Information security and ethical hacking overview 7
A network puts a firewall, host hardening and monitoring one behind another, so that an attack is weakened at each layer. What is this approach called?RFC 4949, definition of "defense in depth"
A tester probes a client's systems only within a signed agreement. Which element of the U.S. computer fraud statute is that agreement meant to keep the tester clear of?18 U.S.C. 1030, subsection (a)(2)
An eavesdropper copies traffic off a link and changes nothing. How does RFC 4949 class this attack?RFC 4949, definition of "attack"
How does NIST SP 800-115 define penetration testing?NIST SP 800-115, section 5.2
In a penetration test as NIST describes it, what is the attack phase for?NIST SP 800-115, section 5.2.1
In MITRE ATT&CK, which tactic is "the adversary is trying to establish resources they can use to support operations"?MITRE ATT&CK, Enterprise tactics, TA0042
Which word does RFC 4949 give for a person who tries to break another party's system security, often with malicious intent?RFC 4949, definition of "cracker"
Show all 125 questions (118 more)
Reconnaissance techniques 21
A port scan report marks a port "filtered". What does Nmap mean by that?Nmap Reference Guide, Port Scanning Basics, filtered
A scan finds TCP port 139 open on an old file server. Which NetBIOS service uses that port?RFC 1002, section 6
A SYN arrives for a TCP port on which nothing is listening. What does the TCP standard have the host send back?RFC 9293, section 3.5.2
An AXFR query asks a DNS server for what?RFC 5936, sections 2 and 5
An intruder lists the folders and drives shared on other systems. Why does ATT&CK say that helps the intruder?MITRE ATT&CK, T1135 Network Share Discovery
An intrusion detection alert reports TCP segments with the FIN, PSH and URG flags all set. Which scan sends such packets?Nmap Reference Guide, Port Scanning Techniques, -sN; -sF; -sX
Attackers search public code repositories while footprinting a company. Which mitigation does ATT&CK give its developers?MITRE ATT&CK, T1593 Search Open Websites/Domains, Mitigations
DNSSEC zone walking follows the chain of NSEC records to list every name in a zone. What did NSEC3 change to make that harder?RFC 5155, Abstract and section 1
During a UDP scan, which reply shows that a port is closed?Nmap Reference Guide, Port Scanning Techniques, -sU (UDP scans)
How does ATT&CK distinguish phishing for information from ordinary phishing?MITRE ATT&CK, T1598 Phishing for Information
How does remote OS detection in Nmap work?Nmap Reference Guide, OS Detection
How does SNMP version 1 decide whether a request is authentic?RFC 1157, section 3.2.5
In MITRE ATT&CK, which tactic covers footprinting: gathering information to plan future operations?MITRE ATT&CK, Enterprise tactics, TA0043
Passive DNS footprinting collects DNS records without touching the target. What do those records outline?MITRE ATT&CK, T1596.001 DNS/Passive DNS
Traceroute maps the routers on a path by sending packets with small time-to-live values. Which ICMP message does each router send back?RFC 792, Time Exceeded Message
What can public WHOIS data give someone who is footprinting an organization?MITRE ATT&CK, T1596.002 WHOIS
What is a TCP ACK scan used for?Nmap Reference Guide, Port Scanning Techniques, -sA (TCP ACK scan)
Which SMTP command asks a server to confirm that an argument identifies a user or mailbox, and so can be abused to enumerate accounts?RFC 5321, sections 4.1.1.6 and 7.3
Which TCP port does RFC 4511 assign to LDAP?RFC 4511, section 5.2.1
Why is a TCP SYN scan often called half-open scanning?Nmap Reference Guide, Port Scanning Techniques, -sS (TCP SYN scan)
Why would an attacker read the password policy of a network before guessing any passwords?MITRE ATT&CK, T1201 Password Policy Discovery
System hacking phases and attack techniques 19
A defender finds a new value under a Windows registry "run key" that starts an unknown program. What does the attacker gain from it?MITRE ATT&CK, T1547.001 Registry Run Keys / Startup Folder
