PrepFree CEH practice test
20 original questions written by our editors against the official EC-Council exam domains. They are not real exam questions. Pick an answer to see why it is right or wrong.
-
Question 1 of 20Information Security and Ethical Hacking Overview
Before a penetration test of a client's network begins, what must the tester have in place first?
Show answer
Answer: C. Written authorization with a defined scope and rules of engagement is what separates ethical hacking from an attack. Credentials may be provided for some tests but are not a prerequisite, and anything outside the agreed scope, such as other organizations, is off limits.
-
Question 2 of 20Information Security and Ethical Hacking Overview
Which term describes a hacker who looks for vulnerabilities without permission and then reports them to the vendor without causing damage?
Show answer
Answer: B. A gray hat acts without authorization but without malicious intent. A white hat always works with permission, a black hat acts maliciously, and a script kiddie is defined by low skill, not by intent.
-
Question 3 of 20Reconnaissance Techniques
An analyst gathers information about a company only from its public website, job postings and search-engine results, never interacting with the company's systems directly. What type of reconnaissance is this?
Show answer
Answer: D. Passive reconnaissance collects information without touching the target's systems, mainly from public sources (OSINT). Active reconnaissance, scanning and enumeration all send traffic to the target.
-
Question 4 of 20Reconnaissance Techniques
Job postings for a company list specific firewall and database products it uses. Why does this matter to a security assessment?
Show answer
Answer: A. Technology details in job ads are valuable OSINT: they narrow down which products and versions to research. Being public is exactly why they are useful to attackers; they say nothing about compliance or individual permissions.
-
Question 5 of 20Reconnaissance Techniques
A port scan shows TCP port 443 open on a server. Which service is most likely listening there?
Show answer
Answer: C. TCP 443 is the standard port for HTTPS. SSH normally uses 22, SMTP 25 (or 587 for submission) and RDP 3389.
-
Question 6 of 20Reconnaissance Techniques
Which DNS record type would reveal the mail servers responsible for a domain during footprinting?
Show answer
Answer: B. MX records list a domain's mail exchangers. A records map names to IPv4 addresses, CNAME records are aliases, and TXT records hold free text such as SPF policies.
-
Question 7 of 20System Hacking Phases and Attack Techniques
What is the main goal of the privilege escalation phase in the ethical hacking methodology?
Show answer
Answer: D. Privilege escalation means moving from limited access to higher rights, such as administrator or root. Covering tracks, scanning and reporting are separate phases.
-
Question 8 of 20System Hacking Phases and Attack Techniques
Which control most directly limits the damage from password-cracking attacks against stolen password hashes?
Show answer
Answer: B. Salting defeats precomputed tables and a deliberately slow algorithm makes every guess expensive. A banner has no technical effect, HTTP weakens security, and disabling lockout helps online guessing rather than preventing it.
-
Question 9 of 20System Hacking Phases and Attack Techniques
Malware that disguises itself as a legitimate program to trick a user into running it is best described as what?
Show answer
Answer: A. A Trojan relies on deception to be executed. A worm spreads by itself, a rootkit hides presence at a low level, and ransomware is defined by encrypting data for extortion, although it may be delivered by a Trojan.
-
Question 10 of 20Network and Perimeter Hacking
An intrusion detection system raises an alert for traffic that turns out to be completely legitimate. What is this called?
Show answer
Answer: C. A false positive is an alert on benign activity. A false negative is a missed attack, which is usually the more dangerous error; true results are correct alerts or correct silence.
-
Question 11 of 20Network and Perimeter Hacking
Which network design places publicly accessible servers in a separate segment between the internet and the internal network?
Show answer
Answer: A. A DMZ isolates internet-facing servers so a compromise does not give direct access to the internal network. A honeynet is a decoy, an air gap means no network connection at all, and a trunk carries multiple VLANs between switches.
-
Question 12 of 20Network and Perimeter Hacking
An attacker floods a switch with frames carrying many fake source MAC addresses until the switch starts forwarding frames out of all ports. Which defence directly prevents this?
Show answer
Answer: D. This is MAC flooding of the switch's address table, and port security limits how many MAC addresses a port can learn. A WAF protects web apps, encryption protects data at rest, and ICMP is unrelated.
-
Question 13 of 20Network and Perimeter Hacking
Which type of denial-of-service attack uses many compromised machines at the same time?
Show answer
Answer: D. A DDoS uses many sources, often a botnet. SYN cookies are a defence against SYN floods, while session hijacking and ARP poisoning are attacks of different kinds.
-
Question 14 of 20Web Application Hacking
A login form passes user input straight into a database query. Which defence best prevents SQL injection?
Show answer
Answer: A. Parameterized queries keep data separate from code, so input cannot change the query's structure. Hiding errors and client-side checks can be bypassed, and changing the port does nothing against injection.
-
Question 15 of 20Web Application Hacking
A website displays user comments without encoding them, so a comment containing script runs in other visitors' browsers. Which vulnerability is this?
Show answer
Answer: B. Script saved on the server and run in other users' browsers is stored XSS, fixed with output encoding and input validation. CSRF abuses a victim's authenticated session, directory traversal reads files outside the web root, and SSRF makes the server send requests.
-
Question 16 of 20Wireless Network Hacking
Which wireless security protocol is current best practice for a new corporate Wi-Fi network?
Show answer
Answer: C. WPA3 is the current standard, adding protection against offline password guessing. WEP is broken, WPA and TKIP are deprecated.
-
Question 17 of 20Wireless Network Hacking
An attacker sets up an access point with the same network name as the company's Wi-Fi to lure employees into connecting. What is this attack called?
Show answer
Answer: A. An evil twin imitates a legitimate access point to intercept traffic. Bluejacking sends unsolicited Bluetooth messages, war driving is searching for networks, and jamming disrupts the radio signal.
-
Question 18 of 20Mobile Platform, IoT, and OT Hacking
Which practice most reduces the risk from IoT devices on a corporate network?
Show answer
Answer: C. Segmentation limits what a compromised device can reach, and default credentials are a common weakness. Sharing a VLAN with sensitive servers, skipping updates and exposing management interfaces all increase risk.
-
Question 19 of 20Cloud Computing
In the cloud shared responsibility model for infrastructure as a service (IaaS), who is responsible for patching the guest operating system on a virtual machine?
Show answer
Answer: C. In IaaS the provider secures the physical infrastructure and hypervisor, while the customer manages the guest OS, applications and data. Managed services shift more of this to the provider.
-
Question 20 of 20Cryptography
Which statement correctly describes hashing compared with encryption?
Show answer
Answer: B. A hash cannot be reversed and is used to verify integrity, for example of files or stored passwords. Encryption is designed to be decrypted with the correct key, and key pairs belong to asymmetric encryption and signatures, not to hashing itself.
| Exam domain | Correct |
|---|