CEH v13 · 312-50 · Updated 2026
Free CEH v13 Practice Exam (2026)
Full-length mock exams with the same number of questions and time as the real 312-50 exam. Tough, scenario-based questions, answers explained, and your score by topic.
1. Choose a set
2. Choose a mode
125 questions · 4 hours · same as the real exam
You have an unfinished attempt on this set.
Your score by topic
Questions 1–10Page 1 of 13
🏆
Question 1Ethics, Social Engineering & Crypto
During an authorized penetration test, you find a critical SQL injection flaw on a server that is not listed in the signed scope. What should you do?
Correct answer: C. Stop testing that server, document what you saw and inform the client contact as the rules of engagement require
Anything outside the signed scope is off limits, even if it is clearly vulnerable. A professional stops, records the finding and tells the client through the agreed channel so they can decide what happens next. Exploiting it, or quietly widening the scope, can be illegal.
Anything outside the signed scope is off limits, even if it is clearly vulnerable. A professional stops, records the finding and tells the client through the agreed channel so they can decide what happens next. Exploiting it, or quietly widening the scope, can be illegal.
Question 2Recon, Scanning & Enumeration
You must list a company's subdomains without sending a single packet to its DNS servers. Which source should you use?
Correct answer: B. Certificate Transparency logs, for example through crt.sh
Certificate Transparency logs are public records of every TLS certificate issued, and they often reveal subdomains. Zone transfers and brute-forcing both query the company's own DNS servers, and an Nmap list scan triggers reverse DNS lookups, so none of them are fully passive.
Certificate Transparency logs are public records of every TLS certificate issued, and they often reveal subdomains. Zone transfers and brute-forcing both query the company's own DNS servers, and an Nmap list scan triggers reverse DNS lookups, so none of them are fully passive.
Question 3Recon, Scanning & Enumeration
A UDP scan with Nmap shows many ports as "open|filtered". What does this mean?
Correct answer: D. Nmap got no response, so it cannot tell whether the port is open or the probe was dropped by a filter
Many UDP services stay silent when they receive an empty probe, and firewalls silently drop packets too. With no reply either way, Nmap reports open|filtered. An ICMP port unreachable reply would have shown the port as closed. Version detection (-sV) can often resolve the doubt.
Many UDP services stay silent when they receive an empty probe, and firewalls silently drop packets too. With no reply either way, Nmap reports open|filtered. An ICMP port unreachable reply would have shown the port as closed. Version detection (-sV) can often resolve the doubt.
Question 4Recon, Scanning & Enumeration
You want to map which ports a firewall filters, not which services are open. Which Nmap scan is designed for this?
Correct answer: A. -sA (ACK scan)
An ACK scan never opens connections. If an RST comes back the port is "unfiltered"; if nothing or an ICMP error comes back it is "filtered". This shows how the firewall rules behave and whether it tracks connection state, but it cannot tell you whether a port is open.
An ACK scan never opens connections. If an RST comes back the port is "unfiltered"; if nothing or an ICMP error comes back it is "filtered". This shows how the firewall rules behave and whether it tracks connection state, but it cannot tell you whether a port is open.
Question 5Recon, Scanning & Enumeration
An idle (zombie) scan lets you scan a target without your IP appearing in its logs. What property must the zombie host have?
Correct answer: B. It must have a predictable, incrementing IP ID sequence and be mostly idle
The idle scan (Nmap -sI) reads the zombie's IP ID before and after spoofing a SYN to the target in the zombie's name. If the IP ID jumped by two, the target answered the zombie, so the port is open. That only works if the zombie increments IP IDs predictably and sends little other traffic.
The idle scan (Nmap -sI) reads the zombie's IP ID before and after spoofing a SYN to the target in the zombie's name. If the IP ID jumped by two, the target answered the zombie, so the port is open. That only works if the zombie increments IP IDs predictably and sends little other traffic.
Question 6Recon, Scanning & Enumeration
Which pair of SMTP commands can confirm whether a user account or mailing list exists on a mail server?
Correct answer: A. VRFY and EXPN
VRFY checks whether a mailbox exists and EXPN expands a mailing list into its members. RCPT TO can leak the same information. Hardened mail servers disable VRFY and EXPN for this reason.
VRFY checks whether a mailbox exists and EXPN expands a mailing list into its members. RCPT TO can leak the same information. Hardened mail servers disable VRFY and EXPN for this reason.
Question 7Recon, Scanning & Enumeration
A vulnerability scan of Windows servers reports far fewer missing patches than the team expected. What is the most likely reason?
Correct answer: D. The scan ran without credentials, so the scanner could not read installed updates and the registry
Unauthenticated scans only see what is exposed on the network, such as service banners. Credentialed scans log in and check installed updates, file versions and registry keys, so they find far more missing patches with fewer false negatives.
Unauthenticated scans only see what is exposed on the network, such as service banners. Credentialed scans log in and check installed updates, file versions and registry keys, so they find far more missing patches with fewer false negatives.
Question 8System Hacking & Malware
You captured the NTLM hash of a domain admin but cannot crack it. Which technique lets you authenticate to other Windows hosts with it anyway?
Correct answer: A. Pass-the-hash
NTLM authentication proves you know the hash, not the password, so a captured hash can be replayed directly. A golden ticket needs the KRBTGT hash, Kerberoasting cracks service account tickets offline, and password spraying needs a plaintext guess.
NTLM authentication proves you know the hash, not the password, so a captured hash can be replayed directly. A golden ticket needs the KRBTGT hash, Kerberoasting cracks service account tickets offline, and password spraying needs a plaintext guess.
Question 9System Hacking & Malware
In a Kerberoasting attack, what does the attacker request and then crack offline?
Correct answer: C. Service tickets (TGS) for accounts that have a Service Principal Name, encrypted with the service account's password hash
Any domain user can request a TGS for an account with an SPN. Part of that ticket is encrypted with the service account's password hash, so it can be cracked offline without touching the account. Long, random service account passwords and managed service accounts are the fix.
Any domain user can request a TGS for an account with an SPN. Part of that ticket is encrypted with the service account's password hash, so it can be cracked offline without touching the account. Long, random service account passwords and managed service accounts are the fix.
Question 10System Hacking & Malware
While reviewing a breached Windows server, you see Security event ID 1102. What happened?
Correct answer: A. The security audit log was cleared
Event 1102 means the audit log was cleared, a classic way attackers cover their tracks. 4624 is a successful logon, 4625 a failed logon and 4720 a new user account. Forwarding logs to a central SIEM makes clearing them far less useful to an attacker.
Event 1102 means the audit log was cleared, a classic way attackers cover their tracks. 4624 is a successful logon, 4625 a failed logon and 4720 a new user account. Forwarding logs to a central SIEM makes clearing them far less useful to an attacker.
Question 11System Hacking & Malware
You have a low-privilege shell on a Linux server and want to find binaries that run with their owner's privileges, a common route to root. Which command helps most?
Correct answer: D. find / -perm -4000 -type f 2>/dev/null
find / -perm -4000 lists SUID binaries, which run as their owner (often root). A misconfigured SUID program, such as an editor or interpreter, can give you a root shell. Defenders should audit SUID files and remove the bit where it is not needed.
find / -perm -4000 lists SUID binaries, which run as their owner (often root). A misconfigured SUID program, such as an editor or interpreter, can give you a root shell. Defenders should audit SUID files and remove the bit where it is not needed.
Question 12System Hacking & Malware
A piece of malware rewrites its entire code body on each infection, without using encryption, while keeping the same behavior. What is it?
Correct answer: B. Metamorphic malware
Metamorphic malware rebuilds its own code each time, so no two copies look alike. Polymorphic malware keeps the same core and changes only an encryption layer or decryptor. Both aim to beat signature-based antivirus, which is why behavior-based detection matters.
Metamorphic malware rebuilds its own code each time, so no two copies look alike. Polymorphic malware keeps the same core and changes only an encryption layer or decryptor. Both aim to beat signature-based antivirus, which is why behavior-based detection matters.
Question 13Network Attacks & Evasion
An attacker floods a switch with frames from thousands of fake MAC addresses until it starts sending traffic out of every port. Which switch feature best prevents this?
Correct answer: C. Port security limiting MAC addresses per port
This is MAC flooding: once the CAM table is full, the switch behaves like a hub. Port security caps how many MAC addresses a port can learn and can shut the port down. DHCP snooping stops rogue DHCP servers, DAI stops ARP spoofing and BPDU guard protects spanning tree.
This is MAC flooding: once the CAM table is full, the switch behaves like a hub. Port security caps how many MAC addresses a port can learn and can shut the port down. DHCP snooping stops rogue DHCP servers, DAI stops ARP spoofing and BPDU guard protects spanning tree.
Question 14Network Attacks & Evasion
Users are getting IP settings that point to an attacker's gateway from an unauthorized DHCP server. Which control stops this on the switch?
Correct answer: B. DHCP snooping with trusted uplink ports
DHCP snooping only allows DHCP offers from ports marked as trusted, such as the uplink to the real DHCP server. Offers from any other port are dropped, which shuts down rogue DHCP servers. It also builds the binding table that Dynamic ARP Inspection relies on.
DHCP snooping only allows DHCP offers from ports marked as trusted, such as the uplink to the real DHCP server. Offers from any other port are dropped, which shuts down rogue DHCP servers. It also builds the binding table that Dynamic ARP Inspection relies on.
Question 15Network Attacks & Evasion
An attacker sends small DNS queries with the victim's spoofed IP to thousands of open resolvers, which send large responses to the victim. What is this?
Correct answer: D. DNS amplification (reflection) attack
It is a reflection attack because the resolvers send the traffic, and an amplification attack because each small query triggers a much bigger answer. Closing open resolvers, rate limiting and ingress filtering of spoofed source addresses (BCP 38) reduce it.
It is a reflection attack because the resolvers send the traffic, and an amplification attack because each small query triggers a much bigger answer. Closing open resolvers, rate limiting and ingress filtering of spoofed source addresses (BCP 38) reduce it.
Question 16Network Attacks & Evasion
An attacker gets a victim to log in using a session ID the attacker chose in advance, then reuses that same ID. Which flaw does this exploit, and what is the fix?
