Free Certified Professional Ethical Hacker exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Professional Ethical Hacker exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization authorizes assessors to mimic real attacks to identify ways around a system's security features. Which assessment technique are they performing?

   1. A.Penetration testingCorrect answer: A
   2. B.Vulnerability scanning
   3. C.Network discovery
   4. D.Security policy review

   Explanation: NIST states that "Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network." The authorized activity matches that definition.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 5.2, page 5-2

2. 2An assessor finds that unauthorized users can alter transaction records without detection. Which security objective is most directly affected by the unauthorized alteration?

   1. A.Confidentiality
   2. B.Availability
   3. C.IntegrityCorrect answer: C
   4. D.Accountability

   Explanation: NIST defines integrity as "Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity." Unauthorized alteration compromises the protection of the records against improper modification.

   Reference: NIST Computer Security Resource Center Glossary: Integrity — Definitions, FIPS 200

3. 3A tester monitors existing network traffic to discover communicating hosts, without transmitting discovery probes. What discovery approach is being used?

   1. A.Active network discovery
   2. B.Passive network discoveryCorrect answer: B
   3. C.Network port and service identification
   4. D.Network vulnerability scanning

   Explanation: NIST explains that "Passive techniques use a network sniffer to monitor network traffic and record the IP addresses of the active hosts" and that this is done without sending probing packets.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 4.1, page 4-1

4. 4A sender encrypts a file with a symmetric encryption key and sends the ciphertext to an authorized recipient. What key must the recipient use for decryption?

   1. A.The sender's public key
   2. B.The recipient's public key
   3. C.The same shared secret keyCorrect answer: C
   4. D.The recipient's private key

   Explanation: NIST states, "The same key must be used to decrypt the data." The sender and recipient must therefore possess the same secret key in this symmetric encryption case.

   Reference: An Introduction to Information Security — Section 9.1.1, page 52

5. 5Two vulnerability scanners independently flag the same suspected flaw. Which shared result would explain why agreement on the positive finding still does not establish that the flaw is present?

   1. A.A shared false-positive resultCorrect answer: A
   2. B.A shared false-negative result
   3. C.A shared true-positive result
   4. D.A shared true-negative result

   Explanation: NIST cautions that "these comparison tools can often produce similar results—including the same false positives." Agreement between scanners can therefore repeat an incorrect finding.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 7.3, page 7-3

6. 6An authenticated API user is allowed to use a document endpoint. Changing the document ID in a request reveals another user's document because the server fails to check permission for that object. Which API security risk does this illustrate?

   1. A.Broken function level authorization
   2. B.Broken object level authorizationCorrect answer: B
   3. C.Broken authentication
   4. D.Improper inventory management

   Explanation: OWASP explains that "the user will have access to the vulnerable API endpoint/function" and that "The violation happens at the object level, by manipulating the ID." That matches access to another user's document through a permitted endpoint.

   Reference: OWASP API Security Top 10: Broken Object Level Authorization — API1:2023, Is the API Vulnerable?

7. 7In an authorized post-exploitation test, an assessor uses a captured password hash to authenticate as a user without knowing that user's plaintext password. Which technique is illustrated?

   1. A.Pass the hashCorrect answer: A
   2. B.Pass the ticket
   3. C.Use an application access token
   4. D.Use a web session cookie

   Explanation: MITRE describes "Pass the hash (PtH)" as "a method of authenticating as a user without having access to the user's cleartext password." The supplied hash is the authentication material.

   Reference: MITRE ATT&CK: Pass the Hash — Technique T1550.002, description

8. 8An authorized social engineering exercise sends deceptive text messages directing recipients to a credential collection page. Which term identifies this technique by its delivery channel?

   1. A.Voice phishing
   2. B.SmishingCorrect answer: B
   3. C.Email phishing
   4. D.Social media phishing

   Explanation: CISA states, "Smishing is a form of social engineering that exploits SMS, or text, messages." The exercise uses that channel.

   Reference: Avoiding Social Engineering and Phishing Attacks — What is a smishing attack?

9. 9A wireless assessor observes a rogue access point configured to advertise the MAC address of a device in the authorized inventory. Which technique explains the misleading identity match?

   1. A.MAC address spoofingCorrect answer: A
   2. B.MAC address flooding
   3. C.ARP cache poisoning
   4. D.DNS cache poisoning

   Explanation: NIST cautions, "Because MAC addresses can be spoofed, assessors should not assume that the MAC addresses of discovered devices are accurate." The rogue device reports an authorized device's address, an instance of MAC spoofing.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 4.4.1, page 4-8

10. 10An assessor prepares an internal report after a security test. Which accompanying artifact describes specific, measurable actions to address the individual vulnerabilities?

    1. A.Rules of engagement
    2. B.Plan of action and milestonesCorrect answer: B
    3. C.System security plan
    4. D.Assessment methodology

    Explanation: NIST states, "A POA&M will ensure that individual vulnerabilities are addressed with specific, measurable, attainable, realistic, and tangible actions." This artifact records the corrective actions.

    Reference: Technical Guide to Information Security Testing and Assessment — Section 8.2, pages 8-1–8-2