I85PREP
⌘ K
CEH study materials
CEH study resources

CEH practice questions

One question at a time. Build your CEH understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Ethical Hacking

Which type of hacker tests a system only after receiving explicit permission from its owner and then reports the findings?

  1. White hat hacker Correct answer.
  2. Grey hat hacker
  3. Black hat hacker
  4. Script kiddie

Explanation

Ethical hacking is defined by authorization and lawful intent, not by the tools used. A white hat hacker obtains the owner's consent, stays within the agreed scope, and reports discovered weaknesses so they can be fixed. Attackers who act without permission fall into different classes regardless of skill.

Question 2Introduction to Ethical Hacking

Which element of the CIA triad guarantees that data has not been modified in transit or at rest?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Availability
  4. Authenticity

Explanation

The CIA triad splits security goals into confidentiality, integrity, and availability. Integrity means data remains accurate and complete and has not been altered by an unauthorized party. Hashes and digital signatures are common controls used to detect unauthorized change.

Question 3Introduction to Ethical Hacking

In a standard hacking methodology, which phase immediately precedes gaining access to a target?

  1. Reconnaissance Correct answer.
  2. Covering tracks
  3. Reporting
  4. Maintaining access

Explanation

Hacking methodologies generally flow from information gathering through exploitation, persistence, cleanup, and reporting. Reconnaissance gathers information about the target so that an attack can be planned and executed. Only after this preparation does the attacker attempt to gain access.

Question 4Introduction to Ethical Hacking

Which term describes an unskilled attacker who runs existing tools and scripts without understanding how they work?

  1. Hacktivist
  2. Cyberterrorist
  3. Script kiddie Correct answer.
  4. State-sponsored attacker

Explanation

Hacker classes are often distinguished by skill, motive, and sponsorship. A script kiddie lacks deep technical understanding and depends on tools and exploits written by others. The label says nothing about the target or the attacker's ideology.

Question 5Introduction to Ethical Hacking

Before beginning a penetration test, what must the tester obtain to make the activity lawful and ethical?

  1. A full copy of the application source code
  2. A public vulnerability disclosure post
  3. Full anonymization of all test traffic
  4. Signed authorization and a defined scope Correct answer.

Explanation

Testing without permission is an attack, no matter how good the intentions are. A written agreement defines the targets, timing, limits, and liabilities of the engagement. Technical details such as source code access depend on the chosen testing type and are not legal prerequisites.

Question 6Introduction to Ethical Hacking

A misconfigured firewall rule that allows unintended inbound traffic is best described as which of the following?

  1. A risk
  2. A vulnerability Correct answer.
  3. A threat
  4. An exploit

Explanation

A vulnerability is a weakness in a system, configuration, or process that can be used to violate security. Threats are the actors or events that could cause harm, while risk combines likelihood and impact. Keeping these terms distinct is essential for accurate reporting.

Question 7Introduction to Ethical Hacking

A researcher discovers a flaw in a vendor's product without permission, confirms it causes no harm, and publishes details after the vendor issues a fix. Which label fits best?

  1. Grey hat hacker Correct answer.
  2. Black hat hacker
  3. Cyberterrorist
  4. White hat hacker

Explanation

Grey hat activity sits between the white and black hat categories: the work is unauthorized, but the intent is not malicious and findings are usually disclosed. Permission is what separates grey hat conduct from white hat conduct. Coordinated disclosure mitigates harm but does not supply the missing authorization.

Question 8Introduction to Ethical Hacking

In a black-box penetration test, what information does the tester receive about the target before testing begins?

  1. Complete network diagrams and credentials
  2. Source code and database schema
  3. A list of known vulnerabilities from the vendor
  4. Only publicly available information Correct answer.

Explanation

Testing types are defined by how much knowledge the tester is given up front. In black-box testing the tester starts with the same view an outside attacker would have. Greater levels of supplied information correspond to grey-box and white-box engagements.

Question 9Introduction to Ethical Hacking

Within a security program, what is the primary role of a red team?

  1. To emulate adversary attacks on the organization Correct answer.
  2. To patch systems and apply configuration baselines
  3. To draft security policies and standards
  4. To monitor and respond to detected intrusions

Explanation

Red teams adopt an attacker's perspective and emulate realistic adversary behavior to test people, processes, and technology together. Blue teams defend, detect, and respond, and the two functions are often exercised against each other. Hardening and policy work belong to operational and governance functions.

Question 10Introduction to Ethical Hacking

An attacker defaces a government website to protest a new environmental law. Which attacker class does this best illustrate?

  1. State-sponsored attacker
  2. Script kiddie
  3. Hacktivist Correct answer.
  4. Insider threat

Explanation

Attacker classes can be inferred from motive as well as skill. Defacement carried out to publicize a political or social cause is the hallmark of hacktivism. The label does not depend on the technical sophistication of the attack.

Question 11Introduction to Ethical Hacking

In the Cyber Kill Chain model, which phase involves combining an exploit with a payload into a deliverable file?

  1. Delivery
  2. Weaponization Correct answer.
  3. Command and control
  4. Reconnaissance

Explanation

The kill chain describes an intrusion as a sequence of stages that must each succeed. Weaponization couples an exploit with malicious code to produce a usable payload. Delivery then transmits that payload to the victim.

Question 12Introduction to Ethical Hacking

A risk assessment finds a highly likely threat against a system with a severe unpatched weakness. Which statement best expresses the risk?

  1. The risk is high due to high likelihood and impact Correct answer.
  2. The risk is eliminated once a firewall is installed
  3. The risk equals the annual cost of the firewall license
  4. The risk is negligible because no attack has occurred

Explanation

Risk is a function of the likelihood that a threat exploits a weakness and the impact if it does. High likelihood combined with severe impact yields high risk that should be prioritized for treatment. The cost of a control is a budget consideration, not a measure of risk itself.

Question 13Introduction to Ethical Hacking

What does the principle of defense in depth require?

  1. A single strong perimeter firewall guarding the network edge
  2. Encrypting only the data that leaves the building
  3. Hiding the network topology from all internal users
  4. Layered controls so a single failure is not fatal Correct answer.

Explanation

Defense in depth places multiple, overlapping controls at different layers so that no single control failure exposes the whole environment. The strategy assumes that any one control can be bypassed. A monolithic perimeter control is the opposite of layered defense.

Question 14Introduction to Ethical Hacking

Which mechanism provides non-repudiation for a message?

  1. Symmetric encryption using a key shared by both parties
  2. Lossless compression applied before transmission
  3. A digital signature made with the sender's private key Correct answer.
  4. A message hash stored on the sender's local hard disk

Explanation

Non-repudiation means the sender cannot credibly deny having produced a message. Only the holder of a private key can create the matching signature, and anyone with the public key can verify it. Shared-key techniques cannot settle disputes because both parties hold the same secret.

Question 15Introduction to Ethical Hacking

Which item belongs in the rules of engagement for a penetration test?

  1. The defined target scope and testing window Correct answer.
  2. The list of commercial tools the tester avoids
  3. The penetration testing vendor's marketing materials
  4. The tester's preferred operating system

Explanation

Rules of engagement define what may be tested, when, how, and under what constraints, including targets, exclusions, and escalation contacts. They protect both the client and the tester by fixing the boundaries of authorized activity. Personal preferences and promotional content are irrelevant to those boundaries.

Question 16Introduction to Ethical Hacking

An organization invites independent researchers to find and report flaws in exchange for monetary rewards, with no individual contract signed in advance. This is best described as:

  1. A bug bounty program Correct answer.
  2. A compliance review
  3. A vulnerability disclosure policy
  4. A closed internal audit

Explanation

A bug bounty program rewards researchers for valid findings under published program rules. A vulnerability disclosure policy invites reports but typically does not pay for them. Internal audits and compliance reviews are performed for the organization rather than by outside researchers.

Question 17Introduction to Ethical Hacking

Which characteristic best distinguishes an advanced persistent threat group from a typical script kiddie?

