EC-Council Certified Ethical Hacker (CEH v13) — Questions and Answers

Question 1: Which wireless security protocol is considered obsolete and easily crackable due to weak RC4 encryption?

WPA3
WPA2
WEP (Correct answer)
802.1X

Correct answer: WEP

WEP (Wired Equivalent Privacy) uses weak RC4 encryption with static keys and flawed IV reuse, making it crackable in minutes using tools like Aircrack-ng.

Question 2: Which sandbox tool is widely used by penetration testers and malware analysts for automated dynamic malware analysis?

IDA Pro
OllyDbg
Cuckoo Sandbox (Correct answer)
Ghidra

Correct answer: Cuckoo Sandbox

Cuckoo Sandbox is an open-source automated malware analysis system that detonates suspicious files in an isolated VM and reports on file system changes, network activity, and API calls.

Question 3: What is the name of the technique for hiding text within an image?

Spyware
Encryption
Keystroke logging
Steganography (Correct answer)

Correct answer: Steganography

Explanation: Steganography is the art of concealing a secret message within (or even on top of) a non-secret object. That something can be anything you want it to be. Many forms of steganography nowadays involve hiding a secret piece of text within a photograph.

Question 4: Which Nmap scan type sends a SYN packet and waits for a SYN-ACK without completing the handshake?

SYN stealth scan (Correct answer)
XMAS scan
Full connect scan
UDP scan

Correct answer: SYN stealth scan

A SYN stealth scan (half-open scan) sends SYN and records the SYN-ACK response without completing the TCP handshake, making it harder to detect.

Question 5: Which type of wireless attack intercepts the initial WPA2 handshake to perform an offline brute-force or dictionary attack?

PMKID attack
Handshake capture and offline cracking (Correct answer)
WPS PIN brute force
Evil twin credential harvesting

Correct answer: Handshake capture and offline cracking

Capturing the WPA2 four-way handshake during client authentication provides an offline crackable artifact — Aircrack-ng or Hashcat can attempt passwords without further network interaction.

Question 6: What is the role of a 'C2' (Command and Control) server in a penetration test simulation?

Scan for open ports
Generate phishing emails
Store cracked passwords
Receive connections from compromised hosts and issue commands (Correct answer)

Correct answer: Receive connections from compromised hosts and issue commands

A C2 server receives beacons from compromised systems and allows the attacker to issue commands, exfiltrate data, and maintain persistence during an engagement.

Question 7: Which HTTP response header helps prevent XSS attacks by restricting which content can be loaded on a page?

Strict-Transport-Security
X-Content-Type-Options
X-Frame-Options
Content-Security-Policy (Correct answer)

Correct answer: Content-Security-Policy

Content-Security-Policy (CSP) headers restrict the sources from which scripts, styles, and other resources can be loaded, significantly reducing XSS attack surface.

Question 8: What is 'Business Email Compromise' (BEC)?

Mass phishing campaigns targeting business email accounts
Fraudulent emails impersonating executives to authorize wire transfers or data disclosure (Correct answer)
Compromising email servers via SQL injection
Malware delivered via email attachments to business networks

Correct answer: Fraudulent emails impersonating executives to authorize wire transfers or data disclosure

BEC attacks impersonate executives or trusted partners via email to trick employees into transferring funds, sharing sensitive data, or changing payment details.

Question 9: What is a 'beacon frame' in 802.11 wireless networking?

A management frame broadcast by APs to announce their presence, SSID, and capabilities (Correct answer)
A frame used to authenticate new clients to the network
A data frame carrying encrypted user traffic
A control frame used to coordinate channel access

Correct answer: A management frame broadcast by APs to announce their presence, SSID, and capabilities

Beacon frames are management frames periodically broadcast by access points to advertise the network's SSID, supported rates, encryption capabilities, and timing information.

Question 10: When a hacker impersonates a legitimate user on a system, what is the term for it?

Valid user
Impersonation (Correct answer)
Third-person authorization
Help desk

Correct answer: Impersonation

Explanation: An impersonation attack is a type of fraud in which attackers impersonate a known or trusted individual in order to trick an employee into transferring money to a fraudulent account, sharing sensitive information (such as intellectual property, financial data, or payroll information), or revealing login credentials.

Question 11: What is a 'dropper' in malware terminology?

A malware component that downloads and installs additional malware payloads (Correct answer)
Malware that drops fake antivirus alerts
An exploit that drops into kernel mode
Malware that deletes itself after installation

Correct answer: A malware component that downloads and installs additional malware payloads

A dropper is a small malware component whose sole purpose is to deliver and install additional malware (payload) on the victim system, often used to bypass initial security controls.

Question 12: What is a 'golden ticket' attack in Active Directory penetration testing?

Injecting malicious Group Policy Objects
Creating a rogue domain controller
Brute forcing domain admin credentials
Exploiting Kerberos by forging TGTs using the KRBTGT hash (Correct answer)

Correct answer: Exploiting Kerberos by forging TGTs using the KRBTGT hash

A golden ticket attack forges Kerberos Ticket Granting Tickets (TGTs) by using the KRBTGT account hash, granting persistent, nearly unlimited domain access.

Question 13: What does PKI stand for and what problem does it solve?

Packet Key Inspection — deep packet inspection for encryption
Public Key Integrity — verifies data has not been altered
Public Key Infrastructure — solves the problem of securely distributing and trusting public keys (Correct answer)
Private Key Implementation — manages private key storage

Correct answer: Public Key Infrastructure — solves the problem of securely distributing and trusting public keys

Public Key Infrastructure (PKI) is a framework of policies, procedures, and technology for creating, distributing, and verifying digital certificates that bind identities to public keys.

Question 14: What type of malware is specifically designed to hide its presence and maintain persistent privileged access on a compromised system?

Adware
Rootkit (Correct answer)
Worm
Ransomware

Correct answer: Rootkit

Rootkits are designed to conceal themselves and other malicious software while maintaining privileged access, often modifying OS components to avoid detection.

Question 15: What is 'pivoting' in the context of network penetration testing?

Using a compromised host to attack other internal systems (Correct answer)
Enumerating open ports
Escalating privileges on a single host
Covering tracks after exploitation

Correct answer: Using a compromised host to attack other internal systems

Pivoting uses a compromised machine as a relay point to reach and attack other systems in a network that are not directly accessible from the attacker's machine.

Question 16: Which attack involves an attacker inserting themselves between two communicating hosts to intercept traffic?

