consider the possibility of firewall blocking the FIN packets and investigate further.
FIN scans are blocked by firewalls, which would prevent response. This is a common security measure, not a breach or congestion issue.
Q13. As a cybersecurity analyst at XYZ Corp., you're examining system logs and notice an array of activities that suggest the presence of an elusive rootkit. Given the stealthy nature of rootkits, their detection and eradication are pivotal to…
Answer: A. Employ a systematic, multi-layered strategy, starting with the deployment of a specialized rootkit detection tool to verify the presence and type of rootkit, followed by an appropriately tailored removal procedure, specific to the identified rootkit.
Systematic detection and tailored removal remove the rootkit effectively. Formatting is extreme, and honeypots are for detection, not remediation.
Q14. You are a cybersecurity analyst at a tech startup that provides cloud-based services to its clients. Recently, your team detected suspicious activity on one of your critical servers. After further investigation, you discovered an unauthori…
Answer: A. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network.
Real-time analysis allows for targeted containment. Powering down disrupts services unnecessarily, and forensics come after containment.
Q15. A global media streaming platform is experiencing periodic traffic surges every 10 minutes, severely degrading performance and leading to widespread buffering issues. Traffic analysis reveals intermittent spikes exceeding 300 Gbps, followe…
Answer: C. A Pulse Wave attack leveraging high-volume short bursts to overwhelm network resources.
Pulse Wave attacks use short bursts to overwhelm resources. Continuous floods and PDoS are different, with PDoS targeting hardware.
Q16. In a recent penetration testing assignment, you were able to breach a servers web service and install a backdoor. Your aim is to maintain access for as long as possible without getting detected. Considering the web server countermeasures e…
Answer: A. Install the backdoor on a non-web file referenced in a URL.
Placing a backdoor in a non-web file avoids detection by web scanners. Increasing size may trigger anomaly detection, and regular updates can remove it.
Q17. Which is the first step followed by Vulnerability Scanners for scanning a network?
Answer: B. Checking if the remote host is alive
Checking if the remote host is alive confirms reachability before scanning. Other steps depend on this initial verification.
Q18. As an IT professional, you are attending a webinar on cybersecurity. The presenter emphasizes the importance of ethical hacking and the different types of hackers involved in the cyber world. Suddenly, the term "script kiddie" is mentioned…
Answer: B. They are novices in the hacking world who mainly use scripts and codes developed by others.
Script kiddies are novices who use pre-existing scripts instead of writing their own. They lack advanced technical skills.
Q19. During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this…
Answer: C. Enforcing timely user de-provisioning
Timely user de-provisioning promptly revokes access when an employee leaves. This directly prevents former employees from retaining access.
Q20. A penetration tester is conducting a security assessment and needs to identify live hosts on a target network without triggering intrusion detection systems. The tester decides to use a technique that sends specially crafted packets to det…
Answer: D. TCP SYN scan on all ports
TCP SYN scan is stealthy as it doesn't complete the handshake, minimizing IDS detection while identifying live hosts.
Q21. A Certified Ethical Hacker (CEH) is investigating a recent attack on a company's web server. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server's document…
Answer: D. Implementing DNSSEC on the DNS server
DNSSEC digitally signs DNS records to prevent hijacking by ensuring the integrity and authenticity of responses.
Q22. You are a cybersecurity analyst at a financial institution. Your company has a strict policy against any unencrypted protocols. You've noticed some data packets being sent via HTTP rather than HTTPS on the network. This raises your concern…
Answer: D. Wireshark
Wireshark is a packet sniffer that can analyze HTTP traffic in plaintext to investigate unencrypted protocols.
Q23. A company's customer data stored in a cloud environment has been exposed due to an unknown vulnerability. Which of the following types of attack most likely led to this incident? Correct answer
Answer: A. Side-channel attack on the hypervisor
A hypervisor side-channel attack directly compromises cloud infrastructure security, which is a core CEH concern for virtualized environments.
Q24. Working as an Information Security Analyst at a technology firm, you've been asked to design training material for employees about the potential dangers of session hijacking. As part of the training, you want to explain how attackers could…
Answer: C. An attacker intercepts network traffic, captures unencrypted session cookies, and uses these to impersonate the user.
Sidejacking involves intercepting unencrypted session cookies to impersonate users, a classic session hijacking attack.
Q25. A multinational company is planning to integrate an IoT-based environmental control system for its manufacturing units worldwide. They engage a cybersecurity team to ensure that the new system remains secure from any potential threats. The…
Answer: D. The APT group will exploit zero-day vulnerabilities present in the IoT device firmware.
Zero-day exploits in IoT firmware are a primary APT attack vector for unpatched systems.
Q26. Harper, a software engineer, is developing an email application. To ensure the confidentiality of email messages, Harper uses a symmetric-key block cipher having a classical 12- or 16-round Feistel network with a block size of 64 bits for…
Answer: A. CAST-128
The described Feistel structure with 64-bit blocks and specific S-boxes matches the CAST-128 algorithm.
Q27. You have been hired by a government agency to evaluate Android smartphones' resistance against covert surveillance. During your assessment, you want to demonstrate whether attackers could eavesdrop on sensitive conversations conducted thro…
Answer: A. Spearphone attack exploiting accelerometer-based vulnerabilities.
Spearphone uses the accelerometer to capture audio vibrations from the loudspeaker without special permissions.
Q28. Which type of malware replicates itself without human intervention to spread across a network?
Answer: D. Worm
Worms self-replicate and spread across networks without human intervention, unlike other malware types.
Q29. You are currently serving as a cybersecurity analyst at a global banking corporation. Your team has recently identified a series of irregular incidents that indicate a potential backdoor attack on the company's intricate network system. So…
Answer: C. Perform detailed monitoring of system and file activity, incorporate anomaly detection techniques in the security framework, and utilize advanced anti-malware tools for comprehensive system scans.
Monitoring system activity and using anomaly detection is key for backdoor identification, as backdoors often exhibit abnormal behavior.
Q30. As a security expert for a prominent tech company, you've noticed an increasing number of attacks on your web services. You've concluded that the best course of action is to enhance your patch management strategies. Considering the informa…
Answer: D. Implementing an automatic patch management process and using a patch management tool to monitor the patched systems.
Automated patch management is the most effective strategy for efficient and timely security updates.
More CEH drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.