A flaw can be exploited only by someone with hands on the device. Which CVSS v3.1 Attack Vector value fits?FIRST, CVSS v3.1 Specification Document, section 2.1.1
A sample does nothing harmful when an analyst runs it in a virtual machine. Which behavior does ATT&CK describe that would explain it?MITRE ATT&CK, T1497 Virtualization/Sandbox Evasion
A user only visits a compromised news site in the course of normal browsing, and the browser is exploited. What does ATT&CK call this way in?MITRE ATT&CK, T1189 Drive-by Compromise
According to NIST SP 800-115, which of these can a vulnerability scanner provide?NIST SP 800-115, section 4.3
An attacker with a low-privilege shell runs code that takes advantage of a programming error in the kernel and becomes SYSTEM. Which ATT&CK technique is this?MITRE ATT&CK, T1068 Exploitation for Privilege Escalation
How does NIST SP 800-83 describe a rootkit?NIST SP 800-83 Rev. 1, section 2.2
In a pass the hash attack, what does the attacker never need?MITRE ATT&CK, T1550.002 Pass the Hash
In the NIST definition of an advanced persistent threat, what does the adversary do over an extended period of time?NIST glossary, "advanced persistent threat"
Logins are tried on a company portal with username and password pairs from the breach of an unrelated website. What is this called?MITRE ATT&CK, T1110.004 Credential Stuffing
Malicious code is found running inside the address space of a legitimate, live process. Which ATT&CK technique put it there?MITRE ATT&CK, T1055 Process Injection
Password hashes have been stolen from a server. Which ATT&CK technique recovers plaintext passwords from them, away from the target?MITRE ATT&CK, T1110.002 Password Cracking
What does the Common Weakness Enumeration (CWE) list?MITRE, About CWE
What is a weakness of vulnerability scanners that NIST SP 800-115 points out?NIST SP 800-115, section 4.3
Where can data be hidden on an NTFS volume so that a normal directory listing does not show it?MITRE ATT&CK, T1564.004 NTFS File Attributes
Which CVSS v3.1 base metric describes conditions outside the attacker's control that must exist for an exploit to work?FIRST, CVSS v3.1 Specification Document, section 2.1.2
Which kind of virus attaches itself to documents such as spreadsheets and uses the application's own scripting language to run and spread?NIST SP 800-83 Rev. 1, section 2.1
Which of these does NIST SP 800-115 class as a review technique, used to find weaknesses without attacking a target?NIST SP 800-115, sections 3 and 5
Why do malware authors pack, encrypt or encode an executable?MITRE ATT&CK, T1027 Obfuscated Files or Information
Network and perimeter hacking 30
A caller asks for internal information and gives a company name. What does CISA advise before answering?CISA, Avoiding Social Engineering and Phishing Attacks, How do you avoid being a victim?
A rogue server answers DHCP requests on the office LAN. What can it hand to clients so that their traffic flows through the attacker?MITRE ATT&CK, T1557.003 DHCP Spoofing
A router applies strict reverse path forwarding. When does it drop an incoming packet?RFC 3704 (BCP 84), section 2.2
A scanner sends tiny IP fragments. What is the idea behind that evasion?Nmap Reference Guide, Firewall/IDS Evasion and Spoofing, -f (fragment packets)
A Windows host fails to resolve a mistyped server name by DNS and falls back to LLMNR. How does an attacker on the same network abuse that?MITRE ATT&CK, T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay
An attacker abuses a flaw or setting in the victim's browser to change content and intercept data in live sessions. What does ATT&CK call this?MITRE ATT&CK, T1185 Browser Session Hijacking
An attacker who already has a password triggers sign-in prompts on the victim's phone again and again, hoping one is approved. Which ATT&CK technique is this?MITRE ATT&CK, T1621 Multi-Factor Authentication Request Generation
An email opens "Dear Valued Customer" and its signature block has no contact details. What does CISA say that suggests?CISA, Avoiding Social Engineering and Phishing Attacks, What are common indicators of phishing attempts?
