EC-Council CEH (Certified Ethical Hacker) Practice Exam

What the EC-Council CEH (Certified Ethical Hacker) exam covers

• Information Security and Ethical Hacking Overview45 questions
• Reconnaissance Techniques161 questions
• System Hacking Phases and Attack Techniques129 questions
• Network and Perimeter Hacking206 questions
• Web Application Hacking131 questions
• Wireless Network Hacking41 questions
• Mobile Platform, IoT, and OT Hacking85 questions
• Cloud Computing45 questions
• Cryptography44 questions

Free EC-Council CEH (Certified Ethical Hacker) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 887.

1. Question 1Information Security and Ethical Hacking Overview

   In the CIA triad, which element is directly compromised when an attacker alters the amount field of a bank transfer message in transit without authorization?

   • AConfidentiality
   • BIntegrityCorrect
   • CAvailability
   • DNon-repudiation
   ✓ Correct answer: B

   Integrity ensures that data is not modified in an unauthorized or undetected manner. Changing the value of a transfer message tampers with the accuracy and trustworthiness of the data, which is precisely what integrity protects.

   Why the other options are wrong

   • AConfidentiality concerns preventing unauthorized disclosure or reading of data, not its modification.
   • CAvailability concerns ensuring systems and data are accessible when needed, which is not the issue when a value is silently changed.
   • DNon-repudiation is a supporting property (proof of origin/action) and is not one of the three core CIA triad elements.
2. Question 2Reconnaissance Techniques

   A UDP scan ('nmap -sU target') probes a port and receives no response after retransmissions. How does Nmap most commonly classify that port?

   • Aclosed
   • Bopen|filteredCorrect
   • Cunfiltered
   • Dopen
   ✓ Correct answer: B

   For UDP, a closed port typically returns an ICMP type 3 code 3 (port unreachable) message. When no response and no ICMP error arrive, Nmap cannot tell whether the port is open or filtered and marks it open|filtered. This ambiguity plus ICMP rate limiting makes UDP scanning slow.

   Why the other options are wrong

   • AA closed UDP port usually elicits an ICMP port-unreachable message, not silence.
   • C'unfiltered' is an ACK-scan state, not a UDP result.
   • D'open' requires a UDP response from the service; silence alone cannot confirm it.
3. Question 3Reconnaissance Techniques

   Which of the following is the typical FIRST phase of the vulnerability management lifecycle?

   • ARemediation of the confirmed and prioritized scan findings
   • BAsset discovery and identification to build an inventoryCorrect
   • CVerification that the applied fixes were successful
   • DPublishing the final summary report to the executive team
   ✓ Correct answer: B

   You cannot protect what you do not know exists, so the vulnerability management lifecycle starts by discovering and inventorying assets to establish the scope of what will be assessed. Only after assets are identified and categorized can the process proceed to scanning, risk assessment, prioritization, remediation, and verification. This ordering ensures no in-scope system is overlooked.

   Why the other options are wrong

   • ARemediation occurs after vulnerabilities have been discovered, assessed, and prioritized, not first.
   • CVerification is a later phase that confirms remediation succeeded.
   • DReporting to executives happens after assessment and analysis, not as the first phase.
4. Question 4System Hacking Phases and Attack TechniquesSelect all that apply

   Which of the following are recognized indicators of compromise (IOCs) that a defender might use to detect malware activity? (Choose three.)

   • AKnown-malicious file hashes (MD5/SHA-256)Correct
   • BConnections to known command-and-control domains or IP addressesCorrect
   • CThe retail price of the antivirus product
   • DUnusual registry Run-key entries or scheduled tasks created for persistenceCorrect
   • EThe color scheme of the corporate website
   ✓ Correct answer: A, B, D

   IOCs are observable forensic artifacts of compromise. File hashes match known-bad samples; connections to known C2 domains/IPs reveal active infections; and unusual persistence mechanisms (registry Run keys, scheduled tasks, new services) indicate malware maintaining a foothold. Defenders feed these into detection tooling and threat intel.

   Why the other options are wrong

   • CThe retail price of an antivirus product is a commercial detail, not evidence that a system is compromised.
   • EA website's color scheme is a cosmetic design attribute and has no bearing on detecting malware.
5. Question 5Network and Perimeter Hacking

   An employee receives a text message on their mobile phone stating a package could not be delivered and containing a shortened link to 'reschedule' delivery. Which social engineering technique is being used?

   • AVishing
   • BSmishingCorrect
   • CWhaling
   • DQuid pro quo
   ✓ Correct answer: B

   Smishing (SMS phishing) sends fraudulent text messages containing malicious links or requests. The mobile SMS delivery channel is what classifies this attack, as opposed to email or voice.

   Why the other options are wrong

   • AVishing uses voice calls, not text messages.
   • CWhaling targets executives specifically and is typically email-based; this is a generic SMS lure.
   • DQuid pro quo offers a service or benefit in exchange for information; this message offers no such exchange.
6. Question 6Web Application Hacking

   Which tool is commonly used to scan a web server for known vulnerabilities, misconfigurations, outdated software, and dangerous default files?

   • ANiktoCorrect
   • BWireshark
   • CJohn the Ripper
   • DCain and Abel
   ✓ Correct answer: A

   Nikto performs comprehensive tests against web servers, flagging outdated versions, dangerous default and sample files, insecure configurations, and known issues. Ethical hackers use it during assessments to identify hardening gaps. It is noisy and intended for authorized testing.

   Why the other options are wrong

   • BWireshark is a packet capture and protocol analyzer, not a web server vulnerability scanner.
   • CJohn the Ripper is a password cracking tool, not a web scanner.
   • DCain and Abel is a Windows password recovery and sniffing tool, not a web server scanner.
7. Question 7Web Application Hacking

   Which of the following is a reliable indicator that an application is likely using parameterized queries correctly, from a tester's black-box perspective?

   • ACharacters like single quotes are treated as literal data and do not alter query behavior or trigger errorsCorrect
   • BThe application returns verbose database error messages and full stack traces for almost any malformed input
   • CThe application's overall response time grows in direct proportion to the character length of the supplied input
   • DThe application accepts a crafted UNION SELECT payload and returns additional merged rows from other tables
   ✓ Correct answer: A

   When parameterized queries are used correctly, user input is bound as data and can never modify the query structure. From a black-box view, this shows up as special characters such as single quotes being stored and returned as literal values without producing SQL syntax errors, boolean differences, or timing effects tied to injected logic. Consistent immunity to a battery of injection probes is the practical signal that binding is in place.

   Why the other options are wrong

   • BVerbose SQL errors on odd input suggest raw concatenation, the opposite of correct parameterization.
   • CResponse time scaling with input length is not an indicator of safe parameterized queries.
   • DAccepting UNION SELECT and merging rows indicates an exploitable injection, not proper parameterization.
8. Question 8Mobile Platform, IoT, and OT Hacking

   In the context of mobile threats, what does 'reverse engineering' of a mobile application typically allow an attacker to do?

   • APhysically repair a cracked or broken display panel on the target mobile device
   • BAnalyze the app's code and logic to find secrets, hardcoded keys, or weaknesses to exploitCorrect
   • CPermanently increase the physical battery storage capacity of the mobile device
   • DRaise the app's official star rating and ranking within the public app store listing
   ✓ Correct answer: B

   By decompiling or disassembling a mobile app's binary, an attacker can study its business logic, discover hardcoded credentials or API keys, understand how it validates input or licenses, and identify weak spots to exploit or to build a repackaged trojan. The OWASP Mobile Top 10 lists Reverse Engineering as a risk, with mitigations such as code obfuscation, removing secrets from the client, and shifting sensitive logic and validation to the server.

   Why the other options are wrong

   • AReverse engineering examines software; it does not perform physical hardware repair.
   • CBattery capacity is a hardware property and is unaffected by analyzing app code.
   • DReverse engineering does not influence an app's store rating or ranking.
9. Question 9Cloud Computing

   A security team wants to detect and remediate cloud identities (human and machine) that have excessive or unused permissions. Which capability is designed for this?

   • AContent Delivery Network (CDN) edge caching
   • BCloud Infrastructure Entitlement Management (CIEM)Correct
   • CWeb Application Firewall (WAF) traffic filtering
   • DDNS sinkholing of malicious domains
   ✓ Correct answer: B

   Cloud Infrastructure Entitlement Management focuses on visibility and governance of identities and their permissions across cloud environments. It analyzes granted versus used permissions to identify over-privileged or unused entitlements for both human users and machine identities, helping enforce least privilege at scale. CIEM directly addresses the identity/permission failures that are a top cloud risk and is often part of a CNAPP.

   Why the other options are wrong

   • AA CDN caches and delivers content; it does not manage entitlements.
   • CA WAF filters web application traffic; it does not analyze cloud identity permissions.
   • DDNS sinkholing redirects malicious domain resolution; it is unrelated to entitlement management.
10. Question 10Network and Perimeter Hacking

    A switch on an access VLAN is being poisoned by a rogue host that answers DHCP requests before the legitimate server. Which switch feature blocks unauthorized DHCP offers by trusting only designated uplink ports?

    • ADHCP snoopingCorrect
    • BPort security
    • CBPDU guard
    • DStorm control
    ✓ Correct answer: A

    DHCP snooping lets the switch treat only uplink ports facing the real DHCP server as trusted, and it silently drops DHCPOFFER/DHCPACK messages arriving on untrusted access ports. This stops a rogue DHCP server from handing clients a malicious gateway or DNS. It also builds the binding table that Dynamic ARP Inspection relies on.

    Why the other options are wrong

    • BPort security limits how many MAC addresses appear on a port; it does not distinguish DHCP server messages from client messages.
    • CBPDU guard shuts a port that receives spanning-tree BPDUs, addressing rogue switches, not rogue DHCP servers.
    • DStorm control rate-limits broadcast/multicast floods; it does not inspect or filter DHCP message direction.

Who this EC-Council CEH (Certified Ethical Hacker) practice exam is for

This practice set is for anyone preparing for the EC-Council CEH (Certified Ethical Hacker) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this EC-Council CEH (Certified Ethical Hacker) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real EC-Council CEH (Certified Ethical Hacker) exam.

Related Security resources

• EC-Council CEH (Certified Ethical Hacker) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated

EC-Council CEH (Certified Ethical Hacker) practice exam FAQ