Free Certified Ethical Hacker Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Ethical Hacker practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What distinguishes ethical hacking from unauthorized hacking when similar tools are used?

   1. A. The assessor has permission to test the target.
   2. B. The assessor uses only freely available tools.
   3. C. The assessor avoids documenting discovered weaknesses.
   4. D. The assessor tests only systems exposed to the Internet.

   Answer: A

   Explanation: The handbook describes testing computers "to which one has official permission to do so". Authorization distinguishes the activity; tool cost, documentation avoidance, and Internet exposure do not establish permission.

   Reference: CEH Candidate Handbook v7.3 — p. 4, What is the C|EH credential?

2. 2An assessor passively maps communications by observing traffic without sending probes. Why might an online host be absent from the resulting map?

   1. A. Its IP address must have been dynamically assigned.
   2. B. It did not send or receive traffic during observation.
   3. C. Its operating system does not support ICMP echo.
   4. D. It uses a TCP port above the well-known range.

   Answer: B

   Explanation: NIST notes that passive discovery can miss "hosts that do not send or receive traffic during the monitoring period". Dynamic addressing, ICMP support, and high TCP ports do not by themselves prevent observation of otherwise visible traffic.

   Reference: Technical Guide to Information Security Testing and Assessment (NIST SP 800-115) — §4.1, Network Discovery

3. 3How does vulnerability scanning extend basic port and service identification?

   1. A. It reports only whether a host responds to ICMP.
   2. B. It removes the need to interpret security findings.
   3. C. It attempts to identify weaknesses such as missing patches.
   4. D. It proves every identified weakness can be exploited.

   Answer: C

   Explanation: NIST states that vulnerability scanning can identify "outdated software versions, missing patches, and misconfigurations". An inventory of listening ports alone does not perform this vulnerability analysis, and scan matches are not exploitation proof.

   Reference: Technical Guide to Information Security Testing and Assessment (NIST SP 800-115) — §4.3, Vulnerability Scanning

4. 4Which Wireshark capture setting limits the number of bytes retained from each packet?

   1. A. Capture buffer size
   2. B. Promiscuous mode
   3. C. Capture-file ring buffer count
   4. D. Snapshot length

   Answer: D

   Explanation: The Wireshark guide defines Snaplen as "the number of bytes to capture for each packet." Capture buffering, number of ring-buffer files, and promiscuous reception affect different capture properties rather than the retained byte count per packet.

   Reference: Wireshark User's Guide — The Capture Options Dialog Box — Input tab — Snaplen

5. 5A patch is available for a production web server, but its compatibility has not been evaluated. Which preparation follows NIST's guidance for avoiding unexpected operational problems?

   1. A. Apply it first to production and wait for user complaints.
   2. B. Assume vendor publication guarantees application compatibility.
   3. C. Test it on another identically configured system.
   4. D. Postpone every patch until the server has been exploited.

   Answer: C

   Explanation: NIST advises against applying patches without "first testing them on another identically configured system". This evaluates compatibility before production changes; it does not justify indefinite delay.

   Reference: Guidelines on Securing Public Web Servers (NIST SP 800-44 Version 2) — §4.1.1, Patch and Upgrade Operating System

6. 6Which cipher underlies the legacy Wired Equivalent Privacy (WEP) mechanism?

   1. A. AES
   2. B. Triple DES
   3. C. RC4
   4. D. DES

   Answer: C

   Explanation: Microsoft describes WEP as "the RC4-based algorithm". This identifies the legacy mechanism, not a recommendation to deploy WEP; the other listed ciphers are not WEP's underlying cipher.

   Reference: Microsoft Native Wi-Fi — DOT11_CIPHER_ALGORITHM enumeration — Constants — DOT11_CIPHER_ALGO_WEP40

7. 7What is the basic identity mechanism Android uses to isolate app resources through Linux user-based protections?

   1. A. One shared user ID for all ordinary apps
   2. B. A process identifier used in place of user-based permission checks
   3. C. A unique user ID assigned to each app
   4. D. A human user's login ID shared by all apps belonging to that user

   Answer: C

   Explanation: Android assigns "a unique user ID (UID) to each Android app". Per-app identity underpins Linux user-based isolation. A process ID is not a substitute for UID permissions; one shared ordinary-app identity or a human user’s shared login identity does not provide per-app separation.

   Reference: Android Open Source Project — Application Sandbox — Application Sandbox, introductory explanation

8. 8Which capability is characteristic of Infrastructure as a Service under the NIST cloud service models?

   1. A. Using only the provider's application with limited user settings
   2. B. Deploying applications while the provider controls the operating system
   3. C. Installing and controlling a guest operating system on provisioned resources
   4. D. Owning and maintaining the provider's underlying physical servers

   Answer: C

   Explanation: For IaaS, NIST states that the consumer "has control over operating systems, storage, and deployed applications". SaaS and PaaS offer different control boundaries; IaaS does not give the consumer control of the underlying physical infrastructure.

   Reference: The NIST Definition of Cloud Computing (NIST SP 800-145) — Section 2, Service Models, IaaS, p. 3

9. 9What is the data block size of AES-256?

   1. A. 64 bits
   2. B. 128 bits
   3. C. 192 bits
   4. D. 256 bits

   Answer: B

   Explanation: FIPS 197 states: "The block size (i.e., the length of the data inputs and outputs) is 128 bits in each case." The 256 in AES-256 denotes key length, not block size; 192 is another AES key length and 64 is a different block-size misconception.

   Reference: Advanced Encryption Standard (AES), FIPS 197 — Section 1, Introduction

10. 10During a security assessment, which phase establishes scope, team responsibilities, limitations, and deliverables?

    1. A. Execution
    2. B. Planning
    3. C. Post-execution
    4. D. Remediation

    Answer: B

    Explanation: NIST states that planning addresses "goals and objectives, scope, requirements, team roles and responsibilities, limitations". These define how the assessment will proceed, before execution and subsequent analysis or remediation.

    Reference: Technical Guide to Information Security Testing and Assessment (NIST SP 800-115) — §2.1, Planning