Man-in-the-Middle attack (Correct answer)
Brute force attack
DoS attack
Replay attack

Correct answer: Man-in-the-Middle attack

A Man-in-the-Middle (MitM) attack positions the attacker between two parties to intercept, read, or modify communications without detection.

Question 17: What type of attack exploits the statistical probability that two people in a group share a birthday to find hash collisions faster than brute force?

Birthday attack (Correct answer)
Replay attack
Side-channel attack
Chosen-plaintext attack

Correct answer: Birthday attack

The birthday attack exploits the birthday paradox to find two inputs with the same hash significantly faster than expected, reducing the security of hash functions.

Question 18: What is the primary function of a software keylogger in system hacking?

Scanning the local system for stored password files
Monitoring network traffic for credentials transmitted in plaintext
Recording all keystrokes entered on a compromised system to capture sensitive data (Correct answer)
Encrypting keystrokes to prevent interception by other attackers

Correct answer: Recording all keystrokes entered on a compromised system to capture sensitive data

Keyloggers capture and record every keystroke on a system, allowing attackers to steal passwords, credit card numbers, messages, and other sensitive input.

Question 19: During a physical penetration test, an attacker wears a company badge and carries equipment to blend in. What technique is this?

Baiting
Impersonation (Correct answer)
Vishing
Tailgating

Correct answer: Impersonation

Impersonation involves disguising oneself as an employee, vendor, or contractor with props like badges or uniforms to gain unauthorized physical access to facilities.

Question 20: What is the KRACK attack and which protocol does it target?

Keyless Remote Access Cracking targeting automotive wireless systems
Known-text Rainbow Attack Cryptanalysis targeting WPA3
Key Reinstallation Attack targeting WPA2 by replaying cryptographic handshake messages (Correct answer)
Key Recovery Attack targeting WEP encryption

Correct answer: Key Reinstallation Attack targeting WPA2 by replaying cryptographic handshake messages

KRACK (Key Reinstallation Attack) targets WPA2 by replaying handshake messages to reset cryptographic nonces, allowing nonce reuse that can decrypt and potentially inject wireless traffic.

Question 21: What is 'HTTP verb tampering' in web security testing?

Modifying server response codes
Sending unexpected HTTP methods like PUT or DELETE to bypass access controls (Correct answer)
Replaying captured HTTP requests
Injecting headers into HTTP responses

Correct answer: Sending unexpected HTTP methods like PUT or DELETE to bypass access controls

HTTP verb tampering sends unusual HTTP methods (PUT, DELETE, PATCH) to web endpoints to bypass access controls that only restrict GET or POST requests.

Question 22: Under _______ scan the ports that have been scanned the most.

SYN
SYN stealth (Correct answer)
DUP
Ping

Correct answer: SYN stealth

Explanation: Scan for TCP SYN (Stealth) (-sS) For good reason, SYN scan is the default and most popular scan option. It can be done quickly, with thousands of ports being scanned per second on a fast network with no obtrusive firewalls. It is the default TCP scan when raw-packet privileges are available, and it requires raw-packet privileges.

Question 23: What is the 'PMKID attack' and how does it differ from handshake-based WPA2 cracking?

PMKID attack requires a client to be connected; handshake cracking does not
PMKID attack is only effective against WPA3; handshake cracking targets WPA2
PMKID attack uses rainbow tables; handshake cracking uses wordlists
PMKID attack can be performed against the AP directly without waiting for a client to connect; handshake cracking requires capturing a client connection (Correct answer)

Correct answer: PMKID attack can be performed against the AP directly without waiting for a client to connect; handshake cracking requires capturing a client connection

The PMKID attack extracts a PMKID directly from the AP without waiting for a client to authenticate, making it possible to crack WPA2 passphrases with just the AP present.

Question 24: What is 'fileless malware' and why is it harder to detect?

Malware stored in encrypted files
Malware that hides inside image files
Malware that deletes its executable after running
Malware that resides only in memory without writing to disk, evading file-based detection (Correct answer)

Correct answer: Malware that resides only in memory without writing to disk, evading file-based detection

Fileless malware operates entirely in RAM using legitimate system tools (PowerShell, WMI) without writing to disk, bypassing traditional file-based antivirus scanning.

Question 25: During a penetration test, what does 'enumeration' primarily involve?

Covering tracks after access
Exploiting a known vulnerability
Gathering detailed information about network resources, users, and services (Correct answer)
Cracking passwords offline

Correct answer: Gathering detailed information about network resources, users, and services

Enumeration involves actively querying target systems to extract detailed information such as usernames, shares, services, and configuration details.

Question 26: What is a 'backdoor' malware?

Malware that spreads via USB drives
Malware that provides persistent remote access to a compromised system (Correct answer)
Malware that installs itself in the system boot sector
Malware that deletes files after a set time

Correct answer: Malware that provides persistent remote access to a compromised system

A backdoor creates a covert persistent entry point into a compromised system, allowing attackers to return at will without needing to re-exploit the initial vulnerability.

Question 27: Hacking for a good cause is referred to as

Activism
Hacktivism (Correct answer)
Black-hat hacking
Active hacking

Correct answer: Hacktivism

Explanation: When political or social activists utilize computer technology to make a statement in support of one of their causes, this is known as hacktivism. Hacktivism typically targets government or corporate targets, although it can also target any prominent institution, such as religious groups, drug dealers, terrorists, or pedophiles.

Question 28: What does 'living off the land' (LotL) mean in the context of system hacking?

Harvesting credentials stored in browser profiles and password managers
Using legitimate system tools already present on the target to carry out attacks and evade detection (Correct answer)
Installing custom malware frameworks on a compromised system
Using zero-day exploits to bypass all security controls

Correct answer: Using legitimate system tools already present on the target to carry out attacks and evade detection

LotL attacks leverage built-in system tools like PowerShell, WMI, or certutil to execute malicious activities, reducing the attacker's footprint and evading signature-based detection.

Question 29: Which tool is commonly used by penetration testers for automated SQL injection detection and exploitation?

Nikto
SQLMap (Correct answer)
Hydra
Dirb

Correct answer: SQLMap

SQLMap is an open-source tool that automatically detects and exploits SQL injection vulnerabilities in web applications, supporting various database backends.

Question 30: Which framework is commonly used by penetration testers to automate social engineering attacks?

Social-Engineer Toolkit (SET) (Correct answer)
Metasploit
Burp Suite
Nessus

Correct answer: Social-Engineer Toolkit (SET)

The Social-Engineer Toolkit (SET) is an open-source framework designed to automate social engineering attacks including spear phishing, credential harvesting, and fake websites.

Question 31: What does TTL (Time to Live) value in a ping response help a penetration tester determine?

