Ethical Hacking CEH 2025 — 60 Practice Questions Penetration
Testing Verified
Series:
CrashCourses Professional Study Series
Author:
Dr Z. Moomba, MBChB, MRCPsych | BethelWellness Ltd
Exam Target:
EC-Council CEH
Year:
2025/2026
Format:
60 Questions with Verified Answers and Rationales
>
Author's Note:
This document is an original work produced for the CrashCourses Professional Study Series.
Clinical questions and professional scenarios were composed by Dr Z. Moomba based on current
exam objectives, published guidelines, and evidence-based sources (2024–2025). All patient
names, ages, and case details are fictional. Any resemblance to existing published Q&A banks is
coincidental. For personal study use only — not for reproduction or redistribution.
PART 1: CORE PRINCIPLES & FOUNDATIONS
1. An ethical hacker is undertaking non-intrusive reconnaissance on a regional trust's external-facing
assets. Their objective is to harvest associated subdomains and staff email addresses without
sending packets to the trust's actual servers. Which utility is the optimal choice for this requirement?
A. Nmap network mapper
B. theHarvester utility
C. Nessus vulnerability scanner
D. OpenVAS platform
Answer: B
,Rationale:
Lead: theHarvester is a specialized OSINT tool designed to aggregate emails, subdomains, and
employee data from public search engines and databases.
Discriminator: The requirement for "non-intrusive reconnaissance" (passive footprinting)
makes theHarvester the only correct tool, as it queries third-party indexes rather than the
target.
Distractor: Nmap fails here because it actively sends packets to the target's infrastructure,
violating the passive constraint.
High-Yield Point: Passive footprinting ensures no alerts are triggered on the target's intrusion
detection systems, forming the crucial first phase of stealth engagements. [NIST SP 800-115]
2. While conducting an internal compliance check on a private clinic's network, an auditor needs to
identify the underlying operating systems powering various connected diagnostic machines using
Nmap. Which specific parameter forces Nmap to perform this OS detection?
A. -sS
B. -sV
C. -O
D. -p-
Answer: C
Rationale:
Lead: The `-O` parameter in Nmap explicitly triggers operating system fingerprinting by
analyzing TCP/UDP packet responses against a known database.
Discriminator: The prompt specifically asks for the parameter that determines the "operating
systems," which maps directly to `-O`.
Distractor: The `-sV` flag attempts to determine the version of the service running on an open
port, not the host operating system itself.
Examiner Insight: Nmap's OS fingerprinting relies on subtle differences in how various
operating systems implement the TCP/IP stack, such as initial TTL values and TCP window
sizes. [Nmap Reference Guide 2025]
3. A red teamer utilizes a popular search engine to locate unsecured administrative portals belonging
to a target medical supplier. They input the query `site:target-medical.com intitle:"index of" /admin`.
Which reconnaissance methodology is demonstrated here?
A. Google Dorking / Hacking
B. DNS Zone Transfer enumeration
, C. Automated Web Crawling
D. Directory Path Traversal
Answer: A
Rationale:
Lead: Google Dorking utilizes advanced search operators to uncover sensitive data,
misconfigurations, or hidden directories that have been inadvertently indexed.
Discriminator: The explicit use of search operators like `site:` and `intitle:` perfectly defines a
Google Dork.
Distractor: Directory Path Traversal is an active exploit involving manipulating file paths (e.g.,
`../../`), whereas this is passive OSINT.
Key Principle: The Google Hacking Database (GHDB) is continually updated with strings
designed to expose vulnerable IoT devices and database backups. [OWASP Information
Gathering 2025]
4. A cybersecurity analyst is hired to uncover security flaws within a pharmaceutical company's
local area network. They launch a Nessus scan across the internal IP ranges. Which step of the
standard penetration testing lifecycle does this activity represent?
A. Reconnaissance
B. Scanning
C. Enumeration
D. Exploitation
Answer: B
Rationale:
Lead: The Scanning phase utilizes automated vulnerability scanners (like Nessus) to
systematically discover live hosts, open ports, and known CVEs.
Discriminator: Deploying a tool specifically to identify vulnerabilities across a subnet moves the
engagement from passive intelligence gathering to active scanning.
Distractor: Enumeration involves extracting detailed data (like user lists or shares) via direct,
active connections, not broad vulnerability identification.
Clinical Pearl: Vulnerability scanners are only as effective as their plugin databases; regular
updates are mandatory to detect newly disclosed flaws. [NIST SP 800-115]
5. During a network assessment of an NHS trust, a security consultant attempts to extract domain
users, user groups, and hidden file shares from a legacy Windows Domain Controller by initiating a
null session. Which underlying protocol is being leveraged for this extraction?