An HTTP flood sends a web server so many requests that its software can no longer answer real users. Which ATT&CK technique is this?MITRE ATT&CK, T1499.002 Service Exhaustion Flood
An intruder takes over an administrator's existing SSH or RDP session to move to another host. Which ATT&CK technique is this?MITRE ATT&CK, T1563 Remote Service Session Hijacking
An intrusion needs the victim to open a document or click a link before any code runs. What does ATT&CK call this dependence?MITRE ATT&CK, T1204 User Execution
How are victims of online identity theft usually chosen, according to CISA?CISA, Preventing and Responding to Identity Theft, How are victims of online identity theft chosen?
How does an application-proxy gateway treat a connection between a client and a server?NIST SP 800-41 Rev. 1, section 2.1.4
How does NIST SP 800-115 define social engineering?NIST SP 800-115, section 5.3
How does RFC 4732 define a denial-of-service attack?RFC 4732, section 1
How much entropy must a session identifier have, according to the OWASP session management cheat sheet, to resist guessing?OWASP Session Management Cheat Sheet, Session ID Entropy
In a reflection amplification attack, what makes third-party servers flood the victim?MITRE ATT&CK, T1498.002 Reflection Amplification
In a Smurf attack as CISA describes it, where do the attacker's ICMP broadcast packets appear to come from?CISA, Understanding Denial-of-Service Attacks, What are common denial-of-service attacks?
In DNS cache poisoning as NIST SP 800-81 describes it, what is the goal?NIST SP 800-81-2, section 6.1.1
Malware copies the session cookie of a signed-in webmail user from the browser. What does that give the attacker?MITRE ATT&CK, T1539 Steal Web Session Cookie
Traffic that a firewall would block is wrapped inside a protocol the firewall allows. What does ATT&CK call this?MITRE ATT&CK, T1572 Protocol Tunneling
What does a stateful inspection firewall add to plain packet filtering?NIST SP 800-41 Rev. 1, section 2.1.2
What does generating unpredictable initial sequence numbers protect a TCP connection against?RFC 6528, Abstract
What does putting a network interface into promiscuous mode let an intruder do?MITRE ATT&CK, T1040 Network Sniffing
What is a botnet, in ATT&CK's words?MITRE ATT&CK, T1584.005 Botnet
Which mitigation does ATT&CK list against network sniffing?MITRE ATT&CK, T1040 Network Sniffing, Mitigations
Which property of ARP makes cache poisoning possible?MITRE ATT&CK, T1557.002 ARP Cache Poisoning
Why can a stolen session cookie get past multi-factor authentication?MITRE ATT&CK, T1550.004 Web Session Cookie
Why does a decoy scan make an attacker harder to single out?Nmap Reference Guide, Firewall/IDS Evasion and Spoofing, -D (cloak a scan with decoys)
Why is signature-based detection easy to evade with a new or disguised attack?NIST SP 800-94, section 2.3.1
Web application hacking 18
A login page sends users on to whatever address is in its "next" parameter, with no check. What can a phisher do with that?MITRE CWE-601, Description
A proxy and the web server behind it disagree about where one HTTP request ends and the next begins. Which weakness does that describe?MITRE CWE-444, Description
A team does not know the versions of the libraries its web application uses. Which OWASP Top 10 category does that fall under?OWASP Top 10:2021, A06 Vulnerable and Outdated Components, Description
A user changes the account number in a URL from 1001 to 1002 and sees another customer's invoice. Which weakness is this?MITRE CWE-639, Description
A web server still has its default accounts with unchanged passwords, and its error pages show stack traces. Which OWASP Top 10 category covers both?OWASP Top 10:2021, A05 Security Misconfiguration, Description
An application copies user input into an HTTP header without removing CR and LF characters. Which weakness is this?MITRE CWE-113, Description
An application loads plugins and updates from a content delivery network without verifying their integrity. Which OWASP Top 10 category is this?OWASP Top 10:2021, A08 Software and Data Integrity Failures, Description
An error-based SQL injection reads table names out of database error pages. Which weakness in the application makes that possible?MITRE CWE-209, Description