  1. Motivation limited to public bragging rights
  2. Long-term, well-funded campaigns with custom tooling Correct answer.
  3. Use of well-known free hacking tools against random targets
  4. Reliance on a single phishing email sent to one user

Explanation

Advanced persistent threats are characterized by sustained, resourced operations that target specific victims over long periods. They typically develop or buy custom tools and adapt when detected. Script kiddies, by contrast, reuse public tools opportunistically and lack persistence.

Question 18Introduction to Ethical Hacking

How does a penetration test differ from a vulnerability assessment?

  1. A penetration test exploits findings to prove real impact Correct answer.
  2. A vulnerability assessment always requires a red team
  3. A penetration test scans and lists findings without validating them
  4. A vulnerability assessment cannot use automated scanners

Explanation

A vulnerability assessment identifies and reports weaknesses, while a penetration test goes further by safely exploiting them to demonstrate business impact. Exploitation is what distinguishes the two activities. Both may use automated scanners as a starting point.

Question 19Introduction to Ethical Hacking

Two people use identical exploits against the same server. One is an ethical hacker and the other is a criminal. Which factor determines the difference?

  1. Documented authorization from the owner Correct answer.
  2. The exploit's technical sophistication
  3. The speed at which the exploit is delivered
  4. The operating system of the target server

Explanation

Ethical hacking is distinguished by permission and lawful intent, not by technique. The same tool used inside an authorized engagement is legitimate, while the same tool used without consent is an attack. Documentation such as a signed scope and rules of engagement evidences that authorization.

Question 20Introduction to Ethical Hacking

A US-based healthcare provider stores electronic patient records. Which regulation most directly mandates safeguards for that data?

  1. SOX
  2. PCI DSS
  3. GDPR
  4. HIPAA Correct answer.

Explanation

HIPAA governs the privacy and security of protected health information held by US healthcare providers and their business associates. Each regulation targets a specific data category or industry. Identifying the data type first makes selecting the applicable rule straightforward.

Question 21Footprinting and Reconnaissance

Which TCP port does the WHOIS service use to answer registration queries?

  1. 53
  2. 80
  3. 43 Correct answer.
  4. 25

Explanation

WHOIS queries are sent over TCP port 43 to a registrar or regional internet registry, which returns registration details for a domain or IP range. The other ports listed belong to unrelated services that do not serve registration records.

Question 22Footprinting and Reconnaissance

Which DNS query type is used to request a full copy of a zone from an authoritative name server?

  1. CNAME
  2. SOA
  3. AXFR Correct answer.
  4. PTR

Explanation

AXFR is the zone transfer query type that asks an authoritative server for the complete set of records in a zone. SOA, PTR and CNAME are ordinary record types returned during normal lookups rather than requests for a zone copy.

Question 23Footprinting and Reconnaissance

Which Google search operator limits results to pages belonging to one specific domain?

  1. cache:
  2. filetype:
  3. inurl:
  4. site: Correct answer.

Explanation

The site: operator restricts results to a specified domain or subdomain, which is useful for enumerating indexed pages of a target. The other operators filter on URL text, file extension, or retrieve a cached copy respectively.

Question 24Footprinting and Reconnaissance

What is the primary purpose of a robots.txt file on a web server?

  1. It stores the encryption keys used for HTTPS sessions.
  2. It tells automated crawlers which paths should not be indexed. Correct answer.
  3. It authenticates automated crawlers before they connect.
  4. It enforces access control for human visitors to the site.

Explanation

robots.txt is a voluntary convention that advertises which directories a crawler is asked to avoid, and analysts read it because it often discloses sensitive path names. It is not an authentication mechanism and offers no enforcement against a direct request.

Question 25Footprinting and Reconnaissance

Which DNS record type identifies the mail servers responsible for accepting email for a domain?

  1. A
  2. NS
  3. CNAME
  4. MX Correct answer.

Explanation

MX records list the hosts that handle inbound mail for a domain, with preference values that set delivery order. Enumerating them during footprinting identifies mail infrastructure and third-party filtering providers.

