Certified Ethical Hacker (CEH) Practice Exam Questions and Answers

Certified Ethical Hacker (CEH) — Practice Exam & Prep

Prepare to think like an ethical hacker and pass the CEH with confidence. This practice exam is built to mirror the structure, difficulty, and practical reasoning of the Certified Ethical Hacker (CEH) certification—helping you master offensive security concepts, tool use, legal/ethical boundaries, and the defensive thinking you need to secure networks and systems.

Why this CEH practice exam matters

The CEH tests not just terminology but judgment: knowing which technique fits a situation, how to sequence an assessment, and what defensive controls mitigate specific attacks. Practical experience helps, but targeted practice questions sharpen the reasoning and speed required on exam day. This product gives you realistic, scenario-driven questions with clear explanations so you can move from knowing concepts to applying them under pressure.

What’s included

• Comprehensive question bank covering core CEH domains: reconnaissance, scanning and enumeration, vulnerability analysis, system and network hacking, web application attacks, wireless, cryptography, social engineering, and incident response.
• Scenario-based items that require applied decision-making—choosing an approach, tool, or mitigation given constraints and objectives.
• Detailed answer explanations for every question that walk through the attacker mindset, the defensive implications, and why alternate answers are weaker.
• Hands-on tips and pointers to lab exercises so you can translate conceptual understanding into practical skills.
• Downloadable PDF/DOC for offline study and lifetime access with free updates when the CEH blueprint changes.

Who should use this resource

• Security professionals preparing for the Certified Ethical Hacker (CEH) certification exam.
• Network and systems engineers who want to strengthen offensive-security reasoning and improve defensive design.
• Penetration testing beginners who need a structured, exam-aligned path to learn tools and tactics responsibly.
• Security students and bootcamp participants seeking focused practice to complement labs and coursework.

How this practice exam helps you pass

• Exam-style realism: Questions are written in the tone and format you’ll see on exam day—clear prompts, realistic constraints, and plausible distractors.
• Applied learning: Explanations emphasize the “why” and “how” (attack sequence, required privileges, likely impact), not just the “what.” That builds better judgement for both the exam and real-world security work.
• Time & accuracy training: Repeated timed practice improves both speed and decision-making under pressure—two critical factors for passing.
• Bridge to labs: Each topic includes suggested hands-on exercises (tools, commands, or simulated setups) so you can verify concepts in a safe, controlled environment.

Topics covered (examples)

• Reconnaissance & footprinting: Passive vs. active techniques, OSINT sources, footprinting goals.
• Scanning & enumeration: Nmap scanning patterns, service/version detection, banner grabbing, enumeration of shares and users.
• Vulnerability assessment: Interpreting scanner output, prioritizing findings, and choosing exploit vs. mitigation.
• System & network attacks: Lateral movement patterns, privilege escalation, exploit chains, and post-exploitation control.
• Web application attacks: Common OWASP risks, SQL injection variants, XSS types, session management flaws and defenses.
• Wireless attacks: Rogue APs, WPA weaknesses, deauthentication attacks, and mitigation best practices.
• Cryptography basics: Common misconfigurations, cipher weaknesses, certificate issues.
• Social engineering: Phishing simulation design, human attack surfaces, and countermeasures.
• Defense & incident response: Detection strategies, containment, forensic data points, and legal/ethical reporting.

Sample question style

• “Given a target network with segmented DMZ and internal VLANs, which initial scan approach minimizes detection while providing sufficient host data for pivot planning?”
• “After discovering a vulnerable web application parameter that reflects unsanitized input, which proof-of-concept test demonstrates exploitability without causing destructive side effects?”
• “An employee reports a suspicious email with a link. What are the immediate containment and evidence-preservation steps you should take?”

Each question is followed by a clear explanation that outlines attacker steps, defensive signals to watch for, and safer lab exercises to practice.

Study strategy — how to get the most from this pack

1. Take a full timed practice session to baseline your speed and topic weaknesses.
2. Review explanations thoroughly—the rationale is where the real learning lives.
3. Pair questions with labs: after a topic block, run short lab tasks in a sandbox to reinforce tooling and techniques.
4. Repeat missed items after 48 hours, then after a week (spaced repetition).
5. Simulate exam conditions periodically—timed tests without notes build stamina and focus.

Ethical & legal guidance

This material is focused on defensive learning and certified testing preparation. Remediation, penetration testing, and tool use should always be conducted in authorized environments with written consent. Explanations emphasize responsible disclosure, legal considerations, and how to report findings ethically.

Format & access

• Instant download after purchase.
• Printable PDF and web-view options for flexible study.
• One-time fee with lifetime access and updates when exam objectives or industry best practices change.

Why choose this CEH practice test

• Questions written with exam fidelity and real-world applicability.
• Emphasis on reasoning, not rote memorization.
• Practical lab suggestions paired with conceptual explanations for balanced learning.
• Designed to prepare you for both the CEH exam and the professional judgement required in security roles.

Sample Questions and Answers

What is the primary goal of ethical hacking?
A) To exploit vulnerabilities for financial gain
B) To identify and fix security weaknesses
C) To launch cyberattacks on organizations
D) To create new hacking tools

✅ Answer: B) To identify and fix security weaknesses
🔹 Explanation: Ethical hacking involves simulating cyberattacks to uncover and address security vulnerabilities before malicious hackers exploit them.

Which of the following is NOT a phase in the ethical hacking process?
A) Reconnaissance
B) Exploitation
C) Scanning
D) Reporting

✅ Answer: B) Exploitation
🔹 Explanation: Ethical hackers do not exploit vulnerabilities for malicious purposes; they focus on identifying and documenting them for remediation.

What is passive reconnaissance?
A) Gathering information about a target without direct interaction
B) Actively probing a network for vulnerabilities
C) Deploying malware on a target system
D) Conducting penetration tests on an organization

✅ Answer: A) Gathering information about a target without direct interaction
🔹 Explanation: Passive reconnaissance involves collecting publicly available information about a target without alerting them, such as analyzing websites and social media.

Which tool is commonly used for footprinting a website?
A) Metasploit
B) WHOIS
C) Nmap
D) Nessus

✅ Answer: B) WHOIS
🔹 Explanation: WHOIS allows ethical hackers to retrieve domain registration details, such as the owner, contact information, and DNS servers.

What is the purpose of a port scan?
A) To test website performance
B) To identify open ports and services running on a target system
C) To encrypt network traffic
D) To detect physical network issues

✅ Answer: B) To identify open ports and services running on a target system
🔹 Explanation: Port scanning helps ethical hackers determine which services are exposed on a system, which may indicate potential vulnerabilities.

Which scanning technique involves sending SYN packets without completing the handshake?
A) UDP Scan
B) XMAS Scan
C) SYN Scan
D) FIN Scan

✅ Answer: C) SYN Scan
🔹 Explanation: SYN scanning, also called half-open scanning, sends SYN packets to detect open ports without completing the TCP handshake.

Which protocol is commonly targeted during enumeration?
A) HTTP
B) FTP
C) SNMP
D) ARP

✅ Answer: C) SNMP
🔹 Explanation: SNMP (Simple Network Management Protocol) is used for network device management and can reveal sensitive information if misconfigured.

What is NetBIOS enumeration used for?
A) To scan open ports
B) To retrieve usernames, shares, and workgroup information
C) To bypass firewalls
D) To encrypt network traffic

✅ Answer: B) To retrieve usernames, shares, and workgroup information
🔹 Explanation: NetBIOS enumeration allows attackers to gather details about network resources, making it a common target for hackers.

What is the primary purpose of privilege escalation?
A) To gain unauthorized administrative access
B) To disable security software
C) To log user keystrokes
D) To install backdoors

✅ Answer: A) To gain unauthorized administrative access
🔹 Explanation: Privilege escalation allows attackers to increase their access rights, potentially giving them full control over a compromised system.

