What is the CVSS severity level for a score of 9.5?

Correct answer: C. Critical. A CVSS score of 9.5 is classified as Critical, making option C the correct answer.

As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The company has been facing persistent cyber threats and as a precautionary measure, you are tas…

Correct answer: A. Stealth Scan (SYN Scan). A SYN scan is the correct answer because it initiates a TCP connection without completing the handshake, making it stealthy and less likely to trigger an IDS.

As a senior cybersecurity professional at a multinational bank, you are investigating an incident where multiple systems have been infected with malware. On the affected systems, the malware remains…

Correct answer: C. Polymorphic Malware: Employ advanced threat detection tools that use behavior-based detection techniques and ensure all systems are patched.. Polymorphic malware is correct because it changes its code to avoid detection, and behavior-based detection is the best mitigation strategy.

Which of the following tactics uses malicious code to redirect users' web traffic? Correct answer

Correct answer: A. Pharming. Pharming is the correct answer as it uses malicious code to redirect web traffic to fraudulent sites.

At XYZ Corporation, a multinational firm known for its digital services, the cybersecurity team is tasked with ensuring a robust, secure network environment. This responsibility includes maintaining…

Correct answer: C. Swiftly apply a virtual patch to the affected web server using a web application firewall to temporarily safeguard against potential exploits.. Applying a virtual patch via a WAF is the correct first step to temporarily block exploits of a zero-day vulnerability.

You are a cybersecurity consultant at a large healthcare organization. As part of your responsibilities, you are tasked with making sure the company's systems are secure from various attacks. Recentl…

Correct answer: C. The attacker splits malicious data packets into smaller segments to avoid detection.. Packet fragmentation is the correct answer because it allows an attacker to split malicious traffic into smaller segments to evade IDS detection.

A system analyst wants to implement an encryption solution that allows safe key distribution. Which encryption method should the analyst consider?

Correct answer: C. Asymmetric encryption. Asymmetric encryption is correct because it uses a public key for distribution while keeping the private key secure.

You're a security analyst conducting a foot printing exercise for a new client to uncover as much information as possible without direct interaction. Your preliminary investigation using search engin…

Correct answer: C. Google Hacking can help identify weaknesses in the client's website code.. Google Hacking is correct because it can find vulnerabilities in website code by searching for specific error messages or file types.

As a certified ethical hacker, you have been engaged to evaluate the security protocols of a smart city project. This cutting-edge venture incorporates an interconnected system featuring intelligent…

Correct answer: B. Isolate the implicated traffic light from the overarching network for a detailed investigation into its firmware to identify any possible security breaches.. Isolating the device is correct to contain the breach and prevent further compromise while investigating the firmware.

You are a security consultant who has been hired to conduct security awareness training at a mid-sized organization. During the session on social engineering, you emphasize the importance of being vi…

Correct answer: C. A person gains access to the building by following an employee through a secure door before it closes.. Following an employee through a secure door is correct as it is the definition of a tailgating physical security attack.