Correct answer: B. Session fixation; issue a new session ID after a successful login
In session fixation the attacker plants a known session ID before login. If the application keeps the same ID after authentication, the attacker's copy becomes a valid logged-in session. Regenerating the session ID at login breaks the attack.
In session fixation the attacker plants a known session ID before login. If the application keeps the same ID after authentication, the attacker's copy becomes a valid logged-in session. Regenerating the session ID at login breaks the attack.
Question 17Network Attacks & Evasion
An attacker sends packets with a TTL just high enough to reach the IDS but too low to reach the target host, so the IDS and the host see different streams. What is this technique called?
Correct answer: C. Insertion attack
In an insertion attack the IDS accepts packets that the real target never receives, so the IDS reassembles a harmless-looking stream while the host gets the real attack. Placing sensors close to the protected hosts and normalizing traffic reduces this risk.
In an insertion attack the IDS accepts packets that the real target never receives, so the IDS reassembles a harmless-looking stream while the host gets the real attack. Placing sensors close to the protected hosts and normalizing traffic reduces this risk.
Question 18Web Apps & SQL Injection
A web app fetches any URL a user submits to generate a preview. A tester submits http://169.254.169.254/latest/meta-data/ and gets cloud instance data back. Which vulnerability is this?
Correct answer: A. Server-side request forgery (SSRF)
SSRF makes the server send requests on the attacker's behalf, including to internal addresses such as the cloud metadata service, which can expose temporary credentials. Allow-lists for outbound URLs and IMDSv2 on AWS are key defenses.
SSRF makes the server send requests on the attacker's behalf, including to internal addresses such as the cloud metadata service, which can expose temporary credentials. Allow-lists for outbound URLs and IMDSv2 on AWS are key defenses.
Question 19Web Apps & SQL Injection
Which control best protects a banking site's "transfer money" form against cross-site request forgery?
Correct answer: D. A unique, unpredictable anti-CSRF token in each form, checked on the server, plus SameSite cookies
CSRF works because the browser automatically sends the victim's cookies. A secret per-session or per-form token that the attacker's site cannot read stops forged requests, and SameSite cookies add a second layer. HTTPS and input validation do not stop CSRF.
CSRF works because the browser automatically sends the victim's cookies. A secret per-session or per-form token that the attacker's site cannot read stops forged requests, and SameSite cookies add a second layer. HTTPS and input validation do not stop CSRF.
Question 20Web Apps & SQL Injection
A login page shows no errors and no data, but the response takes exactly 10 seconds longer when you inject '; WAITFOR DELAY '0:0:10'--. What have you found?
Correct answer: A. Time-based blind SQL injection on Microsoft SQL Server
No output plus a controllable delay means time-based blind SQL injection. WAITFOR DELAY is T-SQL syntax, which points to Microsoft SQL Server. On MySQL you would use SLEEP() and on PostgreSQL pg_sleep().
No output plus a controllable delay means time-based blind SQL injection. WAITFOR DELAY is T-SQL syntax, which points to Microsoft SQL Server. On MySQL you would use SLEEP() and on PostgreSQL pg_sleep().
Question 21Wireless, Mobile & Cloud
To crack a WPA2-Personal passphrase offline, what must the attacker capture first?
Correct answer: C. The 4-way handshake (or the PMKID from the access point)
The 4-way handshake, or the PMKID that many access points expose, contains what is needed to test passphrase guesses offline with tools such as hashcat. Collecting large numbers of data frames was the method for breaking WEP. A long, random passphrase or WPA3 defeats this attack.
The 4-way handshake, or the PMKID that many access points expose, contains what is needed to test passphrase guesses offline with tools such as hashcat. Collecting large numbers of data frames was the method for breaking WEP. A long, random passphrase or WPA3 defeats this attack.
Question 22Wireless, Mobile & Cloud
An attacker in a coffee shop silently pulls contacts and calendar data from a phone through a Bluetooth vulnerability. What is this called?
Correct answer: D. Bluesnarfing
Bluesnarfing is stealing data over Bluetooth. Bluejacking only sends unsolicited messages, and bluebugging takes control of the device, for example to make calls. Turning off discoverability and patching the device reduce the risk.
Bluesnarfing is stealing data over Bluetooth. Bluejacking only sends unsolicited messages, and bluebugging takes control of the device, for example to make calls. Turning off discoverability and patching the device reduce the risk.
Question 23Wireless, Mobile & Cloud
An attacker used an SSRF flaw to steal temporary credentials from an AWS EC2 instance's metadata service. Which change most directly blocks this path?
Correct answer: D. Require IMDSv2, which needs a session token obtained with a PUT request
IMDSv2 requires a token that is fetched with a PUT request and a special header, which a typical SSRF flaw cannot produce. Under the shared responsibility model, configuring this is the customer's job, not AWS's.
IMDSv2 requires a token that is fetched with a PUT request and a special header, which a typical SSRF flaw cannot produce. Under the shared responsibility model, configuring this is the customer's job, not AWS's.
Question 24Ethics, Social Engineering & Crypto
A caller says he is the CFO, stuck at an airport, and pressures the help desk to reset his email password immediately. Which attack is this?
Correct answer: B. Vishing with pretexting
Vishing is voice phishing, and the invented story about the stranded CFO is a pretext designed to create urgency and authority. A strict identity check for password resets, such as a call-back to a known number, stops it.
Vishing is voice phishing, and the invented story about the stranded CFO is a pretext designed to create urgency and authority. A strict identity check for password resets, such as a call-back to a known number, stops it.
Question 25Ethics, Social Engineering & Crypto
Bob must confirm that a contract really came from Alice and was not changed in transit. What should happen?
Correct answer: C. Alice signs a hash of the contract with her private key, and Bob verifies it with Alice's public key
A digital signature is created with the sender's private key and checked with the sender's public key, which proves origin and integrity. Encrypting with Bob's public key gives confidentiality, not proof of who sent it. A hash sent alongside the message can simply be replaced by an attacker.
A digital signature is created with the sender's private key and checked with the sender's public key, which proves origin and integrity. Encrypting with Bob's public key gives confidentiality, not proof of who sent it. A hash sent alongside the message can simply be replaced by an attacker.
Question 26Recon, Scanning & Enumeration
A tester wants to find login portals that a target organization accidentally exposed, limiting results to the target's own domain and only pages whose title contains the word "login". Which Google dork does this BEST?
Correct answer: D. site:acme.com intitle:login
site: restricts results to one domain and intitle: matches a word in the page title, so combining them finds login pages on that domain. inurl: only matches text in the URL and would not reliably limit results to the target domain.
site: restricts results to one domain and intitle: matches a word in the page title, so combining them finds login pages on that domain. inurl: only matches text in the URL and would not reliably limit results to the target domain.
Question 27System Hacking & Malware
During an engagement, a tester has a dictionary of common passwords but suspects users appended digits and symbols to meet policy. Which cracking approach BEST fits this situation?
Correct answer: C. Hybrid attack
A hybrid attack takes dictionary words and mutates them with appended numbers and symbols, matching how users pad base words to satisfy complexity rules. A straight dictionary attack only tries the words as-is, so it would miss 'Summer2024!' style variations.
A hybrid attack takes dictionary words and mutates them with appended numbers and symbols, matching how users pad base words to satisfy complexity rules. A straight dictionary attack only tries the words as-is, so it would miss 'Summer2024!' style variations.
Question 28Network Attacks & Evasion
An admin notices that on a switched LAN, the gateway's IP now maps to the attacker's MAC in several hosts' ARP tables, and traffic for the gateway is reaching the attacker first. Which technique BEST explains how the attacker achieved this?
Correct answer: B. Sending forged ARP replies that map the gateway IP to the attacker's MAC
ARP poisoning works by sending forged (gratuitous) ARP replies that bind the victim IP, here the gateway, to the attacker's MAC, so hosts update their cache and send that traffic to the attacker. CAM-table overflow floods all ports rather than selectively redirecting one IP's traffic to a specific MAC.
ARP poisoning works by sending forged (gratuitous) ARP replies that bind the victim IP, here the gateway, to the attacker's MAC, so hosts update their cache and send that traffic to the attacker. CAM-table overflow floods all ports rather than selectively redirecting one IP's traffic to a specific MAC.
Question 29Web Apps & SQL Injection
A file download page takes a file name as a parameter. A tester adds "../" sequences to it and the server returns a system configuration file from outside the web folder. Which fix BEST prevents this?
Correct answer: C. Canonicalize the path and reject it if it leaves the allowed folder
This is directory traversal. The fix is to canonicalize the requested path and check that the result is still inside the permitted folder, ideally with an allow-list of file names. Hiding banners or renaming folders does not stop "../" from walking out of the directory.
This is directory traversal. The fix is to canonicalize the requested path and check that the result is still inside the permitted folder, ideally with an allow-list of file names. Hiding banners or renaming folders does not stop "../" from walking out of the directory.
Question 30Ethics, Social Engineering & Crypto
An attacker has bundled a remote access trojan with an exploit for a PDF reader flaw into a single file, but has not sent it to anyone yet. Which Cyber Kill Chain phase is the attacker in?
Correct answer: A. Weaponization
Weaponization is the phase where the attacker pairs an exploit with a payload to build something that can be delivered. Delivery only starts when the file is actually sent, for example by email, USB drive or a website. Installation happens later, on the victim's machine, after the exploit runs.
Weaponization is the phase where the attacker pairs an exploit with a payload to build something that can be delivered. Delivery only starts when the file is actually sent, for example by email, USB drive or a website. Installation happens later, on the victim's machine, after the exploit runs.
Question 31Wireless, Mobile & Cloud
A tester captures the full connection exchange between a client and a WPA3-Personal access point, then tries an offline dictionary attack against it. The attack fails. Which property of WPA3-Personal BEST explains this?
Correct answer: B. SAE (Dragonfly) never exposes material that can be tested offline
WPA3-Personal uses Simultaneous Authentication of Equals (the Dragonfly key exchange). Each guess needs a live exchange with the AP, so a captured exchange gives nothing to brute-force offline. Protected Management Frames stop deauth spoofing, but they are not what defeats offline cracking.
WPA3-Personal uses Simultaneous Authentication of Equals (the Dragonfly key exchange). Each guess needs a live exchange with the AP, so a captured exchange gives nothing to brute-force offline. Protected Management Frames stop deauth spoofing, but they are not what defeats offline cracking.