Beyond safe queries, what does the OWASP SQL injection cheat sheet say about the database accounts an application uses?OWASP SQL Injection Prevention Cheat Sheet, Least Privilege
In ATT&CK, what is the adversary doing in Exploit Public-Facing Application?MITRE ATT&CK, T1190 Exploit Public-Facing Application
In blind SQL injection the page shows no query results or database errors. How does the attacker still learn the data?OWASP, Blind SQL Injection, Description
Web logs show requests that each make the database wait a fixed number of seconds before the page returns. Which form of SQL injection does that point to?OWASP, Blind SQL Injection, Time-based
What does a SQL injection attack consist of, in OWASP's definition?OWASP, SQL Injection, Overview
What is clickjacking?OWASP, Clickjacking
Which defense does the OWASP SQL injection cheat sheet list with the warning "strongly discouraged"?OWASP SQL Injection Prevention Cheat Sheet, Defense Option 4
Which hardening step does NIST SP 800-44 give for a web server's operating system?NIST SP 800-44 Version 2, section 4.1.2
Which OWASP Top 10 category of 2021 was previously known as Sensitive Data Exposure?OWASP Top 10:2021, A02 Cryptographic Failures, Overview
Which risk is first in the OWASP API Security Top 10 of 2023?OWASP API Security Top 10 2023, API1:2023
Wireless network hacking 6
A laptop is plugged into the office LAN and joined to a guest Wi-Fi network at the same time. What does NIST call this, and what is the risk?NIST SP 800-153, section 2.1.2
A phone user receives unsolicited messages over Bluetooth from a stranger nearby. What is this attack called?NIST SP 800-121 Rev. 2, section 4.2
What does the IEEE 802.11i 4-Way Handshake establish between a client and an access point?NIST SP 800-97, section 3.3
What is wardriving, as CISA describes it?CISA, Securing Wireless Networks, Wardriving
Which Bluetooth attack forces a connection to an old device and reads the data stored on it, including its IMEI?NIST SP 800-121 Rev. 2, section 4.2
Which protection does the Wi-Fi Alliance say all WPA3 networks require?Wi-Fi Alliance, Security, WPA3
Mobile platform, IoT and OT hacking 12
A mobile app sends its login over plain HTTP. What can a threat agent listening on the wire do, according to OWASP M5?OWASP Mobile Top 10 2024, M5 Insecure Communication, Threat Agents
A reviewer finds an API key written in clear text in the code of a mobile app. Which OWASP Mobile Top 10 risk of 2024 is this?OWASP Mobile Top 10 2024, M1 Improper Credential Usage, Threat Agents
An app keeps session tokens in a plain text file on the device. Which OWASP Mobile Top 10 risk of 2024 is this?OWASP Mobile Top 10 2024, M9 Insecure Data Storage, Security Weakness
In an OT system, what is the human-machine interface?NIST glossary, "human-machine interface"
On a phone used for both work and private life, what do secure containers provide?NIST SP 800-124 Rev. 2, section 4.2.7
Public services publish the results of Internet-wide scans: live addresses, open ports, even server banners. Why does this matter for exposed cameras and controllers?MITRE ATT&CK, T1596.005 Scan Databases
Staff phones often join hotel and cafe Wi-Fi. How does NIST SP 800-124 say the risk of untrusted networks can be reduced?NIST SP 800-124 Rev. 2, section 4.3.5
What are mobile threat defense (MTD) systems designed to detect?NIST SP 800-124 Rev. 2, section 4.2.3
What sets many IoT devices apart from conventional IT devices, in the first of the NISTIR 8228 risk considerations?NISTIR 8228, Executive Summary
Which NIST baseline capability says an IoT device's software can be updated, by authorized entities only, using a secure and configurable mechanism?NISTIR 8259A, Table 1
Which OT component is a solid-state control system with user-programmable memory for functions such as I/O control, logic, timing and counting?NIST glossary, "programmable logic controller"
Why do the default passwords of Internet-enabled devices give no real protection, according to CISA?CISA, Securing the Internet of Things, Use strong passwords
Cloud computing 6
An attacker who can run code on a cloud virtual machine queries a service that every running instance can reach. What is the attacker after?MITRE ATT&CK, T1552.005 Cloud Instance Metadata API