CEH Practice Test – 148 Free Exam Questions with Answers

CEH

148 questions · instant answer feedback · concise explanations · free

Question 1 of 148What is the CVSS severity level for a score of 9.5?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Critical
A CVSS score of 9.5 is classified as Critical, making option C the correct answer.
Question 2 of 148As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The company has been facing persistent cyber threats and as a precautionary measure, you are tasked to conduct a thorough network vulnerability assessment. Your key objective is to efficiently map out all open ports and associated services in the organization's expansive network. Simultaneously, it's of paramount importance that your activities remain stealthy and do not trigger the advanced intrusion detection systems (IDS) employed by the organization. Given these requirements, which scanning technique would you opt for to achieve your task with maximum efficacy and discretion? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Stealth Scan (SYN Scan)
A SYN scan is the correct answer because it initiates a TCP connection without completing the handshake, making it stealthy and less likely to trigger an IDS.
Question 3 of 148As a senior cybersecurity professional at a multinational bank, you are investigating an incident where multiple systems have been infected with malware. On the affected systems, the malware remains dormant until a specific action triggers its malicious activity. The malware has also shown signs of being able to avoid detection by changing its code or encryption each time it infects a new. Based on these characteristics, which type of malware is likely causing this problem, and what is the best method to mitigate its impact?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Polymorphic Malware: Employ advanced threat detection tools that use behavior-based detection techniques and ensure all systems are patched.
Polymorphic malware is correct because it changes its code to avoid detection, and behavior-based detection is the best mitigation strategy.
Question 4 of 148Which of the following tactics uses malicious code to redirect users' web traffic? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Pharming
Pharming is the correct answer as it uses malicious code to redirect web traffic to fraudulent sites.
Question 5 of 148At XYZ Corporation, a multinational firm known for its digital services, the cybersecurity team is tasked with ensuring a robust, secure network environment. This responsibility includes maintaining a keen focus on vulnerability assessment and patch management strategies to guard against potential threats, including the increasingly prevalent zero-day attacks. Recent intelligence has alerted the team to a concerning issue: the primary web server software that the corporation relies on for its critical operations has been hit with a newly discovered zero-day vulnerability. Alarmingly, this vulnerability is not just theoretical; active exploitations of this vulnerability have been spotted in the wild, making the threat immediate and real. However, the vendor of the software, caught off guard by the discovery, has not yet released an official patch to mitigate this vulnerability. Given these circumstances, what is the FIRST step that the cybersecurity team at XYZ Corporation should undertake to manage the significant risk posed by this unpatched zero-day vulnerability?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Swiftly apply a virtual patch to the affected web server using a web application firewall to temporarily safeguard against potential exploits.
Applying a virtual patch via a WAF is the correct first step to temporarily block exploits of a zero-day vulnerability.
Question 6 of 148You are a cybersecurity consultant at a large healthcare organization. As part of your responsibilities, you are tasked with making sure the company's systems are secure from various attacks. Recently, you've noticed some unusual traffic patterns that suggest someone might be trying to evade the company's Intrusion Detection System (IDS). Which of the following techniques would most likely be used by an attacker in an attempt to evade detection by the IDS?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The attacker splits malicious data packets into smaller segments to avoid detection.
Packet fragmentation is the correct answer because it allows an attacker to split malicious traffic into smaller segments to evade IDS detection.
Question 7 of 148A system analyst wants to implement an encryption solution that allows safe key distribution. Which encryption method should the analyst consider?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Asymmetric encryption
Asymmetric encryption is correct because it uses a public key for distribution while keeping the private key secure.
Question 8 of 148You're a security analyst conducting a foot printing exercise for a new client to uncover as much information as possible without direct interaction. Your preliminary investigation using search engines and public databases has provided a significant amount of data about the organization's online presence. You are now considering using Google Hacking techniques to find further vulnerabilities. Which of the following could best justify this decision?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Google Hacking can help identify weaknesses in the client's website code.
Google Hacking is correct because it can find vulnerabilities in website code by searching for specific error messages or file types.
Question 9 of 148As a certified ethical hacker, you have been engaged to evaluate the security protocols of a smart city project. This cutting-edge venture incorporates an interconnected system featuring intelligent traffic lights, public Wi-Fi points, and advanced water management facilities. Upon evaluating the IoT network's logs, you stumble upon anomalous traffic patterns, signifying a high volume of data exchange between a particular traffic light and an external IP address. Your further investigation reveals that this traffic light has an inexplicably open port. Given the gravity of these revelations, what would be your subsequent course of action?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Isolate the implicated traffic light from the overarching network for a detailed investigation into its firmware to identify any possible security breaches.
Isolating the device is correct to contain the breach and prevent further compromise while investigating the firmware.
Question 10 of 148You are a security consultant who has been hired to conduct security awareness training at a mid-sized organization. During the session on social engineering, you emphasize the importance of being vigilant against different types of social engineering attacks. Which of the following scenarios best describes a tailgating social engineering attack?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. A person gains access to the building by following an employee through a secure door before it closes.
Following an employee through a secure door is correct as it is the definition of a tailgating physical security attack.
Question 11 of 148As a recent graduate, you've landed your first job as a junior cybersecurity analyst for a local company. Your team leader is explaining the different types of hackers and their motivations. He mentions the term "hacktivist". According to the information you recall from your CEH v12 study material, which of the following best describes a hacktivist? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A hacker who uses their skills to promote a political agenda or a social cause, often by launching attacks against systems to draw attention to their cause.
The option promoting a political agenda is correct because hacktivists use cyber attacks to raise awareness for social causes.
Question 12 of 148An attacker examines differences in ciphertext outputs resulting from small changes in the input to deduce key patterns in a symmetric algorithm. What method is being employed?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Differential cryptanalysis on input-output differences
Differential cryptanalysis analyzes how small input changes affect ciphertext to reveal key patterns.
Question 13 of 148A tester evaluates a login form that constructs SQL queries using unsanitized user input. By submitting ' OR '1'='1';–, the tester gains unauthorized access to the application. What type of SQL injection has occurred?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Tautology-based SQL injection
The correct answer is right because a tautology like '1=1' always evaluates true, bypassing authentication checks.
Question 14 of 148During a routine security audit, administrators found that cloud storage backups were illegally accessed and modified. What countermeasure would most directly mitigate such incidents in the future?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Adopting the 3-2-1 backup model.
The 3-2-1 backup model directly prevents unauthorized access through redundancy and off-site storage. SQL injection and auto-scaling are irrelevant.
Question 15 of 148Scenario: 1. Victim opens the attacker's web site. 2. Attacker sets up a web site which contains interesting and attractive content like 'Do you want to make $1000 in a day?'. 3. Victim clicks to the interesting and attractive content URL. 4. Attacker creates a transparent 'iframe' in front of the URL which the victim attempts to click, so the victim thinks that he/she clicks on the 'Do you want to make$1000 in a day?' URL but actually he/she clicks on the content or URL that exists in the transparent 'iframe' which is setup by the attacker. What is the name of the attack which is mentioned in the scenario? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Clickjacking Attack
Clickjacking is correct as it uses transparent iframes to mislead clicks. Session fixation and HTML injection are different attack types.
Question 16 of 148To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https. Which of the following firewall rules meets this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 443) then permit
Rule D correctly specifies source, destination, and port 443 for HTTPS. Rule B incorrectly allows HTTP, and rules A and C have syntax errors.
Question 17 of 148Which protocol uses port 443 by default?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. HTTPS
The answer is correct as HTTPS uses port 443 for encrypted web traffic. All other options use different ports.
Question 18 of 148Which tool is used to capture and analyze network traffic in real-time?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Wireshark
Wireshark is the correct answer as it is the standard tool for capturing and analyzing network traffic in real-time.
Question 19 of 148After a recent breach, your team discovers that attackers used modified versions of legitimate system utilities and a Windows service to persist undetected for weeks, accessing internal credentials. What key step can be taken to better protect against similar future threats? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Monitor file hashes of sensitive executables for unauthorized changes.
The answer is correct because monitoring file hashes detects unauthorized changes to legitimate tools, preventing persistence. The other options are recovery or perimeter controls.
Question 20 of 148A future-focused security audit discusses risks where attackers collect encrypted data now, anticipating that they can decrypt it later with quantum computers. What is this threat known as?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Saving data today for future quantum decryption
This is the definition of a harvest-now-decrypt-later attack. Attackers store encrypted data for future decryption by quantum computers.
Question 21 of 148As a cybersecurity consultant, you are helping a small startup strengthen its information security awareness. During an internal audit, an employee reports finding a USB drive labeled "Employee Salary Info 2024" in the company parking lot. Curious, they plugged it into their office computer, after which the system began behaving erratically. What kind of social engineering attack does this scenario represent?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Tempting the victim to engage with a malicious device using curiosity.
This is baiting, where curiosity tempts victims to interact with a malicious device, making option B the clear choice.
Question 22 of 148Identify the web application attack where attackers inject client-side scripts into web pages viewed by other users.
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) is correct because it involves injecting malicious scripts into web pages viewed by other users.
Question 23 of 148You are a new member of your company's IT team, and you've been assigned to understand and implement ethical hacking principles to improve the company's cybersecurity posture. Your supervisor highlights the importance of following the five phases of ethical hacking. What is the correct order of these phases?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks
The correct order is Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks, making option D right.
Question 24 of 148A security analyst working for a large financial corporation has been assigned to conduct a comprehensive penetration test on the corporation's wireless infrastructure. The infrastructure relies on a secured WPA2-PSK-secured network to ensure data protection. During the course of the examination, the analyst discerned a significant vulnerability within the network that could potentially be exploited. Which of the subsequent options most accurately delineates the procedure that the analyst might have employed to pinpoint this particular vulnerability?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The analyst instigated a de-authentication attack, purposely causing a mass disconnection of all clients from the access point. The analyst then attentively observed the four-way handshake process that occurred during the clients' reconnection attempts.
A de-authentication attack captures the four-way handshake to test WPA2-PSK security. This is a standard wireless penetration testing technique.
Question 25 of 148What is the purpose of an 'Exit Node' in the Tor network?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. It is the final node that decrypts traffic and sends it to the destination
The exit node is the final hop that decrypts and sends traffic to the destination. It is a key concept in understanding Tor's anonymity model.
Question 26 of 148An attacker redirects a user to a malicious website by modifying their local hosts file. What is this called?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Pharming
Modifying a local hosts file to redirect a user is a classic pharming attack. This tests knowledge of social engineering and DNS manipulation.
Question 27 of 148As a security analyst, you're investigating an incident where an attacker was able to gain access to your network. Upon initial examination of the log files, you noticed a large number of TCP SYN packets sent to various ports on the network but with no corresponding ACKs. What type of scanning technique do you think the attacker may have used?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. The attacker has used a SYN scan, also known as half-open scanning, which involves sending SYN packets and waiting for SYN/ACK responses.
A SYN scan, or half-open scan, sends SYN packets without completing the handshake. This is a common stealthy port scanning technique.
Question 28 of 148Jim's company regularly performs backups of their critical servers. But the company cannot afford to send backup tapes to an off-site vendor for long-term storage and archiving. Instead, Jim's company keeps the backup tapes in a safe in the office. Jim's company is audited each year, and the results from this year's audit show a risk because backup tapes are not stored off-site. The Manager of Information Technology has a plan to take the backup tapes home with him and wants to know what two things he can do to secure the backup tapes while in transit?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Encrypt the backup tapes and transport them in a lock box.
Encrypting backup tapes protects data confidentiality, while a lock box adds physical security during transit. Hashing is for integrity, not encryption.
Question 29 of 148A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. It is suspected to be a Bluesnarfing attack, aimed at accessing unauthorized information from Bluetooth-enabled devices. Which of the following would be the most effective countermeasure to prevent further unauthorized access?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Disable "Discoverable Mode" and activate "Non-discoverable Mode" on all Bluetooth devices.
Disabling discoverable mode prevents attackers from finding the device. Firmware updates and PINs are helpful but less direct against Bluesnarfing.
Question 30 of 148In a comprehensive penetration testing scenario, you are charged with the task of gaining detailed insights into a target organization's network configuration, structure, and security posture. To accomplish this task, you plan to employ a multitude of reconnaissance techniques, including an in-depth DNS interrogation. DNS interrogation can reveal various pieces of information that are invaluable to a penetration tester. However, there are certain limitations to the kind of data you can obtain directly through this method. Considering these restrictions, which among the following pieces of information CANNOT be directly obtained from an extensive DNS interrogation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The specific usernames and passwords used by the organization's employees.
DNS interrogation cannot reveal usernames or passwords. It provides domain, IP, and server information, but not user credentials.
Question 31 of 148In your role as a cybersecurity analyst at a large e-commerce company, you have been tasked with reinforcing the firm's defenses against potential Denial-of-Service (DoS) attacks. During a recent review, you noticed several IP addresses generating excessive traffic, causing an unnaturally high load on the server. An inspection of these packets revealed that the TCP three-way handshake was never completed, leaving multiple connections in a SYN_RECEIVED state. The intent appears to be the saturation of server resources without any genuine intent to establish a full connection. Given these details, what type of DoS attack is most likely being executed against the company's servers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. SYN Flood: This attack floods a target with SYN requests in an attempt to consume enough server resources to make the system unresponsive, aligning with the high volume of incomplete TCP handshakes.
A SYN flood exploits incomplete handshakes to overwhelm server resources. The description matches the attack vector perfectly.
Question 32 of 148An organization uses SHA-256 for data integrity checks but is still experiencing unauthorized data modification. Which cryptographic tool can help resolve this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Digital signatures
Digital signatures ensure data integrity by verifying that data hasn't been tampered with using cryptographic validation.
Question 33 of 148During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the following tactics best represents this scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Gaining physical access by assuming the identity of a trusted internal staff.
This scenario describes physical penetration testing through impersonation, a key CEH social engineering tactic.
Question 34 of 148You are tasked with assessing wireless network security for a corporation using WPA2 encryption. During the assessment, you identify vulnerabilities that could allow attackers to intercept and replay previously captured packets. Which WPA2 vulnerability is likely being exploited?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. KRACK vulnerabilities through key reinstallation.
KRACK exploits key reinstallation to decrypt WPA2 traffic, a well-documented wireless vulnerability.
Question 35 of 148You are a security administrator for a medium-sized company. Your manager has asked you to conduct an audit of the organization's security infrastructure. While reviewing the logs from the Intrusion Detection System (IDS), you notice that there have been several instances of alerts being triggered by regular user activities. Which of the following is the most likely reason for this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The IDS is configured with very high sensitivity settings, leading to many false positives.
High sensitivity in IDS causes false positives by flagging normal user activities as threats. This is a common configuration issue.
Question 36 of 148As a Certified Ethical Hacker, you have been approached by a leading international corporation to assess and enhance their cloud-based security framework. The corporation recently transitioned to a serverless computing architecture for its e-commerce application and experienced significant improvements in scalability and cost efficiency. However, they fell victim to an intricate attack where an unauthorized user manipulated their cloud service's function-as-a-service (FaaS) component to execute malicious commands. Your investigation revealed that the attack originated from an insecure third-party API used within one of the serverless functions. Given the attack's complexity, what would be your recommended countermeasure for strengthening the security posture?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Implementing a function-level permission model and enforcing the principle of least privilege.
Least privilege at the function level prevents unauthorized access in serverless architectures.
Question 37 of 148A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hide malicious activities? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Because BITS packets appear identical to normal Windows update traffic.
BITS mimics Windows update traffic to blend in with legitimate activity and evade detection.
Question 38 of 148During a cybersecurity training session at your organization, you present several hypothetical scenarios to the trainees to assess their understanding of social engineering threats. Which of these scenarios best describes a social engineering attack?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Sarah, a new recruit, receives a call from someone claiming to be from the IT department, who asks for her login credentials to solve a non-existing issue.
Impersonating IT to trick a user into revealing credentials is a classic social engineering attack.
Question 39 of 148During a black-box assessment, an attacker executes the Nmap command nmap -p25 –script smtp-enum-users –script-args smtp-enumusers.methods={VRFY, EXPN, RCPT). The script successfully returns multiple valid usernames. What server misconfiguration is being exploited?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. SMTP user verification commands are exposed without restrictions.
SMTP user enumeration commands like VRFY and EXPN are exposed without restrictions.
Question 40 of 148A red team operator is assessing the resilience of a corporate network's authentication infrastructure. They input valid usernames with specifically structured guesses based on prior intel about naming conventions, such as birthdates or favorite sports teams. The guesses are tailored and automated with logic-based iterations. Which technique best describes this targeted approach? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Strategic pattern-based input using known logic.
Using known logic and patterns for targeted username guesses is a strategic, non-exhaustive approach.
Question 41 of 148As a cybersecurity analyst at a renowned software corporation, you've noticed some peculiar activity. The company's internal network has seen a sudden increase in redundant network traffic and system crashes. Initial scans have found that most affected systems run a particular version of the operating system, and the identified malicious code seems to be self-replicating and spreading across the network autonomously. Considering the following malware types, which would you identify as the probable cause of this anomalous behavior? Furthermore, how would you prioritize your response to counteract this malware threat and alleviate the system disruptions?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Worm: Quarantine the affected systems, perform an immediate network-wide sweep with the latest antivirus definitions, and update the operating system on all network systems.
A worm is correct as it self-replicates across networks. The described symptoms and remediation align perfectly with worm behavior and containment.
Question 42 of 148During a red team engagement targeting a custom web application, a tester observes that the app takes a numeric id parameter from the URL and dynamically builds SQL queries. Suspecting SQL injection, the tester sends a crafted HTTP GET request like: Shortly after, the application throws database errors, and the team confirms that the users table has been removed from the backend database. Based on this behavior, which SQL injection method was most likely used?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The attacker executed a second malicious query alongside the first.
The attacker executed a second query to drop the table, a classic SQL injection technique for data destruction.
Question 43 of 148You are a cybersecurity trainer and are planning a course on ethical hacking for some newcomers in your organization. While creating the content, you recall from the CEH vl2 study material that there are different types of penetration tests. Which of the following best describes a black box penetration test?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The tester has no prior knowledge of the system to be tested.
A black box test simulates a real external attacker by providing no prior knowledge of the system.
Question 44 of 148During a routine security audit at a large financial services organization, the IT team detects severe network latency and recurring bandwidth exhaustion across its corporate WAN links. Upon deeper investigation, they discover that several employee workstations and IoT-connected devices are unknowingly transmitting enormous volumes of traffic to numerous external IP addresses. These devices, all exhibiting similar traffic patterns and command-response behaviors, are found to be under the control of a remote botnet operator. The incident raises serious concerns about insider-originated denial-of-service activity that is also affecting external entities. Which type of denial-of-service attack best describes the organization's current situation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. An attack where compromised internal devices participate in a botnet and flood external targets with traffic.
The correct answer is right because it describes a botnet-based DDoS attack where compromised internal devices flood external targets. The trap is confusing it with an amplification attack.
Question 45 of 148A red team operator is conducting reconnaissance on a financial organization's infrastructure. While probing UDP port 123, they send NTP queries and receive a list of internal IP addresses and connected hostnames. The organization is unaware that sensitive network details are exposed externally. What is the most likely reason for this information disclosure? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The NTP daemon is configured to accept queries from external sources without restriction.
The correct answer is right because an unrestricted NTP daemon allows external queries that leak internal IP and hostname information.
Question 46 of 148As an Ethical Hacker, you've been asked to test an application's vulnerability to SQL injection. In the process, you discover an entry field that appears susceptible. However, the backend database is unknown, and regular SQL injection techniques have so far failed to elicit useful information. Which advanced SQL injection technique should you apply next?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Time-Based Blind SQL Injection
The correct answer is right because time-based blind SQLi uses delays to extract info when other methods fail.
Question 47 of 148You work as a network security officer for a large corporation. Recently, you've noticed that certain confidential files are being accessed by unauthorized users within the network. You suspect that a Man-in-the- Middle (MitM) attack is being carried out. Which of the following network activities would help you confirm this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. IP addresses being resolved to multiple MAC addresses.
The correct answer is right because a single IP resolving to multiple MAC addresses indicates traffic interception.
Question 48 of 148Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to implant malicious backdoors in its firmware. He also identified that an installed backdoor can persist even if the server is reallocated to new clients or businesses that use it as an IaaS. What is the type of cloud attack that can be performed by exploiting the vulnerability discussed in the above scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Cloudborne attack
Cloudborne attack is correct as it involves exploiting cloud infrastructure like firmware for persistent backdoors. Other options describe different cloud threats.
Question 49 of 148In a highly secure online banking environment, customers have reported unauthorized access to their accounts despite robust authentication measures in place. Upon investigation, it is discovered that attackers are employing sophisticated session hijacking techniques to compromise user sessions and conduct fraudulent transactions. The security team is tasked with implementing effective countermeasures to prevent further unauthorized access and protect customer accounts. Considering the scenario described, which advanced session-hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of online banking transactions?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User Sessions
Man-in-the-Browser (MitB) is highly sophisticated as it uses malicious browser extensions for undetected session hijacking. XSS and sniffing are less advanced.
Question 50 of 148As the newly appointed head of IT security at a growing startup, you have been tasked with improving the company's security posture. Given the rise in social engineering attacks, you decide to set up training sessions for employees to help them identify these threats. During a session, you ask the team to identify the type of social engineering attack where an attacker impersonates a co-worker or an authority figure to extract confidential information. Which option correctly identifies this type of attack?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Pretexting
Pretexting is correct as it involves impersonating someone for information. Baiting, phishing, and quid pro quo are different social engineering methods.
Question 51 of 148During a penetration test, a security analyst encounters a web page that returns identical generic error messages regardless of input. To test for SQL injection, they submit a query that includes AND 1=1 and later AND 1=2, observing a change in the page content. What type of injection is being tested?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The analyst is using conditional logic to infer database behavior from page responses.
Conditional logic in the queries infers database behavior from page responses, defining a boolean-based SQL injection attack.
Question 52 of 148A penetration tester intercepts HTTP requests between a user and a vulnerable web server. The tester observes that the session ID is embedded in the URL, and the web application does not regenerate the session upon login. Which session hijacking technique is most likely to succeed in this scenario? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Session fixation by pre-setting the token in a URL.
Session fixation succeeds because the attacker can pre-set the session ID in the URL since it's not regenerated.
Question 53 of 148In her role as a cybersecurity analyst for an established technology firm, Maria is assigned a crucial task. She's instructed to perform a thorough passive reconnaissance of a major competitor's online environment to understand their digital strategies better. The challenge, however, is to gather as much relevant information as she can without directly interacting with the competitor's systems or alerting them to her activities, to avoid any potential legal implications. Given these constraints and the sensitive nature of her assignment, which of the following tools or methods would be least appropriate and potentially risky for Maria to employ in her task?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Running an intensive port scan against the competitor's public IP addresses to gain information on their internal network and server structure.
Port scanning is active and intrusive, risking detection and legal issues, unlike passive reconnaissance methods.
Question 54 of 148An attacker performs DNS cache snooping using the dig command with the +norecurse flag against a known DNS server. The server returns NOERROR but provides no answer to the query. What does this most likely suggest? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. No client from the DNS server's network has recently accessed the domain.
The NOERROR response with no answer indicates the DNS server's cache lacks recent entries for the domain, meaning no clients from its network have accessed it recently.
Question 55 of 148You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist's email, and you send her an email changing the source email to her boss's email (boss@company). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don't work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network. What testing method did you use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Social engineering
The attacker used social engineering by impersonating a boss to manipulate the receptionist into opening malicious links and executing malware.
Question 56 of 148A red team simulation reveals a malware strain that adapts its behavior based on observed user activity and evades detection by altering its code dynamically. The malware exfiltrates data only when the system is idle and uses encrypted channels for communication. Based on these traits, what is the most probable nature of this malware?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. AI-powered malware using machine learning to tailor its execution.
The malware's adaptive behavior and evasion techniques suggest it uses machine learning to optimize its execution based on user activity.
Question 57 of 148A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do next to understand the potential impact? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Extract and analyze stream objects using PDFStreamDumper.
Extracting stream objects with PDFStreamDumper reveals hidden malicious scripts and embedded content to assess the PDF's attack potential.
Question 58 of 148A large media-streaming company begins receiving complaints from users that their web application is timing out or failing to load. The security team observes that the web server is overwhelmed with a high number of open HTTP connections, most of which appear to be legitimate but are transmitting data at an abnormally slow rate. These connections are never fully completed, causing the server's resources to remain occupied and unable to process new incoming client requests. The incident response team rules out bandwidth exhaustion and malformed packet-based attacks and suspects an application-layer DoS technique is responsible. Given the scenario, which specific type of attack is most likely being executed on the company's web application?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The attacker uses a Slowloris attack to keep many open connections alive, slowly exhausting the server's connection pool.
A Slowloris attack keeps connections open slowly, exhausting the server's resources, which matches the described symptoms.
Question 59 of 148Your role as a network administrator in a mid-sized company involves protecting the company's web servers from potential security threats. Recently, your company's web server experienced a Distributed Denial of Service (DDoS) attack. In explaining the situation to your team, you mention the attack specifically targeted the web server's application layer. Which type of DDoS attack was most likely used against your company's web server? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. HTTP flood attack
An HTTP flood attack targets the application layer by overwhelming the web server with HTTP requests.
Question 60 of 148During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outboundHTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Application
The answer is correct because an application firewall inspects the content of traffic, like distinguishing IRC from HTTP. The provided explanation is cut off.
Question 61 of 148Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. PKI
The answer is correct because PKI uses certificates and keys to verify identities in a data exchange. The trap is confusing it with an authentication method like SSO.
Question 62 of 148While conducting a thorough reconnaissance operation on a potential threat actor's digital footprint, an ethical hacker working for a cybersecurity firm stumbled upon an interesting discovery. The threat actor appeared to have left a series of digital breadcrumbs across various internet forums and hidden web pages, pointing to a potential future attack strategy. The ethical hacker, wanting to gather as much information as possible about the actor's potential strategy without tipping them off, has to make careful tool and technique choices. Which of the following approaches should the ethical hacker most likely avoid to maintain a low profile and avoid alerting the threat actor?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Directly interacting with the threat actor on the forums using a pseudonym to gain more information about their plans.
Direct interaction risks alerting the threat actor and compromising the investigation. Passive methods like archives and Tor are safer for reconnaissance.
Question 63 of 148While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts and displays a video of cats playing a piano. The next business day, the user receives what looks like an email from his bank, indicating that his bank account has been accessed from a foreign country. The email asks the user to call his bank and verify the authorization of a funds transfer that took place. What Web browser-based security vulnerability was exploited to compromise the user?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Cross-Site Request Forgery
CSRF forces an authenticated user to perform unwanted actions on a web application. Clickjacking involves a visible UI element, not a form submission.
Question 64 of 148A cybersecurity analyst notices that a large number of plaintext-ciphertext pairs were used in an attempted attack against a block cipher. The attacker applied statistical analysis to XOR combinations of specific plaintext and ciphertext bits. Which technique is the attacker likely using?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Deriving linear patterns from cipher behavior
Linear cryptanalysis exploits statistical patterns in cipher behavior. This is distinct from brute-forcing keys or analyzing input differences.
Question 65 of 148You are a Certified Ethical Hacker hired by a financial institution to assess the robustness of its web application security. In your penetration testing, you are particularly focused on exploiting vulnerabilities related to session management mechanisms. The web application uses multi-factor authentication, encrypted cookies, and has well-configured web application firewalls. During your assessment, you identify several possibilities to compromise session management. Which of the following techniques would most effectively exploit a session management vulnerability while bypassing the application's sophisticated security measures? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Utilize Session Fixation to manipulate a user into utilizing a session ID that an attacker already has access to.
Session Fixation is correct because it manipulates a user into using an attacker-controlled session ID, bypassing advanced security like MFA and WAF.
Question 66 of 148At DEF Corporation, as you dive deeper into the vulnerability analysis of their multi-tiered web applications, you observe an anomaly. Some encrypted user session tokens appear to be much longer than others, hinting at possible variable encryption strength based on user roles. This inconsistency could expose certain user sessions, especially those with elevated privileges, to cryptographic attacks. Given the intricate nature of the system and the potential implications of a breach, what would be the most appropriate step to mitigate this specific vulnerability?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Implement uniform encryption strength across all user roles, eliminating disparities in session token lengths.
Uniform encryption strength eliminates token length disparities, preventing cryptographic attacks on privileged sessions, making C the best fix.
Question 67 of 148You are a new IT intern at a local tech company. The company has a strong focus on cybersecurity and regularly hires ethical hackers to maintain its security posture. You come across the term 'black box testing' in a company document. Uncertain about its meaning, you decide to ask your supervisor. She explains that it refers to a type of testing in cybersecurity. In the context of ethical hacking, what is 'black box testing'?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. It involves the ethical hacker trying to break into a system without any prior knowledge about the system.
Black box testing is correct because it simulates an attacker with no prior knowledge of the system, making option D accurate.
Question 68 of 148You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side controls. During your testing, you discover that client-side controls enforce password strength and ensure CAPTCHA validation. The application also uses a proprietary encryption algorithm for client-side data. Your goal is to bypass these client-side controls to assess how robust they really are. What method would be the most effective for bypassing these controls without triggering server-side alarms?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Disable JavaScript in the browser and proceed to submit weaker passwords and invalid CAPTCHAs.
Disabling JavaScript bypasses client-side checks without server alerts. This tests client-side validation bypassing, a core hacking technique.
Question 69 of 148A cloud provider faced a situation where one customer's malicious activity affected the organization's reputation and service delivery. Which security control would have most effectively prevented this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Assessing multi-tenant isolation techniques
Multi-tenant isolation prevents one customer's malicious activity from affecting others in the cloud. This is a fundamental cloud security principle.
Question 70 of 148During an internal security audit, the cybersecurity team at a large healthcare organization detects abnormal patterns in DNS resolution behavior on the corporate internal network. Several employees report that when they attempt to visit legitimate internal and external websites, they are redirected to login pages that appear slightly altered. Upon deeper inspection, security logs reveal that DNS responses are being returned from an internal IP address that is not an authorized DNS server. These rogue responses are consistently faster than the legitimate replies from the corporate DNS server. Around the same time, network monitoring tools register a sharp spike in ARP spoofing alerts originating from a specific subnet. The organization becomes concerned that sensitive login credentials and personal health data may have been intercepted by an insider. Given this scenario, what type of sniffing-based attack is most likely being executed?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Intranet DNS poisoning via local spoofed responses
Intranet DNS poisoning uses local spoofed responses to redirect internal traffic. The ARP spoofing and DNS response speeds confirm this attack vector.
Question 71 of 148In a healthcare organization, the network security team detects unusual network activity, indicating advanced sniffing techniques used by a potential attacker. Upon investigation, it's found that the attacker exploits vulnerabilities in medical imaging protocols to intercept patient data. The security team must identify the specific sniffing technique being used and take action to protect patient privacy. Considering the scenario, which sophisticated sniffing technique poses the greatest challenge for the security team, potentially compromising patient data security?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Exploiting MRI machine firmware vulnerabilities to intercept real-time patient scans.
Exploiting firmware vulnerabilities in medical devices is a sophisticated sniffing attack. This tests knowledge of medical device security and sniffing.
Question 72 of 148As a cybersecurity analyst working for a multinational corporation, you are tasked with the responsibility of conducting routine vulnerability scans. This time around, you decided to use a different strategy and opted to employ a FIN scan, which is a type of stealth scanning technique. Upon conclusion of your scan, you notice an interesting anomaly – a significant number of ports did not respond to your FIN packets. With this unexpected result, you are now faced with the challenge of correctly interpreting the findings and planning the next course of action. Based on your understanding of FIN scanning and TCP/IP protocols, how should you interpret these findings?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Consider the possibility of firewall blocking the FIN packets and investigate further.
FIN scans are blocked by firewalls, which would prevent response. This is a common security measure, not a breach or congestion issue.
Question 73 of 148As a cybersecurity analyst at XYZ Corp., you're examining system logs and notice an array of activities that suggest the presence of an elusive rootkit. Given the stealthy nature of rootkits, their detection and eradication are pivotal to maintaining system security and preventing data compromise. Assessing the system, you find the rootkit has been embedded deeply within the operating system kernel. In this critical situation, which strategy should you follow to remediate the rootkit effectively while minimizing potential damage? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Employ a systematic, multi-layered strategy, starting with the deployment of a specialized rootkit detection tool to verify the presence and type of rootkit, followed by an appropriately tailored removal procedure, specific to the identified rootkit.
Systematic detection and tailored removal remove the rootkit effectively. Formatting is extreme, and honeypots are for detection, not remediation.
Question 74 of 148You are a cybersecurity analyst at a tech startup that provides cloud-based services to its clients. Recently, your team detected suspicious activity on one of your critical servers. After further investigation, you discovered an unauthorized user gained escalated privileges and is attempting to perform malicious actions. Your task is to thwart the attack and secure the system from future exploits. Considering the potential consequences and complex nature of the situation, which of the following actions would you take first to immediately contain the threat without causing significant disruption to your services? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network.
Real-time analysis allows for targeted containment. Powering down disrupts services unnecessarily, and forensics come after containment.
Question 75 of 148A global media streaming platform is experiencing periodic traffic surges every 10 minutes, severely degrading performance and leading to widespread buffering issues. Traffic analysis reveals intermittent spikes exceeding 300 Gbps, followed by quiet intervals. The security team suspects the attacker is using a technique designed to disrupt services without maintaining a continuous flood. What type of DDoS attack best explains this scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. A Pulse Wave attack leveraging high-volume short bursts to overwhelm network resources.
Pulse Wave attacks use short bursts to overwhelm resources. Continuous floods and PDoS are different, with PDoS targeting hardware.
