Sample EC-Council CEH CEH Practice Questions
Q: What is the primary goal of ethical hacking?
A: To identify and fix security vulnerabilities before malicious hackers exploit them — Ethical hacking aims to proactively discover security weaknesses in systems, networks, and applications so organizations can remediate them before malicious actors exploit them. This is done with proper authorization and within a defined scope.
Q: Which command-line tool is used to query DNS records and retrieve information about a domain?
A: nslookup — nslookup is a network administration tool used to query Domain Name System (DNS) servers to obtain domain name or IP address mapping and other DNS records such as MX, NS, and SOA records.
Q: What does the Nmap flag '-sS' perform?
A: A SYN stealth scan (half-open scan) — The '-sS' flag in Nmap performs a TCP SYN scan, also known as a half-open or stealth scan. It sends SYN packets and analyzes responses without completing the TCP three-way handshake, making it less likely to be logged by the target.
Q: Which tool is commonly used for password cracking using wordlists?
A: John the Ripper — John the Ripper is a fast, open-source password cracker that supports hundreds of hash types and can perform dictionary attacks, brute-force attacks, and rule-based attacks to crack password hashes.
Q: Which social engineering attack involves sending fraudulent emails that appear to come from a trusted source?
A: Phishing — Phishing is a social engineering attack where attackers send deceptive emails that appear to come from legitimate, trusted sources to trick recipients into revealing sensitive information, clicking malicious links, or downloading malware.
Q: What is ARP poisoning (ARP spoofing)?
A: A technique where an attacker sends falsified ARP messages to link their MAC address with a legitimate IP address, intercepting network traffic — ARP poisoning involves sending forged ARP reply packets to associate the attacker's MAC address with the IP address of another host (such as the default gateway), allowing the attacker to intercept, modify, or stop network traffic in transit.
Q: In cloud computing, what is the shared responsibility model?
A: Security responsibilities are divided between the cloud provider (infrastructure) and the customer (data and applications), varying by service model — The shared responsibility model divides security obligations between the cloud provider and customer. The provider secures the underlying infrastructure, while the customer is responsible for securing their data, applications, access management, and configuration, with the exact split depending on whether IaaS, PaaS, or SaaS is used.
Q: What is the difference between symmetric and asymmetric encryption?
A: Symmetric encryption uses the same key for encryption and decryption, while asymmetric uses a public-private key pair — Symmetric encryption uses a single shared key for both encryption and decryption (e.g., AES), making it fast but requiring secure key distribution. Asymmetric encryption uses a mathematically related public-private key pair, solving key distribution but being slower.
Q: Which phase of the Cyber Kill Chain involves the attacker researching and selecting a target?
A: Reconnaissance — Reconnaissance is the first phase of the Cyber Kill Chain where attackers gather information about the target, including identifying employees, technologies, and potential vulnerabilities before crafting an attack.
Q: In the MITRE ATT&CK framework, which tactic describes techniques used by an adversary to maintain their foothold in a compromised environment?
A: Persistence — The Persistence tactic in MITRE ATT&CK encompasses techniques adversaries use to maintain access to systems across restarts, changed credentials, and other interruptions that could cut off their access.