An intruder adds malicious code to a machine image that the team launches new servers from. What does the intruder gain?MITRE ATT&CK, T1525 Implant Internal Image
How has cloud storage most often been left open to outsiders, according to ATT&CK?MITRE ATT&CK, T1530 Data from Cloud Storage
In ATT&CK, what does Escape to Host mean?MITRE ATT&CK, T1611 Escape to Host
Under the AWS shared responsibility model, who patches the guest operating system of a virtual server?AWS, Shared Responsibility Model
Why is a stolen application access token valuable in a cloud environment?MITRE ATT&CK, T1528 Steal Application Access Token
Cryptography 6
The CRIME and BREACH attacks recover secrets such as cookies from encrypted web traffic. Which feature do they abuse?RFC 7457, section 2.6
In S/MIME, which service does encryption provide, as distinct from the digital signature?RFC 8551, Abstract
What do SSL stripping attacks do?RFC 7457, section 2.1
What does a certification authority assert by signing a certificate?RFC 5280, section 3.1
What is true of a self-signed certificate?RFC 5280, section 3.2
Which algorithm does the OWASP password storage cheat sheet recommend first for hashing stored passwords?OWASP Password Storage Cheat Sheet, Introduction, summary of recommendations
How this list was compiled: Own questions, written to the nine domains of EC-Council's CEH Exam Blueprint v5.0 (https://cert.eccouncil.org/wp-content/uploads/2024/04/CEH-Exam-Blueprint-v5.pdf, read 2026-10-12) and to the number of questions it gives each of its twenty topics. Facts were read on 2026-10-12 in public texts: MITRE ATT&CK technique pages and CWE entries; the Nmap Reference Guide; NIST SP 800-41 Rev. 1, 800-44 Version 2, 800-81-2, 800-83 Rev. 1, 800-94, 800-97, 800-115, 800-121 Rev. 2, 800-124 Rev. 2 and 800-153, NISTIR 8228 and 8259A and the NIST glossary; IETF RFCs 792, 1002, 1157, 3704, 4511, 4732, 4949, 5155, 5280, 5321, 5936, 6528, 7457, 8551 and 9293; FIRST's CVSS v3.1 specification; the OWASP Top 10 lists of 2021, 2023 and 2024, cheat sheets and attack pages; CISA's tips; 18 U.S.C. 1030; and the Wi-Fi Alliance and AWS pages named in the questions. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from an EC-Council exam, course, sample question or assessment, or from another practice product.
How it works
An unofficial CEH practice test: 125 questions of our own, in the numbers the Certified Ethical Hacker blueprint gives its nine domains. It is not affiliated with EC-Council and uses none of the exam's own questions.
Read the full guide
What the CEH exam covers
EC-Council's CEH Exam Blueprint v5.0, read on October 12, 2026, gives each domain a number of questions: information security and ethical hacking overview 7, reconnaissance techniques 21, system hacking phases and attack techniques 19, network and perimeter hacking 30, web application hacking 18, wireless network hacking 6, mobile platform, IoT and OT hacking 12, cloud computing 6 and cryptography 6. The bank has the same numbers.
What the questions ask
Each question asks what a technique or control is and how a defender recognizes or counters it. None gives steps for attacking a system. The practical exam of 20 challenges is a separate, optional exam and is not practiced here.
A closed TCP port answers a SYN with a reset; no reply after several retransmissions marks the port filtered (RFC 9293, Nmap Reference Guide).
Pass the hash needs a stolen password hash, never the cleartext password (ATT&CK T1550.002).
OWASP's SQL injection cheat sheet marks escaping all user-supplied input as strongly discouraged.
Questions and answers
How many questions are on the CEH exam?
125 multiple-choice questions in 4 hours, by EC-Council's page for exam 312-50. Exam mode here asks all 125 of our questions against a 240-minute clock.
What is the passing score for the CEH exam?
There is no single figure. EC-Council sets a cut score for each exam form, and its page says they range from 60% to 85%. This page shows your percent in each domain and no pass or fail.
Is this a CEH v9 practice test?
No. EC-Council's page now offers CEH v13, and its exam blueprint is version 5.0. This bank follows that blueprint, so it suits the exam as it is given today.
Is the CEH exam open book?
No. EC-Council's certification page says it is not an open book exam. It is a multiple-choice exam taken in one 4-hour session.