EC-Council Certified Ethical Hacker (CEH v13) — Questions and Answers

Question 1: Which technique do malware analysts use to identify strings and metadata in a malware binary without execution?

Network traffic analysis
String extraction and PE header analysis (Correct answer)
Dynamic analysis
Behavioral analysis

Correct answer: String extraction and PE header analysis

String extraction reveals hardcoded URLs, IP addresses, and commands within malware, while PE header analysis exposes import tables, compilation timestamps, and packer signatures.

Question 2: What vulnerability in WPS (Wi-Fi Protected Setup) allows its PIN to be cracked much faster than expected?

WPS uses a static PIN that never changes
WPS disables account lockout by design
The PIN is transmitted in plaintext during setup
The 8-digit PIN is validated in two halves of 4 digits each, reducing possible combinations to ~11,000 (Correct answer)

Correct answer: The 8-digit PIN is validated in two halves of 4 digits each, reducing possible combinations to ~11,000

WPS validates the 8-digit PIN in two separate 4-digit halves, reducing the brute-force search space from 100 million to only ~11,000 attempts, enabling attacks with tools like Reaver.

Question 3: Consider the following scenario: You are an attacker who has successfully compromised your victim by exploiting a service that was supposed to be deactivated. You were able to easily exploit flaws in the service. What could be the problem in this situation?

The administrator did not apply the correct patches
The firewall was not configured correctly
The web server was improperly configured
You are dealing with a honeypot (Correct answer)

Correct answer: You are dealing with a honeypot

Explanation: <br> A "honeypot" attack is a type of AP impersonation attack in which an attacker from outside the building puts up an AP with the same BSSID and ESSID as a legitimate AP and tries to entice enterprise customers to connect to it.

Question 4: What form of attack is it when a hacker tries to attack a host over the Internet?

Internal attack
Local access
Remote attack (Correct answer)
Physical access

Correct answer: Remote attack

Explanation: <br> A remote attack is a hostile operation directed at one or more computers through the internet. The attacker's machine is unaffected by the remote attack. Instead, the attacker will look for weak places in the security software on a computer or network in order to get access to the machine or system.

Question 5: Which tool is commonly used by penetration testers for automated SQL injection detection and exploitation?

SQLMap (Correct answer)
Dirb
Hydra
Nikto

Correct answer: SQLMap

SQLMap is an open-source tool that automatically detects and exploits SQL injection vulnerabilities in web applications, supporting various database backends.

Question 6: What is a CSRF attack?

Bypassing login with SQL injection
Stealing session cookies via XSS
Forging requests from an authenticated user's browser (Correct answer)
Injecting scripts into a web page

Correct answer: Forging requests from an authenticated user's browser

Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into sending unauthorized requests to a trusted site, performing actions without the user's knowledge.

Question 7: What does the social engineering term 'baiting' refer to?

Luring victims with promises of a reward or curiosity-inducing item (e.g., infected USB drive) (Correct answer)
Calling targets under false pretenses
Sending unsolicited emails
Shoulder surfing to steal credentials

Correct answer: Luring victims with promises of a reward or curiosity-inducing item (e.g., infected USB drive)

Baiting entices victims with something appealing (a free USB drive, download link) that contains malware, exploiting curiosity or greed to execute the attack.

Question 8: What is the name of the technique for hiding text within an image?

Encryption
Steganography (Correct answer)
Spyware
Keystroke logging

Correct answer: Steganography

Explanation: <br> Steganography is the art of concealing a secret message within (or even on top of) a non-secret object. That something can be anything you want it to be. Many forms of steganography nowadays involve hiding a secret piece of text within a photograph.

Question 9: During a physical penetration test, an attacker wears a company badge and carries equipment to blend in. What technique is this?

Vishing
Tailgating
Impersonation (Correct answer)
Baiting

Correct answer: Impersonation

Impersonation involves disguising oneself as an employee, vendor, or contractor with props like badges or uniforms to gain unauthorized physical access to facilities.

Question 10: Which social engineering technique involves an attacker calling a target while pretending to be a trusted authority?

Smishing
Baiting
Phishing
Vishing (Correct answer)

Correct answer: Vishing

Vishing (voice phishing) uses phone calls to deceive targets into revealing sensitive information by impersonating IT support, banks, or government agencies.

Question 11: Which scan technique sets the FIN, PSH, and URG flags simultaneously to probe for open ports?

