Free Questions

Free CEH practice

20 free CEH practice questions

Twenty original scenarios for the EC-Council Certified Ethical Hacker knowledge exam (312-50), split across the nine blueprint domains in proportion to EC-Council's published question counts. It is a short original preview that cannot match the real exam's length, topic mix, or difficulty, and a percentage here is not an EC-Council cut score.

Start question 1
Quick PracticeQuestion 1 of 20
Your progress through this set
Information Security and Ethical Hacking OverviewStep 1 · Choose one answer

During an authorized external penetration test, a tester finds a mail server whose IP address is on the client's exclude list in the signed rules of engagement. The server appears to run an outdated service. What should the tester do?

Question review

All 20 CEH questions with explanations

Try the set above first, then use this list to review. Each answer and explanation stays closed until you open it.

  1. Question 1 · Information Security and Ethical Hacking Overview

    During an authorized external penetration test, a tester finds a mail server whose IP address is on the client's exclude list in the signed rules of engagement. The server appears to run an outdated service. What should the tester do?

    1. Run a quick vulnerability scan to confirm the finding before reporting it
    2. Leave it untested and raise it with the client's point of contact
    3. Test it lightly, since the rest of the client's network is in scope
    4. Add it to the scope, since an outdated service puts the client at risk
    Show answer and explanation for question 1

    Correct answer: B · Leave it untested and raise it with the client's point of contact

    NIST SP 800-115's rules of engagement template asks the test plan to identify every system not authorized for testing, the exclude list, and to detail allowable and unallowable activities, and senior management signs to confirm the scope and boundaries. A host on that list is outside the tester's authorization, whatever it seems to run, so the tester leaves it alone and raises the observation with the client's point of contact, who decides whether to change the scope. A quick scan or light testing is still testing without authorization. Testers cannot add a system to the scope on their own judgment; only the client can.

    Look for this next time: Authorization defines ethical hacking: a system on the exclude list stays untested until the client changes the authorized scope.

  2. Question 2 · Reconnaissance Techniques

    A tester must identify active hosts on a plant-floor network segment where the client forbids sending any probe packets. The tester connects a laptop to a mirrored switch port and records traffic for two hours. Which limitation of this approach should the report state?

    1. It sends probes that may slow down the busiest devices on the segment
    2. It finds every host on the segment but cannot show which ports they use
    3. It cannot run during working hours, because it needs an idle network
    4. Hosts that send no traffic during the capture window may not be found
    Show answer and explanation for question 2

    Correct answer: D · Hosts that send no traffic during the capture window may not be found

    NIST SP 800-115 describes passive discovery as using a network sniffer to record the addresses of active hosts, and the ports and operating systems in use, without sending out a single probing packet. It also names the trade-off: passive discovery takes more time than active discovery, and hosts that do not send or receive traffic during the monitoring period might not be reported. Sending probes describes active discovery, which the client forbids. Passive monitoring does not guarantee that every host appears, and it can report ports in use. It also needs no idle network, because it watches the traffic that normal work produces.

    Look for this next time: Passive discovery sends no probes, but it is slower and can miss hosts that stay silent while you listen.

  3. Question 3 · Reconnaissance Techniques

    An IDS log shows one external address sending TCP SYN packets to hundreds of ports on a web server within a minute. Wherever the server answered with SYN/ACK, the next packet from that address was a RST, so no connection was ever completed. Which scan type does this pattern match?

    1. A TCP SYN scan, which is also known as half-open scanning
    2. A TCP connect scan, which completes each open connection
    3. A UDP scan, which checks for services such as DNS and SNMP
    4. A ping sweep, which sends ICMP echo requests to find hosts
    Show answer and explanation for question 3

    Correct answer: A · A TCP SYN scan, which is also known as half-open scanning

    Nmap's reference guide calls SYN scan half-open scanning because it never opens a full TCP connection: it sends a SYN, reads a SYN/ACK as a listening port and a RST as a non-listener, and never completes the handshake. A connect scan instead asks the operating system to establish each connection through the connect system call, so open ports would see completed connections, which the log does not show. A UDP scan sends UDP datagrams, not TCP SYN packets. A ping sweep looks for live hosts across addresses, not hundreds of ports on one server.