Question 32Recon, Scanning & Enumeration
During passive footprinting, a tester wants to view how a target's login page looked two years ago to study old form fields and hidden comments that may still exist. Which resource is the right choice?
Correct answer: A. Wayback Machine (archive.org)
The Wayback Machine on archive.org stores historical snapshots of web pages, letting a tester review old versions of a site. Shodan indexes internet-facing devices and services, not historical copies of web pages.
The Wayback Machine on archive.org stores historical snapshots of web pages, letting a tester review old versions of a site. Shodan indexes internet-facing devices and services, not historical copies of web pages.
Question 33System Hacking & Malware
On an internal Windows network, a tester runs Responder. When users mistype a share name that DNS cannot resolve, the tool answers their broadcast name queries and collects NetNTLMv2 hashes. Which attack is this?
Correct answer: C. LLMNR/NBT-NS poisoning
When DNS fails, Windows falls back to LLMNR and NBT-NS broadcasts, and Responder answers them pretending to be the requested host. The victim then sends its NetNTLMv2 hash, which can be cracked offline or relayed. Disabling LLMNR and NBT-NS through Group Policy stops this.
When DNS fails, Windows falls back to LLMNR and NBT-NS broadcasts, and Responder answers them pretending to be the requested host. The victim then sends its NetNTLMv2 hash, which can be cracked offline or relayed. Disabling LLMNR and NBT-NS through Group Policy stops this.
Question 34Network Attacks & Evasion
An attacker's access port is in VLAN 10, which is also the native VLAN of the trunk between two switches. The attacker sends a frame carrying two stacked 802.1Q tags, outer VLAN 10 and inner VLAN 20, and it reaches a host in VLAN 20, but no reply ever comes back. Which attack is this, and why is it one-directional?
Correct answer: D. Double tagging; the first switch strips the native tag, and replies have no path back
In double tagging, the first switch removes the outer tag because it matches the trunk's native VLAN, and the next switch reads the inner tag and delivers the frame into VLAN 20. Replies carry only a VLAN 20 tag and have no route back to the attacker, so the attack is one-way. Switch spoofing instead forms a full trunk and works in both directions.
In double tagging, the first switch removes the outer tag because it matches the trunk's native VLAN, and the next switch reads the inner tag and delivers the frame into VLAN 20. Replies carry only a VLAN 20 tag and have no route back to the attacker, so the attack is one-way. Switch spoofing instead forms a full trunk and works in both directions.
Question 35Web Apps & SQL Injection
A site sits behind a caching CDN. A tester sends a request with a changed X-Forwarded-Host header, the app uses it to build script links in the page, and the CDN then serves that altered page to every visitor. What is this attack?
Correct answer: D. Web cache poisoning
Web cache poisoning abuses an input the cache does not include in its cache key, such as an unkeyed header, to get a harmful response stored and served to other users. DNS cache poisoning targets name resolution, not the HTTP cache.
Web cache poisoning abuses an input the cache does not include in its cache key, such as an unkeyed header, to get a harmful response stored and served to other users. DNS cache poisoning targets name resolution, not the HTTP cache.
Question 36Ethics, Social Engineering & Crypto
During an incident, an analyst records the domain names and IP addresses the intruders used for command and control. In the Diamond Model of Intrusion Analysis, which core feature do these belong to?
Correct answer: A. Infrastructure
The Diamond Model has four core features: adversary, capability, infrastructure and victim. Infrastructure covers the channels the attacker uses to reach the victim, such as IP addresses, domains and email accounts. Capability is the set of tools and malware, which is the most common mix-up.
The Diamond Model has four core features: adversary, capability, infrastructure and victim. Infrastructure covers the channels the attacker uses to reach the victim, such as IP addresses, domains and email accounts. Capability is the set of tools and malware, which is the most common mix-up.
Question 37Wireless, Mobile & Cloud
A researcher shows that by blocking and replaying message 3 of the WPA2 4-way handshake, a client can be forced to reinstall a key it already uses, resetting its nonce. What is this attack?
Correct answer: B. KRACK
KRACK (Key Reinstallation Attack) replays handshake message 3 so the client reinstalls the key and resets its nonce and replay counter. Nonce reuse then lets the attacker decrypt or replay frames. Dragonblood targets WPA3 SAE side channels and downgrades, not WPA2 key reinstallation.
KRACK (Key Reinstallation Attack) replays handshake message 3 so the client reinstalls the key and resets its nonce and replay counter. Nonce reuse then lets the attacker decrypt or replay frames. Dragonblood targets WPA3 SAE side channels and downgrades, not WPA2 key reinstallation.
Question 38Recon, Scanning & Enumeration
A tester runs theHarvester against a target domain. Which type of information is this tool designed to gather from public sources?
Correct answer: D. Email addresses, subdomains, and hostnames
theHarvester collects OSINT such as email addresses, employee names, subdomains, and hostnames from search engines and public sources. It does not perform port scanning or extract credentials, which are active or post-exploitation tasks.
theHarvester collects OSINT such as email addresses, employee names, subdomains, and hostnames from search engines and public sources. It does not perform port scanning or extract credentials, which are active or post-exploitation tasks.
Question 39System Hacking & Malware
On a reachable domain controller, an attacker uses replication privileges to pull password hashes for any account directly from Active Directory without running code on the DC. Which technique is this?
Correct answer: C. DCSync
DCSync abuses directory replication rights to request account hashes from a DC as if it were another DC, needing no code execution on the target. A silver ticket forges a service ticket and does not extract hashes from the directory.
DCSync abuses directory replication rights to request account hashes from a DC as if it were another DC, needing no code execution on the target. A silver ticket forges a service ticket and does not extract hashes from the directory.
Question 40Network Attacks & Evasion
To find which machines on a subnet may be running a sniffer, an analyst sends ARP requests to each host using a destination MAC that is not the broadcast address but which a card in promiscuous mode will still accept. Replies from hosts that should have ignored the frame suggest sniffing. What is this method called?
Correct answer: B. The ARP non-broadcast test
The ARP non-broadcast test sends requests to a bogus MAC that only a NIC in promiscuous mode passes to the OS, so a host that answers reveals its interface is capturing all frames. The DNS reverse-lookup test is a separate heuristic that watches for hosts resolving sniffed IPs, not a response to a crafted ARP frame.
The ARP non-broadcast test sends requests to a bogus MAC that only a NIC in promiscuous mode passes to the OS, so a host that answers reveals its interface is capturing all frames. The DNS reverse-lookup test is a separate heuristic that watches for hosts resolving sniffed IPs, not a response to a crafted ARP frame.
Question 41Web Apps & SQL Injection
A tester puts a payload after the # in a URL. The server logs never show the payload, yet the script runs because the page's own JavaScript writes location.hash into innerHTML. Which type of XSS is this?
Correct answer: C. DOM-based XSS
In DOM-based XSS the flaw is entirely in client-side code that moves attacker-controlled data (here location.hash) into a dangerous sink. The fragment after # is never sent to the server, which is why the server logs are clean. Reflected XSS needs the server to echo the input back.
In DOM-based XSS the flaw is entirely in client-side code that moves attacker-controlled data (here location.hash) into a dangerous sink. The fragment after # is never sent to the server, which is why the server logs are clean. Reflected XSS needs the server to echo the input back.
Question 42Ethics, Social Engineering & Crypto
Auditors at a publicly traded US company check who can change entries in the accounting system and whether management has certified its internal controls over financial reporting. Which law drives these requirements?
Correct answer: A. Sarbanes-Oxley Act (SOX)
SOX requires public companies to keep accurate financial records and makes management certify their internal controls over financial reporting. GLBA is about how financial institutions protect their customers' personal information, not the accuracy of a company's own financial statements.
SOX requires public companies to keep accurate financial records and makes management certify their internal controls over financial reporting. GLBA is about how financial institutions protect their customers' personal information, not the accuracy of a company's own financial statements.
Question 43Wireless, Mobile & Cloud
During a walkthrough, a tester finds a cheap consumer router plugged into a network jack under a desk. An employee installed it for better signal, and it bridges to the internal LAN with no approval. Which term BEST describes this device?
Correct answer: B. Rogue access point
A rogue AP is an unauthorized access point connected to the organization's wired network, often installed by an insider. An evil twin is different: it is an attacker's AP that copies a legitimate SSID to lure clients, and it is not usually connected to the internal LAN.
A rogue AP is an unauthorized access point connected to the organization's wired network, often installed by an insider. An evil twin is different: it is an attacker's AP that copies a legitimate SSID to lure clients, and it is not usually connected to the internal LAN.
Question 44Recon, Scanning & Enumeration
A WHOIS lookup on a target domain returns a registrant name of "Domains By Proxy" and a generic masked email instead of real contact details. What has most likely happened?
Correct answer: A. A privacy service is masking the registrant
Privacy or proxy services replace the real registrant's details with those of the proxy, so the masked data points to WHOIS privacy protection. An expired domain would show a different status, and DNSSEC signs DNS records rather than altering WHOIS contact fields.
Privacy or proxy services replace the real registrant's details with those of the proxy, so the masked data points to WHOIS privacy protection. An expired domain would show a different status, and DNSSEC signs DNS records rather than altering WHOIS contact fields.
Question 45System Hacking & Malware
An attacker obtains the NTLM hash of a SQL Server service account and uses it to forge Kerberos tickets for that one service, without ever contacting the domain controller. Which artifact has been created?
Correct answer: C. Silver ticket
A silver ticket is a forged service ticket signed with a service account's hash, so it only works for that service and never touches the domain controller. A golden ticket needs the KRBTGT hash and gives access across the whole domain.
A silver ticket is a forged service ticket signed with a service account's hash, so it only works for that service and never touches the domain controller. A golden ticket needs the KRBTGT hash and gives access across the whole domain.
Question 46Network Attacks & Evasion
While investigating a capture, an analyst applies the Wireshark display filter: tcp.flags.syn == 1 && tcp.flags.ack == 0. Which packets will be shown?
Correct answer: B. Only initial connection requests, not the server's SYN-ACK replies
A segment with SYN set and ACK clear is a client's initial connection request; the server's reply would have both SYN and ACK set, so it is excluded. Packets completing the handshake carry ACK, and resets carry the RST flag, so neither matches this filter.