XMAS scan (Correct answer)
SYN scan
NULL scan
ACK scan

Correct answer: XMAS scan

An XMAS scan lights up packets with FIN, PSH, and URG flags like a Christmas tree and can bypass some firewalls, though it doesn't work reliably on Windows systems.

Question 12: What does an NTLM relay attack exploit to authenticate to target services without cracking the hash?

Weak NTLM hash encryption to recover plaintext passwords offline
A buffer overflow vulnerability in Windows NTLM authentication libraries
The ability to intercept and forward NTLM authentication challenges to another target service (Correct answer)
Plaintext NTLM credentials inadvertently transmitted over unencrypted network protocols

Correct answer: The ability to intercept and forward NTLM authentication challenges to another target service

NTLM relay attacks intercept authentication requests from a victim and relay them to a different target, authenticating as the victim without needing to crack the NTLM hash.

Question 13: Which type of malware replicates itself by attaching its code to legitimate executable files?

Virus (Correct answer)
Worm
Ransomware
Trojan

Correct answer: Virus

A virus attaches itself to legitimate files and spreads when infected files are executed, requiring a host file to propagate unlike worms which self-replicate independently.

Question 14: Which network indicator is a common sign of malware C2 communication?

Increased ICMP echo requests
High-volume HTTP traffic to CDN servers
Sudden drop in network bandwidth
Beaconing — regular, periodic connections to an external IP at fixed intervals (Correct answer)

Correct answer: Beaconing — regular, periodic connections to an external IP at fixed intervals

Beaconing is a telltale C2 sign where malware sends periodic 'check-in' requests to its command-and-control server at regular intervals, detectable by network traffic analysis.

Question 15: It's critical to conduct a slow network scan of your target.

It is not necessary to scan the network slowly
To evade the firewall
To avoid alerting the IDS (Correct answer)
Services may not have started, so starting slowly ensures that you capture services that started late

Correct answer: To avoid alerting the IDS

The correct answer: <br> To avoid alerting the IDS

Question 16: What is a 'watering hole attack'?

Infecting websites frequently visited by the target organization (Correct answer)
Poisoning a company's water supply
Sending phishing emails to HR staff
Installing keyloggers on shared computers

Correct answer: Infecting websites frequently visited by the target organization

A watering hole attack compromises websites that a target group regularly visits, infecting visitors with malware when they browse the compromised site.

Question 17: What is process hollowing, and how does it differ from standard DLL injection?

Terminating a running process and immediately restarting it with a different executable
Injecting shellcode into a process's heap to overflow adjacent memory regions
Creating a legitimate process in a suspended state and replacing its entire memory image with malicious code (Correct answer)
Monitoring a running process's memory for credentials or sensitive data in plaintext

Correct answer: Creating a legitimate process in a suspended state and replacing its entire memory image with malicious code

Process hollowing creates a legitimate process in suspended state, unmaps its code from memory, and injects malicious code that runs under the trusted process's identity to evade detection.

Question 18: Which technique involves sending malformed packets to crash or reveal information about a target system?

Enumeration
Fuzzing (Correct answer)
Sniffing
Pivoting

Correct answer: Fuzzing

Fuzzing sends unexpected, malformed, or random data to a system to discover vulnerabilities, crashes, or unexpected behaviors in software.

Question 19: Which privilege escalation technique exploits weak file permissions on service executable files to run malicious code with elevated privileges?

Kernel exploitation via unpatched CVE
Service binary hijacking (binary path replacement) (Correct answer)
UAC bypass using registry manipulation
Token impersonation via Meterpreter

Correct answer: Service binary hijacking (binary path replacement)

Service binary hijacking replaces or modifies a service executable due to misconfigured weak permissions, causing the service to execute the attacker's code with SYSTEM or admin privileges.

Question 20: Which Windows subsystem service stores user credentials in memory to support single sign-on and is a primary target for credential dumping tools like Mimikatz?

Windows Defender Credential Guard
LSASS (Local Security Authority Subsystem Service) (Correct answer)
Windows Management Instrumentation (WMI)
Task Scheduler Service

Correct answer: LSASS (Local Security Authority Subsystem Service)

LSASS stores credentials in memory to facilitate Windows authentication; Mimikatz and similar tools target this process to extract plaintext passwords and hashes.

Question 21: What does IDOR stand for in web security testing?

Internal Directory Object Redirect
Indirect Data Object Retrieval
Insecure Direct Object Reference (Correct answer)
Insecure Data Object Reference

Correct answer: Insecure Direct Object Reference

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal object references (IDs) without access control checks, allowing unauthorized data access.