Question 26Footprinting and Reconnaissance

Which service would an analyst use to view versions of a target website that were published years ago?

  1. Shodan
  2. Maltego
  3. Netcraft
  4. The Internet Archive Wayback Machine Correct answer.

Explanation

The Wayback Machine stores historical snapshots of public web pages, letting an analyst recover old contact details, employee names, and technology references that were removed from the live site. The other services provide device indexing, hosting information, or link analysis rather than archived page content.

Question 27Footprinting and Reconnaissance

Which command queries the MX records of example.com using dig?

  1. dig example.com /MX
  2. dig -x example.com
  3. dig MX @example.com
  4. dig example.com MX Correct answer.

Explanation

In dig the query type is supplied as a positional argument after the name, so the record type MX follows the domain. Supplying @ before a name is how an alternate name server is specified, not a record type.

Question 28Footprinting and Reconnaissance

Which command performs a reverse DNS lookup of the address 203.0.113.10?

  1. nslookup -type=MX example.com
  2. host -a example.com
  3. dig example.com A
  4. dig -x 203.0.113.10 Correct answer.

Explanation

Reverse lookups resolve an address to a name and are issued in dig with the -x option followed by the IP address, which builds a query in the in-addr.arpa zone. Forward queries take a name and a record type instead.

Question 29Footprinting and Reconnaissance

What role does the serial number field of an SOA record play?

  1. It holds the email address of the zone administrator.
  2. It is the zone version number, incremented on change so secondaries know to reload. Correct answer.
  3. It sets the time-to-live applied to every cached record in the zone.
  4. It defines how often a secondary polls the primary server.

Explanation

The serial acts as a version stamp for the zone; secondary servers compare it against their stored copy and request a transfer when it increases. The remaining SOA fields cover refresh, retry, expiry, minimum TTL, and the responsible mailbox.

Question 30Footprinting and Reconnaissance

Why is enumerating a domain's TXT records useful during footprinting?

  1. They often publish SPF data, showing which hosts may send mail for the domain. Correct answer.
  2. They reveal the registrar that holds the domain registration.
  3. They contain the domain's DNSSEC public signing keys.
  4. They encode the physical location of each mail server.

Explanation

TXT records commonly carry SPF and DMARC policy text, which lists the hosts and third parties authorized to send email as the domain. That list informs an assessment of whether spoofed messages would pass receiving-side checks.

Question 31Footprinting and Reconnaissance

Which tool gathers email addresses, employee names, subdomains and hosts for a target from public sources?

  1. theHarvester Correct answer.
  2. Netcat
  3. Nmap
  4. Hydra

Explanation

theHarvester aggregates open-source intelligence such as addresses, names, and hosts by querying search engines, public databases, and certificate sources. It performs passive collection rather than authentication attacks or port scanning.

Question 32Footprinting and Reconnaissance

A job advertisement for a target company lists experience with Cisco ASA firewalls and Windows Server 2019. What does this most directly tell a footprinting analyst?

  1. The company is vulnerable to a specific published exploit.
  2. Technologies in use at the company that are worth further investigation. Correct answer.
  3. The company runs an unpatched build of each product.
  4. Valid employee credentials for those systems are exposed.

Explanation

Recruitment material is a passive source that discloses platform and product names in the environment, which helps an analyst focus later research. It does not establish patch levels, vulnerabilities, or credentials on its own.

Question 33Footprinting and Reconnaissance

What kind of information does Shodan provide to a reconnaissance analyst?

  1. Historical snapshots of web pages that have since been removed.
  2. Results of authenticated vulnerability scans on remote hosts.
  3. Banners and metadata for internet-facing devices and services. Correct answer.
  4. Answers to DNS zone transfer requests.

Explanation

Shodan continuously indexes service banners, TLS certificate details, and product metadata from devices reachable on the internet, which reveals exposed services without direct contact from the analyst. It does not authenticate to targets or archive page history.

Question 34Footprinting and Reconnaissance

How can certificate transparency logs assist subdomain discovery?

  1. They record issued certificates, whose subject alternative names often include internal hostnames. Correct answer.
  2. They log the router hops between the analyst and the target.
  3. They list the registration details of the domain owner.
  4. They store every path a web crawler has indexed.

Explanation

Certificates are published to public transparency logs, and the subject alternative name field frequently enumerates hostnames the organization requested certificates for. Querying those logs surfaces subdomains that no longer resolve or are not linked publicly.

Question 35Footprinting and Reconnaissance

What does a traceroute to a target primarily reveal?

  1. The operating system patch level of each hop.
  2. The sequence of routers between the analyst and the target. Correct answer.
  3. The registrar and expiry date of the target domain.
  4. The plaintext contents of encrypted traffic along the path.

Explanation

Traceroute sends probes with increasing hop limits and reports the responding routers, mapping the path and rough latency between networks. This helps identify upstream providers and network boundaries near the target.

Question 36Footprinting and Reconnaissance

What does DNS cache snooping attempt to determine?

  1. Whether specific domains were recently resolved through a caching resolver. Correct answer.
  2. Whether a zone can be copied from an authoritative server.
  3. Whether forged records can be injected into a resolver's cache.
  4. Whether local DNS traffic can be captured on the same segment.

Explanation

Cache snooping probes a recursive resolver for names it may already hold, because a cached answer implies that someone recently queried that name. This can hint at an organization's browsing interests without generating a fresh authoritative lookup.

Question 37Footprinting and Reconnaissance

An AXFR request sent to ns1.example.com returns 'Transfer failed.' Which conclusion is best supported?

  1. The zone is protected by DNSSEC and therefore cannot be enumerated.
  2. The domain has no subdomains configured in its zone.
  3. The server restricts transfers to authorized secondary servers, so subdomains must be gathered another way. Correct answer.
  4. The name server is unreachable from the network.

Explanation

A refusal means the server did not authorize the requesting host, which is the normal hardened configuration; it says nothing about whether subdomains exist. Enumeration then continues through dictionary-based resolution, certificate transparency, and passive DNS sources.

Question 38Footprinting and Reconnaissance

Which activity counts as active footprinting rather than passive reconnaissance?

  1. Reading the target's published press releases.
  2. Querying WHOIS records at a regional internet registry.
  3. Reviewing employee profiles on a social networking site.
  4. Requesting a zone transfer from the target's authoritative name server. Correct answer.

Explanation

Active footprinting involves sending traffic directly to systems the target controls, so a zone transfer request reaches the target's own server and may be logged. The other choices draw on third-party or published sources that never contact the target's infrastructure.

Question 39Footprinting and Reconnaissance

A WHOIS lookup returns 'REDACTED FOR PRIVACY' for the registrant fields. Which remaining data is most useful for mapping the target's infrastructure?

  1. The registrant street address
  2. The authoritative name servers Correct answer.
  3. The registrant telephone number
  4. The registrant email address

Explanation

Privacy shielding hides personal registrant details but normally leaves the delegated name servers and registrar visible, and those name servers lead directly into the organization's DNS infrastructure. Enumerating those servers supports further zone and host discovery.

Question 40Footprinting and Reconnaissance

An email contains several Received headers. Which one is closest to the sender's originating system?

  1. The bottom-most, added by the first server that handled the message Correct answer.
  2. The one listing the numerically highest IP address
  3. The one containing the Message-ID value
  4. The topmost, added by the recipient's mail server

Explanation

Each relay prepends a Received header, so the earliest hop appears lowest in the list and is nearest the originating host, while the topmost entry records the final delivery step. Analysts read the headers from the bottom upward to trace the true origin.

Question 41Scanning Networks and Enumeration

An Nmap scan is launched with administrator or root privileges and no scan-type flag is specified. Which scan technique does Nmap apply by default?

  1. TCP SYN scan Correct answer.
  2. TCP ACK scan
  3. UDP scan
  4. TCP connect scan

Explanation

With raw-socket privileges Nmap defaults to the half-open TCP SYN scan, which sends a SYN, reads the reply, and tears the connection down before the handshake completes. Without those privileges it falls back to the full connect scan.

Question 42Scanning Networks and Enumeration

Which Nmap option requests a UDP port scan?

  1. -sU Correct answer.
  2. -sN
  3. -sA
  4. -sT

Explanation

The -sU flag selects UDP scanning, in which Nmap sends UDP datagrams and treats an ICMP port-unreachable reply as evidence that the port is closed. Open UDP ports usually answer with nothing at all.

Question 43Scanning Networks and Enumeration

Which Nmap option limits the run to host discovery only, without probing any ports?

  1. -sn Correct answer.
  2. -sV
  3. -sS
  4. -O

Explanation

The -sn option performs a ping sweep: Nmap sends discovery probes such as ICMP echo, TCP SYN to common ports, and ARP, then reports which hosts are up without scanning ports.

Question 44Scanning Networks and Enumeration

Which DNS request is used to copy an entire zone from an authoritative name server?

  1. AXFR Correct answer.
  2. SRV
  3. PTR
  4. MX

Explanation

An AXFR request asks an authoritative server to transfer the full contents of a zone. If the server is misconfigured to answer anyone, the transfer discloses every hostname and record in that zone.

Question 45Scanning Networks and Enumeration

During a TCP FIN scan, a target port replies with an RST segment. What does this indicate about the port?

  1. The port is filtered
  2. The target is offline
  3. The port is closed Correct answer.
  4. The port is open

Explanation

A closed port answers an unexpected FIN segment with RST, whereas an open port silently discards the segment and produces no reply. The technique depends on that asymmetry in RFC-compliant TCP stacks.

Question 46Scanning Networks and Enumeration

What is the purpose of banner grabbing during enumeration?

  1. Reading identification text a service presents on connection Correct answer.
  2. Guessing valid credentials against a remote service
  3. Overwhelming a listener until it refuses connections
  4. Mapping firewall rule sets with crafted probes

Explanation

Banner grabbing connects to a service and reads the greeting text it returns, which often discloses the software name, version, and sometimes the host or platform. That text feeds later version-matching and exploit selection.

Question 47Scanning Networks and Enumeration

Which property must a host satisfy to be usable as the zombie in an Nmap idle scan (-sI)?

  1. It must run an open recursive DNS resolver
  2. It must sit in the target's broadcast domain
  3. It must accept fragmented IP packets
  4. It must assign IP ID values predictably Correct answer.

Explanation

Idle scanning infers the target's port states by watching the zombie's IP identification counter. The zombie must increment that counter globally and predictably so the scanner can detect the increment caused by the target's response.

Question 48Scanning Networks and Enumeration

Nmap reports a live host as down because the host ignores ICMP echo requests. Which option forces Nmap to scan the host anyway?

  1. -O
  2. -n
  3. -sA
  4. -Pn Correct answer.

Explanation

The -Pn option disables host discovery and treats every supplied target as online, so the port scan proceeds even when discovery probes go unanswered. It is the standard fix for hosts that silently drop ping traffic.

Question 49Scanning Networks and Enumeration

Nmap reports a port as filtered. What does that state mean?

  1. The port is open and accepting connections
  2. The port is closed and returned an RST
  3. Probes are dropped, leaving the state unknown Correct answer.
  4. The host answered but runs no service

Explanation

A filtered result means Nmap received no usable answer: packets were dropped, or an ICMP error such as administratively prohibited came back. Because no TCP response was seen, the scanner cannot tell whether a service is listening.

Question 50Scanning Networks and Enumeration

Why are FIN, NULL, and XMAS scans unreliable against Microsoft Windows targets?

  1. Windows drops segments that carry no payload
  2. Windows rate-limits half-open connections
  3. Windows resets ports regardless of their state Correct answer.
  4. Windows strips all TCP options from its replies

Explanation

These three scan types rely on open ports staying silent and closed ports answering with RST. The Windows TCP stack instead returns RST for any segment that reaches a port, so every probed port appears closed and the results cannot be trusted.