A segment with SYN set and ACK clear is a client's initial connection request; the server's reply would have both SYN and ACK set, so it is excluded. Packets completing the handshake carry ACK, and resets carry the RST flag, so neither matches this filter.
Question 47Web Apps & SQL Injection
A logged-in user changes /api/invoices/1043 to /api/invoices/1044 and sees another customer's invoice. Which OWASP Top 10 (2021) category does this fall under?
Correct answer: D. A01 Broken Access Control
This is an insecure direct object reference (IDOR), which OWASP 2021 places under A01 Broken Access Control. The user is properly logged in, so authentication works; the server simply fails to check that the invoice belongs to that user.
This is an insecure direct object reference (IDOR), which OWASP 2021 places under A01 Broken Access Control. The user is properly logged in, so authentication works; the server simply fails to check that the invoice belongs to that user.
Question 48Ethics, Social Engineering & Crypto
A threat report maps an intrusion to MITRE ATT&CK. Which ATT&CK element describes the adversary's goal behind an action, such as "Credential Access" or "Lateral Movement"?
Correct answer: A. Tactic
Tactics are the "why" of an action: the goal the attacker wants to reach. Techniques are the "how", such as OS Credential Dumping, and procedures are the specific way a particular group carries out a technique.
Tactics are the "why" of an action: the goal the attacker wants to reach. Techniques are the "how", such as OS Credential Dumping, and procedures are the specific way a particular group carries out a technique.
Question 49Wireless, Mobile & Cloud
A tester uses Reaver against an access point with WPS enabled and recovers the WPA2 passphrase within hours. Why is a brute-force attack on the 8-digit WPS PIN practical?
Correct answer: B. The PIN is checked in two halves, so about 11,000 guesses suffice
The AP confirms the first 4 digits separately from the last 4, and the final digit is a checksum. That cuts the space to about 10,000 plus 1,000 guesses. The PIN is not broadcast in beacons; the flaw is in how it is validated.
The AP confirms the first 4 digits separately from the last 4, and the final digit is a checksum. That cuts the space to about 10,000 plus 1,000 guesses. The PIN is not broadcast in beacons; the flaw is in how it is validated.
Question 50Recon, Scanning & Enumeration
A tester needs to find the mail servers responsible for receiving email for a target domain, in priority order. Which DNS record type should be queried?
Correct answer: D. MX
MX records list a domain's mail exchangers along with priority values, which is exactly what the tester needs. PTR records map IPs back to names, CNAME defines aliases, and SOA holds zone administrative data.
MX records list a domain's mail exchangers along with priority values, which is exactly what the tester needs. PTR records map IPs back to names, CNAME defines aliases, and SOA holds zone administrative data.
Question 51System Hacking & Malware
A Windows application loads a DLL by name without specifying its full path, and a writable directory earlier in the search order is attacker-controlled. Which privilege escalation technique does this enable?
Correct answer: D. DLL hijacking
When a program resolves a DLL by name, Windows walks a search order; a malicious DLL placed in an earlier writable location loads instead, which is DLL hijacking. An unquoted service path abuses spaces in a service's executable path, a different flaw.
When a program resolves a DLL by name, Windows walks a search order; a malicious DLL placed in an earlier writable location loads instead, which is DLL hijacking. An unquoted service path abuses spaces in a service's executable path, a different flaw.
Question 52Network Attacks & Evasion
A web server under attack has a backlog full of half-open connections, each stuck after the server sent SYN-ACK and never got the final ACK. The team enables a defense that lets the server validate returning clients without keeping state for each pending connection. Which defense is this?
Correct answer: A. Enabling SYN cookies to encode handshake state in the sequence number
SYN cookies let the server encode the needed handshake state into the SYN-ACK sequence number instead of allocating a backlog entry, so a flood of half-open SYNs cannot exhaust memory and only a valid returning ACK is honored. Growing the thread pool does nothing about connections that never finish the handshake.
SYN cookies let the server encode the needed handshake state into the SYN-ACK sequence number instead of allocating a backlog entry, so a flood of half-open SYNs cannot exhaust memory and only a valid returning ACK is honored. Growing the thread pool does nothing about connections that never finish the handshake.
Question 53Web Apps & SQL Injection
An app accepts XML uploads. A tester defines an external entity pointing to a local file and the file's contents appear in the app's response. Which fix BEST removes the root cause?
Correct answer: C. Disable DTD and external entity processing in the XML parser
This is XML external entity (XXE) injection. Turning off DTDs and external entities in the parser removes the feature being abused. Schema validation and output encoding do not stop the parser from resolving the entity in the first place.
This is XML external entity (XXE) injection. Turning off DTDs and external entities in the parser removes the feature being abused. Schema validation and output encoding do not stop the parser from resolving the entity in the first place.
Question 54Ethics, Social Engineering & Crypto
An attacker studies a company's CEO for weeks, then sends her a personalized email styled as a court subpoena with a link to "view the case file". Which term BEST describes this attack?
Correct answer: A. Whaling
Whaling is spear phishing aimed at senior executives, often using legal or financial themes that suit their role. Spear phishing is not wrong, but whaling is the more precise term when the target is a top executive. Clone phishing copies a real email the victim received earlier.
Whaling is spear phishing aimed at senior executives, often using legal or financial themes that suit their role. Spear phishing is not wrong, but whaling is the more precise term when the target is a top executive. Clone phishing copies a real email the victim received earlier.
Question 55Wireless, Mobile & Cloud
A red team uses aireplay-ng to flood spoofed deauthentication frames, kicking clients off a corporate WPA2 network so they reconnect to an evil twin. Which control MOST directly stops the spoofed frames from working?
Correct answer: B. Enabling 802.11w Protected Management Frames
802.11w (PMF) adds integrity protection to deauthentication and disassociation frames, so clients ignore forged ones. Hiding the SSID and MAC filtering do nothing here, because deauth frames are unauthenticated management frames that anyone can spoof without PMF.
802.11w (PMF) adds integrity protection to deauthentication and disassociation frames, so clients ignore forged ones. Hiding the SSID and MAC filtering do nothing here, because deauth frames are unauthenticated management frames that anyone can spoof without PMF.
Question 56Recon, Scanning & Enumeration
A tester captures a target's response to a crafted probe and sees an IP TTL of 128 and a TCP window size of 8192. Which operating system family does this fingerprint BEST suggest?
Correct answer: B. Legacy Windows host
An initial TTL of 128 combined with an 8192 window size is characteristic of older Windows systems. Linux hosts typically use an initial TTL of 64, so the values point away from Linux.
An initial TTL of 128 combined with an 8192 window size is characteristic of older Windows systems. Linux hosts typically use an initial TTL of 64, so the values point away from Linux.
Question 57System Hacking & Malware
A tester finds a Windows service whose executable path is C:\Program Files\My App\svc.exe entered without quotation marks, and C:\ is writable. Which file would Windows try to run first?
Correct answer: C. C:\Program.exe
With an unquoted path containing spaces, Windows tries each truncation at a space, so it attempts C:\Program.exe before the intended target. Placing a malicious Program.exe there yields execution with the service's privileges.
With an unquoted path containing spaces, Windows tries each truncation at a space, so it attempts C:\Program.exe before the intended target. Placing a malicious Program.exe there yields execution with the service's privileges.
Question 58Network Attacks & Evasion
A single attacking host keeps a web server's worker slots occupied by opening many connections and sending partial HTTP request headers very slowly, one line every few seconds, never completing a request. Bandwidth use stays tiny. Which attack BEST matches this behavior?
Correct answer: B. A Slowloris low-and-slow application-layer attack
Slowloris ties up the server by holding many connections open with trickled partial headers, exhausting the worker pool at the application layer while using almost no bandwidth. A volumetric flood or Smurf would instead be defined by high traffic volume, which is absent here.
Slowloris ties up the server by holding many connections open with trickled partial headers, exhausting the worker pool at the application layer while using almost no bandwidth. A volumetric flood or Smurf would instead be defined by high traffic volume, which is absent here.
Question 59Web Apps & SQL Injection
An app stores a serialized object in a cookie. A tester modifies the object and achieves code execution on the server when it is deserialized. Under which OWASP Top 10 (2021) category does insecure deserialization now fall?
Correct answer: D. A08 Software and Data Integrity Failures
In the 2021 list, insecure deserialization was merged into A08 Software and Data Integrity Failures, which covers trusting data or code without checking its integrity. Signing the data and avoiding native deserialization of untrusted input are the main defenses.
In the 2021 list, insecure deserialization was merged into A08 Software and Data Integrity Failures, which covers trusting data or code without checking its integrity. Signing the data and avoiding native deserialization of untrusted input are the main defenses.
Question 60Ethics, Social Engineering & Crypto
Several employees type the correct address of the company's payroll portal but land on a convincing fake login page. No phishing emails were sent, and the attacker had altered the hosts file on their PCs. What is this attack?
Correct answer: A. Pharming
Pharming sends users to a fake site by tampering with name resolution, such as the hosts file or a DNS server, so even a correctly typed URL leads to the attacker. Typosquatting only works when the user mistypes the address.
Pharming sends users to a fake site by tampering with name resolution, such as the hosts file or a DNS server, so even a correctly typed URL leads to the attacker. Typosquatting only works when the user mistypes the address.
Question 61Wireless, Mobile & Cloud
An attacker convinces a mobile carrier to move a victim's phone number to a new SIM, then resets the victim's banking password using SMS codes. Which change BEST prevents this type of account takeover?
Correct answer: C. Replacing SMS codes with an authenticator app or FIDO key
SIM swapping moves the phone number, so anything sent by SMS goes to the attacker. App-based or hardware-key MFA is bound to the device or key, not the number. Device encryption and lock screen passcodes do not help, because the attacker never touches the victim's phone.
SIM swapping moves the phone number, so anything sent by SMS goes to the attacker. App-based or hardware-key MFA is bound to the device or key, not the number. Device encryption and lock screen passcodes do not help, because the attacker never touches the victim's phone.
Question 62Recon, Scanning & Enumeration
A tester runs "nmap -sN target" against a host and every port returns no response (no RST). According to RFC 793 behavior, how should these ports be interpreted?
Correct answer: A. Ports are open or filtered
In a NULL scan, a closed port replies with RST while an open port sends nothing, so silence means the port is open or filtered. A closed port would have produced an RST, which did not happen here.
In a NULL scan, a closed port replies with RST while an open port sends nothing, so silence means the port is open or filtered. A closed port would have produced an RST, which did not happen here.
Question 63System Hacking & Malware
An attacker hides a secret file on an NTFS volume by attaching it as an extra named stream to an existing, harmless file, so it does not appear in a normal directory listing. Which feature is being abused?
Correct answer: D. Alternate Data Streams
NTFS Alternate Data Streams let additional named streams ride alongside a file's main data and stay hidden from standard directory listings. Slack space is leftover space in a cluster, not a named stream attached to a file.
NTFS Alternate Data Streams let additional named streams ride alongside a file's main data and stay hidden from standard directory listings. Slack space is leftover space in a cluster, not a named stream attached to a file.
Question 64Network Attacks & Evasion
Two classic amplification attacks spoof the victim's source IP and abuse a network broadcast to multiply traffic. One elicits ICMP echo replies from every host on the subnet; the other elicits UDP responses from services like echo or chargen. Which pairing is correct?
Correct answer: A. Smurf uses ICMP echo; Fraggle uses UDP echo/chargen
Smurf broadcasts ICMP echo requests with the victim's spoofed source so every host floods the victim with echo replies, while Fraggle does the same using UDP packets aimed at echo or chargen ports. The two differ only in protocol, so claiming both use ICMP, or swapping them, is wrong.
Smurf broadcasts ICMP echo requests with the victim's spoofed source so every host floods the victim with echo replies, while Fraggle does the same using UDP packets aimed at echo or chargen ports. The two differ only in protocol, so claiming both use ICMP, or swapping them, is wrong.
Question 65Web Apps & SQL Injection
A PHP page loads templates using a page parameter. A tester makes it load and run code from a URL on the tester's own server. Which PHP setting must be enabled on the target for this to work?
Correct answer: C. allow_url_include
Remote file inclusion needs PHP to include files from URLs, which requires allow_url_include to be on (it is off by default). open_basedir restricts local file paths and would not enable remote includes.
Remote file inclusion needs PHP to include files from URLs, which requires allow_url_include to be on (it is off by default). open_basedir restricts local file paths and would not enable remote includes.
Question 66Ethics, Social Engineering & Crypto
A visitor carrying two heavy boxes asks an employee to hold the secure door for him. The employee knowingly lets him in without checking for a badge. In CEH terms, what is this?
Correct answer: D. Piggybacking
Piggybacking is when an authorized person lets an unauthorized person through, often after a request for help like this one. Tailgating is when the intruder slips in close behind someone without their consent or awareness. Mantraps and a firm "badge every person" rule counter both.
Piggybacking is when an authorized person lets an unauthorized person through, often after a request for help like this one. Tailgating is when the intruder slips in close behind someone without their consent or awareness. Mantraps and a firm "badge every person" rule counter both.
Question 67Wireless, Mobile & Cloud
A tester decompiles an Android banking APK and finds a production API secret key hardcoded in a Java class. Under the OWASP Mobile Top 10 (2024), which category fits BEST?
Correct answer: D. M1: Improper Credential Usage
The 2024 list places hardcoded credentials and keys under M1, Improper Credential Usage. M9 covers sensitive data the app writes insecurely at runtime, such as tokens in plaintext files, not secrets baked into the code.
The 2024 list places hardcoded credentials and keys under M1, Improper Credential Usage. M9 covers sensitive data the app writes insecurely at runtime, such as tokens in plaintext files, not secrets baked into the code.
Question 68Recon, Scanning & Enumeration
A tester on a fast, reliable LAN wants Nmap to run faster than its default timing, but without the most extreme template, which can sacrifice accuracy and is very noisy. Which timing template fits BEST?
Correct answer: B. -T4
-T4 (Aggressive) is the usual choice for speeding up scans on fast, reliable networks. -T3 (Normal) is the default, so it is not faster, and -T5 (Insane) is the most extreme level that can miss results. -T1 (Sneaky) is a slow template for IDS evasion.
-T4 (Aggressive) is the usual choice for speeding up scans on fast, reliable networks. -T3 (Normal) is the default, so it is not faster, and -T5 (Insane) is the most extreme level that can miss results. -T1 (Sneaky) is a slow template for IDS evasion.
Question 69System Hacking & Malware
After gaining access to a Windows host, an attacker runs 'auditpol' to disable specific audit categories rather than clearing the whole log. What is the main advantage of this over wiping logs?
Correct answer: C. It avoids the obvious gap a cleared log creates
Clearing a log leaves a conspicuous empty or truncated record that defenders notice, whereas quietly turning off audit categories stops new evidence while existing history looks normal. It does not encrypt logs or alter account databases.
Clearing a log leaves a conspicuous empty or truncated record that defenders notice, whereas quietly turning off audit categories stops new evidence while existing history looks normal. It does not encrypt logs or alter account databases.
Question 70Network Attacks & Evasion
A legacy host crashes when it receives a stream of IP fragments whose offset fields are deliberately set so the fragments overlap and cannot be reassembled correctly. Which denial-of-service attack is described?
Correct answer: B. A Teardrop attack exploiting overlapping fragment offsets
Teardrop sends IP fragments with mangled, overlapping offset values so a vulnerable reassembly routine miscalculates and crashes. The Ping of Death instead relies on a single oversized packet, not malformed overlapping fragment offsets.
Teardrop sends IP fragments with mangled, overlapping offset values so a vulnerable reassembly routine miscalculates and crashes. The Ping of Death instead relies on a single oversized packet, not malformed overlapping fragment offsets.
Question 71Web Apps & SQL Injection
A network tool page runs ping on an IP address the user enters. A tester adds a shell separator and another command after the IP, and the output shows the server's user list. Which fix BEST addresses the root cause?
Correct answer: C. Avoid the shell and strictly validate the IP format
This is OS command injection: user input reaches a system shell. Avoiding the shell entirely and accepting only input that matches a strict IP format removes the injection point. Output encoding protects the browser, not the server's shell.
This is OS command injection: user input reaches a system shell. Avoiding the shell entirely and accepting only input that matches a strict IP format removes the injection point. Output encoding protects the browser, not the server's shell.
Question 72Ethics, Social Engineering & Crypto
A finance clerk joins a video call where the CFO and two colleagues urgently ask him to wire funds to a new supplier. All three participants were AI-generated deepfakes. Which control would MOST likely have stopped the transfer?
Correct answer: B. Out-of-band verification and dual payment approval
Deepfakes can fake a face and voice convincingly, so the defense is a process that does not trust the call itself: confirm through a separate known channel and require a second approver. Spam filtering and DMARC protect email, but this attack happened on a live video call.
Deepfakes can fake a face and voice convincingly, so the defense is a process that does not trust the call itself: confirm through a separate known channel and require a second approver. Spam filtering and DMARC protect email, but this attack happened on a live video call.
Question 73Wireless, Mobile & Cloud
A company allows personal phones to access corporate email. Security is worried that jailbroken iPhones and rooted Android devices bypass app sandboxing. Which control BEST addresses this?
Correct answer: C. MDM compliance checks that block jailbroken or rooted devices
MDM can detect jailbreak or root status and deny access through conditional access when a device is non-compliant. Rooting removes the OS protections that keep apps isolated. A VPN protects data in transit but does nothing about a compromised device.
MDM can detect jailbreak or root status and deny access through conditional access when a device is non-compliant. Rooting removes the OS protections that keep apps isolated. A VPN protects data in transit but does nothing about a compromised device.
Question 74Recon, Scanning & Enumeration
A tester issues "nmap -sS -D 10.0.0.5,10.0.0.7,ME,10.0.0.9 target". What is the purpose of the addresses other than ME in this command?
Correct answer: A. They are spoofed decoy sources hiding the real scanner
The -D option sends scan packets that appear to come from decoy IPs as well as the real one, making it harder to tell which source is the true scanner. The addresses are not targets and have nothing to do with port selection.
The -D option sends scan packets that appear to come from decoy IPs as well as the real one, making it harder to tell which source is the true scanner. The addresses are not targets and have nothing to do with port selection.
Question 75System Hacking & Malware
A rootkit survives OS reinstallation and operates below the operating system by residing in device firmware. Which rootkit type is this?
Correct answer: D. Firmware/hardware rootkit
A firmware rootkit embeds in hardware firmware such as the BIOS/UEFI or a device controller, so it persists even after the OS is wiped and reinstalled. A kernel-mode rootkit lives in OS kernel space and is removed by replacing the OS.
A firmware rootkit embeds in hardware firmware such as the BIOS/UEFI or a device controller, so it persists even after the OS is wiped and reinstalled. A kernel-mode rootkit lives in OS kernel space and is removed by replacing the OS.
Question 76Network Attacks & Evasion
An attacker on the path between a client and server observes the TCP traffic, predicts the next expected sequence number, and injects a spoofed segment that the server accepts as part of the live session, desynchronizing the real client. Which category of session hijacking is this?
Correct answer: A. Network-level hijacking via TCP sequence prediction
Predicting sequence numbers and injecting accepted TCP segments operates on the transport session itself, which defines network-level hijacking. Stealing a cookie is application-level, and a man-in-the-browser works inside the client software rather than by forging transport-layer sequence numbers.
Predicting sequence numbers and injecting accepted TCP segments operates on the transport session itself, which defines network-level hijacking. Stealing a cookie is application-level, and a man-in-the-browser works inside the client software rather than by forging transport-layer sequence numbers.
Question 77Web Apps & SQL Injection
An attacker loads a bank's transfer page inside an invisible iframe on top of a fake "Claim your prize" button. Which response header BEST stops this?
Correct answer: C. Content-Security-Policy: frame-ancestors 'none'
This is clickjacking. The frame-ancestors directive of CSP (or the older X-Frame-Options header) tells the browser not to render the page inside frames on other sites. HSTS only forces HTTPS and does nothing about framing.
This is clickjacking. The frame-ancestors directive of CSP (or the older X-Frame-Options header) tells the browser not to render the page inside frames on other sites. HSTS only forces HTTPS and does nothing about framing.