Which tool is commonly used for password cracking?
A) Wireshark
B) John the Ripper
C) Nikto
D) Burp Suite

✅ Answer: B) John the Ripper
🔹 Explanation: John the Ripper is an open-source password-cracking tool that uses dictionary and brute-force attacks.

What is the main characteristic of a rootkit?
A) It automatically replicates across networks
B) It hides malicious activities from the operating system
C) It encrypts files and demands ransom
D) It creates pop-up advertisements

✅ Answer: B) It hides malicious activities from the operating system
🔹 Explanation: Rootkits modify system processes to conceal malicious activities and maintain persistent access.

What is ARP poisoning used for?
A) To encrypt network traffic
B) To intercept communication between devices on a LAN
C) To scan for open ports
D) To conduct brute-force attacks

✅ Answer: B) To intercept communication between devices on a LAN
🔹 Explanation: ARP poisoning manipulates the Address Resolution Protocol (ARP) to redirect network traffic through an attacker’s system.

What is the primary objective of phishing?
A) To exploit web application vulnerabilities
B) To deceive users into providing sensitive information
C) To scan for network vulnerabilities
D) To perform a DoS attack

✅ Answer: B) To deceive users into providing sensitive information
🔹 Explanation: Phishing attacks use fraudulent emails or websites to trick users into revealing credentials or financial details.

What is SQL injection?
A) An attack that overflows memory buffers
B) A method of injecting malicious SQL queries into database-driven applications
C) A technique for scanning networks
D) A form of brute-force attack

✅ Answer: B) A method of injecting malicious SQL queries into database-driven applications
🔹 Explanation: SQL injection manipulates input fields to execute unauthorized database commands, potentially exposing sensitive data.

What type of encryption does WPA2 use?
A) DES
B) AES
C) RSA
D) MD5

✅ Answer: B) AES
🔹 Explanation: WPA2 uses AES (Advanced Encryption Standard) for strong wireless security encryption.

What is the primary purpose of a VPN?
A) To bypass firewalls
B) To securely encrypt network traffic over public networks
C) To provide free internet access
D) To increase network speed

✅ Answer: B) To securely encrypt network traffic over public networks
🔹 Explanation: VPNs create encrypted tunnels to protect data from eavesdropping on insecure networks.

Which of the following tools is used to extract metadata from files and images?
A) Nmap
B) FOCA
C) Aircrack-ng
D) Metasploit

✅ Answer: B) FOCA
🔹 Explanation: FOCA (Fingerprinting Organizations with Collected Archives) extracts metadata from documents, revealing sensitive information like usernames, file paths, and software versions.

What type of DNS record is used to identify mail servers?
A) A Record
B) CNAME Record
C) MX Record
D) TXT Record

✅ Answer: C) MX Record
🔹 Explanation: Mail Exchange (MX) records specify mail servers for a domain, which can be targeted in reconnaissance for email spoofing or phishing attacks.

Which of the following is a stealthy scanning technique that evades IDS detection?
A) Full Connect Scan
B) SYN Scan
C) Null Scan
D) Ping Sweep

✅ Answer: C) Null Scan
🔹 Explanation: Null scans send packets with no TCP flags set, helping evade detection systems while checking for open ports.

What does the “O” flag in an Nmap scan indicate?
A) Open port
B) OS detection
C) Overloaded server
D) Outbound connection

✅ Answer: B) OS detection
🔹 Explanation: The -O option in Nmap enables OS fingerprinting to determine the target system’s operating system.

What command is used to enumerate shared network resources on a Windows system?
A) net use
B) net view
C) tracert
D) ping -t

✅ Answer: B) net view
🔹 Explanation: The net view command lists shared resources, helping attackers identify accessible network shares.

