Free CEH v13 Practice Test 2026 (Set 2): Full 125-Question Mock Exams

Question 1Recon, Scanning & Enumeration

A tester wants Google to return only Excel spreadsheets hosted on the target's own website. Which pair of operators does this?

Correct answer: A. filetype: and site:
filetype: limits results to a file extension such as xls, and site: limits them to one domain. Together they surface documents the company may not have meant to publish. intitle: and inurl: match words in page titles and URLs, not file types.

Question 2System Hacking & Malware

A tester finds domain accounts with "Do not require Kerberos preauthentication" enabled. Which attack does this setting allow?

Correct answer: C. AS-REP roasting
Without pre-authentication, anyone can request an AS-REP for the account, and part of it is encrypted with the user's password hash. That piece can be cracked offline. Keeping pre-authentication on for every account blocks this.

Question 3Network Attacks & Evasion

Passive sniffing worked when the office used hubs, but after moving to switches the tester sees only their own traffic. Why?

Correct answer: D. Switches send frames only to the destination port
A hub repeats every frame to all ports, while a switch learns MAC addresses and sends each frame only to the right port. On switched networks an attacker needs active methods such as ARP poisoning to see others' traffic.

Question 4Web Apps & SQL Injection

A comment box saves user input and shows it to every visitor. A tester's script runs in other users' browsers. Which fix addresses the root cause?

Correct answer: D. Context-aware output encoding of comments
This is stored XSS. Context-aware output encoding turns characters like < and > into harmless text, so the browser does not run them as script. Length limits and HTTPS do not stop script from running.

Question 5Ethics, Social Engineering & Crypto

A file server is valued at $200,000. A flood would damage 25% of its value, and the company expects such a flood once every two years. What is the annualized loss expectancy (ALE)?

Correct answer: B. $25,000
SLE = asset value x exposure factor = $200,000 x 0.25 = $50,000. ALE = SLE x ARO = $50,000 x 0.5 = $25,000. $50,000 is only the single loss expectancy, not the yearly figure.

Question 6Wireless, Mobile & Cloud

A site survey team is replacing old access points. They need a standard that works in both the 2.4 GHz and 5 GHz bands and uses OFDMA so many clients can share one channel at once. Which standard fits BEST?

Correct answer: B. 802.11ax (Wi-Fi 6)
802.11ax (Wi-Fi 6) runs in 2.4 and 5 GHz and adds OFDMA to serve many clients in parallel. 802.11n also uses both bands but has no OFDMA, and 802.11ac is 5 GHz only.

Question 7Recon, Scanning & Enumeration

A tester queries a target domain's DNS and finds a record listing every third-party service allowed to send email for the company. Which record type holds this?

Correct answer: D. TXT (SPF)
SPF policies are published in TXT records and list the servers and providers allowed to send mail for the domain, which reveals which vendors the company uses. MX records only show where the domain receives mail.

Question 8System Hacking & Malware

Attackers capture NTLM authentication from one machine and replay it live to a file server to log in as the victim. Which control BEST stops this relay?

Correct answer: C. Require SMB signing
An NTLM relay forwards the victim's authentication to another server in real time. Required SMB signing ties each session to keys the attacker does not have, so relayed sessions fail. Longer passwords do not help because nothing is cracked.

Question 9Network Attacks & Evasion

A security team needs a complete copy of all traffic on a busy link, including malformed frames, with nothing dropped under load. Which option is BEST?

Correct answer: B. A network TAP
A TAP is hardware that copies every bit on the link, including errors, and does not drop traffic when the switch is busy. SPAN ports can drop packets under load and often filter out bad frames.

Question 10Web Apps & SQL Injection

A search page echoes the search term back in the results. The script only runs when a victim clicks a crafted link that contains it. Which type of XSS is this?

Correct answer: C. Reflected XSS
In reflected XSS the payload travels in the request, usually a link, and the server reflects it straight back in the response. Nothing is saved, so the attacker must get each victim to open the link.

Question 11Ethics, Social Engineering & Crypto

Ransomware encrypts a database server. The administrator wipes the server, rebuilds it and restores the data from a clean offline backup. Which type of security control is the restore process?

Correct answer: A. Corrective
Corrective controls fix or limit damage after an incident has happened, such as restoring from backup. Detective controls only spot or alert on an incident; they do not repair anything.

Question 12Wireless, Mobile & Cloud

A client hides its SSID and believes the network is now invisible. A tester with airodump-ng sees the network with a blank name, then learns the real SSID within minutes. How did the tester get it?

Correct answer: B. From probe and association frames sent by clients
Hiding the SSID only removes it from beacons. Legitimate clients still send it in cleartext in probe requests and association frames, so a tester just waits or forces a reconnect. The SSID in beacons is blanked, not encrypted.

Question 13Recon, Scanning & Enumeration

Which DNS record shows a zone's primary name server, the administrator's contact address and the zone serial number?

Correct answer: A. SOA
The Start of Authority (SOA) record holds the primary name server, a responsible-person email address and timing values such as the serial number. NS records list the name servers but not the admin contact or serial.

Question 14System Hacking & Malware

Attackers keep dumping credentials from LSASS memory on Windows workstations. Which control BEST protects those secrets?

Correct answer: C. Windows Credential Guard or LSA protection
Credential Guard isolates secrets with virtualization-based security, and LSA protection (RunAsPPL) stops untrusted processes from reading LSASS. BitLocker protects data at rest, not memory on a running system.

Question 15Network Attacks & Evasion

An attacker floods a DHCP server with requests from thousands of fake MAC addresses until no IP addresses are left. What is this attack?

Correct answer: D. DHCP starvation
DHCP starvation uses up the whole address pool so legitimate clients cannot get an IP, often as a first step before setting up a rogue DHCP server. Port security and DHCP snooping rate limits defend against it.

Question 16Web Apps & SQL Injection

An attacker uses XSS to read document.cookie and steal session IDs. Which cookie attribute stops page scripts from reading the session cookie?

Correct answer: D. HttpOnly
HttpOnly hides the cookie from JavaScript, so document.cookie cannot read it even if XSS exists. Secure only stops the cookie from being sent over plain HTTP. HttpOnly limits the damage but does not fix the XSS itself.

Question 17Ethics, Social Engineering & Crypto

A company adopting NIST CSF 2.0 wants to define its cybersecurity risk strategy, assign roles and responsibilities, and make sure leadership oversees security policy. Which CSF function covers this work?

Correct answer: A. Govern
NIST CSF 2.0 added the Govern function for risk strategy, roles, policy and oversight. Identify focuses on understanding assets and risks, not on setting the governance structure.

Question 18Wireless, Mobile & Cloud

A company uses WPA2-Enterprise with PEAP-MSCHAPv2. A red team sets up a fake AP with the same SSID and collects MSCHAPv2 challenge-response hashes from laptops that do not validate the server certificate. Which change BEST stops this?

Correct answer: B. Moving to EAP-TLS with certificates on both sides
EAP-TLS uses mutual certificate authentication, so there is no password hash for a fake AP to collect. A longer pre-shared key does not apply to WPA2-Enterprise, and SSID hiding or MAC filtering are easy to bypass.

Question 19Recon, Scanning & Enumeration

A tester resolves every IP address in a target's public /24 range back to names and finds hosts such as vpn01 and hr-portal. Which record type made this possible?

Correct answer: D. PTR
Reverse DNS lookups query PTR records, which map an IP address back to a hostname. Descriptive names often reveal the purpose of each host. AAAA records map names to IPv6 addresses, not addresses to names.

Question 20System Hacking & Malware

An attacker tries one common password, such as Winter2026!, against every account in a company, then waits before trying the next one. What is this technique, and why is it used?

Correct answer: C. Password spraying, to avoid account lockouts
Password spraying tries a few likely passwords across many accounts, so no single account gets enough failed logins to lock out. Smart lockout, MFA and banned-password lists are the main defenses.

Question 21Network Attacks & Evasion

On an IPv6 network, an attacker sends fake router advertisements so hosts use the attacker as their default gateway. Which switch feature blocks this?

Correct answer: A. RA Guard
RA Guard drops router advertisements arriving on ports that are not meant to connect routers. It plays the same role for IPv6 that DHCP snooping plays for rogue DHCP in IPv4.

Question 22Web Apps & SQL Injection

A team wants the browser to refuse any script that does not come from the site's own origin, including inline scripts injected by an attacker. Which header does this?

Correct answer: C. Content-Security-Policy with script-src 'self'
A CSP with script-src 'self' only allows scripts loaded from the site's own origin and blocks inline scripts by default. That greatly reduces XSS impact. X-Frame-Options only controls framing.

Question 23Ethics, Social Engineering & Crypto

An analyst monitors underground forums and learns that a named group plans to attack the company's payment portal next week, along with its likely motive. Which type of threat intelligence is this?

Correct answer: A. Operational
Operational intelligence gives details about a specific upcoming attack, such as its target, timing and intent. Strategic intelligence is high-level trend and risk information for executives, not details of one planned attack.

Question 24Wireless, Mobile & Cloud

In an office tower, an employee's phone joins a network called 'HomeNet-5G', which does not exist in the building. Analysis shows a rogue device answered the phone's probe requests by claiming to be every SSID the phone asked for. What is this attack?

Correct answer: B. KARMA attack
A KARMA attack replies to any probe request with the SSID the device is looking for, tricking it into auto-joining. An evil twin copies one specific real AP that is nearby, but here the network does not exist on site.

Question 25Recon, Scanning & Enumeration

A tester downloads PDFs and Word files from a company website and pulls out author usernames, printer paths and software versions. What is this technique?

Correct answer: A. Metadata extraction
Office and PDF files carry hidden metadata such as author names, internal paths and application versions. Tools like ExifTool and FOCA extract it, giving usernames and naming conventions for later attacks. Mirroring only copies the site for offline review.

Question 26System Hacking & Malware

Why are legacy LM hashes so much weaker than NT hashes?

Correct answer: C. Uppercase only, split into two 7-character halves
LM converts the password to uppercase, pads it to 14 characters and hashes each 7-character half on its own, so an attacker only has to crack two short, case-insensitive pieces. LM storage should be disabled on all systems.

Question 27Network Attacks & Evasion

An attacker sends forged ICMP messages telling a victim host that a better route to the internet goes through the attacker's machine. What is this?

Correct answer: B. ICMP redirect attack
ICMP redirect messages change a host's routing choices, so forged ones can push traffic through the attacker for man-in-the-middle sniffing. Hosts and routers should ignore ICMP redirects.

Question 28Web Apps & SQL Injection

A PHP page includes local files by name, and a tester uses it to read system files outside the application folder. Which PHP setting limits the directories PHP can open files from?

Correct answer: D. open_basedir
open_basedir restricts PHP file access to a list of directories, which limits what a local file inclusion bug can reach. It is a safety net; the real fix is to never build include paths from user input.

Question 29Ethics, Social Engineering & Crypto

A researcher breaks into a retailer's web server without permission, causes no damage, and then reports the flaw to the retailer so it can be fixed. Which hacker class BEST describes this person?

Correct answer: A. Gray hat
A gray hat acts without authorization but without malicious intent, often disclosing the flaw afterward. A white hat always has written permission before testing, which this person did not have.

Question 30Wireless, Mobile & Cloud

A researcher shows that a nearby attacker can take over unpatched phones and laptops through their Bluetooth stack with no pairing and no user action, even when the device is not discoverable. Which threat is this?

Correct answer: B. BlueBorne
BlueBorne is a set of Bluetooth stack flaws that allow remote code execution without pairing or user interaction. Bluesnarfing steals data like contacts but does not give full device control, and bluejacking only sends unsolicited messages.

Question 31Recon, Scanning & Enumeration

A tester sends an email to a target employee and gets a reply. Which part of the reply is MOST useful for mapping the company's internal mail servers?

Correct answer: A. The Received headers
Each mail server that handles a message adds a Received header with its name and IP address, so the chain often reveals internal mail relays and their software. Signatures and subject lines contain business details, not routing information.

Question 32System Hacking & Malware

On a standalone Windows server, where are the password hashes for local user accounts stored?

Correct answer: D. The SAM database
Local account hashes live in the SAM (Security Account Manager) database, protected by the SYSTEM key. NTDS.dit stores domain account hashes on domain controllers.

Question 33Network Attacks & Evasion

In Wireshark, which display filter shows only HTTP POST requests?

Correct answer: A. http.request.method == "POST"
http.request.method == "POST" matches only HTTP requests that use POST, which is useful for spotting submitted logins and forms in captured cleartext traffic. The other filters are invalid or match the wrong thing.

Question 34Web Apps & SQL Injection

A login page sends users to whatever URL is in its next parameter after sign-in. Attackers use it in phishing emails to bounce victims to a fake site. Which fix is BEST?

Correct answer: C. Allow only an approved list of destinations
This is an open redirect. Accepting only known internal paths or an allow-list of destinations stops the site from forwarding users to attacker domains. Encoding the parameter does not change where it points.

Question 35Ethics, Social Engineering & Crypto

After exploiting a web server, an attacker installs a rootkit and creates a hidden backdoor account so he can return later even if the original flaw is patched. Which hacking phase is this?

Correct answer: A. Maintaining access
Installing backdoors and rootkits to keep future access is the maintaining access phase. Gaining access is the earlier step where the flaw was first exploited to get in.

Question 36Wireless, Mobile & Cloud

A tester installs the Burp CA as a trusted system certificate on a rooted Android phone. Traffic from most apps decrypts fine, but one banking app refuses to connect while the proxy is on. What is the MOST likely reason?

Correct answer: D. The app pins the expected server certificate or key
Certificate pinning makes the app trust only a specific certificate or public key, so a valid proxy CA is still rejected. HSTS only forces HTTPS; it does not decide which certificate authorities are trusted.

Question 37Recon, Scanning & Enumeration

A tester wants to find a target's exposed webcams and industrial devices without sending a single packet to the target. Which approach fits?

Correct answer: B. Search Shodan for the target's IP ranges
Shodan continuously scans the internet and stores service banners, so searching it reveals exposed devices without touching the target yourself. Nmap and hping3 both send packets directly to the target.

Question 38System Hacking & Malware

A normal user changes an ID in a request and can read another normal user's private messages, but gains no admin rights. What type of privilege escalation is this?

Correct answer: C. Horizontal
Horizontal escalation means reaching another account's data or functions at the same privilege level. Vertical escalation means gaining higher rights, such as user to admin.

Question 39Network Attacks & Evasion

Attackers send small spoofed UDP requests to exposed servers on port 11211, which reply with responses tens of thousands of times larger. Which service is being abused?

Correct answer: B. Memcached
Exposed memcached servers on UDP 11211 have shown amplification factors in the tens of thousands, behind some of the largest DDoS attacks on record. Memcached should never listen on UDP to the internet.

Question 40Web Apps & SQL Injection

A web server copies a user-supplied value into a response header. A tester injects encoded carriage return and line feed characters and adds a new header of their own. What is this attack?

Correct answer: D. HTTP response splitting
Injecting CR and LF (%0d%0a) into a header value ends that header early and lets the attacker add headers or even a second response. The fix is to strip or reject CR and LF in any value placed in headers. Request smuggling abuses disagreements between front-end and back-end servers.

Question 41Ethics, Social Engineering & Crypto

Attackers cannot phish a defense contractor directly, so they plant an exploit kit on a regional engineering association website that the contractor's staff visit often. Which attack is this?

Correct answer: B. Watering hole
A watering hole attack compromises a trusted site the target group already visits and waits for them to come to it. Spear phishing sends tailored messages directly to the victims, which did not happen here.

Question 42Wireless, Mobile & Cloud

An attacker downloads a popular Android game, injects spyware, re-signs it with his own key and posts it on a third-party store. Why can this fake APK NOT install as an update over the real game already on a victim's phone?

Correct answer: C. Android requires updates signed with the same key
Android only allows an update when its signing certificate matches the installed app. The repackaged APK can still trick new users, but it cannot replace the genuine app. Play Protect scans sideloaded apps but does not block all of them.

Question 43Recon, Scanning & Enumeration

What does running nmap with the -sn option do?

Correct answer: A. Performs host discovery only, with no port scan
-sn (formerly -sP) tells Nmap to find which hosts are up and then stop, without scanning ports. A NULL scan is -sN with a capital N, and DNS resolution is turned off with -n.

Question 44System Hacking & Malware

A Linux server runs a backup script from root's crontab every 5 minutes, and the script file is writable by all users. What can a low-privilege attacker do?

Correct answer: D. Add commands that cron will run as root
Cron runs the script with root's rights, so anyone who can edit it gets their commands executed as root on the next run. Scripts run by privileged jobs must be owned by root and not writable by others.

Question 45Network Attacks & Evasion

An attack pushes corrupted firmware to network devices so that they stop working and must be replaced or reflashed. What is this called?

Correct answer: A. Permanent denial of service (phlashing)
Permanent DoS, or phlashing, damages the hardware's firmware so the device cannot recover by rebooting. Signed firmware updates and locked-down management interfaces prevent it.

Question 46Web Apps & SQL Injection

An image upload feature saves files in a public folder. A tester uploads a server-side script renamed with a double extension and runs it by browsing to it. Which control BEST prevents this?

Correct answer: C. Store uploads outside the web root, never executable
Keeping uploads outside the web root, giving them random names and serving them without script execution means an uploaded script can never run. The Content-Type header is set by the client and is easy to fake.

Question 47Ethics, Social Engineering & Crypto

An attacker calls random extensions at a company, claiming to be from IT support and offering to fix slow computers. When someone accepts, he asks for the user's login details to apply the fix. Which technique is this?

Correct answer: D. Quid pro quo
Quid pro quo offers a service or favor in exchange for information, such as fake IT help for credentials. Baiting uses a physical or digital lure, such as an infected USB drive, rather than an offered service.

Question 48Wireless, Mobile & Cloud

A mobile app review finds session tokens and customer details saved in plain text in the app's SharedPreferences and local SQLite file. Which fix BEST addresses this?

Correct answer: D. Encrypt stored data with keys held in the Keystore
This is insecure data storage. Encrypting data with keys protected by the Android Keystore keeps it safe even if files are copied. Obfuscation hides code logic but leaves stored data readable, and Base64 is encoding, not encryption.

Question 49Recon, Scanning & Enumeration

Nmap reports a host as down, but its website loads fine in a browser. The firewall drops ICMP. Which option makes Nmap scan the host anyway?

Correct answer: B. -Pn
-Pn skips host discovery and treats every target as online, so Nmap scans ports even when ping probes are blocked. -PE sends ICMP echo requests, which is exactly what the firewall is dropping.

Question 50System Hacking & Malware

A program that runs with root rights calls the ps command without its full path. An attacker places a malicious file named ps in a writable folder at the front of their PATH. What is this?

Correct answer: C. PATH variable hijacking
When a privileged program uses a bare command name, the system searches the PATH in order and runs the first match. Putting a fake ps earlier in the PATH gets it executed with the program's privileges. Using absolute paths prevents this.

Question 51Network Attacks & Evasion

A site goes down although bandwidth use is normal. Logs show thousands of valid-looking requests per second for an expensive search page. What kind of attack is this?

Correct answer: D. Application-layer (layer 7) flood
Layer 7 floods use requests that look legitimate and target costly pages, so they exhaust server resources without large traffic volumes. WAF rules, rate limits and challenge pages help where bandwidth filtering does not.

Question 52Web Apps & SQL Injection

An admin page blocks GET requests from non-admins, but a tester sends the same request with the HEAD method and the action still runs. What is this weakness?

Correct answer: C. HTTP verb tampering
The access check only covers certain HTTP methods, so switching the method skips it. Access control should apply to every method, and unused methods should be rejected.

Question 53Ethics, Social Engineering & Crypto

An attacker disables a department's network printer, then leaves flyers saying "Printer problems? Call the new IT help line" with his own number. Staff call him and give remote access. Which technique is this?

Correct answer: B. Reverse social engineering
In reverse social engineering, the attacker creates a problem and advertises himself as the helper, so the victim makes contact. In basic impersonation the attacker contacts the victim first, which is the opposite flow.

Question 54Wireless, Mobile & Cloud

Staff refuse to enroll personal phones because they do not want the company to control or wipe the whole device. Security still needs to protect corporate data inside email and file apps and wipe only that data when someone leaves. Which approach fits BEST?

Correct answer: C. Mobile application management (MAM) policies
MAM applies policies to specific apps and can wipe only corporate app data, leaving personal content alone. Full MDM controls the whole device, which is exactly what staff are refusing.

Question 55Recon, Scanning & Enumeration

A tester on the same Ethernet segment as the targets wants the most reliable way to find live hosts, even ones with host firewalls that block ping. Which method fits best?

Correct answer: A. ARP scan (-PR)
Hosts on the same subnet must answer ARP requests to communicate at all, so an ARP scan finds them even when they block ICMP and TCP probes. Nmap uses ARP discovery by default on local networks for this reason.

Question 56System Hacking & Malware

Security staff suspect a keylogger on a trading desk PC, but antivirus and EDR scans are clean. Which type of keylogger fits, and how is it found?

Correct answer: B. Hardware keylogger, found by physical inspection
Hardware keyloggers sit inline on the keyboard cable or port and run no software on the PC, so security tools cannot see them. Physical checks of ports and cables are the way to find them.

Question 57Network Attacks & Evasion

During a large DDoS, an ISP routes all traffic for the victim's IP address to a null route. What is the main downside?

Correct answer: A. Legitimate traffic is dropped as well
Blackhole routing drops everything sent to the target, good and bad, so it protects the wider network but completes the outage for the victim. Scrubbing centers try to filter out only the attack traffic instead.

Question 58Web Apps & SQL Injection

A login page says "Unknown username" for accounts that do not exist and "Wrong password" for accounts that do. What does this allow, and what is the fix?

Correct answer: C. Username enumeration; return one generic error for both cases
Different messages let an attacker confirm which usernames are real before guessing passwords. A single generic message such as "Invalid username or password" removes that signal. Response timing should also be the same for both cases.

Question 59Ethics, Social Engineering & Crypto

An employee gets dozens of MFA push prompts at 2 AM and finally taps Approve to stop them. The attacker already had her correct password. Which control BEST stops this attack in the future?

Correct answer: D. Number matching in the push MFA app
Number matching forces the user to enter a code shown on the login screen, so a blind tap cannot approve an attacker's sign-in. Password rules and lockouts do not help because the attacker already knew the correct password.

Question 60Wireless, Mobile & Cloud

An OT engineer delays a critical patch because installing it would require rebooting a PLC that runs a continuous chemical process. Which priority order BEST reflects how OT environments rank security goals?

Correct answer: D. Availability, integrity, confidentiality
OT puts availability first, then integrity, then confidentiality (AIC), because downtime can stop production or create safety risks. The classic IT order puts confidentiality first, which does not match plant priorities.

Question 61Recon, Scanning & Enumeration

A tester runs Nmap without root or administrator rights and asks for a port scan. Which scan type does Nmap use, and what is its main drawback?

Correct answer: A. TCP connect scan, which completes the handshake and gets logged more
Without raw socket privileges Nmap falls back to a TCP connect scan (-sT), which uses the operating system's normal connect call. Completing the full three-way handshake means applications are more likely to log the connection than with a half-open SYN scan.

Question 62System Hacking & Malware

Stolen data is hidden by changing the least significant bit of each pixel in a company logo image, with no visible change. Which technique is this?

Correct answer: B. Image (LSB) steganography
LSB steganography stores data in the lowest bit of pixel values, which changes colours too little for the eye to notice. Steganalysis tools look for statistical oddities in those bits.

Question 63Network Attacks & Evasion

An attacker floods random UDP ports on a server. The server spends its resources checking for listening applications and replying with ICMP destination unreachable messages. What attack is this?

Correct answer: D. UDP flood
In a UDP flood, every packet to a closed port makes the host check for a listener and send back an ICMP unreachable, which uses up CPU and bandwidth. Fraggle instead sends UDP echo traffic to broadcast addresses.

Question 64Web Apps & SQL Injection

A scan shows an application uses a JavaScript library version with a published, actively exploited CVE. Which OWASP Top 10 (2021) category fits?

Correct answer: C. A06 Vulnerable and Outdated Components
Running components with known vulnerabilities falls under A06. The fix is a software inventory, regular patching and removing unused libraries.

Question 65Ethics, Social Engineering & Crypto

Stickers with QR codes appear on parking meters around a company office, telling drivers to scan and pay. The code opens a fake payment site that collects card details. Which attack is this?

Correct answer: B. Quishing
Quishing is phishing delivered through QR codes, which send victims to a malicious site. Smishing uses SMS text messages as the lure, not printed QR codes.

Question 66Wireless, Mobile & Cloud

An attacker jams a car's receiver while the owner presses the key fob, capturing the first code. On the second press, he captures that code and replays the first so the car unlocks. Later he uses the stored second code to unlock it himself. What is this?

Correct answer: C. Rolling code attack using jam and capture
This is a rolling code attack (RollJam): jamming keeps a valid code unused so it can be replayed later. A relay attack forwards the fob's signal in real time to extend its range; it does not store codes for later.

Question 67Recon, Scanning & Enumeration

During a SYN scan, a target port answers the tester's SYN with an RST/ACK. How does Nmap classify the port?

Correct answer: A. Closed
An RST in reply to a SYN means the host is reachable but nothing is listening, so the port is closed. A SYN/ACK means open, and no reply or an ICMP unreachable error means filtered.

Question 68System Hacking & Malware

During an investigation, a malicious file's created and modified timestamps match standard Windows system files from years ago. Which anti-forensics technique was likely used?

Correct answer: B. Timestomping
Timestomping changes a file's MAC times so it blends in with legitimate files and falls outside the incident time window. Investigators compare NTFS $STANDARD_INFORMATION and $FILE_NAME times to spot it.

Question 69Network Attacks & Evasion

An attacker injects commands into a victim's TCP session by guessing sequence numbers, but cannot see any of the server's replies. What is this called?

Correct answer: A. Blind hijacking
In blind hijacking the attacker is not on the traffic path, so they inject data without seeing responses. That limits them to actions that do not need feedback, such as running a command that creates an account.

Question 70Web Apps & SQL Injection

When an error occurs, a production site shows full stack traces with file paths and framework versions. Which OWASP Top 10 (2021) category does this fall under?

Correct answer: C. A05 Security Misconfiguration
Detailed error pages in production are a configuration problem and fall under A05 Security Misconfiguration. Users should see a generic message while details go to server logs.

Question 71Ethics, Social Engineering & Crypto

At a conference, a stranger chats with a database engineer and makes deliberately wrong statements about the engineer's company systems. The proud engineer corrects him with real details. Which technique is the stranger using?

Correct answer: B. Elicitation
Elicitation draws out information through casual conversation, flattery or false statements the target feels urged to correct. Eavesdropping is passively listening to others, while here the attacker actively steers the talk.

Question 72Wireless, Mobile & Cloud

Malware in an industrial plant targets the independent controllers whose only job is to shut the process down safely when pressure or temperature passes set limits. Which component is being targeted?

Correct answer: D. Safety instrumented system (SIS)
An SIS is a separate control layer that brings the process to a safe state when limits are exceeded, and attacks like TRITON targeted it. An HMI is the operator's screen for monitoring and control, not the safety shutdown layer.

Question 73Recon, Scanning & Enumeration

Which TCP flags are set in an Nmap Xmas scan?

Correct answer: A. FIN, PSH and URG
An Xmas scan lights up FIN, PSH and URG like a Christmas tree. On RFC 793 compliant stacks a closed port replies with RST and an open port stays silent.

Question 74System Hacking & Malware

Malware infects the boot record and loads before the operating system, hiding from the OS-level antivirus. Which control BEST prevents this?

Correct answer: B. UEFI Secure Boot
This is a bootkit. Secure Boot only lets signed boot loaders run, so a modified boot component fails the check. Allow-listing works after the OS loads, which is too late.

Question 75Network Attacks & Evasion

An attacker sends a spoofed TCP packet with the RST flag and a valid sequence number, which tears down a user's active session. What is this attack?

Correct answer: D. RST hijacking
RST injection, or RST hijacking, ends a connection by sending a reset that looks like it came from one side. TLS does not stop it because the reset hits the TCP layer underneath. IPsec or TCP authentication options, plus randomized sequence numbers, make forged resets fail.

Question 76Web Apps & SQL Injection

An API that checks one-time passcodes allows unlimited guesses, so a tester can try every 6-digit code within minutes. Which control BEST fixes this?

Correct answer: D. Rate limiting and lockout after a few failed attempts
Without limits a 6-digit code has only a million possibilities, which is easy to try. Rate limiting, lockouts and short code lifetimes make guessing impractical. A longer lifetime makes the problem worse.

Question 77Ethics, Social Engineering & Crypto

A tester encrypts a company logo bitmap with a block cipher. The outline of the logo is still clearly visible in the encrypted image. Which mode of operation is MOST likely in use?

Correct answer: A. ECB
ECB encrypts each block on its own, so identical plaintext blocks give identical ciphertext blocks and patterns remain visible. CBC chains each block with the previous ciphertext, which hides such patterns.

Question 78Wireless, Mobile & Cloud

While testing a smart building, a tester finds HVAC and lighting controllers answering on UDP port 47808 and replying to Who-Is requests. Which protocol is in use?

Correct answer: C. BACnet/IP
BACnet/IP is the building automation protocol that uses UDP 47808 and Who-Is/I-Am device discovery. DNP3 is used mainly in utilities on port 20000, and Modbus TCP uses port 502.

Question 79Recon, Scanning & Enumeration

A FIN scan against a Windows server reports every port as closed, even though the server clearly runs a web service. What is the most likely reason?

Correct answer: A. Windows answers these probes with RST regardless of port state
Windows does not follow RFC 793 for stray FIN, NULL and Xmas probes and sends RST from both open and closed ports. These scans therefore cannot tell open from closed on Windows hosts. They work better against many Unix-like systems.

Question 80System Hacking & Malware

A rootkit quietly moves the running operating system into a virtual machine it controls, so the OS cannot see it. What kind of rootkit is this?

Correct answer: B. Hypervisor-level rootkit
A hypervisor rootkit runs below the OS as a thin hypervisor, intercepting hardware calls without changing OS files. Library and application rootkits replace or hook files and calls inside the OS.

Question 81Network Attacks & Evasion

A web app's session IDs are the login time in seconds plus the user's ID number. What is the BEST fix?

Correct answer: B. Use long IDs from a secure random generator
Predictable session IDs let attackers guess valid sessions for other users. Session tokens need high entropy from a secure random generator. Base64 is just encoding and adds no secrecy.

Question 82Web Apps & SQL Injection

A GraphQL endpoint in production answers introspection queries and returns its full schema, including admin-only mutations. What is the BEST action?

Correct answer: C. Disable introspection and authorize every resolver
Introspection hands attackers a full map of the API. Turning it off in production reduces exposure, but every resolver still needs its own authorization check, because hidden operations can still be called. Renaming or moving the endpoint is only obscurity.

Question 83Ethics, Social Engineering & Crypto

A developer needs one symmetric cipher mode that provides both confidentiality and built-in integrity checking, so tampered ciphertext is rejected. Which option BEST meets this need?

Correct answer: B. AES-GCM
AES-GCM is an authenticated encryption mode that adds an authentication tag, so changes to the ciphertext are detected. AES-CBC only provides confidentiality and needs a separate MAC for integrity.

Question 84Wireless, Mobile & Cloud

A company uses a SaaS CRM. An employee sets a customer report to 'anyone with the link can view', and the data leaks. Under the shared responsibility model, who is responsible for this exposure?

Correct answer: D. The customer, who manages its data and access
Even in SaaS, the customer owns its data, user accounts and sharing settings. The provider secures the platform, but a sharing choice made by the customer's own staff is the customer's responsibility.

Question 85Recon, Scanning & Enumeration

A firewall allows inbound traffic whose source port is 53 so that DNS replies get through. Which Nmap option abuses this rule?

Correct answer: A. --source-port 53 (or -g 53)
--source-port (or -g) sets the source port of the scan packets, so a rule that trusts traffic from port 53 lets the probes through. -p 53 only chooses which destination port to scan.

Question 86System Hacking & Malware

A virus hides its code in unused space inside a host program, so the file size does not change. What type of virus is this?

Correct answer: C. Cavity (space-filler) virus
Cavity viruses fill empty sections inside a file, so the size stays the same and size-based checks miss them. Integrity checking with hashes catches the change.

Question 87Network Attacks & Evasion

An app puts the session ID in the URL. Which risk does this create?

Correct answer: A. It can leak via Referer headers, history and logs
Session IDs in URLs show up in Referer headers sent to other sites, in proxy and server logs and in shared links, so others can reuse them. Session IDs belong in secure, HttpOnly cookies.

Question 88Web Apps & SQL Injection

An app receives webhooks from a payment provider. How should it confirm each webhook really came from that provider?

Correct answer: D. Verify the HMAC signature using the shared secret
Providers sign each webhook body with a shared secret, and the receiver recomputes the HMAC to confirm the sender and that the body was not changed. HTTPS protects the connection but anyone can send a request over HTTPS, and headers are easy to fake.

Question 89Ethics, Social Engineering & Crypto

Two internal services share a secret key. The receiver must confirm each API message was not altered and came from a holder of that key. Public-key cryptography is not allowed. What should be used?

Correct answer: A. An HMAC using SHA-256
HMAC combines a shared secret key with a hash, proving both integrity and origin from a key holder. A plain hash proves nothing about origin because anyone can recompute it after changing the message.

Question 90Wireless, Mobile & Cloud

A DevOps team builds containers from public base images pulled from Docker Hub. An audit finds several running containers with known critical CVEs inherited from those base images. Which control BEST prevents this?

Correct answer: C. Scan images in the CI/CD pipeline before deployment
Scanning images in the pipeline catches known vulnerable packages before they reach production, and builds can fail on critical findings. Restarting a container just reloads the same vulnerable image.

Question 91Recon, Scanning & Enumeration

ICMP echo requests are blocked, but the tester suspects the host still answers other ICMP messages. Which ICMP type is a timestamp request?

Correct answer: D. Type 13
Type 13 is a timestamp request and type 14 its reply. Some filters block only echo (type 8), so timestamp or address mask (type 17) requests can still reveal live hosts. Type 0 is echo reply and type 3 is destination unreachable.

Question 92System Hacking & Malware

A virus infects only every tenth program that runs, or only on certain dates, to avoid drawing attention. What is this called?

Correct answer: D. Sparse infector
A sparse infector spreads only now and then under set conditions, which makes it harder to notice and trace. A stealth virus instead hides its changes by intercepting system calls.

Question 93Network Attacks & Evasion

All traffic to a web server is HTTPS, and the network IDS cannot read it. Where is a sensor most useful for inspecting the decrypted requests?

Correct answer: B. A host-based IDS on the web server
A HIDS on the server sees requests after TLS is decrypted, along with local logs and file changes. A network IDS on the wire only sees encrypted data unless TLS is terminated before it.

Question 94Web Apps & SQL Injection

A tester wants Burp Suite to send one request hundreds of times, swapping a parameter's value with each word in a wordlist. Which Burp tool is built for this?

Correct answer: C. Intruder
Intruder automates payload placement and sends many variations of a request, which suits fuzzing and brute-forcing. Repeater is for manually editing and resending one request at a time.

Question 95Ethics, Social Engineering & Crypto

An attacker records months of encrypted TLS traffic and later steals the server's long-term private key. The company wants past sessions to stay safe even if this happens. Which choice provides this?

Correct answer: B. ECDHE key exchange
ECDHE creates a fresh ephemeral key for each session, giving perfect forward secrecy, so a stolen long-term key cannot decrypt old sessions. With RSA key transport, the session key is encrypted with the server key, so stealing that key exposes all recorded sessions.

Question 96Wireless, Mobile & Cloud

A company's cloud bill jumps overnight. Investigators find unknown pods using high CPU to run mining software. The attackers got in through a Kubernetes dashboard left open to the internet with no login. Which fix BEST prevents a repeat?

Correct answer: C. Require auth and remove public dashboard access
The root cause is an exposed, unauthenticated management dashboard, which allowed cryptojacking. Requiring login and keeping the dashboard off the internet closes that path. A budget alert only reports the cost after the abuse starts.

Question 97Recon, Scanning & Enumeration

Which hping3 option switches it to UDP mode?

Correct answer: B. -2
In hping3, -1 is ICMP mode, -2 is UDP mode and -8 is scan mode. -S sets the SYN flag in the default TCP mode.

Question 98System Hacking & Malware

An attacker combines a trojan with a free game installer into one file. When the victim installs the game, the trojan also runs silently. Which tool was used?

Correct answer: C. A wrapper (binder)
Wrappers or binders join a malicious program to a legitimate one so both run from a single file. Crypters and packers instead encrypt or compress malware to dodge antivirus.

Question 99Network Attacks & Evasion

A tester sends packets with a TTL set to expire one hop past the firewall to learn which ports the firewall lets through. What is this technique?

Correct answer: A. Firewalking
Firewalking uses TTL values like traceroute does. If an ICMP time-exceeded message comes back from beyond the firewall, the firewall allowed that port. Blocking outbound ICMP time-exceeded messages limits it.

Question 100Web Apps & SQL Injection

A tester injects into a product ID and the page shows a database error that contains the database version string. Which SQL injection technique is this?

Correct answer: D. Error-based
Error-based SQL injection gets the database to put data inside its error messages, which the page then displays. Showing generic errors to users and logging details on the server shuts down this channel.

Question 101Ethics, Social Engineering & Crypto

A small group of journalists exchanges encrypted email. There is no central certificate authority; instead, members sign each other's public keys to vouch for them. Which trust model is this?

Correct answer: A. Web of trust
PGP's web of trust lets users vouch for each other's keys by signing them, with no central authority. Hierarchical PKI depends on a root CA that issues and signs all certificates.

Question 102Wireless, Mobile & Cloud

A serverless function that resizes images has an execution role with full access to every storage bucket and database in the account. A tester exploits an injection flaw in the function and reads payroll data from an unrelated bucket. Which fix addresses the root cause?

Correct answer: C. Give the function a least-privilege execution role
The function's role allowed far more than resizing images needed, so any code flaw exposed the whole account. A least-privilege role limits the damage to the one bucket it really uses. Versioning helps recover data but does not stop it being read.

Question 103Recon, Scanning & Enumeration

A tester sniffs SNMP traffic on a network and reads the community string in plain text. Which change BEST fixes this?

Correct answer: D. Move to SNMPv3 with authentication and privacy (encryption)
SNMPv1 and v2c send community strings in clear text, so a longer string can still be sniffed. SNMPv3 with authPriv adds user authentication and encryption. Changing the string only helps against guessing.

Question 104System Hacking & Malware

A trojan sends stolen data out by encoding it into the subdomain names of DNS queries to an attacker-controlled domain. What is this technique?

Correct answer: D. A covert channel using DNS tunneling
Hiding data inside allowed protocols such as DNS creates a covert channel that slips past firewalls that allow DNS out. Watching for long, high-entropy subdomains and unusual query volumes helps detect it.

Question 105Network Attacks & Evasion

Which firewall type checks that TCP handshakes and sessions are valid at the session layer but does not inspect the content of packets?

Correct answer: B. Circuit-level gateway
A circuit-level gateway works at the session layer and only confirms that sessions are legitimate, without looking at application data. An application proxy inspects the content of specific protocols such as HTTP.

Question 106Web Apps & SQL Injection

A page shows the product when a tester adds a condition that is always true, and shows "not found" when the condition is false. No errors or data appear. Which technique is this?

Correct answer: B. Boolean-based blind
In boolean-based blind injection the attacker asks yes or no questions and reads the answer from how the page changes. Data is pulled out one bit or character at a time.

Question 107Ethics, Social Engineering & Crypto

An attacker obtains only a stored hash value and tries to find any input that produces exactly that hash. He is not given the original input. Which attack is this?

Correct answer: D. Preimage attack
A preimage attack starts from a hash value alone and searches for any input that maps to it. A second preimage attack starts from a known input and seeks a different input with the same hash.

Question 108Wireless, Mobile & Cloud

A security team wants continuous checks across all cloud accounts for issues like public storage buckets, open security groups and disabled logging, mapped to compliance benchmarks. Which tool category fits BEST?

Correct answer: C. Cloud security posture management (CSPM)
CSPM continuously scans cloud configurations for misconfigurations and compliance gaps. A CWPP protects the workloads themselves, such as VMs and containers, at runtime, not the account-level settings.

Question 109Recon, Scanning & Enumeration

A tester runs ldapsearch against a domain controller with no username or password and receives a full list of user accounts. What allowed this?

Correct answer: B. The directory allows anonymous LDAP binds
An anonymous bind lets anyone connect to LDAP (port 389) without credentials. If the directory allows it, attackers can list users, groups and attributes. Disabled Kerberos pre-authentication enables AS-REP roasting, not anonymous directory reads.

Question 110System Hacking & Malware

Malware calculates hundreds of new domain names every day and tries them until it reaches one its operator has registered. Why do attackers use this?

Correct answer: C. To make blocking a single C2 domain useless
A domain generation algorithm (DGA) means defenders cannot just block one command-and-control domain, because the malware keeps moving to new ones. Defenders reverse the algorithm to predict and sinkhole the domains.

Question 111Network Attacks & Evasion

A security team plants a fake customer record in the database that no real process ever reads, and alerts if anyone queries it. What is this?

Correct answer: A. A honeytoken
A honeytoken is fake data such as a record, credential or file whose only purpose is to raise an alert when touched. Since nobody legitimate uses it, any access is suspicious.

Question 112Web Apps & SQL Injection

An attacker logs in without a valid password by injecting a condition into the username field that is always true. Why does this work?

Correct answer: B. The query's WHERE clause becomes true for every row
Adding an always-true condition such as OR 1=1 makes the WHERE clause match every row, so the login check returns a user without a matching password. Parameterized queries stop this because the input is treated as data, not SQL.

Question 113Ethics, Social Engineering & Crypto

A web app decrypts AES-CBC cookies and returns one error for bad padding and a different error for other failures. By sending modified cookies, an attacker recovers the plaintext byte by byte. Which attack is this?

Correct answer: A. Padding oracle attack
A padding oracle attack uses differing error responses about padding validity to decrypt CBC ciphertext without the key. A chosen-plaintext attack requires the attacker to get chosen plaintext encrypted, not to probe decryption errors.

Question 114Recon, Scanning & Enumeration

Which NTP query can make an old, misconfigured NTP server return a list of the most recent hosts that talked to it?

Correct answer: C. monlist
The monlist command on older ntpd versions returns up to the last 600 client addresses, which leaks internal host lists and was also abused for amplification attacks. peers only shows the server's time sources.

Question 115System Hacking & Malware

An analyst finds a new value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to an unknown program. What does this give the malware?

Correct answer: D. Persistence: it starts each time the user logs on
Run keys launch programs automatically at logon, a common way for malware to survive reboots. A Run key under HKCU does not grant extra privileges.

Question 116Network Attacks & Evasion

A defender deploys a system that answers connection attempts to unused IP addresses and then keeps those connections open very slowly, wasting attackers' and worms' time. What is this?

Correct answer: D. A tarpit
A tarpit such as LaBrea holds connections open with a tiny TCP window, slowing scanners and worms to a crawl. It wastes the attacker's resources instead of simply blocking them.

Question 117Web Apps & SQL Injection

After confirming a SQL injection point, a tester wants sqlmap to list the databases on the server. Which option does this?

Correct answer: A. --dbs
--dbs enumerates the databases, --tables lists tables in a chosen database and --dump extracts table contents. --batch only answers sqlmap's prompts with defaults.

Question 118Ethics, Social Engineering & Crypto

Company laptops use full-disk encryption. The key is sealed in a chip on the motherboard and released only if boot components match known-good measurements. Which component provides this?

Correct answer: B. Trusted Platform Module
A TPM is a chip on the motherboard that stores keys and can seal them to boot integrity measurements. An HSM is a separate, usually network or PCIe appliance for high-volume key operations in data centers, not a per-laptop boot check.

Question 119Recon, Scanning & Enumeration

A tester finds TCP port 2049 open on a Linux server. Which command lists the directories it shares?

Correct answer: D. showmount -e
Port 2049 is NFS, and showmount -e lists the exported directories and which clients may mount them. smbclient -L and nbtstat target Windows SMB and NetBIOS services.

Question 120System Hacking & Malware

During dynamic analysis, an analyst wants to see exactly which registry keys a malware sample adds or changes. Which tool approach fits best?

Correct answer: C. Compare Regshot snapshots taken before and after
Regshot compares registry and file system snapshots taken before and after execution, so every change shows up. strings and hex editors are static methods and do not show runtime behavior.

Question 121Recon, Scanning & Enumeration

SMB running directly over TCP, without the NetBIOS session layer, uses which port?

Correct answer: A. 445
Modern SMB runs directly over TCP 445. Port 139 carries SMB over the NetBIOS session service, port 137 is NetBIOS name service and 389 is LDAP.

Question 122System Hacking & Malware

A security team wants to write rules that flag files containing specific byte patterns and strings linked to a malware family. Which tool is designed for this?

Correct answer: C. YARA
YARA rules describe malware families with strings, byte patterns and conditions, and are used to scan files and memory. Snort rules inspect network traffic instead of files.

Question 123Recon, Scanning & Enumeration

A tester wants to enumerate a company's VoIP phones and extensions. Which protocol and default port should be the focus?

Correct answer: A. SIP on 5060
SIP handles VoIP call setup and usually runs on UDP or TCP 5060. Tools like svmap and svwar find SIP devices and valid extensions. RTP carries the voice itself, and 3389 is RDP.

Question 124Recon, Scanning & Enumeration

A company rescores a vendor's CVSS rating upward because the affected server holds customer payment data and has no compensating controls. Which CVSS metric group is it using?

Correct answer: B. Environmental
Environmental metrics let an organization adjust a score for its own setting, such as how important the asset is and which controls exist. Base metrics describe the flaw itself, and temporal metrics reflect things like exploit availability over time.

Question 125Recon, Scanning & Enumeration

Half of a company's laptops are rarely on the office network when the weekly network vulnerability scan runs. Which approach gives the most complete coverage?

Correct answer: A. Use agent-based scanning installed on each laptop
Agents run on the device itself and report results whenever it is online, wherever it is. Network scans only see hosts that are reachable at scan time, so laptops away from the office are missed.