Question 78Ethics, Social Engineering & Crypto
Malware on an engineer's laptop steals his VPN credentials, and an outside attacker uses them to browse internal file shares. The engineer has no idea this is happening. How does CEH classify this insider threat?
Correct answer: D. Compromised insider
A compromised insider is a legitimate user whose access is being used by an outside attacker, usually without their knowledge. A negligent insider causes harm through their own careless actions, such as misconfiguring a share, rather than having their account taken over.
A compromised insider is a legitimate user whose access is being used by an outside attacker, usually without their knowledge. A negligent insider causes harm through their own careless actions, such as misconfiguring a share, rather than having their account taken over.
Question 79Wireless, Mobile & Cloud
Hundreds of IP cameras at a client site join a botnet that launches DDoS attacks. Analysis shows the malware scanned for open Telnet and logged in with factory usernames and passwords. Which control would have MOST likely prevented the infection?
Correct answer: D. Changing default credentials and disabling Telnet
This is Mirai-style behavior: it spreads by trying a built-in list of default credentials over Telnet. Changing defaults and closing Telnet removes the entry point. A VLAN that still allows internet access does not stop the login, and a WAF does not inspect Telnet.
This is Mirai-style behavior: it spreads by trying a built-in list of default credentials over Telnet. Changing defaults and closing Telnet removes the entry point. A VLAN that still allows internet access does not stop the login, and a WAF does not inspect Telnet.
Question 80Recon, Scanning & Enumeration
A tester needs to confirm whether a host is alive but all ICMP echo requests are being dropped by a firewall. Which hping3 approach is a reasonable alternative to detect the live host?
Correct answer: B. Send a TCP SYN to a likely open port and watch for a SYN/ACK
If ICMP is blocked, a TCP SYN to a commonly open port that returns a SYN/ACK confirms the host is up. Resending ICMP in any form still relies on the protocol the firewall is already dropping.
If ICMP is blocked, a TCP SYN to a commonly open port that returns a SYN/ACK confirms the host is up. Resending ICMP in any form still relies on the protocol the firewall is already dropping.
Question 81System Hacking & Malware
An incident team finds malware that executes entirely in memory using PowerShell and legitimate signed Windows binaries, leaving no malicious file on disk. This behavior is BEST described as using what?
Correct answer: B. Fileless techniques with LOLBins
Fileless malware runs in memory and abuses living-off-the-land binaries (LOLBins) like legitimate signed tools to execute, avoiding a malicious file on disk. A dropper, by contrast, writes a payload file to disk, which is exactly what this case lacks.
Fileless malware runs in memory and abuses living-off-the-land binaries (LOLBins) like legitimate signed tools to execute, avoiding a malicious file on disk. A dropper, by contrast, writes a payload file to disk, which is exactly what this case lacks.
Question 82Network Attacks & Evasion
Malware installed as a browser extension waits for the user to log in to their bank, then silently alters transaction fields in the page before they are submitted, even though the session uses HTTPS and the padlock shows a valid certificate. Which attack is this?
Correct answer: D. A man-in-the-browser attack altering data inside the client
A man-in-the-browser sits inside the browser via a malicious extension and edits data after decryption and before submission, so valid TLS and a correct certificate give no protection. A TLS man-in-the-middle would fail certificate validation, which is not what happens here.
A man-in-the-browser sits inside the browser via a malicious extension and edits data after decryption and before submission, so valid TLS and a correct certificate give no protection. A TLS man-in-the-middle would fail certificate validation, which is not what happens here.
Question 83Web Apps & SQL Injection
A tester edits a JWT, sets the header algorithm to "none", removes the signature and changes the role claim to admin. The API accepts it. Which fix BEST addresses this?
Correct answer: C. Reject unsigned tokens and accept only the expected algorithm
The server is trusting the algorithm named in the token itself. It should enforce the expected signing algorithm and always verify the signature, rejecting "none". A shorter lifetime only limits how long a forged token works.
The server is trusting the algorithm named in the token itself. It should enforce the expected signing algorithm and always verify the signature, rejecting "none". A shorter lifetime only limits how long a forged token works.
Question 84Ethics, Social Engineering & Crypto
A tester recovers printed org charts, old invoices and password reset letters from a company's recycling bins. Which countermeasure BEST addresses this weakness?
Correct answer: B. Cross-cut shredding and locked disposal bins
This is dumpster diving, and the fix is to destroy paper before it leaves the building and keep disposal bins locked. A clean desk policy protects papers left on desks during the day, not documents that have already been thrown away.
This is dumpster diving, and the fix is to destroy paper before it leaves the building and keep disposal bins locked. A clean desk policy protects papers left on desks during the day, not documents that have already been thrown away.
Question 85Wireless, Mobile & Cloud
A tester on a plant's control network sends Modbus TCP 'write single coil' commands to a PLC and changes a pump's state without any credentials. Why does this work?
Correct answer: C. Modbus TCP has no built-in authentication
Standard Modbus was designed for trusted serial links and has no authentication or encryption. Any host that can reach port 502 can send valid read and write commands. Modbus TCP runs over TCP, not UDP, and no exploit is needed when the protocol itself trusts every sender.
Standard Modbus was designed for trusted serial links and has no authentication or encryption. Any host that can reach port 502 can send valid read and write commands. Modbus TCP runs over TCP, not UDP, and no exploit is needed when the protocol itself trusts every sender.
Question 86Recon, Scanning & Enumeration
A tester runs "nmap -sV --script banner target" and one port returns a text string identifying the software and version. What technique has the tester used?
Correct answer: A. Banner grabbing
Reading the service identification string a server returns on connection is banner grabbing, which reveals the software and version. OS fingerprinting infers the operating system from packet behavior rather than reading an application banner.
Reading the service identification string a server returns on connection is banner grabbing, which reveals the software and version. OS fingerprinting infers the operating system from packet behavior rather than reading an application banner.
Question 87System Hacking & Malware
A malware sample infects both the boot sector and executable files, spreading through either vector. Which classification fits it?
Correct answer: B. Multipartite virus
A multipartite virus infects both boot records and program files, using multiple propagation paths at once. A stealth virus is defined by hiding its changes from detection, not by infecting two targets.
A multipartite virus infects both boot records and program files, using multiple propagation paths at once. A stealth virus is defined by hiding its changes from detection, not by infecting two targets.
Question 88Network Attacks & Evasion
After a session-hijacking incident where attackers replayed cookies captured over an accidental plain-HTTP request, the team wants browsers to refuse any non-HTTPS connection to the site for a set period, closing the window for such capture. Which mechanism enforces this?
Correct answer: A. HTTP Strict Transport Security (HSTS)
HSTS tells the browser to connect only over HTTPS for a declared max-age, so it never sends the stray plain-HTTP request that leaked the cookie. The Secure flag only stops that one cookie from being sent over HTTP and HttpOnly only blocks script access; neither makes the browser refuse non-HTTPS connections.
HSTS tells the browser to connect only over HTTPS for a declared max-age, so it never sends the stray plain-HTTP request that leaked the cookie. The Secure flag only stops that one cookie from being sent over HTTP and HttpOnly only blocks script access; neither makes the browser refuse non-HTTPS connections.
Question 89Web Apps & SQL Injection
An API reflects any Origin header back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. What is the main risk?
Correct answer: C. Any website can read a logged-in victim's API responses
Reflecting every origin while allowing credentials means a malicious site can make requests with the victim's cookies and read the replies. The fix is a strict allow-list of trusted origins. CORS does not affect DNS or the HttpOnly status of cookies.
Reflecting every origin while allowing credentials means a malicious site can make requests with the victim's cookies and read the replies. The fix is a strict allow-list of trusted origins. CORS does not affect DNS or the HttpOnly status of cookies.
Question 90Ethics, Social Engineering & Crypto
A breached database shows that users with the same password have identical hashes, and the attacker cracked most of them in minutes using rainbow tables. Which change BEST fixes this?
Correct answer: D. Add a unique random salt to each password
A unique salt per user makes identical passwords produce different hashes and makes precomputed rainbow tables useless. Unsalted SHA-256 still gives identical hashes for identical passwords, and rainbow tables exist for it too. A slow algorithm such as bcrypt or Argon2 adds further protection.
A unique salt per user makes identical passwords produce different hashes and makes precomputed rainbow tables useless. Unsalted SHA-256 still gives identical hashes for identical passwords, and rainbow tables exist for it too. A slow algorithm such as bcrypt or Argon2 adds further protection.
Question 91Wireless, Mobile & Cloud
An OT team wants business analysts on the corporate network to view production data from the plant historian, without opening direct paths into control systems. Under the Purdue model, where should the replica historian be placed?
Correct answer: D. The industrial DMZ between Levels 3 and 4
The industrial DMZ (often called Level 3.5) brokers data between IT and OT, so enterprise users never connect directly to control zones. Putting the replica at Level 2 would let corporate traffic reach the supervisory layer, which defeats the segmentation.
The industrial DMZ (often called Level 3.5) brokers data between IT and OT, so enterprise users never connect directly to control zones. Putting the replica at Level 2 would let corporate traffic reach the supervisory layer, which defeats the segmentation.
Question 92Recon, Scanning & Enumeration
A tester wants to scan a target that is only reachable over IPv6 and knows its global address. Which Nmap option is required to scan it?
Correct answer: A. -6
The -6 flag tells Nmap to treat the targets as IPv6 addresses, which is necessary to scan an IPv6-only host. -Pn only skips host discovery and does not switch the address family.
The -6 flag tells Nmap to treat the targets as IPv6 addresses, which is necessary to scan an IPv6-only host. -Pn only skips host discovery and does not switch the address family.
Question 93System Hacking & Malware
During triage, an analyst sees a small program whose only job was to connect out and retrieve the larger malicious payload from a remote server. What is this component called?
Correct answer: B. Downloader
A downloader is a lightweight component that reaches out and fetches the main payload from a remote location. A dropper differs because it already contains the payload embedded within itself and writes it to disk, with no remote retrieval.
A downloader is a lightweight component that reaches out and fetches the main payload from a remote location. A dropper differs because it already contains the payload embedded within itself and writes it to disk, with no remote retrieval.
Question 94Network Attacks & Evasion
A security team replaces a sensor that only matches known attack byte patterns with one that first learns a baseline of normal traffic and alerts on deviations. During the first week it generates many alerts on legitimate but unusual activity. Which description fits the new sensor and that side effect?