What is an effective countermeasure against SNMP enumeration?
A) Disabling ICMP responses
B) Using complex community strings
C) Blocking TCP port 80
D) Implementing DNSSEC

✅ Answer: B) Using complex community strings
🔹 Explanation: SNMP enumeration exploits weak community strings. Using strong, unique strings reduces the risk of unauthorized access.

What is a key characteristic of a rainbow table attack?
A) It uses precomputed password hashes
B) It exploits SQL vulnerabilities
C) It requires brute-force attempts
D) It encrypts files for ransom

✅ Answer: A) It uses precomputed password hashes
🔹 Explanation: Rainbow table attacks use precomputed hash values to quickly crack passwords, reducing computation time.

Which file in Windows stores hashed user passwords?
A) /etc/passwd
B) shadow
C) SAM
D) config.sys

✅ Answer: C) SAM
🔹 Explanation: The Security Accounts Manager (SAM) file in Windows stores password hashes and is a target for privilege escalation attacks.

What is polymorphic malware?
A) Malware that spreads across networks
B) Malware that changes its code to avoid detection
C) Malware that exploits browser vulnerabilities
D) Malware that installs rootkits

✅ Answer: B) Malware that changes its code to avoid detection
🔹 Explanation: Polymorphic malware frequently alters its signature, making it harder for antivirus software to detect.

What is a botnet?
A) A single malware-infected machine
B) A network of compromised computers controlled remotely
C) A type of phishing attack
D) A firewall bypass technique

✅ Answer: B) A network of compromised computers controlled remotely
🔹 Explanation: Botnets consist of multiple infected devices controlled by attackers to perform DDoS attacks, spamming, or credential theft.

What is the primary defense against ARP poisoning attacks?
A) Using MAC address filtering
B) Implementing ARP spoofing
C) Enabling static ARP entries
D) Disabling SNMP

✅ Answer: C) Enabling static ARP entries
🔹 Explanation: ARP poisoning attacks manipulate ARP tables, and using static ARP entries prevents unauthorized changes.

Which tool is commonly used for network packet sniffing?
A) Nikto
B) Wireshark
C) Aircrack-ng
D) Hydra

✅ Answer: B) Wireshark
🔹 Explanation: Wireshark captures and analyzes network packets, making it a key tool for network security analysis.

What is a common sign of a phishing attack?
A) Emails from trusted senders
B) URLs with misspellings or extra characters
C) Secure HTTPS websites
D) Software updates from official sources

✅ Answer: B) URLs with misspellings or extra characters
🔹 Explanation: Phishing attacks often use slightly altered URLs to deceive users into entering credentials on fake websites.

Which vulnerability allows attackers to execute unauthorized database commands?
A) Cross-Site Scripting (XSS)
B) SQL Injection
C) Clickjacking
D) Buffer Overflow

✅ Answer: B) SQL Injection
🔹 Explanation: SQL injection exploits input fields to inject malicious SQL queries, potentially compromising database integrity.

What is a primary method to prevent XSS attacks?
A) Encrypting network traffic
B) Validating and sanitizing user input
C) Disabling cookies
D) Blocking TCP port 443

✅ Answer: B) Validating and sanitizing user input
🔹 Explanation: XSS attacks inject malicious scripts into web pages. Input validation and sanitization prevent execution of harmful code.

What encryption algorithm does WPA3 use?
A) TKIP
B) AES-CCMP
C) SAE
D) DES

✅ Answer: C) SAE
🔹 Explanation: WPA3 uses Simultaneous Authentication of Equals (SAE) for stronger wireless authentication and protection against brute-force attacks.

What is the main purpose of a digital certificate?
A) To store encrypted files
B) To verify the authenticity of websites and entities
C) To provide firewall protection
D) To enhance brute-force attack efficiency

✅ Answer: B) To verify the authenticity of websites and entities
🔹 Explanation: Digital certificates authenticate users and websites by validating their identity using Public Key Infrastructure (PKI).