Open ports
Firewall rules
Network latency
Operating system type (Correct answer)

Correct answer: Operating system type

Different operating systems use different default TTL values (e.g., Windows=128, Linux=64), allowing testers to fingerprint the OS from ping responses.

Question 32: Which Burp Suite feature is used to intercept and modify HTTP requests between a browser and web server?

Repeater
Intruder
Proxy (Correct answer)
Scanner

Correct answer: Proxy

Burp Suite's Proxy module intercepts HTTP/HTTPS traffic between the browser and the server, allowing testers to inspect and modify requests in real time.

Question 33: What is process hollowing, and how does it differ from standard DLL injection?

Monitoring a running process's memory for credentials or sensitive data in plaintext
Creating a legitimate process in a suspended state and replacing its entire memory image with malicious code (Correct answer)
Injecting shellcode into a process's heap to overflow adjacent memory regions
Terminating a running process and immediately restarting it with a different executable

Correct answer: Creating a legitimate process in a suspended state and replacing its entire memory image with malicious code

Process hollowing creates a legitimate process in suspended state, unmaps its code from memory, and injects malicious code that runs under the trusted process's identity to evade detection.

Question 34: Which protocol provides encrypted communication for remote system administration and has replaced Telnet?

FTP
SSH (Correct answer)
HTTP
SFTP

Correct answer: SSH

SSH (Secure Shell) provides encrypted remote access, file transfer, and tunneling, replacing the insecure Telnet protocol which transmitted credentials in plaintext.

Question 35: Which technique do malware analysts use to identify strings and metadata in a malware binary without execution?

Behavioral analysis
Network traffic analysis
Dynamic analysis
String extraction and PE header analysis (Correct answer)

Correct answer: String extraction and PE header analysis

String extraction reveals hardcoded URLs, IP addresses, and commands within malware, while PE header analysis exposes import tables, compilation timestamps, and packer signatures.

Question 36: What is 'perfect forward secrecy' (PFS) in cryptography?

Generating encryption keys from hardware random number generators
Using unique session keys so past sessions remain secure even if long-term keys are compromised (Correct answer)
Preventing any single key from decrypting all past and future traffic
Ensuring all future data is encrypted with the same key

Correct answer: Using unique session keys so past sessions remain secure even if long-term keys are compromised

Perfect Forward Secrecy ensures each session uses a unique ephemeral key, so compromising the long-term private key cannot decrypt previously recorded sessions.

Question 37: Which vulnerability allows an attacker to execute commands on a server through unsanitized input passed to system functions?

Remote Code Execution (RCE) (Correct answer)
CSRF
XSS
IDOR

Correct answer: Remote Code Execution (RCE)

Remote Code Execution (RCE) lets attackers execute arbitrary commands on the server by exploiting unsafe handling of user input in functions like eval(), system(), or exec().

Question 38: Which Windows database stores locally cached user account password hashes?

NTFS (New Technology File System)
SAM (Security Account Manager) (Correct answer)
LSA (Local Security Authority)
HKLM (HKEY Local Machine)

Correct answer: SAM (Security Account Manager)

The SAM database stores Windows user account passwords as hashes and is a primary target for credential dumping attacks.

Question 39: Which TCP and UDP ports would you block at the firewall to prevent a hacker from hijacking an SMB session?

139 and 445 (Correct answer)
167 and 137
80 and 23
1277 and 1270

Correct answer: 139 and 445

Explanation: Block the ports 139 and 445, which are utilized by NetBIOS null sessions, by blocking these ports.

Question 40: What is a CSRF attack?

Bypassing login with SQL injection
Injecting scripts into a web page
Forging requests from an authenticated user's browser (Correct answer)
Stealing session cookies via XSS

Correct answer: Forging requests from an authenticated user's browser

Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into sending unauthorized requests to a trusted site, performing actions without the user's knowledge.

Question 41: What are the requirements for installing a hardware keylogger on a target system?

The IP address of the system
The Administrator username and password
Telnet access to the system
Physical access to the system (Correct answer)

Correct answer: Physical access to the system

Explanation: Physical access is a word used in computer security to describe a person's capacity to physically access a computer system

Question 42: What is lateral movement in the context of post-exploitation system hacking?

Exfiltrating collected data from the target environment to an external server
Using compromised credentials or exploits to spread access to other systems within the same network (Correct answer)
Establishing persistence mechanisms on the initially compromised system
Escalating privileges on the initially compromised system to administrator level

Correct answer: Using compromised credentials or exploits to spread access to other systems within the same network

Lateral movement involves leveraging compromised credentials, pass-the-hash, or exploits to extend access from one machine to other systems within the target network.

Question 43: Which tool is used to test web application security by fuzzing HTTP parameters and headers?

Responder
Aircrack-ng
John the Ripper
Wfuzz (Correct answer)

Correct answer: Wfuzz

Wfuzz is a web application fuzzer that tests parameters, headers, forms, and URLs by substituting payloads from wordlists to discover vulnerabilities.

Question 44: Which process injection technique inserts malicious code into a legitimate running process to evade detection?

Registry hijacking
ARP poisoning
DLL injection (Correct answer)
Keylogging

Correct answer: DLL injection

DLL injection inserts a malicious dynamic-link library into the memory space of a legitimate running process, allowing malware to execute under the trusted process's identity.

Question 45: Which commercial post-exploitation and adversary simulation platform, widely used by red teams and frequently associated with advanced threat actors, uses 'Beacon' as its primary payload?

PowerShell Empire
BeEF (Browser Exploitation Framework)
Cobalt Strike (Correct answer)
Metasploit Framework

Correct answer: Cobalt Strike

Cobalt Strike is a commercial adversary simulation platform with Beacon as its C2 payload, widely used for post-exploitation and commonly seen in APT campaigns.

Question 46: Which Metasploit command is used to search for available exploit modules?

search (Correct answer)
find
scan
use

Correct answer: search

The 'search' command in Metasploit queries its database of exploit modules, payloads, and auxiliary modules by keyword or CVE.

Question 47: What is 'pretexting' in social engineering?

Creating a fake website to capture credentials
Fabricating a scenario to manipulate a target into divulging information (Correct answer)
Sending malware via email attachments
Intercepting phone calls

Correct answer: Fabricating a scenario to manipulate a target into divulging information

Pretexting involves creating a fabricated scenario (pretext) to manipulate a target into providing information or performing actions they otherwise wouldn't.

Question 48: Which Nmap option is used to detect the operating system of a target host?

-O (Correct answer)
-A
-sV
-Pn

Correct answer: -O

The -O flag in Nmap enables OS detection by analyzing TCP/IP stack behavior and comparing it against a fingerprint database.

Question 49: What is a 'man-in-the-middle' attack on TLS and how does certificate pinning defend against it?

Flooding the TLS handshake with requests; rate limiting defends against it
Presenting a fraudulent certificate to intercept TLS traffic; pinning rejects certificates not matching the expected public key (Correct answer)
Downgrading TLS to SSL 2.0; enforcing minimum TLS 1.2 defends against it
Replaying captured TLS sessions; session tokens defend against it

Correct answer: Presenting a fraudulent certificate to intercept TLS traffic; pinning rejects certificates not matching the expected public key

TLS MitM attacks use fraudulent CA-signed certificates to intercept traffic; certificate pinning hardcodes the expected certificate or public key in the application, rejecting any other certificate.

Question 50: Which type of XSS permanently stores malicious script in the target server's database?

Stored XSS (Correct answer)
Reflected XSS
DOM-based XSS
Blind XSS

Correct answer: Stored XSS

Stored XSS (persistent XSS) saves malicious scripts in server-side storage like databases, which are then served to all users who view the affected page.

Question 51: Which tool is primarily used for automated network vulnerability scanning during a penetration test?

Aircrack-ng
Metasploit
Nessus (Correct answer)
Burp Suite

Correct answer: Nessus

Nessus is a widely-used automated vulnerability scanner that identifies security weaknesses across network devices and services.

Question 52: A penetration tester conducting a social engineering assessment sends an email appearing to be from IT support asking employees to click a link and verify credentials. What attack is this?

Whaling
Business Email Compromise
Vishing
Credential harvesting phishing (Correct answer)

Correct answer: Credential harvesting phishing

Credential harvesting phishing creates a fake login page linked from a phishing email to capture usernames and passwords entered by deceived victims.

Question 53: It's critical to conduct a slow network scan of your target.

Services may not have started, so starting slowly ensures that you capture services that started late
It is not necessary to scan the network slowly
To evade the firewall
To avoid alerting the IDS (Correct answer)

Correct answer: To avoid alerting the IDS

The correct answer: To avoid alerting the IDS

Question 54: What is 'packing' in the context of malware evasion?

Adding junk code to increase file size
Splitting malware across multiple files
Compressing or encrypting malware to hide its true code from antivirus detection (Correct answer)
Bundling multiple malware payloads together

Correct answer: Compressing or encrypting malware to hide its true code from antivirus detection

Packers compress or encrypt malware executables at rest, only unpacking the true payload in memory at runtime, making static signature detection ineffective.

Question 55: Which command displays the IP packet's path from a Cisco router to a host?

Tracert
Ifconfig
traceroute (Correct answer)
Ping

Correct answer: traceroute

Explanation: Traceroute is a network diagnostic tool that tracks a packet's travel from source to destination on an IP network in real time, revealing the IP addresses of all the routers it pings along the way.

Question 56: Which authentication attack uses precomputed hash tables to reverse password hashes?

Pass the Hash attack
Brute force attack
Dictionary attack
Rainbow table attack (Correct answer)

Correct answer: Rainbow table attack

Rainbow table attacks use precomputed tables of password-hash pairs to reverse cryptographic hashes quickly, far faster than brute-force cracking.

Question 57: Which technique involves loading a malicious DLL into the address space of a legitimate running process to execute attacker-controlled code?

Process Hollowing
DLL Injection (Correct answer)
SQL Injection
Heap Spraying

Correct answer: DLL Injection

DLL injection loads a malicious dynamic-link library into the memory space of a legitimate process, executing attacker code under the cover of a trusted application.

Question 58: What does XSS stand for in web application security?

Cross-Server Scanning
Cross-Site Session
Cross-Site Scripting (Correct answer)
Extensible Security Schema

Correct answer: Cross-Site Scripting

Cross-Site Scripting (XSS) is a vulnerability where attackers inject malicious scripts into web pages viewed by other users, stealing sessions or redirecting victims.

Question 59: What does IDOR stand for in web security testing?

Internal Directory Object Redirect
Insecure Direct Object Reference (Correct answer)
Insecure Data Object Reference
Indirect Data Object Retrieval

Correct answer: Insecure Direct Object Reference

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal object references (IDs) without access control checks, allowing unauthorized data access.

Question 60: What is a 'digital certificate' used for in PKI?

Binding a public key to an identity, verified by a trusted Certificate Authority (Correct answer)
Storing encrypted passwords securely
Encrypting network traffic between two endpoints
Generating one-time passwords for authentication

Correct answer: Binding a public key to an identity, verified by a trusted Certificate Authority

A digital certificate issued by a Certificate Authority (CA) cryptographically binds a public key to an identity (person, server, organization), enabling trust in public key infrastructure.

Question 61: What is Windows token impersonation, and why is it valuable in privilege escalation?

Creating a forged Kerberos ticket to bypass authentication controls
Encrypting an existing access token to prevent security tools from revoking it
Generating a new SYSTEM token by exploiting a kernel vulnerability in token management
Stealing a higher-privileged user's access token from a running process to execute commands with their privileges (Correct answer)

Correct answer: Stealing a higher-privileged user's access token from a running process to execute commands with their privileges

Token impersonation steals the security token of a higher-privileged process (e.g., SYSTEM) and uses it to execute malicious commands with those elevated privileges.

Question 62: What is 'spear phishing' as opposed to regular phishing?

Phishing through SMS messages
Phishing using phone calls
Targeted phishing aimed at a specific individual using personalized information (Correct answer)
Mass phishing emails sent to thousands of recipients

Correct answer: Targeted phishing aimed at a specific individual using personalized information

Spear phishing is a targeted attack using personal details about the victim (name, employer, colleagues) to craft convincing emails that appear legitimate.

Question 63: Which tool is used to brute force hidden directories and files on a web server?

Gobuster (Correct answer)
Wireshark
Sqlmap
Metasploit

Correct answer: Gobuster

Gobuster performs brute-force enumeration of directories, files, and DNS subdomains using wordlists, helping testers find hidden content on web servers.

Question 64: What does a penetration tester use 'Netcat' for during a network test?

Wireless packet injection
SQL injection testing
Password cracking
Creating reverse shells and banner grabbing (Correct answer)

Correct answer: Creating reverse shells and banner grabbing

Netcat is a versatile networking utility used for creating reverse shells, banner grabbing, port scanning, and transferring files during penetration tests.

Question 65: In the digital signature procedure, what algorithm is used?

Blowfish
RC5
RC4
MD5 (Correct answer)

Correct answer: MD5

Explanation: The MD5 message-digest technique, which produces a 128-bit hash value, is cryptographically broken yet nevertheless extensively used. Although MD5 was created with the intention of being used as a cryptographic hash function, it has been discovered to have numerous flaws.

Question 66: Which asymmetric algorithm is widely used for digital signatures and secure key exchange in SSL/TLS?

AES
RSA (Correct answer)
SHA-256
DES

Correct answer: RSA

RSA (Rivest-Shamir-Adleman) is a widely used asymmetric algorithm for digital signatures, encryption, and key exchange, with security based on the difficulty of factoring large prime numbers.

Question 67: What is the difference between symmetric and asymmetric encryption?

Symmetric uses larger keys; asymmetric uses smaller keys
Symmetric is faster for large keys; asymmetric is faster for small keys
Symmetric uses the same key for encryption and decryption; asymmetric uses a key pair (public/private) (Correct answer)
There is no practical difference in modern cryptography

Correct answer: Symmetric uses the same key for encryption and decryption; asymmetric uses a key pair (public/private)

Symmetric encryption uses one shared key for both encryption and decryption (e.g., AES), while asymmetric encryption uses a mathematically linked public/private key pair (e.g., RSA).

Question 68: Which network indicator is a common sign of malware C2 communication?

Increased ICMP echo requests
High-volume HTTP traffic to CDN servers
Sudden drop in network bandwidth
Beaconing — regular, periodic connections to an external IP at fixed intervals (Correct answer)

Correct answer: Beaconing — regular, periodic connections to an external IP at fixed intervals

Beaconing is a telltale C2 sign where malware sends periodic 'check-in' requests to its command-and-control server at regular intervals, detectable by network traffic analysis.

Question 69: What is the purpose of running a 'banner grab' during network reconnaissance?

Perform SQL injection
Crack password hashes
Capture authentication tokens
Identify service version information (Correct answer)

Correct answer: Identify service version information

Banner grabbing retrieves service banners that reveal software names and version numbers, helping attackers identify potentially vulnerable services.

Question 70: Which tool is used for wireless packet injection and monitoring in penetration tests?

Nessus
Aircrack-ng (Correct answer)
Wireshark
Metasploit

Correct answer: Aircrack-ng

The Aircrack-ng suite includes tools for packet capture (airodump-ng), packet injection (aireplay-ng), and WEP/WPA cracking (aircrack-ng), making it the standard wireless pentesting toolkit.

Question 71: What is 'tailgating' in the context of physical social engineering?

Copying an RFID badge from a distance
Leaving malware on a shared drive
Following an authorized person through a secured door without using credentials (Correct answer)
Accessing a network by piggybacking on another's Wi-Fi

Correct answer: Following an authorized person through a secured door without using credentials

Tailgating (piggybacking) is a physical social engineering technique where an attacker follows an authorized person into a secure area without proper authentication.

Question 72: Which WPA2 attack captures and cracks the four-way handshake to recover the network passphrase?

Pixie Dust attack
Deauth and handshake capture with Aircrack-ng (Correct answer)
KRACK attack
PMKID attack

Correct answer: Deauth and handshake capture with Aircrack-ng

Capturing a WPA2 four-way handshake with airodump-ng (often triggered by a deauth attack) and cracking it offline with Aircrack-ng and a wordlist is the classic WPA2 attack method.

Question 73: Why do attackers typically clear Windows event logs after a successful compromise?

To destroy forensic evidence of their activities and impede incident response (Correct answer)
To free up disk space needed for storing exfiltrated data
To disable Windows Defender real-time protection and alerting
To prevent Windows from generating new alerts about system activity

Correct answer: To destroy forensic evidence of their activities and impede incident response

Clearing event logs is an anti-forensics technique that destroys evidence of attacker actions, making incident investigation and attribution significantly more difficult.

Question 74: Which wireless attack exploits the WPS PIN by targeting a vulnerability in the pseudo-random number generator used during offline authentication?

Pixie Dust attack (Correct answer)
KRACK attack
Deauthentication attack
Evil Twin attack

Correct answer: Pixie Dust attack

The Pixie Dust attack exploits weak randomness in the WPS offline authentication process to recover the WPS PIN in seconds for vulnerable router chipsets.

Question 75: On Windows, which utility may be used to accomplish a DNS zone transfer?

whois
ipconfig
DNSlookup
nslookup (Correct answer)

Correct answer: nslookup

Explanation: nslookup is the name of a program that allows an Internet server administrator or any computer user to type in a host name (for example, "whatis.com") and get the IP address or DNS record associated with it. The user can also give it a command to perform a reverse DNS lookup and determine the host name for a given IP address.

Question 76: Consider the following scenario: You are an attacker who has successfully compromised your victim by exploiting a service that was supposed to be deactivated. You were able to easily exploit flaws in the service. What could be the problem in this situation?

The administrator did not apply the correct patches
The web server was improperly configured
The firewall was not configured correctly
You are dealing with a honeypot (Correct answer)

Correct answer: You are dealing with a honeypot

Explanation: A "honeypot" attack is a type of AP impersonation attack in which an attacker from outside the building puts up an AP with the same BSSID and ESSID as a legitimate AP and tries to entice enterprise customers to connect to it.

Question 77: Which type of malware demands payment to restore access to encrypted files?

Spyware
Ransomware (Correct answer)
Adware
Rootkit

Correct answer: Ransomware

Ransomware encrypts victim files or locks systems and demands payment (typically cryptocurrency) for the decryption key to restore access.

Question 78: What is 'HTTP response splitting' in web application security?

Splitting cookies across multiple requests
Intercepting responses with a proxy
Splitting large HTTP responses for performance
Injecting CRLF characters into headers to manipulate HTTP responses (Correct answer)

Correct answer: Injecting CRLF characters into headers to manipulate HTTP responses

HTTP response splitting injects CRLF (carriage return/line feed) characters into HTTP headers, allowing attackers to control response content and enable XSS or cache poisoning.

Question 79: What is the primary difference between static and dynamic malware analysis?

Static analysis examines code without execution; dynamic analysis observes malware behavior during execution (Correct answer)
Static analysis runs the malware; dynamic analysis does not
Static analysis uses virtual machines; dynamic analysis uses physical machines
There is no difference — both involve executing the malware

Correct answer: Static analysis examines code without execution; dynamic analysis observes malware behavior during execution

Static analysis examines malware code, strings, and structure without executing it, while dynamic analysis runs the malware in a controlled environment to observe its runtime behavior.