Question 76 of 148In a recent penetration testing assignment, you were able to breach a servers web service and install a backdoor. Your aim is to maintain access for as long as possible without getting detected. Considering the web server countermeasures explained earlier, which of the following actions would make your backdoor most likely to remain undetected? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Install the backdoor on a non-web file referenced in a URL.
Placing a backdoor in a non-web file avoids detection by web scanners. Increasing size may trigger anomaly detection, and regular updates can remove it.
Question 77 of 148Which is the first step followed by Vulnerability Scanners for scanning a network?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Checking if the remote host is alive
Checking if the remote host is alive confirms reachability before scanning. Other steps depend on this initial verification.
Question 78 of 148As an IT professional, you are attending a webinar on cybersecurity. The presenter emphasizes the importance of ethical hacking and the different types of hackers involved in the cyber world. Suddenly, the term "script kiddie" is mentioned, piquing your curiosity. According to the presenter, who are "script kiddies" in the context of ethical hacking?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. They are novices in the hacking world who mainly use scripts and codes developed by others.
Script kiddies are novices who use pre-existing scripts instead of writing their own. They lack advanced technical skills.
Question 79 of 148During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Enforcing timely user de-provisioning
Timely user de-provisioning promptly revokes access when an employee leaves. This directly prevents former employees from retaining access.
Question 80 of 148A penetration tester is conducting a security assessment and needs to identify live hosts on a target network without triggering intrusion detection systems. The tester decides to use a technique that sends specially crafted packets to determine which hosts are active. Which scanning technique should the tester use to minimize detection while identifying live hosts?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. TCP SYN scan on all ports
TCP SYN scan is stealthy as it doesn't complete the handshake, minimizing IDS detection while identifying live hosts.
Question 81 of 148A Certified Ethical Hacker (CEH) is investigating a recent attack on a company's web server. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server's document root directory, which stores critical HTML files, is named "certroot" and is stored in the directory /admin/web. The server root, which stores the server's configuration, error, executable, and log files, is also identified. The CEH also notes that the server uses a virtual document tree for additional storage. The server was compromised via a DNS server hijacking attack where the attacker redirected all requests coming towards the target web server to their own malicious server. Given this scenario which of the following actions would most likely prevent such an attack in the future?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Implementing DNSSEC on the DNS server
DNSSEC digitally signs DNS records to prevent hijacking by ensuring the integrity and authenticity of responses.
Question 82 of 148You are a cybersecurity analyst at a financial institution. Your company has a strict policy against any unencrypted protocols. You've noticed some data packets being sent via HTTP rather than HTTPS on the network. This raises your concern because HTTP is a protocol that sends data in plaintext. To further investigate this matter, you decide to use a sniffing tool. Which of the following would be the most appropriate choice?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Wireshark
Wireshark is a packet sniffer that can analyze HTTP traffic in plaintext to investigate unencrypted protocols.
Question 83 of 148A company's customer data stored in a cloud environment has been exposed due to an unknown vulnerability. Which of the following types of attack most likely led to this incident? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Side-channel attack on the hypervisor
A hypervisor side-channel attack directly compromises cloud infrastructure security, which is a core CEH concern for virtualized environments.
Question 84 of 148Working as an Information Security Analyst at a technology firm, you've been asked to design training material for employees about the potential dangers of session hijacking. As part of the training, you want to explain how attackers could use side jacking to compromise their accounts. Which of the following scenarios would most accurately describe a side jacking attack?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. An attacker intercepts network traffic, captures unencrypted session cookies, and uses these to impersonate the user.
Sidejacking involves intercepting unencrypted session cookies to impersonate users, a classic session hijacking attack.
Question 85 of 148A multinational company is planning to integrate an IoT-based environmental control system for its manufacturing units worldwide. They engage a cybersecurity team to ensure that the new system remains secure from any potential threats. The cybersecurity team is tasked with identifying the most likely method an advanced persistent threat (APT) group might use to compromise the new IoT-based environmental control system. What is the most plausible attack vector?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. The APT group will exploit zero-day vulnerabilities present in the IoT device firmware.
Zero-day exploits in IoT firmware are a primary APT attack vector for unpatched systems.
Question 86 of 148Harper, a software engineer, is developing an email application. To ensure the confidentiality of email messages, Harper uses a symmetric-key block cipher having a classical 12- or 16-round Feistel network with a block size of 64 bits for encryption, which includes large 8 × 32-bit S-boxes (S1, S2, S3, S4) based on bent functions, modular addition and subtraction, key-dependent rotation, and XOR operations. This cipher also uses a masking key (Km1) and a rotation key (Kr1) for performing its functions. What is the algorithm employed by Harper to secure the email messages? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. CAST-128
The described Feistel structure with 64-bit blocks and specific S-boxes matches the CAST-128 algorithm.
Question 87 of 148You have been hired by a government agency to evaluate Android smartphones' resistance against covert surveillance. During your assessment, you want to demonstrate whether attackers could eavesdrop on sensitive conversations conducted through the loudspeaker without special permissions by exploiting built-in smartphone sensors. Which specific attack technique should you implement to effectively demonstrate this privacy risk? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Spearphone attack exploiting accelerometer-based vulnerabilities.
Spearphone uses the accelerometer to capture audio vibrations from the loudspeaker without special permissions.
Question 88 of 148Which type of malware replicates itself without human intervention to spread across a network?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Worm
Worms self-replicate and spread across networks without human intervention, unlike other malware types.
Question 89 of 148You are currently serving as a cybersecurity analyst at a global banking corporation. Your team has recently identified a series of irregular incidents that indicate a potential backdoor attack on the company's intricate network system. Some of these irregularities include a significant rise in outbound network traffic during non-working hours, unexpected and unaccounted system reboots, and strangely modified system files. Your primary focus now is to detect any hidden backdoor in the system, neutralize it, and ensure the overall integrity of the systems involved, while preventing any further security breaches. Given the complexity of the situation and the importance of maintaining the bank's network security, what combination of measures would be most effective in accurately identifying the potential backdoor, neutralizing it, and ensuring the system's security?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Perform detailed monitoring of system and file activity, incorporate anomaly detection techniques in the security framework, and utilize advanced anti-malware tools for comprehensive system scans.
Monitoring system activity and using anomaly detection is key for backdoor identification, as backdoors often exhibit abnormal behavior.
Question 90 of 148As a security expert for a prominent tech company, you've noticed an increasing number of attacks on your web services. You've concluded that the best course of action is to enhance your patch management strategies. Considering the information presented, which of the following strategies would be most effective in ensuring the secure and efficient management of patches and hotfixes?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Implementing an automatic patch management process and using a patch management tool to monitor the patched systems.
Automated patch management is the most effective strategy for efficient and timely security updates.
Question 91 of 148A corporation has transitioned to a public cloud service. The security team found a critical flaw in the API of the cloud service provider. What is the potential threat they are most likely to face? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Unauthorized access to cloud resources
An API flaw directly leads to unauthorized resource access, a fundamental cloud security risk.
Question 92 of 148You've been hired as a Certified Ethical Hacker (CEH) by a large multinational corporation to investigate the unauthorized access of sensitive data from their web application. You discover that the web application uses a custom authorization scheme involving token-based authentication. The system issues tokens, which expire after 30 minutes. In the server logs, you notice multiple failed login attempts using expired tokens within a 3-minute window, followed by successful access with a valid token. You suspect that an attacker exploited the authorization scheme. What could be the most likely attack scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The attacker captured a valid token before its expiry and used it to gain access.
Capturing a valid token before expiry allows an attacker to bypass the authentication mechanism successfully.
Question 93 of 148A multinational corporation provides its employees with mobile devices to support remote work and enhance productivity. Recently, the security team detected suspicious activities indicating potential vulnerabilities in the mobile platforms, raising concerns about unauthorized access and data leakage. The team is tasked with identifying advanced hacking techniques targeting mobile platforms and implementing robust measures to enhance mobile security and prevent intrusions. Given the scenario described, which sophisticated hacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of the multinational corporation's mobile platforms?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Remote Access Trojan (RAT) Implanting Malicious Software on Mobile Devices to Gain Unauthorized Remote Access and Monitor User Activities, such as Keystrokes and Screen Capture
A RAT provides stealthy, persistent remote access, making it highly challenging to detect on mobile devices.
Question 94 of 148Following an attack on its mobile infrastructure, an e-commerce company is reconsidering its mobile security strategies. In an event where an attacker has been able to gain partial root access to the mobile application, which of these tactics will offer the most effective barrier to additional exploitation? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Implementation of certificate pinning to protect against Man-In-The-Middle (MITM) attacks.
The correct answer is right because certificate pinning protects MITM attacks, which are a major risk after root compromise.
Question 95 of 148You are conducting a vulnerability assessment in a segmented internal network. When scanning a set of IPs using the nbtscan tool, you discover multiple devices responding with NetBIOS names, but only one of them has the entry in its response. What does this indicate about that specific host? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. It is the domain master browser or Primary Domain Controller (PDC).
The correct answer is right because only the PDC or master browser provides the NetBIOS name list in a Windows network.
Question 96 of 148You have recently been hired as an entry-level IT technician in a large corporation. In a meeting with the IT team, the terms "ethical hacking" and "penetration testing" are mentioned frequently. Later, a colleague explains to you that the main difference between the two is based on their goals. What is the primary goal of an ethical hacker in comparison to a penetration tester? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. An ethical hacker is primarily focused on securing the system, while a penetration tester tries to exploit the system's vulnerabilities.
An ethical hacker's primary focus is security through identifying and fixing vulnerabilities. Pretexting and quid pro quo are other social engineering types.
Question 97 of 148A major financial institution is experiencing persistent Denial-of-Service (DoS) attacks targeting its online banking services, causing significant disruption to customer transactions and eroding trust in the institution. The security team is under immense pressure to identify and mitigate the sophisticated tactics employed by the attackers to ensure uninterrupted access to banking services. Considering the scenario described, which sophisticated Denial-of-Service (DoS) technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially jeopardizing the availability of online banking services?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. A zero-day exploit targeting the institution's web server software, causing buffer overflow and service unavailability through remote code execution.
Zero-day exploit is the most challenging as it uses unknown vulnerabilities for remote code execution. Other options are known techniques.
Question 98 of 148A multinational corporation recently survived a severe Distributed Denial-of-Service (DDoS) attack, which caused significant downtime and resulted in substantial financial losses. After implementing enhanced security measures, the company contracted you as a cybersecurity consultant to assess their new infrastructure. During the audit, you discovered that the organization uses both hardware and cloud-based solutions to distribute incoming traffic. The primary purpose of these solutions is to absorb and mitigate the effects of a DDoS attack, ensuring that legitimate requests are not affected during such an event. What type of DDoS mitigation strategy is the company utilizing?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Load Balancing
Load balancing distributes traffic to prevent overload. Black hole routing drops traffic, while sinkholing redirects it to a null route.
Question 99 of 148You have recently joined as a cybersecurity analyst at a multinational corporation. Your role includes regular vulnerability assessments of the company's wide-ranging IT infrastructure. During one of these assessments, you employ the Nessus scanner. The scanner flags a severe vulnerability marked as CVE-2023-12456. This vulnerability specifically targets the SSH (Secure Shell) service running on one of the company's Linux servers. With a CVSS score of 9.0, the vulnerability poses a substantial risk. Most concerning is its ability to allow potential remote code execution. Given the high-risk nature of the vulnerability, what course of action should be immediately prioritized? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Without delay, apply the patch recommended by the vendor.
Patching the vulnerability immediately is critical to prevent exploitation and remote code execution.