    Look for this next time: SYN packets answered by SYN/ACK and then reset, with no completed handshake, point to a half-open SYN scan.

  4. Question 4 · Reconnaissance Techniques

    During enumeration, a tester finds that the client's network switches answer SNMPv2c queries that use an easily guessed community string, and the replies list device and interface details. Which recommendation addresses the root weakness?

    1. Change the community string every quarter and keep SNMPv2c running
    2. Move SNMP to a nonstandard UDP port so scans are less likely to find it
    3. Migrate to SNMPv3 with authentication and privacy set for each user
    4. Block ICMP echo requests to the switches at the perimeter firewall
    Show answer and explanation for question 4

    Correct answer: C · Migrate to SNMPv3 with authentication and privacy set for each user

    RFC 3410 states that SNMPv1 and SNMPv2c support only trivial authentication based on plain-text community strings and are, as a result, fundamentally insecure. SNMPv3's User-based Security Model, defined in RFC 3414, adds per-user authentication and a privacy service that protects message contents. Rotating the community string keeps the plain-text design, so a captured or guessed string works until the next change. A nonstandard port hides the service only from scans that skip that port. Blocking ICMP echo does nothing to SNMP queries, which travel over UDP.

    Look for this next time: SNMPv1 and v2c rely on plain-text community strings; SNMPv3 with authentication and privacy fixes the design.

  5. Question 5 · System Hacking Phases and Attack Techniques

    A client's automated vulnerability scan lists 340 findings on its internal servers. The security manager asks the ethical hacker what a penetration test would add to the scan report. Which answer is accurate?

    1. It repeats the scan with more plug-ins, so the report lists more flaws
    2. It replaces patching, because exploited flaws are fixed during the test
    3. It tries to prove which findings can be exploited, and their impact
    4. It removes the need to interpret results, because testers score them
    Show answer and explanation for question 5

    Correct answer: C · It tries to prove which findings can be exploited, and their impact

    NIST SP 800-115 says vulnerability scanners identify hosts, open ports, and known vulnerabilities but can have a high false positive rate, so an expert should interpret the results. Its target vulnerability validation techniques, which include penetration testing, aim to prove that a vulnerability exists and to demonstrate the security exposures that occur when it is exploited. A penetration test is not a bigger scan. Testing fixes nothing: remediation still follows the report. Interpretation also remains part of the work, since NIST tells assessors to set each vulnerability's risk level rather than accept the scanner's.

    Look for this next time: A scan lists possible weaknesses; a penetration test tries to prove which ones are exploitable and what that exposes.

  6. Question 6 · System Hacking Phases and Attack Techniques

    After a breach, a company learns that its web app stored user passwords as plain, unsalted MD5 hashes, so users with the same password had the same hash. Which storage change follows current NIST guidance?

    1. Salt each password and hash it with a password hashing scheme that has a cost factor
    2. Switch from MD5 to SHA-256 and use one shared salt for every stored password
    3. Encrypt the passwords with AES and keep the key on the same database server
    4. Keep MD5 but require every user to change their password every 30 days
    Show answer and explanation for question 6

    Correct answer: A · Salt each password and hash it with a password hashing scheme that has a cost factor

    NIST SP 800-63B (Revision 4) says verifiers shall store passwords in a form resistant to offline attacks: salted and hashed with a suitable password hashing scheme, which takes a password, a salt, and a cost factor and makes each guess more expensive. It requires a salt of at least 32 bits chosen to minimize collisions, so that accounts with the same password do not share a hash, and one shared salt fails that test. Reversible encryption with the key on the same server hands an attacker who takes the server both. Forced changes leave the weak storage in place, and the same guidance says verifiers shall not require periodic password changes.

    Look for this next time: Store passwords salted and hashed with a slow, cost-based scheme; a unique salt per password stops identical hashes.

  7. Question 7 · System Hacking Phases and Attack Techniques

    A malicious program spreads across a company network overnight by copying itself from server to server through an unpatched network service. No user opened a file or ran a program on any of the infected servers. Which malware type matches this behavior best?