Question 80: What is the primary purpose of establishing a backdoor on a compromised system?

To encrypt the victim's files and demand ransom for decryption
To perform man-in-the-middle attacks on network communications
To immediately exfiltrate all sensitive data before detection occurs
To maintain persistent remote access even after system reboots or credential changes (Correct answer)

Correct answer: To maintain persistent remote access even after system reboots or credential changes

Backdoors provide persistent, covert remote access to a compromised system even if the initial vulnerability is patched or user passwords are changed.

Question 81: Which Metasploit post-exploitation module is commonly used to extract NTLM password hashes from a compromised Windows system?

exploit/windows/smb/ms17_010_eternalblue
post/windows/gather/credentials/credential_collector
post/multi/recon/local_exploit_suggester
post/windows/gather/hashdump (Correct answer)

Correct answer: post/windows/gather/hashdump

The hashdump module in Metasploit extracts NTLM password hashes from the SAM database on compromised Windows systems for offline cracking.

Question 82: What is 'lateral movement' in a network penetration test?

Exfiltrating data to an external server
Establishing persistence through a backdoor
Escalating privileges on a single machine
Moving between hosts within a network after initial compromise (Correct answer)

Correct answer: Moving between hosts within a network after initial compromise

Lateral movement refers to techniques used by attackers to progressively move through a network after initial access to reach high-value targets.

Question 83: Which technique involves searching through discarded documents to find sensitive organizational information?

Pretexting
Dumpster diving (Correct answer)
Tailgating
Shoulder surfing

Correct answer: Dumpster diving

Dumpster diving involves going through trash to find discarded documents containing passwords, network diagrams, employee information, or other sensitive data.

Question 84: Which tool is widely used for password cracking through brute force, dictionary, and rainbow table attacks?

Nmap
John the Ripper (Correct answer)
Burp Suite
Wireshark

Correct answer: John the Ripper

John the Ripper is a popular open-source password security auditing tool that supports multiple cracking modes and numerous hash types.

Question 85: Which type of malware replicates itself by attaching its code to legitimate executable files?

Trojan
Virus (Correct answer)
Worm
Ransomware

Correct answer: Virus

A virus attaches itself to legitimate files and spreads when infected files are executed, requiring a host file to propagate unlike worms which self-replicate independently.

Question 86: What form of attack is it when a hacker tries to attack a host over the Internet?

Physical access
Internal attack
Local access
Remote attack (Correct answer)

Correct answer: Remote attack

Explanation: A remote attack is a hostile operation directed at one or more computers through the internet. The attacker's machine is unaffected by the remote attack. Instead, the attacker will look for weak places in the security software on a computer or network in order to get access to the machine or system.

Question 87: Which technique involves sending malformed packets to crash or reveal information about a target system?

Enumeration
Pivoting
Fuzzing (Correct answer)
Sniffing

Correct answer: Fuzzing

Fuzzing sends unexpected, malformed, or random data to a system to discover vulnerabilities, crashes, or unexpected behaviors in software.

Question 88: What is 'shoulder surfing' in social engineering?

Intercepting Wi-Fi traffic in public places
Physically observing a target's screen or keyboard to steal credentials (Correct answer)
Dumpster diving for sensitive documents
Cloning RFID badges at close range

Correct answer: Physically observing a target's screen or keyboard to steal credentials

Shoulder surfing involves physically observing a person entering credentials or sensitive information, typically in public places like coffee shops or airports.

Question 89: What is a 'rootkit' and why is it particularly dangerous?

Malware that hides its presence deep in the OS, often at the kernel level, making it very difficult to detect (Correct answer)
A virus that spreads through network shares
Malware that encrypts files for ransom
Adware that displays unwanted advertisements

Correct answer: Malware that hides its presence deep in the OS, often at the kernel level, making it very difficult to detect

Rootkits embed themselves at the OS or kernel level to conceal their presence and other malware, evading traditional antivirus tools and persisting even after system reboots.

Question 90: Which type of malware disguises itself as legitimate software to trick users into installation?

Virus
Trojan (Correct answer)
Adware
Worm

Correct answer: Trojan

A Trojan horse (Trojan) masquerades as legitimate or desirable software to trick users into installing it, then performs malicious actions once executed.

Question 91: What does 'persistence' mean in the context of malware infection?

The malware's ability to evade antivirus software
Mechanisms that allow malware to survive system reboots and remain active (Correct answer)
The speed at which malware spreads through a network
The malware's resistance to removal tools

Correct answer: Mechanisms that allow malware to survive system reboots and remain active

Persistence mechanisms (registry run keys, scheduled tasks, service installation) ensure malware continues operating after the system restarts, maintaining long-term access.

Question 92: Which OWASP Top 10 vulnerability occurs when untrusted data is sent to an interpreter as part of a command?

Security Misconfiguration
Insecure Deserialization
Broken Authentication
Injection (Correct answer)

Correct answer: Injection

Injection vulnerabilities (SQL, OS, LDAP) occur when untrusted input is sent to an interpreter, potentially allowing attackers to execute unintended commands.

Question 93: Which hashing algorithm is recommended by NIST for security applications due to its resistance to known attacks?

CRC32
SHA-256 (Correct answer)
SHA-1
MD5

Correct answer: SHA-256

SHA-256 (part of the SHA-2 family) produces a 256-bit hash and is recommended by NIST for digital signatures, certificate hashing, and data integrity verification.

Question 94: What does placing a wireless adapter in 'monitor mode' allow a penetration tester to do?

Passively capture all wireless frames in range without associating with an AP (Correct answer)
Boost wireless signal strength for longer range attacks
Connect to multiple SSIDs simultaneously
Bypass WPA2 authentication automatically

Correct answer: Passively capture all wireless frames in range without associating with an AP

Monitor mode (promiscuous mode for wireless) allows the network adapter to capture all wireless frames in range, including frames not destined for that adapter, enabling passive reconnaissance.

Question 95: The implementation is known as _______ if DNS servers are located in the DMZ and on the intranet.

Split dns (Correct answer)
Dnssec
Dynamic dns
auto dns

Correct answer: Split dns

Explanation: split DNS is the ability of a Domain Name System (DNS) implementation to deliver various sets of DNS information, which is normally determined by the DNS request's originating address. This facility may be able to provide a security and privacy method.

Question 96: What is the default port used by the SMB protocol that penetration testers frequently target?

21
80
3389
445 (Correct answer)

Correct answer: 445

SMB (Server Message Block) uses TCP port 445 by default and is a common target for exploitation in network penetration tests.