Question 100 of 148A new wireless client is configured to join a 802.11 network. This client uses the same hardware and software as many of the other clients on the network. The client can see the network, but cannot connect. A wireless packet sniffer shows that the Wireless Access Point (WAP) is not responding to the association requests being sent by the wireless client. What is a possible source of this problem? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The WAP does not recognize the client's MAC address
The WAP likely has MAC filtering enabled and does not recognize the client's MAC address, blocking association.
Question 101 of 148A senior executive receives a personalized email with a subject line that reads "Annual Performance Review 2024". The email contains a downloadable PDF that installs a backdoor when opened. The email appears to come from the CEO and includes company branding. Which phishing method does this best illustrate? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Whaling attack aimed at high-ranking personnel
A whaling attack targets high-ranking personnel, like impersonating a CEO to trick a senior executive.
Question 102 of 148A prominent healthcare organization relies on mobile platforms to access electronic health records (EHR) and facilitate communication among healthcare professionals. Recently, the security team detected suspicious activities indicating potential vulnerabilities in the mobile platforms, raising concerns about unauthorized access to sensitive patient data and potential breaches of medical privacy laws. The team is tasked with identifying advanced hacking techniques targeting mobile platforms and implementing robust measures to enhance mobile security and protect patient confidentiality. Given the scenario described, which sophisticated hacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of the healthcare organization's mobile platforms?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Zero-Day Exploits Leveraging Previously Unknown Vulnerabilities in Mobile Operating Systems or Applications to Gain Unauthorized Access to Healthcare Data and Patient Records
Zero-day exploits are challenging because they use unknown vulnerabilities, making them hard to detect and mitigate.
Question 103 of 148Which service in a PKI will vouch for the identity of an individual or company?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. CA
A Certificate Authority (CA) issues digital certificates to verify identities in a PKI, vouching for the authenticity of the certificate holder.
Question 104 of 148Some clients of TPNQM SA were redirected to a malicious site when they tried to access the TPNQM main site. Bob, a system administrator at TPNQM SA, found that they were victims of DNS Cache Poisoning. What should Bob recommend to deal with such a threat?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The use of DNSSEC
DNSSEC is the correct solution as it digitally signs DNS records, ensuring data integrity and authenticity to prevent cache poisoning attacks.
Question 105 of 148An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up. What is the most likely cause?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The network devices are not all synchronized.
Unsynchronized network device clocks cause timestamp discrepancies in logs, making event correlation difficult and obscuring the attack sequence.
Question 106 of 148A cybersecurity team is assessing an organization's network for misconfigurations. During the enumeration process, they use a tool that sends a request to UDP port 161 and receives a large list of software names installed on remote devices. The operation is successful due to the use of a publicly known community string. What enabled this enumeration technique to work so effectively?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The SNMP agent allowed anonymous bulk data queries due to default settings.
The SNMP agent's default settings allowed anonymous bulk queries, enabling enumeration of sensitive data without authentication.
Question 107 of 148A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were compromised, leading to vehicle thefts. The cybersecurity team suspects that attackers captured unique signals emitted by the key fobs during regular usage. To effectively confirm and prevent this attack in the future, what should the security team prioritize? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Monitor wireless signals for abnormal jamming or interference.
Monitoring wireless signals for interference or jamming can detect attackers capturing key fob signals, confirming and preventing future attacks.
Question 108 of 148You are a security analyst investigating a network compromise. The infected systems are receiving external instructions, masking the control traffic using widely allowed protocols like HTTP and DNS. The payloads are stealthy and modify system components without saving files to disk. What would be the most effective action to detect and disrupt this kind of malware communication? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Use behavioral analytics to monitor for irregular outbound requests and abnormal application behavior.
Behavioral analytics detects irregular outbound requests and abnormal behavior, ideal for identifying stealthy malware using common protocols.
Question 109 of 148While performing a vulnerability assessment for XYZ Corporation, you discover that several key systems are regularly interacting with unidentified external entities. These interactions often involve data transfers, both incoming and outgoing. While some of these might be legitimate, the nature and volume of this unmonitored traffic raise concerns about potential data exfiltration or malware introduction. Given the ambiguous nature of these interactions and the high stakes involved, which strategy would most directly identify and mitigate the vulnerabilities associated with these unsanctioned exchanges? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Prioritize a behavioral analytics solution that profiles normal system behaviors and alerts on deviations, focusing on the interaction patterns of the identified systems.
Behavioral analytics profiles normal system behaviors to detect deviations, directly identifying unsanctioned exchanges and data exfiltration.
Question 110 of 148During an ethical hacking exercise, a security analyst is testing a web application that manages confidential information. The analyst suspects the application may be susceptible to SQL injection attacks. Which of the following payloads will most likely reveal if the application is vulnerable to time-based blind SQL injection attacks? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. ' AND BENCHMARK(5000000,ENCODE('test','test')); —
The BENCHMARK payload causes a delay, revealing time-based blind SQL injection if the response is significantly delayed.
Question 111 of 148As a Certified Ethical Hacker, you have been contracted by a leading technology company to test the vulnerabilities in its web application. The application integrates various third-party services and employs multiple APIs. During your advanced testing, you discover a particularly robust Web API that is designed to work with several webhooks. Additionally, you find that the server has a web shell planted for legitimate administrative tasks. Your objective is to exploit vulnerabilities related to the Web API, webhooks, and web shell. What technique would best allow you to compromise the system effectively while leaving minimal traces?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Utilize SSRF (Server-Side Request Forgery) to make unauthorized API calls from the server itself.
SSRF allows unauthorized API calls from the server, compromising the system stealthily without leaving obvious traces.
Question 112 of 148As a security analyst, you are testing your company's network for potential vulnerabilities. During your investigation, you suspect that an attacker might be using MAC flooding to compromise the switches and sniff network traffic. Which of the following indicators would most likely confirm your suspicions? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Numerous MAC addresses that correspond to a single switch port.
A correct answer because numerous MAC addresses on a single port indicate the switch's CAM table is overflowing. The trap is confusing this with an IP-related issue.
Question 113 of 148A leading online retailer has been experiencing a series of security incidents involving unauthorized access to customer accounts and fraudulent transactions. Upon investigation, it is suspected that attackers are employing sophisticated session-hijacking techniques to compromise user sessions and carry out illicit activities. The security team is tasked with implementing robust measures to prevent further breaches and protect customer trust. Given the scenario described, which advanced session hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of online transactions on the retailer's website?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Session Replay Attack Capturing and Replaying Encrypted Session Tokens to Gain Unauthorized Access
This is correct as session replay attacks are hard to detect because they use valid, captured tokens. The trap is confusing it with an attack that relies on user interaction.
Question 114 of 148As a cybersecurity analyst for a leading multinational company, you have unearthed evidence suggesting a breach. Analysis indicates that sophisticated steganography techniques are in play, allowing the hacker to exfiltrate data by cleverly embedding it within image files. Confronted with the deceptive nature of steganography and its potential implications, which course of action offers the best chance to detect and counteract this clandestine threat?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Engage a specialized steganalysis tool to scrutinize questionable files, decode the obscured data, and reveal the hacker's exfiltration methodology.
The answer is correct because a steganalysis tool is specifically designed to find hidden data in files. The trap is choosing a general monitoring tool.
Question 115 of 148You've recently been hired as a cybersecurity intern for a growing tech startup. During your onboarding, the company's chief information security officer (CISO) explains the various types of hackers you need to be aware of as part of your role. The term "script kiddie" comes up during this discussion. Based on your CEH v12 study material, which of the following descriptions best defines a script kiddie?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. A hacker who uses pre-existing scripts and tools to carry out attacks without fully understanding how they work.
Script kiddies use pre-existing tools without understanding them. They lack the skills to create their own exploits.
Question 116 of 148As a cybersecurity professional conducting a network vulnerability assessment for your organization, you discover a potentially critical vulnerability. This vulnerability arises from an outdated software component installed on a critical production server used by the financial department. The software vendor has acknowledged this vulnerability and promptly released a patch to fix it. However, the application of the patch has been deferred due to the department's operational needs, as they cannot tolerate downtime during business hours, which would significantly impact their productivity. The situation poses a significant risk due to the potential for exploitation until the patch is applied. With these constraints in mind, as a Certified Ethical Hacker, what immediate action could you undertake to reduce the risk associated with this vulnerability without disrupting department operations?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Implement a strategy of Virtual Patching, providing a protective layer around the vulnerability until the actual patch can be applied.
Virtual patching applies security controls to mitigate risk without downtime. The other options are either too disruptive or insufficient.
Question 117 of 148As a newly appointed cybersecurity analyst in a financial firm, you are tasked with performing network scanning to maintain the organization's network security posture. You decide to conduct a SYN scan, sometimes referred to as half-open scanning, using a popular tool like Nmap. If you initiate a SYN scan against a target IP address and receive a SYN/ACK packet in response, how would you interpret this result? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The scanned port on the target IP address is open, as the receipt of a SYN/ACK packet indicates that the port is prepared to establish a connection.
A SYN/ACK response confirms a port is open and ready to connect. A closed port would respond with a RST packet.
Question 118 of 148As part of a security audit, your team evaluates a system flagged by your automated scanner. The tool outputs a vector string with a numerical range of 9.8, indicating a critical severity. However, the client is unsure about the real-world implications of this score. You are tasked with explaining what this score conveys and how it was derived. Which of the following best explains the purpose and benefit of this type of rating in prioritizing remediation efforts?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. It quantifies technical impact and ease of exploitation, guiding structured risk response based on impact and environment.
Option C is correct because CVSS scores quantify technical impact and exploitability to guide risk-based remediation priorities.
Question 119 of 148A cybersecurity company wants to prevent attackers from gaining information about its encrypted traffic patterns. Which of the following encryption algorithms should they utilize? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. AES
AES is correct because it provides strong encryption to obscure traffic patterns, while RSA is for key exchange, not encryption.
Question 120 of 148A large chemical plant uses operational technology (OT) networks to control its industrial processes. Recently, security personnel noticed abnormal behavior from critical Programmable Logic Controllers (PLCs), suspecting a stealthy compromise via malicious firmware. Which action should the team take first to effectively verify and neutralize this issue? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Perform detailed inspections of device software for unauthorized modifications.
Inspecting device software for modifications is the first step to detect malicious firmware. Isolating without inspection risks missing forensic evidence.
Question 121 of 148You are a security analyst for a medium-sized e-commerce company. Recently, the company has been suffering from repeated incidents of session hijacking. To prevent future incidents, you've been asked to suggest a robust strategy to mitigate this risk. Which of the following approaches would you recommend?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Apply an IPsec VPN solution that encrypts the entire IP packet, thereby making session hijacking attempts more difficult.
An IPsec VPN encrypts the entire IP packet, securing sessions against hijacking. Other options are less direct or focus on prevention rather than mitigation.
Question 122 of 148You're an IT security analyst at a fast-growing fintech startup. Recently, you've noticed an uptick in network traffic anomalies. You decide to perform a more thorough network scan using the ICMP Echo Request method. During the scan, you notice that a certain set of IPs in your network are not returning any Echo Reply, but other network functionalities seem to be operating normally. How would you interpret this situation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The firewall or another security control is probably blocking the ICMP Echo Requests.
Firewalls commonly block ICMP requests to prevent probing. This is a security measure, not congestion or a breach.
Question 123 of 148Due to a slowdown of normal network operations, the IT department decided to monitor internet traffic for all of the employees. From a legal standpoint, what would be troublesome to take this kind of measure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Not informing the employees that they are going to be monitored could be an invasion of privacy.
Monitoring without informing employees violates privacy laws. Legal trouble arises from lack of consent, not work disruption or ongoing slowdowns.
Question 124 of 148If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TC
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Hping
Hping can send custom TCP packets to get a response when ICMP is disabled. It is a versatile tool for this purpose.
Question 125 of 148Ron, a security professional, was pen testing web applications and SaaS platforms used by his company. While testing, he found a vulnerability that allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company. What is the API vulnerability revealed in the above scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. No ABAC validation
The lack of ABAC validation allows unauthorized access to API objects based on user and resource attributes.
Question 126 of 148During a penetration test on a legacy Windows network, you use the nbtstat -A command on a target system and retrieve several NetBIOS names, including entries ending with <20> and <03>. However, attempts to list shared folders fail. Which of the following best explains this behavior?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. File and printer sharing is disabled on the target system.
File and printer sharing must be enabled to list shared folders via NetBIOS. Its failure explains the behavior.
Question 127 of 148A multinational corporation relies heavily on remote access for its employees to connect to internal systems and resources. Recently, there have been reports of unauthorized access to sensitive company data, leading to concerns about potential session hijacking attacks. The security team is tasked with identifying the specific techniques used by attackers and implementing measures to enhance session security. Considering the scenario described, which advanced session hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the confidentiality of corporate data?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. ARP Spoofing Attack Redirecting Traffic to Capture Session Data on Local Networks
ARP spoofing is challenging to detect as it occurs at Layer 2, making it a sophisticated session hijacking method.
Question 128 of 148The web application security team of a global firm detected a sophisticated injection attack that exploited a flaw in the application's input validation. The attack was carried out using a custom script that used obfuscation and evasion techniques to bypass security measures. To counter such attacks in the future, the security team is considering implementing additional security measures. Which of the following would be the most effective?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Deploy a Web Application Firewall (WAF) with built-in evasion detection features.
A WAF with evasion detection blocks obfuscated injection attempts, directly countering web application attacks.
Question 129 of 148A cybersecurity analyst working for a multinational corporation is tasked with performing regular surveillance of their competitors' digital presence to identify any changes that could indicate strategic shifts or potential threats. To stay updated on their competitors' web content updates, the analyst has devised a plan to use several tools and techniques to achieve his objective efficiently. However, there is a key component in his strategy that he overlooked. Which of the following is the most crucial aspect he should add to ensure the effective implementation of his surveillance strategy? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Set up Google Alerts to receive email notifications whenever new web content includes their competitors' names or other key terms.
Google Alerts provide real-time notifications on competitors' web content updates for effective monitoring.
Question 130 of 148A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS), firewalls, and honeypots, to protect its network from malicious activities. Despite these measures, the security team has noticed suspicious traffic patterns indicating potential attempts to evade detection and breach the network perimeter. The team is tasked with identifying advanced evasion techniques and strengthening the defense mechanisms to mitigate emerging threats effectively. Given the scenario described, which sophisticated evasion technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the integrity of the cybersecurity firm's network? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Covert Channel Communication Exploiting Unused IP Header Fields to Conceal Malicious Traffic and Evade Detection by Security Devices
Covert channels in IP headers evade detection by hiding malicious traffic in seemingly normal network packets.
Question 131 of 148During an investigation, an ethical hacker discovered that a web application's API has been compromised, leading to unauthorized access and data manipulation. They identified webhooks and a webshell being used by the attacker. To prevent further exploits, which of the following actions should be taken?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Harden the web server security, add multi-factor authentication for API users, and restrict the execution of scripts server-side.
Hardening the server, adding MFA, and restricting script execution directly addresses the webshell and API compromise.
Question 132 of 148As a certified ethical hacker, you have been tasked to exploit a security vulnerability on an Android device that uses the latest version of the OS. You found that there's an unpatched weakness in the handling of user permissions in the device, but the device has a fully updated anti-virus application installed. What would be the most effective approach to exploit this vulnerability without being detected by the anti-virus application?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Develop a custom exploit code that uses obfuscation techniques to avoid detection.
The correct answer is right because a custom obfuscated exploit avoids detection by standard antivirus signatures.
Question 133 of 148As a newly appointed network security analyst at a mid-tier company, you have been tasked with assessing the security of the network. As part of this, you need to ensure that your company's network can detect and prevent evasion techniques. You know that one popular evasion technique used by attackers is using 'packet fragmentation'. Which of the following IDS configurations should you implement to counteract this particular technique?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Implementing an anomaly-based IDS that can recognize the irregular traffic patterns caused by packet fragmentation.
The correct answer is right because an anomaly-based IDS detects the irregular patterns from fragmented packets.
Question 134 of 148During a red team exercise, a certified ethical hacker (CEH) is working on exploiting a potential vulnerability in the target's web server. The CEH has completed the information gathering and footprinting stages and mirrored the website for offline analysis. They have also discovered the server is prone to session hijacking. Which next step is most likely to be part of a successful attack methodology, keeping in mind the requirement to minimize the possibility of detection?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Hijack a session and immediately modify server configuration files.
Hijacking a session and modifying config files is stealthy. SQL injection and brute force are detectable. Vulnerability scanning is passive.
Question 135 of 148A "Server-Side Includes" attack refers to the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary code remotely. Which web-page file type, if it exists on the web server, is a strong indication that the server is vulnerable to this kind of attack? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. .stm
The file type ".stm" is associated with Microsoft Active Server Pages (ASP) which supports Server-Side Includes (SSI), making it vulnerable to SSI attacks.
Question 136 of 148A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless access point. The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24. Which of the following has occurred?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The gateway is not routing to a public IP address.
The gateway is not routing to a public IP address, which is why local communication works but internet access fails.
Question 137 of 148As a cybersecurity professional in a growing organization, you are tasked with conducting comprehensive reconnaissance of your own company's digital presence. In addition to using tools like WHOIS, DNS analysis, and search engines, you are also considering investigating the Deep Web. Which of the following justifications best supports your idea to explore the Deep Web for potential risks related to your organization's information?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Search engines don't index the Deep Web, and there could be non-indexed company information lying there.
Search engines don't index the Deep Web, so exploring it can reveal non-indexed company data that traditional methods would miss.
Question 138 of 148Your role as a cybersecurity analyst at XYZ Corporation requires you to perform a thorough security assessment of the company's online presence. You initiate the process with a passive reconnaissance phase, trying to gather as much information as possible without interacting directly with the target system. Which of the following techniques or tools is least likely to assist you in this endeavor?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Using a tool like Nmap to scan the company's public IP range.
Nmap scanning involves active interaction, making it unsuitable for passive reconnaissance which avoids direct contact.
Question 139 of 148During an internal penetration test, a security analyst assesses a web application that interfaces with a backend Oracle database. Initial attempts using standard SQL injection payloads such as ' OR '1'='1 and UNION SELECT return no useful output and do not affect application behavior. Suspecting input sanitization and error suppression, the analyst crafts a new payload: 1 AND 1 < (SELECT COUNT(*) FROM all_users A, all_users B, all_users C) Upon submitting this payload, the page takes significantly longer to respond compared to previous inputs, even though no visible output is returned. What type of SQL injection technique is most likely being used here?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Heavy query-based SQL injection
Heavy query-based SQL injection uses complex, resource-intensive queries to cause delays, as seen in the payload's COUNT operation.
Question 140 of 148During a cybersecurity operation, a CEH professional discovered an unknown Bluetooth Low Energy (BLE) device actively transmitting pairing signals. The professional decided to breach the BLE device using a crackle. The device was seen pairing and exchanging keys, leading to the establishment of a secure connection. However, the professional only managed to capture LL_ENC_REQ and LL_ENC_RSP packets, but not the Long-Term Key (LTK). Which of the following best describes the professional's next course of action? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The operation cannot continue without the LTK.
The operation cannot continue without the Long-Term Key (LTK), which is essential for decrypting the BLE data.
Question 141 of 148A city's power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has shown unexplained anomalies such as inconsistent sensor values and intermittent outages. Security experts suspect a side-channel attack aiming to discreetly extract sensitive information from SCADA devices. Which investigative technique would best confirm if attackers employed this specific side-channel method? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Measure unusual fluctuations during device operations at the hardware level.
Measuring hardware-level fluctuations can detect side-channel attacks, which exploit physical characteristics to extract data.
Question 142 of 148A globally-operating bank recently encountered a severe security breach within its Android OS-based mobile banking application. Cybercriminals managed to exploit the bank's Mobile Device Management (MDM) system and successfully carried out a series of remote commands, creating significant havoc. Upon thorough investigation of this incident, it emerged that the attackers might have leveraged the Android Debug Bridge (ADB) as a conduit for unauthorized access. As a Certified Ethical Hacker tasked with developing countermeasures to this issue, which action would you consider the most potent response in this situation? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Establishing and enforcing a rigorous policy that unequivocally mandates the disabling of ADB, except when absolutely necessary and only within strictly regulated environments.
This is correct because disabling ADB directly closes the attackers' primary access vector. The trap is choosing a general security measure over a specific, targeted fix.
Question 143 of 148As a cybersecurity consultant, you have been hired by a multinational corporation to identify potential security risks in their network. During the enumeration phase, you utilize LDAP to gather information about the network infrastructure. However, you observe that some critical information isn't retrievable. What could be the primary reason for this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The LDAP directory data is protected by Access Control Lists (ACLs).
The answer is correct as ACLs are specifically designed to restrict access to directory information during enumeration. The trap is blaming a network issue.
Question 144 of 148Louis, a professional hacker, had used specialized tools or search engines to encrypt all his browsing activity and navigate anonymously to obtain sensitive/hidden information about official government or federal databases. After gathering the information, he successfully performed an attack on the target government organization without being traced. Which of the following techniques is described in the above scenario? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Dark web footprinting
The scenario describes using anonymizing tools to access the dark web. This is distinct from standard website footprinting.
Question 145 of 148You are a Certified Ethical Hacker contracted by a technology company to perform a security assessment on Bluetooth-enabled devices. These devices have Secure Simple Pairing (SSP) enabled, which generally offers strong security. During your assessment, you identify an attacker trying to exploit a vulnerability in the SSP implementation by employing sophisticated brute-force techniques. The attacker has partial access to the Diffie-Hellman key exchange. Your mission is to identify the most effective method to counteract this attack. Which of the following countermeasures is most likely to be effective?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Impose rate-limiting to slow down the brute-force attack.
Rate-limiting slows brute-force attacks, making it effective against the described SSP exploit, while other options are less direct.
Question 146 of 148You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly. What is the best Nmap command you will use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. nmap -T4 -F 10.10.0.0/24
The -F flag performs a fast scan, making it ideal for quick network enumeration in a penetration test.
Question 147 of 148As a cybersecurity analyst, you were assigned the task of analyzing the traffic patterns of your company's network. You started noticing irregularities that suggested a potential scanning attempt. The attacker appears to be quite sophisticated, operating slowly and meticulously, making it a challenge to detect or trace. Given the stealthiness of this approach, which of the following scenarios best describes the scanning technique the attacker might be using?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. The attacker is utilizing a 'zombie' machine to transmit the scan, thus making the true source of the scan difficult to determine.
The correct answer is right because using a 'zombie' machine makes the source hard to trace. The elimination cue is that the other options are less stealthy.
Question 148 of 148A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named nc. The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port. What kind of vulnerability must be present to make this remote attack possible?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. File system permissions
The vulnerability is in file system permissions, allowing an anonymous user to upload, extract, and execute files.

This test also exists as narrated videos — every answer explained out loud:

▶ Part 1 ▶ Part 2 ▶ Part 3 ▶ Part 4 ▶ Part 5

More free practice tests at certpunch.com and new video rounds on @CertPunch.

Question 1 of 148What is the CVSS severity level for a score of 9.5?

Question 4 of 148Which of the following tactics uses malicious code to redirect users' web traffic? Correct answer

Question 7 of 148A system analyst wants to implement an encryption solution that allows safe key distribution. Which encryption method should the analyst consider?

Question 12 of 148An attacker examines differences in ciphertext outputs resulting from small changes in the input to deduce key patterns in a symmetric algorithm. What method is being employed?

Question 13 of 148A tester evaluates a login form that constructs SQL queries using unsanitized user input. By submitting ' OR '1'='1';–, the tester gains unauthorized access to the application. What type of SQL injection has occurred?

Question 14 of 148During a routine security audit, administrators found that cloud storage backups were illegally accessed and modified. What countermeasure would most directly mitigate such incidents in the future?

Question 17 of 148Which protocol uses port 443 by default?

Question 18 of 148Which tool is used to capture and analyze network traffic in real-time?

Question 20 of 148A future-focused security audit discusses risks where attackers collect encrypted data now, anticipating that they can decrypt it later with quantum computers. What is this threat known as?

Question 22 of 148Identify the web application attack where attackers inject client-side scripts into web pages viewed by other users.

Question 25 of 148What is the purpose of an 'Exit Node' in the Tor network?

Question 26 of 148An attacker redirects a user to a malicious website by modifying their local hosts file. What is this called?

Question 32 of 148An organization uses SHA-256 for data integrity checks but is still experiencing unauthorized data modification. Which cryptographic tool can help resolve this issue?

Question 34 of 148You are tasked with assessing wireless network security for a corporation using WPA2 encryption. During the assessment, you identify vulnerabilities that could allow attackers to intercept and replay previously captured packets. Which WPA2 vulnerability is likely being exploited?

Question 37 of 148A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hide malicious activities? Correct answer

Question 38 of 148During a cybersecurity training session at your organization, you present several hypothetical scenarios to the trainees to assess their understanding of social engineering threats. Which of these scenarios best describes a social engineering attack?

Question 39 of 148During a black-box assessment, an attacker executes the Nmap command nmap -p25 –script smtp-enum-users –script-args smtp-enumusers.methods={VRFY, EXPN, RCPT). The script successfully returns multiple valid usernames. What server misconfiguration is being exploited?

Question 54 of 148An attacker performs DNS cache snooping using the dig command with the +norecurse flag against a known DNS server. The server returns NOERROR but provides no answer to the query. What does this most likely suggest? Correct answer

Question 60 of 148During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outboundHTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic?

Question 61 of 148Which of the following is the structure designed to verify and authenticate the identity of individuals within the enterprise taking part in a data exchange?

Question 69 of 148A cloud provider faced a situation where one customer's malicious activity affected the organization's reputation and service delivery. Which security control would have most effectively prevented this issue?

Question 77 of 148Which is the first step followed by Vulnerability Scanners for scanning a network?

Question 79 of 148During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this issue?

Question 83 of 148A company's customer data stored in a cloud environment has been exposed due to an unknown vulnerability. Which of the following types of attack most likely led to this incident? Correct answer

Question 88 of 148Which type of malware replicates itself without human intervention to spread across a network?

Question 91 of 148A corporation has transitioned to a public cloud service. The security team found a critical flaw in the API of the cloud service provider. What is the potential threat they are most likely to face? Correct answer

Question 103 of 148Which service in a PKI will vouch for the identity of an individual or company?

Question 104 of 148Some clients of TPNQM SA were redirected to a malicious site when they tried to access the TPNQM main site. Bob, a system administrator at TPNQM SA, found that they were victims of DNS Cache Poisoning. What should Bob recommend to deal with such a threat?

Question 119 of 148A cybersecurity company wants to prevent attackers from gaining information about its encrypted traffic patterns. Which of the following encryption algorithms should they utilize? Correct answer

Question 123 of 148Due to a slowdown of normal network operations, the IT department decided to monitor internet traffic for all of the employees. From a legal standpoint, what would be troublesome to take this kind of measure?

Question 124 of 148If a tester is attempting to ping a target that exists but receives no response or a response that states the destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option could the tester use to get a response from a host using TC

Question 146 of 148You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly. What is the best Nmap command you will use?