Testing Verified
Series:
CrashCourses Professional Study Series
Author:
Dr Z. Moomba, MBChB, MRCPsych | BethelWellness Ltd
Exam Target:
EC-Council CEH
Year:
2025/2026
Format:
60 Questions with Verified Answers and Rationales
>
Author's Note:
This document is an original work produced for the CrashCourses Professional Study Series.
Clinical questions and professional scenarios were composed by Dr Z. Moomba based on current
exam objectives, published guidelines, and evidence-based sources (2024–2025). All patient
names, ages, and case details are fictional. Any resemblance to existing published Q&A banks is
coincidental. For personal study use only — not for reproduction or redistribution.
PART 1: CORE PRINCIPLES & FOUNDATIONS
1. An ethical hacker is undertaking non-intrusive reconnaissance on a regional trust's external-facing
assets. Their objective is to harvest associated subdomains and staff email addresses without
sending packets to the trust's actual servers. Which utility is the optimal choice for this requirement?
A. Nmap network mapper
B. theHarvester utility
C. Nessus vulnerability scanner
D. OpenVAS platform
Answer: B
,Rationale:
Lead: theHarvester is a specialized OSINT tool designed to aggregate emails, subdomains, and
employee data from public search engines and databases.
Discriminator: The requirement for "non-intrusive reconnaissance" (passive footprinting)
makes theHarvester the only correct tool, as it queries third-party indexes rather than the
target.
Distractor: Nmap fails here because it actively sends packets to the target's infrastructure,
violating the passive constraint.
High-Yield Point: Passive footprinting ensures no alerts are triggered on the target's intrusion
detection systems, forming the crucial first phase of stealth engagements. [NIST SP 800-115]
2. While conducting an internal compliance check on a private clinic's network, an auditor needs to
identify the underlying operating systems powering various connected diagnostic machines using
Nmap. Which specific parameter forces Nmap to perform this OS detection?
A. -sS
B. -sV
C. -O
D. -p-
Answer: C
Rationale:
Lead: The `-O` parameter in Nmap explicitly triggers operating system fingerprinting by
analyzing TCP/UDP packet responses against a known database.
Discriminator: The prompt specifically asks for the parameter that determines the "operating
systems," which maps directly to `-O`.
Distractor: The `-sV` flag attempts to determine the version of the service running on an open
port, not the host operating system itself.
Examiner Insight: Nmap's OS fingerprinting relies on subtle differences in how various
operating systems implement the TCP/IP stack, such as initial TTL values and TCP window
sizes. [Nmap Reference Guide 2025]
3. A red teamer utilizes a popular search engine to locate unsecured administrative portals belonging
to a target medical supplier. They input the query `site:target-medical.com intitle:"index of" /admin`.
Which reconnaissance methodology is demonstrated here?
A. Google Dorking / Hacking
B. DNS Zone Transfer enumeration
, C. Automated Web Crawling
D. Directory Path Traversal
Answer: A
Rationale:
Lead: Google Dorking utilizes advanced search operators to uncover sensitive data,
misconfigurations, or hidden directories that have been inadvertently indexed.
Discriminator: The explicit use of search operators like `site:` and `intitle:` perfectly defines a
Google Dork.
Distractor: Directory Path Traversal is an active exploit involving manipulating file paths (e.g.,
`../../`), whereas this is passive OSINT.
Key Principle: The Google Hacking Database (GHDB) is continually updated with strings
designed to expose vulnerable IoT devices and database backups. [OWASP Information
Gathering 2025]
4. A cybersecurity analyst is hired to uncover security flaws within a pharmaceutical company's
local area network. They launch a Nessus scan across the internal IP ranges. Which step of the
standard penetration testing lifecycle does this activity represent?
A. Reconnaissance
B. Scanning
C. Enumeration
D. Exploitation
Answer: B
Rationale:
Lead: The Scanning phase utilizes automated vulnerability scanners (like Nessus) to
systematically discover live hosts, open ports, and known CVEs.
Discriminator: Deploying a tool specifically to identify vulnerabilities across a subnet moves the
engagement from passive intelligence gathering to active scanning.
Distractor: Enumeration involves extracting detailed data (like user lists or shares) via direct,
active connections, not broad vulnerability identification.
Clinical Pearl: Vulnerability scanners are only as effective as their plugin databases; regular
updates are mandatory to detect newly disclosed flaws. [NIST SP 800-115]
5. During a network assessment of an NHS trust, a security consultant attempts to extract domain
users, user groups, and hidden file shares from a legacy Windows Domain Controller by initiating a
null session. Which underlying protocol is being leveraged for this extraction?