Correct answer: D. Anomaly-based IDS producing excess false positives
A sensor that builds a baseline and flags deviations is anomaly-based, and its tendency to alert on benign-but-unusual traffic is a false positive, benign activity labeled malicious. A false negative is the opposite error, missing a real attack, so that pairing does not match the described behavior.
A sensor that builds a baseline and flags deviations is anomaly-based, and its tendency to alert on benign-but-unusual traffic is a false positive, benign activity labeled malicious. A false negative is the opposite error, missing a real attack, so that pairing does not match the described behavior.
Question 95Web Apps & SQL Injection
A user updates their profile through an API and adds an extra field, "isAdmin": true, to the JSON body. The API saves it and the user becomes an administrator. What is this vulnerability called?
Correct answer: C. Mass assignment
Mass assignment happens when an API binds every client-supplied field to the data model, including fields users should never set. OWASP API Top 10 2023 groups it under Broken Object Property Level Authorization. BOLA is about accessing another user's object, not changing a protected property of your own.
Mass assignment happens when an API binds every client-supplied field to the data model, including fields users should never set. OWASP API Top 10 2023 groups it under Broken Object Property Level Authorization. BOLA is about accessing another user's object, not changing a protected property of your own.
Question 96Ethics, Social Engineering & Crypto
An application uses a hash function with a 128-bit output. Roughly how many hash computations would a birthday attack need to find any two inputs with the same hash?
Correct answer: A. 2^64
Because of the birthday paradox, a collision is likely after about 2^(n/2) attempts, which is 2^64 for a 128-bit hash. 2^128 is roughly the cost of finding an input that matches one specific hash, a much harder problem.
Because of the birthday paradox, a collision is likely after about 2^(n/2) attempts, which is 2^64 for a 128-bit hash. 2^128 is roughly the cost of finding an input that matches one specific hash, a much harder problem.
Question 97Wireless, Mobile & Cloud
A company runs its web application on a PaaS offering. A critical vulnerability is announced in the operating system that hosts the platform runtime. Who is primarily responsible for patching it?
Correct answer: C. The cloud provider, because it manages the OS in PaaS
In PaaS the provider manages the infrastructure, OS, and runtime, while the customer owns its application code, data, and access settings. In IaaS the customer would patch the guest OS, which is the distinction this question tests.
In PaaS the provider manages the infrastructure, OS, and runtime, while the customer owns its application code, data, and access settings. In IaaS the customer would patch the guest OS, which is the distinction this question tests.
Question 98Recon, Scanning & Enumeration
A tester splits probe packets into very small pieces using Nmap's -f option. What is the intended effect of this technique?
Correct answer: A. Break headers across fragments to evade some packet filters
Fragmentation breaks the TCP header across multiple small IP fragments so simple filters that inspect a single packet may miss the signature. It is an evasion technique and does not make scanning faster or improve OS detection.
Fragmentation breaks the TCP header across multiple small IP fragments so simple filters that inspect a single packet may miss the signature. It is an evasion technique and does not make scanning faster or improve OS detection.
Question 99System Hacking & Malware
An analyst examines a suspicious executable with PEiD and 'strings' but does not run it, looking at headers, imports, and embedded text. Which analysis method is this?
Correct answer: B. Static analysis
Inspecting a binary's headers, imports, and strings without executing it is static analysis. Dynamic analysis requires actually running the sample and observing its behavior, which is not happening here.
Inspecting a binary's headers, imports, and strings without executing it is static analysis. Dynamic analysis requires actually running the sample and observing its behavior, which is not happening here.
Question 100Network Attacks & Evasion
A company wants a perimeter device that terminates each client connection, inspects the full application-layer content such as HTTP requests, and opens a separate connection to the internal server on the client's behalf, so the two never talk directly. Which firewall type is this?
Correct answer: A. An application-level proxy (proxy) firewall
An application-level proxy terminates the client session, inspects the application-layer payload, and makes its own connection to the server, so client and server never communicate directly. A stateful firewall tracks connection state but forwards packets between the endpoints rather than proxying the application content.
An application-level proxy terminates the client session, inspects the application-layer payload, and makes its own connection to the server, so client and server never communicate directly. A stateful firewall tracks connection state but forwards packets between the endpoints rather than proxying the application content.
Question 101Web Apps & SQL Injection
Before running a UNION-based SQL injection, a tester needs to know how many columns the original query returns. Which approach is commonly used?
Correct answer: C. Increase an ORDER BY number until the query errors
Ordering by column 1, 2, 3 and so on works until the number exceeds the column count, which causes an error. The UNION must then select exactly that many columns. A single quote only confirms injection exists; it does not give the column count.
Ordering by column 1, 2, 3 and so on works until the number exceeds the column count, which causes an error. The UNION must then select exactly that many columns. A single quote only confirms injection exists; it does not give the column count.
Question 102Ethics, Social Engineering & Crypto
Why does encrypting data twice with DES using two different 56-bit keys (2DES) give only about 57 bits of effective security instead of 112?
Correct answer: B. It is vulnerable to a meet-in-the-middle attack
In a meet-in-the-middle attack, the attacker encrypts a known plaintext under every possible first key, decrypts the ciphertext under every possible second key, and looks for a match in the middle. That takes about 2^57 work instead of 2^112, which is why 3DES uses three stages. Birthday attacks target hash collisions, not this.
In a meet-in-the-middle attack, the attacker encrypts a known plaintext under every possible first key, decrypts the ciphertext under every possible second key, and looks for a match in the middle. That takes about 2^57 work instead of 2^112, which is why 3DES uses three stages. Birthday attacks target hash collisions, not this.
Question 103Wireless, Mobile & Cloud
A tester gains code execution in a Kubernetes pod and reads the mounted service account token. Using it, the tester lists secrets across every namespace. Which fix BEST addresses the root cause?
Correct answer: D. Scoping RBAC so the service account has least privilege
The token worked cluster-wide because its service account had excessive RBAC rights. Granting only the permissions the workload needs, or not mounting the token at all, limits the damage. Encrypting etcd protects stored data on disk but not access through the API with a valid token.
The token worked cluster-wide because its service account had excessive RBAC rights. Granting only the permissions the workload needs, or not mounting the token at all, limits the damage. Encrypting etcd protects stored data on disk but not access through the API with a valid token.
Question 104Recon, Scanning & Enumeration
While enumerating a Windows host, a tester runs nbtstat and sees a NetBIOS name with the suffix code <1B>. What does this code indicate?
Correct answer: A. The domain master browser (PDC emulator)
The <1B> suffix identifies the domain master browser, typically the PDC emulator, which is valuable for mapping the domain. The <20> suffix, by contrast, marks the file and printer sharing (server) service.
The <1B> suffix identifies the domain master browser, typically the PDC emulator, which is valuable for mapping the domain. The <20> suffix, by contrast, marks the file and printer sharing (server) service.
Question 105System Hacking & Malware
Malware authors often run their executables through a packer before release. What is the main purpose of this?
Correct answer: B. Obfuscate the code to evade signature detection
A packer compresses and obfuscates the executable so its on-disk bytes no longer match known signatures, unpacking itself in memory at runtime. It does not grant privileges, set up C2, or encrypt victim files on its own.
A packer compresses and obfuscates the executable so its on-disk bytes no longer match known signatures, unpacking itself in memory at runtime. It does not grant privileges, set up C2, or encrypt victim files on its own.
Question 106Network Attacks & Evasion
A defender deploys a decoy system that emulates only a few services with limited, scripted responses and captures connection attempts, choosing it specifically to reduce the risk that an attacker could use the decoy to pivot into the real network. Which honeypot type did they choose?
Correct answer: A. A low-interaction honeypot emulating limited services
A low-interaction honeypot emulates a few services with canned responses, so there is no real OS for an attacker to take over and pivot from. High-interaction and pure honeypots run real systems, which carry exactly the pivot risk the defender wanted to avoid.
A low-interaction honeypot emulates a few services with canned responses, so there is no real OS for an attacker to take over and pivot from. High-interaction and pure honeypots run real systems, which carry exactly the pivot risk the defender wanted to avoid.
Question 107Web Apps & SQL Injection
A sign-up form stores the username safely with a parameterized query. Later, the password change feature builds a query by joining that stored username into a SQL string, and an attack fires at that point. What is this?
Correct answer: D. Second-order SQL injection
In second-order SQL injection the input is stored safely first and only becomes dangerous when other code later reuses it in an unsafe query. That is why every query, including ones using data already in the database, must be parameterized.
In second-order SQL injection the input is stored safely first and only becomes dangerous when other code later reuses it in an unsafe query. That is why every query, including ones using data already in the database, must be parameterized.
Question 108Ethics, Social Engineering & Crypto
Two servers agree on a session key using basic Diffie-Hellman with no certificates or signatures. Which weakness does this leave open?
Correct answer: A. An interceptor can impersonate each server to the other
Diffie-Hellman never sends the shared secret; each side calculates it. But plain Diffie-Hellman does not prove who is on the other end, so an attacker can set up one key with each server and relay traffic. Signing the exchange with certificates, as TLS does, closes this gap.
Diffie-Hellman never sends the shared secret; each side calculates it. But plain Diffie-Hellman does not prove who is on the other end, so an attacker can set up one key with each server and relay traffic. Signing the exchange with certificates, as TLS does, closes this gap.
Question 109Wireless, Mobile & Cloud
Attackers breach a managed service provider and use its trusted remote access and shared credentials to move into the cloud environments of the provider's clients. What is this technique called?
Correct answer: C. Cloud hopping
Cloud hopping targets a service provider to pivot into many customers through trusted connections. Cloudborne is a different attack that implants persistent firmware backdoors in bare-metal cloud servers that are later reassigned to new tenants.
Cloud hopping targets a service provider to pivot into many customers through trusted connections. Cloudborne is a different attack that implants persistent firmware backdoors in bare-metal cloud servers that are later reassigned to new tenants.
Question 110Recon, Scanning & Enumeration
A tester finds SNMP open on a network device and wants to read its configuration using the default read-only community string. Which string should be tried FIRST?
Correct answer: A. public
"public" is the common default read-only community string on many SNMP devices, so it is the first to try for reading data. "private" is the usual default read-write string, used for making changes rather than simple reads.
"public" is the common default read-only community string on many SNMP devices, so it is the first to try for reading data. "private" is the usual default read-write string, used for making changes rather than simple reads.
Question 111System Hacking & Malware
An organization is hit by a slow, stealthy intrusion where an actor maintains long-term covert access, moving laterally over months to steal data. Which term BEST describes this campaign?
Correct answer: D. Advanced Persistent Threat
An Advanced Persistent Threat is characterized by a skilled actor maintaining long-term, stealthy access and pursuing specific objectives over an extended period. A worm outbreak spreads fast and noisily rather than lying low for months.
An Advanced Persistent Threat is characterized by a skilled actor maintaining long-term, stealthy access and pursuing specific objectives over an extended period. A worm outbreak spreads fast and noisily rather than lying low for months.
Question 112Network Attacks & Evasion
An analyst reviews this Snort rule: alert tcp any any -> 192.168.1.0/24 80 (content:"/etc/passwd"; msg:"passwd access"; sid:1000001;). What will it do?
Correct answer: B. Alert on TCP packets to the subnet's port 80 that contain /etc/passwd
The rule's action is alert, it matches TCP traffic headed to port 80 on 192.168.1.0/24, and the content option looks for the string /etc/passwd. Snort's alert action logs and raises an alert; it does not drop the packet, so it is not a block.
The rule's action is alert, it matches TCP traffic headed to port 80 on 192.168.1.0/24, and the content option looks for the string /etc/passwd. Snort's alert action logs and raises an alert; it does not drop the packet, so it is not a block.
Question 113Web Apps & SQL Injection
A tester sees no difference in page output and time delays are unreliable. They get the database server to make a DNS lookup to a domain the tester controls, carrying query results in the name. Which technique is this?
Correct answer: C. Out-of-band SQL injection
Out-of-band SQL injection sends data through a different channel, such as DNS or HTTP requests from the database server, when in-band and inference methods do not work. Blocking outbound DNS and HTTP from database servers limits it.
Out-of-band SQL injection sends data through a different channel, such as DNS or HTTP requests from the database server, when in-band and inference methods do not work. Blocking outbound DNS and HTTP from database servers limits it.
Question 114Ethics, Social Engineering & Crypto
A browser needs to check, in real time, whether one web server's certificate has been revoked, without downloading the CA's full revocation list. Which mechanism does it use?
Correct answer: B. Online Certificate Status Protocol (OCSP)
OCSP lets a client ask a responder about the status of a single certificate and get a signed answer right away. A CRL is the full list of revoked certificates, which must be downloaded and can be out of date between updates. A CSR is used to request a certificate, not to check one.
OCSP lets a client ask a responder about the status of a single certificate and get a signed answer right away. A CRL is the full list of revoked certificates, which must be downloaded and can be out of date between updates. A CSR is used to request a certificate, not to check one.
Question 115Wireless, Mobile & Cloud
A security team finds that staff upload sensitive files to unsanctioned file-sharing SaaS apps. They want visibility into which cloud apps are used and the ability to apply DLP policies to them. Which solution fits BEST?
Correct answer: D. Cloud access security broker (CASB)
A CASB sits between users and cloud services to discover shadow IT and enforce policies like DLP. CSPM checks your own cloud accounts for misconfigurations, and CWPP protects workloads such as VMs and containers, so neither controls user activity in third-party SaaS.
A CASB sits between users and cloud services to discover shadow IT and enforce policies like DLP. CSPM checks your own cloud accounts for misconfigurations, and CWPP protects workloads such as VMs and containers, so neither controls user activity in third-party SaaS.
Question 116Recon, Scanning & Enumeration
A tester runs enum4linux against a Windows host and successfully lists shares and user accounts without providing any credentials. Which weakness made this possible?
Correct answer: B. An anonymous SMB null session
A null session lets a tester connect to SMB/IPC$ with no username or password and enumerate users and shares. The task used no credentials, so it was anonymous SMB access rather than a cracked password or a forged ticket.
A null session lets a tester connect to SMB/IPC$ with no username or password and enumerate users and shares. The task used no credentials, so it was anonymous SMB access rather than a cracked password or a forged ticket.
Question 117System Hacking & Malware
Analysts distinguish a worm from a virus chiefly by which property?
Correct answer: C. It spreads by itself without needing a host file
A worm spreads on its own across networks and does not need to attach to a host file, unlike a virus which requires a host and user action to execute. Encryption and boot-sector residence are not defining traits of worms.
A worm spreads on its own across networks and does not need to attach to a host file, unlike a virus which requires a host and user action to execute. Encryption and boot-sector residence are not defining traits of worms.
Question 118Web Apps & SQL Injection
A developer says, "We use stored procedures, so we are safe from SQL injection." The procedure builds a query string by joining the input and then runs it with EXEC. Is the app vulnerable?
Correct answer: A. Yes, the procedure builds SQL from input by concatenation
Stored procedures only help when they use parameters inside the SQL. Building dynamic SQL with string concatenation inside the procedure reintroduces injection. Running as an admin makes the damage worse, but is not what makes it vulnerable.
Stored procedures only help when they use parameters inside the SQL. Building dynamic SQL with string concatenation inside the procedure reintroduces injection. Running as an admin makes the damage worse, but is not what makes it vulnerable.
Question 119Ethics, Social Engineering & Crypto
A researcher recovers the private key from a smart card by measuring tiny changes in its power consumption while it performs RSA operations. What type of attack is this?
Correct answer: D. Side-channel attack
Side-channel attacks use physical leaks from a device, such as power use, timing, electromagnetic signals or sound, rather than flaws in the math. A chosen-ciphertext attack feeds crafted ciphertexts to the system and studies the decrypted results.
Side-channel attacks use physical leaks from a device, such as power use, timing, electromagnetic signals or sound, rather than flaws in the math. A chosen-ciphertext attack feeds crafted ciphertexts to the system and studies the decrypted results.
Question 120Recon, Scanning & Enumeration
A tester wants to walk a DNSSEC-signed zone by following the chain of records that proves which names do not exist, thereby revealing all existing names. Which record type enables this zone walking?
Correct answer: A. NSEC
NSEC records link to the next existing name in a signed zone to prove non-existence, and chaining them lets an attacker enumerate every name. RRSIG and DNSKEY handle signatures and keys, not the ordered listing of names.
NSEC records link to the next existing name in a signed zone to prove non-existence, and chaining them lets an attacker enumerate every name. RRSIG and DNSKEY handle signatures and keys, not the ordered listing of names.
Question 121System Hacking & Malware
A sandbox report shows the sample checked for signs of virtualization and stayed dormant when it detected an analysis environment. What is this behavior called?
Correct answer: C. Sandbox evasion
Deliberately detecting an analysis or virtual environment and staying inactive to avoid observation is sandbox evasion. Polymorphic mutation refers to changing the code's appearance between infections, not withholding behavior during analysis.
Deliberately detecting an analysis or virtual environment and staying inactive to avoid observation is sandbox evasion. Polymorphic mutation refers to changing the code's appearance between infections, not withholding behavior during analysis.
Question 122Web Apps & SQL Injection
A WAF blocks requests containing the words UNION SELECT. A tester gets past it using mixed letter case and inline comments between the words. What is the BEST long-term fix?
Correct answer: D. Use parameterized queries in the application code
Block lists can always be bypassed with encoding, case changes or comments, so the WAF is only a safety net. Parameterized queries keep data separate from SQL code, which removes the vulnerability itself. Hiding errors makes testing harder but does not fix the flaw.
Block lists can always be bypassed with encoding, case changes or comments, so the WAF is only a safety net. Parameterized queries keep data separate from SQL code, which removes the vulnerability itself. Hiding errors makes testing harder but does not fix the flaw.
Question 123Ethics, Social Engineering & Crypto
A battery-powered IoT sensor needs strong public-key cryptography for key exchange and signatures, but it has very little memory and processing power. Which option is the BEST fit?
Correct answer: D. Elliptic Curve Cryptography (ECC)
ECC gives the same security as older algorithms with much smaller keys: a 256-bit ECC key is roughly as strong as a 3072-bit RSA key. Smaller keys mean less CPU, memory and bandwidth, which suits constrained devices. RSA, DSA and classic Diffie-Hellman need far larger keys for the same strength.
ECC gives the same security as older algorithms with much smaller keys: a 256-bit ECC key is roughly as strong as a 3072-bit RSA key. Smaller keys mean less CPU, memory and bandwidth, which suits constrained devices. RSA, DSA and classic Diffie-Hellman need far larger keys for the same strength.
Question 124Recon, Scanning & Enumeration
A scanner reports a CVSS v3.1 base score of 8.1 for a flaw. Into which qualitative severity band does this score fall?
Correct answer: B. High
CVSS v3.1 defines High as 7.0 to 8.9, so 8.1 falls in the High band. Critical begins at 9.0, which this score does not reach.
CVSS v3.1 defines High as 7.0 to 8.9, so 8.1 falls in the High band. Critical begins at 9.0, which this score does not reach.
Question 125Recon, Scanning & Enumeration
A vulnerability scan flags a service as vulnerable to a specific CVE, but manual testing shows the installed version is already patched and not exploitable. What is the correct term for this scanner result?
Correct answer: C. False positive
A false positive is when a scanner reports a vulnerability that does not actually exist, which matches a patched, non-exploitable service being flagged. A false negative is the opposite: a real vulnerability the scanner missed.
A false positive is when a scanner reports a vulnerability that does not actually exist, which matches a patched, non-exploitable service being flagged. A false negative is the opposite: a real vulnerability the scanner missed.
The real CEH v13 exam at a glance
125questions
4htime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Cyber Security practice tests
CISSP Practice Test150 questions · 2024 outlineCompTIA Security+ Practice Test90 questions · SY0-701 & SY0-801CompTIA CySA+ Practice Test85 questions · CS0-004CompTIA SecurityX Practice Test90 questions · CAS-005CHFI v11 Practice Test150 questions · 312-49CCISO Practice Test150 questions · Blueprint v3
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the CEH v13 exam. They are not real exam questions. CEH v13 and EC-Council are trademarks of their owners. Real exam format: 125 questions · 4 hours · passing score 60% to 85% depending on the exam form.