    1. A Trojan horse, disguised as useful software that a user installs
    2. A file-infecting virus, which spreads when users run infected programs
    3. A rootkit, a set of files that hides an attacker's presence on one host
    4. A worm, a self-contained program that copies itself without user action
    Show answer and explanation for question 7

    Correct answer: D · A worm, a self-contained program that copies itself without user action

    NIST SP 800-83 Revision 1 defines a worm as a self-replicating, self-contained program that usually executes itself without user intervention. A virus self-replicates by inserting copies of itself into host programs or data files and is often triggered through user interaction such as opening a file or running a program, which the stem rules out. A Trojan horse is self-contained but nonreplicating, so it would not copy itself between servers. A rootkit is a collection of files installed on a host to alter its normal functions stealthily; hiding activity on one host does not explain the spread.

    Look for this next time: A worm spreads by itself across systems; a virus needs a host file and usually a user's action.

  8. Question 8 · Network and Perimeter Hacking

    Several workstations on one access switch suddenly map the default gateway's IP address to the MAC address of a desktop in the same VLAN, and some unencrypted traffic is now relayed through that desktop. Which switch feature is designed to block this?

    1. Port mirroring, so the IDS sees copies of the traffic from every port
    2. DHCP snooping with Dynamic ARP Inspection, to drop forged ARP replies
    3. A larger MAC address table, so the switch can track more devices
    4. Spanning Tree Protocol, so the switch prevents loops between ports
    Show answer and explanation for question 8

    Correct answer: B · DHCP snooping with Dynamic ARP Inspection, to drop forged ARP replies

    The pattern is ARP cache poisoning: forged ARP replies tie the gateway's IP address to another host's MAC address, so traffic passes through that host. MITRE ATT&CK's entry for ARP cache poisoning (T1557.002) suggests enabling DHCP snooping and Dynamic ARP Inspection on switches, which bind DHCP-assigned addresses to switch ports and may block bogus ARP traffic, and it also recommends encrypting sensitive traffic. Port mirroring copies traffic for monitoring but blocks nothing. A larger MAC address table does not check whether an ARP reply is genuine. Spanning Tree prevents switching loops, a different problem.

    Look for this next time: Forged ARP replies that redirect gateway traffic are ARP poisoning; Dynamic ARP Inspection with DHCP snooping is the switch-side control.

  9. Question 9 · Network and Perimeter Hacking

    A caller tells the help desk he is a regional vice president about to board a flight. He gives a correct employee ID number and demands an immediate password reset, with the new password read to him over the phone. Which response follows sound security practice?

    1. Verify him by the documented procedure, such as a callback to the number on file
    2. Reset it, because a correct employee ID shows the caller is that person
    3. Reset it, but require him to choose a new password at the next sign-in
    4. Send the new password to a personal email address that the caller gives
    Show answer and explanation for question 9

    Correct answer: A · Verify him by the documented procedure, such as a callback to the number on file

    NIST SP 800-115 names calling the help desk while posing as a user and asking for a password reset as a social engineering technique, and says social engineering reveals weaknesses such as failing to follow standard procedures. Urgency, seniority, and one correct detail are pressure, not proof of identity. The sound step is the organization's documented verification, such as calling back a number already on file. Forcing a change at the next sign-in still hands the account to whoever is on the phone. Sending the password to an address the caller chooses gives it to a person no one has verified.

    Look for this next time: Urgent reset requests by phone get the documented identity check, however senior or rushed the caller sounds.

  10. Question 10 · Network and Perimeter Hacking

    A public web server's TCP backlog fills with half-open connections from thousands of spoofed source addresses, and legitimate users can no longer connect, although bandwidth use stays moderate. Which server-side defense is designed for this attack?

    1. Closing port 443 until the attack ends, so the backlog can drain
    2. Disabling ICMP echo replies, so attackers cannot ping the server
    3. Enabling SYN cookies, so no state is held for half-open requests
    4. Raising the session timeout, so users stay signed in for longer
    Show answer and explanation for question 10

    Correct answer: C · Enabling SYN cookies, so no state is held for half-open requests

    RFC 4987 describes TCP SYN flooding: spoofed SYNs fill the limited backlog of connections waiting in the SYN-RECEIVED state, so new requests are ignored or replace older ones. SYN cookies allocate no state at all for connections in SYN-RECEIVED; they encode the needed state in the sequence number of the SYN-ACK and rebuild it only when a real ACK completes the handshake. Closing the service port shuts out legitimate users as well. Disabling ICMP echo replies has no effect on TCP SYN segments. A longer session timeout concerns signed-in application sessions, not the half-open TCP backlog.

    Look for this next time: A backlog full of half-open connections from spoofed sources is a SYN flood; SYN cookies avoid holding state for them.

  11. Question 11 · Network and Perimeter Hacking

    A penetration tester shows that a web application keeps the same session ID before and after a user signs in, so an ID planted in a victim's browser before sign-in still works afterward. Which fix addresses this session fixation weakness?

    1. Make the session ID longer, while keeping the same ID after sign-in
    2. Move the session ID into the URL, so users can see when it changes
    3. Raise the idle timeout, so sessions expire less often during work
    4. Issue a new session ID at sign-in and at every privilege change
    Show answer and explanation for question 11

    Correct answer: D · Issue a new session ID at sign-in and at every privilege change

    OWASP's Session Management Cheat Sheet says the session ID must be renewed or regenerated after any privilege level change, most commonly at authentication, and that this regeneration is mandatory to prevent session fixation. A longer ID resists guessing but does nothing when the attacker already knows the ID. OWASP warns that IDs carried in URLs can leak through links, logs, browser history, and the Referer header, and advises refusing IDs sent that way as a defense against fixation. A longer idle timeout gives a planted ID more time to be used, not less.

    Look for this next time: Regenerate the session ID at sign-in and at every privilege change, so an ID set before login is worthless after it.

  12. Question 12 · Network and Perimeter Hacking

    A company's IDS matches traffic against patterns of known attacks. The SOC wants it to also flag unusual behavior it has never seen before, such as a host suddenly sending far more email than its normal baseline. Which detection method adds that capability?

    1. Signature-based detection, with a faster signature update schedule
    2. Anomaly-based detection, comparing activity with a normal profile
    3. Port mirroring, so the sensor receives copies of more traffic flows
    4. A honeypot, placed on the network to log scans aimed at the decoy
    Show answer and explanation for question 12

    Correct answer: B · Anomaly-based detection, comparing activity with a normal profile

    NIST SP 800-94 defines signature-based detection as comparing activity with patterns that correspond to known threats: very effective against known threats but largely ineffective against previously unknown ones. Anomaly-based detection compares observed events with profiles of normal behavior built over time, such as the number of emails a user sends, and NIST names its major benefit as detecting previously unknown threats. Faster signature updates still cover only known patterns. Port mirroring changes what the sensor sees, not how it decides what is suspicious. A honeypot records activity aimed at a decoy, not deviations on production hosts.

    Look for this next time: Signatures catch known attacks; anomaly-based detection compares activity with a learned normal profile to catch new ones.

  13. Question 13 · Web Application Hacking

    When a request fails, a company's web server returns a page with a full stack trace that names the application framework and its exact version. Which hardening step addresses this finding?

    1. Move the site to a different port, so the error page is harder to reach
    2. Add a CAPTCHA to the site, so automated tools cannot trigger the error
    3. Show users a generic error page and keep the details in server logs
    4. Turn on verbose logging, so the error page also shows the request ID
    Show answer and explanation for question 13

    Correct answer: C · Show users a generic error page and keep the details in server logs

    OWASP's Top 10:2025 lists error handling that reveals stack traces or other overly informative error messages under security misconfiguration, with the example of an application server whose detailed stack traces expose component versions that may be known to be vulnerable. Its prevention advice adds a central configuration that intercepts excessive error messages; in practice, users then see a generic page while the details stay in server logs. A different port or a CAPTCHA leaves the same details visible to anyone who triggers an error. Putting more detail on the error page adds information instead of removing it.

    Look for this next time: Stack traces on public error pages are a misconfiguration; show a generic message and keep the details server-side.

  14. Question 14 · Web Application Hacking

    A tester signed in as customer 1043 changes the URL /account?id=1043 to /account?id=1044 and sees another customer's billing details. Which risk category and fix fit this finding?

    1. Broken access control: check on the server that the user owns the record
    2. Cross-site scripting: encode output so scripts cannot run in the page
    3. Cryptographic failure: encrypt the account ID in the URL with a strong key
    4. Security misconfiguration: disable directory listing on the web server
    Show answer and explanation for question 14

    Correct answer: A · Broken access control: check on the server that the user owns the record

    OWASP's Top 10:2025 lists permitting viewing or editing someone else's account by providing its unique identifier, an insecure direct object reference, under broken access control, along with bypassing checks by modifying the URL. Its prevention advice is to enforce access control on the server and to have access controls enforce record ownership, so the application must confirm that the signed-in user may see record 1044. Output encoding addresses cross-site scripting, which the stem does not show. Encrypting the ID only hides the number; without an ownership check, another valid ID would still work. Directory listing concerns browsing folders, not record IDs.

    Look for this next time: Changing an ID to reach another user's record is broken access control; the server must check ownership on every request.

  15. Question 15 · Web Application Hacking

    A code review finds a login query built by joining the username field directly into a SQL string. The developer proposes escaping the quote characters in that input. What does OWASP recommend as the primary defense instead?

    1. Hiding database error messages so testers cannot see the query fail
    2. A firewall rule that blocks every request containing a quote mark
    3. Browser-side JavaScript that rejects usernames with special symbols
    4. Prepared statements with parameterized queries for each input value
    Show answer and explanation for question 15

    Correct answer: D · Prepared statements with parameterized queries for each input value

    OWASP's SQL Injection Prevention Cheat Sheet lists prepared statements with parameterized queries as the first primary defense and marks escaping all dynamic inputs as strongly discouraged. Parameters keep user input as data, so it cannot change the structure of the query. Hiding error messages removes clues but leaves the injection in place. A rule that blocks every quote mark filters requests instead of fixing the query, and it also rejects legitimate names such as O'Brien. Browser-side checks run on the user's machine, so anyone who sends requests to the server directly skips them.

    Look for this next time: Parameterized queries keep input as data; escaping and filters are weaker substitutes for fixing how the query is built.

  16. Question 16 · Wireless Network Hacking

    A small office's Wi-Fi uses WPA2-Personal with a short shared password, and an assessment shows the password could be guessed. Every device in the office is Wi-Fi CERTIFIED for WPA3. Which change most improves protection against password guessing?

    1. Hide the network name, so the SSID no longer appears in scan lists
    2. Move to WPA3-Personal and set a long, unique password for the network
    3. Allow only known MAC addresses and keep the current WPA2 password
    4. Lower the access point's power, so the signal stays inside the office
    Show answer and explanation for question 16

    Correct answer: B · Move to WPA3-Personal and set a long, unique password for the network

    The Wi-Fi Alliance says WPA3 is mandatory for Wi-Fi CERTIFIED devices and that users of WPA3-Personal receive increased protections from password guessing attempts, and a long, unique password adds to the effort a guesser faces. Hiding the network name and filtering MAC addresses leave the same short WPA2 password and the same protocol in place, so the guessing risk the assessment found stays as it was. Lowering transmit power shrinks the coverage area, but it does not change the password or how the network protects it.

    Look for this next time: Against password guessing on Wi-Fi, a stronger protocol (WPA3-Personal) and a long password help; hiding the SSID does not.

  17. Question 17 · Mobile Platform, IoT, and OT Hacking

    Employees enroll company phones in the organization's enterprise mobility management (EMM) system, and several have installed apps from unknown sources outside the official app stores. Which EMM policy addresses this risk most directly?

    1. Restrict sideloading and allow only approved apps from official stores
    2. Require a longer device passcode and a shorter screen lock timeout
    3. Turn on remote wipe, so a lost phone can be erased after a report
    4. Require a VPN on every phone, so app traffic crosses the company network
    Show answer and explanation for question 17

    Correct answer: A · Restrict sideloading and allow only approved apps from official stores

    NIST SP 800-124 Revision 2 says sideloading apps from untrusted or unknown sources poses significant security risks, and it lists EMM restrictions that limit which app stores may be used, restrict sideloading, and allowlist approved apps, which it calls preferable to blocklisting. A stronger passcode and remote wipe protect a lost or stolen phone, not a phone that is running an untrusted app. A VPN protects traffic in transit, but it does not stop a malicious app from being installed or from running on the device.

    Look for this next time: Apps from unknown sources are a mobile malware risk; EMM policies that restrict sideloading and allowlist apps address it.

  18. Question 18 · Mobile Platform, IoT, and OT Hacking

    A facilities team installs 60 network cameras that all ship with the same factory default administrator password, and the cameras' web interfaces are reachable from the corporate network. What should the team do first?

    1. Keep the default password, since the cameras sit behind the firewall
    2. Write the default password on each camera so technicians can find it
    3. Wait for the next firmware release, which may remove the default login
    4. Replace the shared default with a unique, strong password on each camera
    Show answer and explanation for question 18

    Correct answer: D · Replace the shared default with a unique, strong password on each camera

    CISA's Secure by Design alert on default passwords urges manufacturers to eliminate static default passwords so that they cannot be exploited in customers' systems. When a device still ships with one, replacing it with a unique, strong credential for each device removes the single shared secret that would open all 60 cameras at once. The perimeter firewall does not protect the interfaces from devices already on the corporate network, where they are reachable. Writing the password on each camera spreads it further, and waiting for a firmware release leaves the cameras exposed in the meantime.

    Look for this next time: A shared factory default password on IoT devices is replaced with a unique, strong credential per device before use.

  19. Question 19 · Cloud Computing

    A company stores customer files in an Amazon S3 bucket. An assessment finds that the bucket's permissions let anyone on the internet read its contents. Under the AWS Shared Responsibility Model, who is responsible for fixing this?

    1. AWS, because it operates the storage infrastructure for the service
    2. Both parties equally, because the data is stored in the AWS cloud
    3. The customer, because it manages its own data and its access settings
    4. Nobody, because S3 buckets are meant to be readable by the public
    Show answer and explanation for question 19

    Correct answer: C · The customer, because it manages its own data and its access settings

    AWS describes the model as AWS being responsible for security of the cloud and the customer for security in the cloud. For abstracted services such as Amazon S3, AWS operates the infrastructure layer, the operating system, and the platform, while customers are responsible for managing their data, classifying their assets, and using IAM tools to apply the appropriate permissions. A bucket readable by anyone is a permissions setting, so it falls to the customer. Shared responsibility does not split every task equally, and public access is a configuration choice rather than the purpose of the service.

    Look for this next time: In the shared responsibility model, the provider secures the cloud itself; the customer secures its data and access settings.

  20. Question 20 · Cryptography

    A developer wants to sign a software release so that anyone can confirm the file came from the developer and was not altered. Which key creates the digital signature, and which key do recipients use to verify it?

    1. The developer's public key signs it; recipients verify with the private key
    2. The developer's private key signs it; recipients verify with the public key
    3. Each recipient's public key signs it; each verifies with a private key
    4. One shared secret key signs it; recipients verify with that same key
    Show answer and explanation for question 20

    Correct answer: B · The developer's private key signs it; recipients verify with the public key

    FIPS 186-5 says signature generation uses a private key and signature verification uses the corresponding public key. Private keys must be kept secret, public keys may be known by anyone, and only the holder of the private key can generate the signature, which ties the release to the developer. If a public key created signatures, anyone could forge them. Using recipients' public keys is how data is encrypted for them, which gives confidentiality, not proof of origin. A key shared by everyone lets every holder create the same value, so it cannot show which of them signed.

    Look for this next time: Sign with your private key; anyone can verify with your public key, and only you could have made the signature.

Use the sample well

The rationale matters more than the score.

A short set can show you what deserves another look. A strong run shows you can match a technique to its phase and pick the countermeasure that fits. Twenty questions are a small sample, so the result does not predict a pass on a form whose cut score EC-Council sets between 60% and 85%.

01

Answer before reviewing

Pick the one answer that fits every condition in the scenario. Then read why each other option falls short.

02

Read every rationale

Confirm why the best option fits, even when you were right.

03

Follow the pattern

Use recurring misses—not one score—to choose your next focus.

Want the wider map? Read What each CEH domain covers.

Free CEH resources

Choose your next step.

Keep practicing, build a study plan, or browse the CEH guides.

20 original questions

Try free practice

Answer 20 original questions and learn from every rationale.

Start practice Practical planning aid

Build a study plan

Turn the time you have into a clear study rhythm.

Build my outline Source-backed answers

Browse CEH guides

Go straight to the question already on your mind.

Browse guides