Question 97: Which scan technique sets the FIN, PSH, and URG flags simultaneously to probe for open ports?

XMAS scan (Correct answer)
NULL scan
ACK scan
SYN scan

Correct answer: XMAS scan

An XMAS scan lights up packets with FIN, PSH, and URG flags like a Christmas tree and can bypass some firewalls, though it doesn't work reliably on Windows systems.

Question 98: What is a 'hash collision' and why does it matter for security?

A hash function failing to produce output for certain inputs
Two different inputs producing the same hash output, undermining hash integrity (Correct answer)
Two different encryption keys producing similar outputs
Two identical inputs producing different hashes

Correct answer: Two different inputs producing the same hash output, undermining hash integrity

A hash collision occurs when two different input values produce identical hash outputs, compromising integrity verification and allowing attackers to substitute malicious files undetected.

Question 99: What does an NTLM relay attack exploit to authenticate to target services without cracking the hash?

A buffer overflow vulnerability in Windows NTLM authentication libraries
Weak NTLM hash encryption to recover plaintext passwords offline
Plaintext NTLM credentials inadvertently transmitted over unencrypted network protocols
The ability to intercept and forward NTLM authentication challenges to another target service (Correct answer)

Correct answer: The ability to intercept and forward NTLM authentication challenges to another target service

NTLM relay attacks intercept authentication requests from a victim and relay them to a different target, authenticating as the victim without needing to crack the NTLM hash.

Question 100: What is 'polymorphic malware'?

Malware that changes its code signature with each infection while keeping functionality intact (Correct answer)
Malware controlled by multiple C2 servers
Malware that targets multiple operating systems
Malware that spreads through multiple infection vectors

Correct answer: Malware that changes its code signature with each infection while keeping functionality intact

Polymorphic malware mutates its code signature with each infection cycle while preserving its core malicious functionality, evading signature-based antivirus detection.

Question 101: Which psychological principle does an attacker exploit when claiming 'Only 3 spots left — act now!' in a phishing email?

Authority
Social proof
Scarcity (Correct answer)
Reciprocity

Correct answer: Scarcity

Scarcity exploits the fear of missing out (FOMO) by creating urgency, pressuring targets to act quickly without carefully evaluating the legitimacy of the request.

Question 102: What does a keylogger do?

Deletes files to cause data loss
Records keystrokes to capture passwords and sensitive input (Correct answer)
Encrypts files on the infected system
Creates a backdoor for remote access

Correct answer: Records keystrokes to capture passwords and sensitive input

A keylogger records all keystrokes made on an infected system, capturing passwords, credit card numbers, and other sensitive data typed by the victim.

Question 103: Which protocol is exploited by the 'Pass the Hash' attack technique?

NTLM (Correct answer)
FTP
HTTPS
SSH

Correct answer: NTLM

Pass the Hash exploits NTLM authentication by using captured password hashes directly to authenticate without knowing the plaintext password.

Question 104: Which Windows subsystem service stores user credentials in memory to support single sign-on and is a primary target for credential dumping tools like Mimikatz?

LSASS (Local Security Authority Subsystem Service) (Correct answer)
Windows Defender Credential Guard
Windows Management Instrumentation (WMI)
Task Scheduler Service

Correct answer: LSASS (Local Security Authority Subsystem Service)

LSASS stores credentials in memory to facilitate Windows authentication; Mimikatz and similar tools target this process to extract plaintext passwords and hashes.

Question 105: What is 'whaling' in the context of phishing attacks?

Phishing specifically targeting high-profile executives (Correct answer)
Phishing using large file attachments
Phishing via video conferencing platforms
Phishing targeting a large number of random users

Correct answer: Phishing specifically targeting high-profile executives

Whaling is a highly targeted spear phishing attack aimed at senior executives (CEOs, CFOs), using their authority and access to high-value systems as motivation.

Question 106: What is the method for dealing with network security and performance in the cloud?

Encryption (SSL)
Intrusion detection and prevention (Correct answer)
Network load balancing
Denial of service prevention

Correct answer: Intrusion detection and prevention

Explanation: Intrusion detection and prevention are two broad words that refer to application security methods that are used to mitigate assaults and prevent future threats.

Question 107: Which persistence mechanism involves adding registry entries under Windows Run keys to execute malicious code automatically each time the system starts?

Registry Run key persistence (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Run) (Correct answer)
Scheduled task creation via schtasks.exe
Windows service creation pointing to a malicious binary
DLL search order hijacking via PATH manipulation

Correct answer: Registry Run key persistence (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Run)

Adding entries to Windows registry Run keys causes the specified executables to launch automatically at system startup, providing attackers with persistent execution after reboots.

Question 108: Which behavior is a strong indicator of ransomware activity on a network?

Unusual user login times
Increased outbound DNS queries
Mass file renaming and encryption combined with a ransom note creation (Correct answer)
Excessive CPU usage on servers

Correct answer: Mass file renaming and encryption combined with a ransom note creation

Ransomware typically exhibits mass file modification (encrypting and renaming files with new extensions) and drops ransom notes in affected directories, which are detectable via file integrity monitoring.

Question 109: Which firewall evasion approach will connect to a firewalled DMZ network while HTTP traffic and DNS queries pass through?

tcp over dns (Correct answer)
Firewalking
False positive flooding
An ack scan

Correct answer: tcp over dns

Explanation: A custom DNS server and a special DNS client are included in tcp-over-dns. Through the conventional DNS protocol, the client and server work together to provide a TCP (and now UDP!) tunnel. This software is similar to the now-defunct NSTX DNS Tuneling software.

Question 110: What is a 'watering hole attack'?

Infecting websites frequently visited by the target organization (Correct answer)
Installing keyloggers on shared computers
Poisoning a company's water supply
Sending phishing emails to HR staff

Correct answer: Infecting websites frequently visited by the target organization

A watering hole attack compromises websites that a target group regularly visits, infecting visitors with malware when they browse the compromised site.

Question 111: For an NDIS tap, the most effective setting is

connect to the console port of a router
Connect directly to a server inside the dmz
Connect to a span port on a switch (Correct answer)
Connect directly to a server in the intranet.

Correct answer: Connect to a span port on a switch

The correct answer: Connect to a span port on a switch

Question 112: What is 'clickjacking' in web application security?

Brute forcing login buttons
Stealing clicks via malicious advertisements
Embedding a target page in an iframe to trick users into clicking hidden elements (Correct answer)
Intercepting click events with JavaScript

Correct answer: Embedding a target page in an iframe to trick users into clicking hidden elements

Clickjacking overlays an invisible iframe of a legitimate site over a decoy page, tricking users into clicking elements on the target site without their knowledge.