Question 22: Which encryption protocol does WPA3 use to replace the Pre-Shared Key (PSK) authentication of WPA2?

TKIP
SAE (Simultaneous Authentication of Equals) (Correct answer)
EAP-TLS
CCMP

Correct answer: SAE (Simultaneous Authentication of Equals)

WPA3 replaces WPA2's PSK with SAE (Simultaneous Authentication of Equals), also known as Dragonfly, which provides stronger password-based authentication resistant to offline dictionary attacks.

Question 23: Why do attackers typically clear Windows event logs after a successful compromise?

To disable Windows Defender real-time protection and alerting
To prevent Windows from generating new alerts about system activity
To free up disk space needed for storing exfiltrated data
To destroy forensic evidence of their activities and impede incident response (Correct answer)

Correct answer: To destroy forensic evidence of their activities and impede incident response

Clearing event logs is an anti-forensics technique that destroys evidence of attacker actions, making incident investigation and attribution significantly more difficult.

Question 24: What is a pass-the-hash (PtH) attack?

Cracking a password hash offline using a dictionary attack
Using a plaintext password to authenticate to a remote system
Using a captured NTLM hash to authenticate without knowing the actual password (Correct answer)
Sending a hashed payload to exploit a buffer overflow vulnerability

Correct answer: Using a captured NTLM hash to authenticate without knowing the actual password

Pass-the-hash allows attackers to authenticate to Windows systems using the NTLM hash directly without needing to crack or know the plaintext password.

Question 25: What is 'HTTP verb tampering' in web security testing?

Replaying captured HTTP requests
Modifying server response codes
Injecting headers into HTTP responses
Sending unexpected HTTP methods like PUT or DELETE to bypass access controls (Correct answer)

Correct answer: Sending unexpected HTTP methods like PUT or DELETE to bypass access controls

HTTP verb tampering sends unusual HTTP methods (PUT, DELETE, PATCH) to web endpoints to bypass access controls that only restrict GET or POST requests.

Question 26: Which protocol is exploited by the 'Pass the Hash' attack technique?

SSH
NTLM (Correct answer)
FTP
HTTPS

Correct answer: NTLM

Pass the Hash exploits NTLM authentication by using captured password hashes directly to authenticate without knowing the plaintext password.

Question 27: Which behavior is a strong indicator of ransomware activity on a network?

Increased outbound DNS queries
Mass file renaming and encryption combined with a ransom note creation (Correct answer)
Excessive CPU usage on servers
Unusual user login times

Correct answer: Mass file renaming and encryption combined with a ransom note creation

Ransomware typically exhibits mass file modification (encrypting and renaming files with new extensions) and drops ransom notes in affected directories, which are detectable via file integrity monitoring.

Question 28: What does placing a wireless adapter in 'monitor mode' allow a penetration tester to do?

Bypass WPA2 authentication automatically
Passively capture all wireless frames in range without associating with an AP (Correct answer)
Connect to multiple SSIDs simultaneously
Boost wireless signal strength for longer range attacks

Correct answer: Passively capture all wireless frames in range without associating with an AP

Monitor mode (promiscuous mode for wireless) allows the network adapter to capture all wireless frames in range, including frames not destined for that adapter, enabling passive reconnaissance.

Question 29: Which type of XSS permanently stores malicious script in the target server's database?

Blind XSS
Stored XSS (Correct answer)
Reflected XSS
DOM-based XSS

Correct answer: Stored XSS

Stored XSS (persistent XSS) saves malicious scripts in server-side storage like databases, which are then served to all users who view the affected page.

Question 30: What is a 'beacon frame' in 802.11 wireless networking?

A data frame carrying encrypted user traffic
A control frame used to coordinate channel access
A frame used to authenticate new clients to the network
A management frame broadcast by APs to announce their presence, SSID, and capabilities (Correct answer)

Correct answer: A management frame broadcast by APs to announce their presence, SSID, and capabilities

Beacon frames are management frames periodically broadcast by access points to advertise the network's SSID, supported rates, encryption capabilities, and timing information.

EC-Council Certified Ethical Hacker (CEH v13)

The CEH v13 exam validates mastery of ethical hacking techniques and cybersecurity countermeasures across the five phases of hacking, covering 20 modules including reconnaissance, system hacking, malware analysis, network attacks, web application security, and cryptography.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds