Practice questions · Cybersecurity
Certified Ethical Hacker (CEH): Practice Questions
Ten original concept-check questions on core CEH ideas. Choose an answer to reveal the explanation. Remember: ethical hacking is always authorised and scoped.
Answered 0 · Correct 0
-
What distinguishes ethical hacking from malicious hacking?
Correct answer: C. Ethical hacking is always authorised and scoped. Testing systems without permission is illegal regardless of intent. -
The first phase of an ethical hacking engagement is usually:
Correct answer: B. Reconnaissance (information gathering) comes first, building a picture of the target before any active testing. -
Passive reconnaissance differs from active reconnaissance in that it:
Correct answer: A. Passive recon uses public/third-party sources without touching the target; active recon probes the target directly. -
Enumeration is best described as:
Correct answer: C. Enumeration actively extracts detailed information (accounts, shares, services) to find a way in. -
A honeypot is:
Correct answer: A. A honeypot is a deliberately exposed decoy used to detect, divert and study attacker behaviour. -
Social engineering attacks primarily target:
Correct answer: B. Social engineering manipulates people into breaking security, bypassing technical controls. -
Attackers 'cover their tracks' mainly to:
Correct answer: B. Covering tracks hides evidence; strong logging and monitoring are the defender's countermeasure. -
SQL injection works by:
Correct answer: D. SQL injection inserts malicious input into a query because the application failed to validate or parameterise it. -
Privilege escalation refers to:
Correct answer: B. Privilege escalation moves from limited access to higher (often administrative) rights on a system. -
An ethical hacker may test:
Correct answer: B. Authorisation and scope are non-negotiable: only ever test systems you own or are explicitly permitted to test. -
The 'rules of engagement' (scope) of a penetration test define:
Correct answer: B. The rules of engagement (scope) define what is authorised to be tested and how. They do not specify the target's operating system, the tester's salary, or the attacker's favourite tools; those are not part of scope. -
Black-box testing means the tester:
Correct answer: A. Black-box testing starts with no inside knowledge, simulating an external attacker. Full knowledge is white-box. -
After finding vulnerabilities, an ethical hacker should:
Correct answer: D. Responsible disclosure to the client is required. Selling, exploiting or premature publication are unethical and often illegal. -
Using public records, search engines and social media to gather target information is:
Correct answer: D. OSINT gathers public information. The other terms describe unrelated techniques. -
A WHOIS lookup typically reveals:
Correct answer: C. WHOIS returns domain registration data. It does not expose passwords, keys or system load. -
An open port found by a port scan indicates that:
Correct answer: C. An open port suggests a listening service worth investigating. It says nothing about patching, user status or encryption. -
A SYN (half-open) scan is used to:
Correct answer: B. A SYN (half-open) scan identifies open ports while being less likely to complete and log a full TCP connection. It does not encrypt network traffic, send phishing emails or crack passwords; those are unrelated activities. -
Packet sniffing on an unencrypted network can:
Correct answer: B. Sniffing reads unencrypted traffic, exposing data in transit. It does not improve speed, patch systems or issue certificates. -
A brute-force password attack works by:
Correct answer: A. A brute-force attack systematically tries many combinations until one works. Guessing a single password once is not brute force, reading it from a sticky note is shoulder-surfing or physical theft, and emailing the user is phishing. -
A 'pass-the-hash' attack lets an attacker:
Correct answer: D. Pass-the-hash reuses a stolen hash to authenticate. It does not decrypt files, reset firmware or scan ports. -
A keylogger is malware that:
Correct answer: A. Keyloggers capture typed input such as passwords. The other descriptions are unrelated functions. -
A rootkit is especially dangerous because it:
Correct answer: A. A rootkit is dangerous because it hides its presence while keeping privileged access, making it hard to detect. Sending spam, updating software automatically and defragmenting the disk are either benign or unrelated to how a rootkit works. -
'Tailgating' (piggybacking) is:
Correct answer: C. Tailgating is a physical social-engineering technique. It is not phishing, password cracking or malware. -
'Pretexting' in social engineering means:
Correct answer: C. Pretexting means inventing a believable scenario to manipulate a target into revealing information. Patching systems, scanning ports and encrypting files are technical actions, not the social-engineering deception that defines pretexting. -
Cross-site scripting (XSS) injects:
Correct answer: A. Cross-site scripting injects malicious scripts into web pages that other users then view. Injecting SQL commands into a database is SQL injection; injecting keys into a TPM or packets into a switch are unrelated to XSS. -
A directory-traversal attack attempts to:
Correct answer: D. A directory-traversal attack uses paths such as ../ to reach files outside the web root. Its goal is not to add new users, encrypt the website, or speed up the server; those are unrelated outcomes. -
The OWASP Top 10 is:
Correct answer: D. The OWASP Top 10 catalogues major web app risks. It is not a product, standard or scanner. -
In security, a cryptographic hash function is used mainly to:
Correct answer: B. Hashing detects changes (integrity); it is one-way, unlike reversible encryption, and unrelated to CPU or networking. -
The main risk of a self-signed certificate on a public website is that:
Correct answer: D. Without a trusted CA, identity cannot be validated, enabling impersonation. Speed, disk and ads are not the core risk. -
Privilege escalation combined with 'covering tracks' suggests an attacker is trying to:
Correct answer: A. Escalating privileges and deleting logs aims to deepen access while avoiding detection, not to help the system.
Practice questions FAQ
- Are these real CEH exam questions?
- No. These are original study questions written to test understanding. They are not real exam questions, exam dumps, or copied from any provider.
- How should I use these practice questions?
- Answer each one, read the explanation (including why the wrong options are wrong), and use the per-domain score below to focus your revision on weak areas. Revisit before exam day.
- How many questions should I do before the exam?
- Enough to score consistently across every domain, alongside full-length practice from official or reputable providers. Understanding why each answer is right matters more than raw volume.
- What score means I am ready?
- A good signal is consistently scoring around 80% or higher across all domains on questions you have not seen before, and being able to explain why the wrong options are wrong.
- Should I use exam dumps?
- No. Dumps (real or leaked questions) breach provider policy, can void your certification, and do not build the understanding the exam actually tests.