Question 113: What does 'salting' a password hash mean?

Encrypting the hash with a symmetric key
Hashing the password multiple times to increase complexity
Storing the hash in a separate database table
Adding a unique random value to each password before hashing to prevent rainbow table attacks (Correct answer)

Correct answer: Adding a unique random value to each password before hashing to prevent rainbow table attacks

Salting adds a unique random value to each password before hashing, ensuring identical passwords produce different hashes and rendering rainbow table attacks ineffective.

Question 114: What is directory traversal in web application hacking?

Brute forcing directory names
Accessing files outside the web root by manipulating path variables (Correct answer)
Injecting code into file upload fields
Enumerating hidden directories with tools

Correct answer: Accessing files outside the web root by manipulating path variables

Directory traversal (path traversal) exploits insufficient input validation to access files outside the intended directory, often using sequences like '../' to navigate up the file system.

Question 115: What does SSRF stand for and why is it dangerous?

Static Site Rendering Framework — a CMS feature
Session Storage Request Filter — a defense mechanism
Server-Side Request Forgery — allows attackers to make the server request internal resources (Correct answer)
Secure Socket Response Framework — a security protocol

Correct answer: Server-Side Request Forgery — allows attackers to make the server request internal resources

Server-Side Request Forgery (SSRF) tricks the server into making HTTP requests to internal resources, potentially exposing cloud metadata, internal services, or enabling port scanning.

Question 116: What is 'steganography' in the context of information security?

Signing data with a digital certificate
Hiding secret information within ordinary-looking files (images, audio) without obvious detection (Correct answer)
Encrypting data with a symmetric key
Compressing data before encryption

Correct answer: Hiding secret information within ordinary-looking files (images, audio) without obvious detection

Steganography hides data within other data (images, audio files, documents) without obvious detection, often used to covertly communicate or exfiltrate data undetected.

Question 117: Which OSINT technique is used to gather email addresses and employee names from a target organization's public information?

DNS brute forcing
Wardriving
Zone transfer
Harvesting with theHarvester (Correct answer)

Correct answer: Harvesting with theHarvester

theHarvester is an OSINT tool that collects email addresses, names, subdomains, and open ports from public sources like Google, LinkedIn, and Shodan.

Question 118: What is a pass-the-hash (PtH) attack?

Cracking a password hash offline using a dictionary attack
Sending a hashed payload to exploit a buffer overflow vulnerability
Using a captured NTLM hash to authenticate without knowing the actual password (Correct answer)
Using a plaintext password to authenticate to a remote system

Correct answer: Using a captured NTLM hash to authenticate without knowing the actual password

Pass-the-hash allows attackers to authenticate to Windows systems using the NTLM hash directly without needing to crack or know the plaintext password.

Question 119: What is the purpose of steganography when used as a technique in system hacking and data exfiltration?

Encrypting sensitive data with a strong key to prevent unauthorized decryption
Cracking encrypted archives to recover concealed configuration files
Hiding malicious data or messages within innocent-looking carrier files such as images or audio (Correct answer)
Scanning file systems for hidden partitions containing sensitive information

Correct answer: Hiding malicious data or messages within innocent-looking carrier files such as images or audio

Steganography conceals data within ordinary files to hide the existence of communication or covertly exfiltrate stolen data without triggering DLP controls.

Question 120: Which privilege escalation technique exploits weak file permissions on service executable files to run malicious code with elevated privileges?

Service binary hijacking (binary path replacement) (Correct answer)
Kernel exploitation via unpatched CVE
UAC bypass using registry manipulation
Token impersonation via Meterpreter

Correct answer: Service binary hijacking (binary path replacement)

Service binary hijacking replaces or modifies a service executable due to misconfigured weak permissions, causing the service to execute the attacker's code with SYSTEM or admin privileges.

Question 121: What is an 'open redirect' vulnerability?

A misconfigured CORS policy
An application that redirects users to attacker-controlled URLs via unvalidated parameters (Correct answer)
An FTP server with anonymous login enabled
A server that allows unrestricted outbound connections

Correct answer: An application that redirects users to attacker-controlled URLs via unvalidated parameters

Open redirects allow attackers to craft URLs that redirect victims from a trusted domain to a malicious site, often used in phishing attacks to increase credibility.

Question 122: What is 'wireless jamming' and why is it illegal in the United States?

Intentionally transmitting interference to disrupt legitimate wireless communications; illegal under FCC regulations (Correct answer)
Scanning for all wireless networks in an area; illegal due to privacy laws
Capturing wireless packets without authorization; illegal under the CFAA
Transmitting on unused wireless channels; illegal due to spectrum allocation rules

Correct answer: Intentionally transmitting interference to disrupt legitimate wireless communications; illegal under FCC regulations

Wireless jamming broadcasts radio frequency interference to disrupt legitimate Wi-Fi, cellular, or other wireless communications, and is illegal under FCC regulations in the US.

Question 123: What is 'wardriving'?

Intercepting cellular communications from a car
Hacking wireless networks using a car antenna
Driving around to discover and map wireless access points using a laptop and antenna (Correct answer)
Jamming wireless signals from a moving vehicle

Correct answer: Driving around to discover and map wireless access points using a laptop and antenna

Wardriving involves using a vehicle to travel through an area while scanning for available Wi-Fi networks, mapping SSIDs, encryption types, and GPS coordinates.

Question 124: What is the primary goal of privilege escalation in system hacking?

Installing malware on the target system
Scanning the network for open ports
Gaining higher-level access rights than initially obtained (Correct answer)
Stealing user credentials from the target system

Correct answer: Gaining higher-level access rights than initially obtained

Privilege escalation aims to gain elevated permissions (e.g., admin or root) beyond what was initially compromised, allowing greater control over the target system.

Question 125: What tool is used by ethical hackers to capture WPA2 handshakes for offline cracking?

Hydra
Nmap
Aircrack-ng suite (airodump-ng) (Correct answer)
Netcat

Correct answer: Aircrack-ng suite (airodump-ng)

Airodump-ng (part of the Aircrack-ng suite) captures 802.11 wireless packets and records WPA2 four-way handshakes that can then be cracked offline with a wordlist.

EC-Council Certified Ethical Hacker (CEH v13)

The CEH v13 exam validates mastery of ethical hacking techniques and cybersecurity countermeasures across the five phases of hacking, covering 20 modules including reconnaissance, system hacking, malware analysis, network attacks, web application security, and cryptography.

125

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds