CEH Certification Exam Study Set
2026/2027 | Certified Ethical Hacker (EC-
Council) | 125 Verified Questions with
Detailed Rationales
Table of Contents
Section 1: Footprinting & Reconnaissance (Questions 1–15) ...... 2
Section 2: Scanning Networks & Enumeration (Questions 16–30) ...... 2
Section 3: System Hacking (Questions 31–50) ...... 2
Section 4: Malware, Sniffing, Social Engineering, & DoS (Questions 51–70) ...... 2
Section 5: Web Application Hacking & Session Hijacking (Questions 71–85) ...... 2
Section 6: Wireless, Mobile, & IoT Hacking (Questions 86–100) ...... 2
Section 7: Cloud Computing, Cryptography, & Penetration Testing (Questions 101–125) ...... 2
Section 1: Footprinting & Reconnaissance
Q1: During the passive reconnaissance phase, an ethical hacker uses a search engine query to find
sensitive files exposed on a target domain. Which Google search operator would BEST locate Excel
spreadsheets containing the word "password" on example.com?
A. site:example.com filetype:xls password [CORRECT]
B. inurl:example.com password xls
C. intitle:password site:example.com
D. cache:example.com password filetype:xlsx
Correct Answer: A
Rationale: The site: operator restricts results to a specific domain, filetype:xls filters for Excel
spreadsheet files, and the keyword password targets potentially sensitive content. This combination is a
standard Google hacking (GHDB) technique taught in CEH Module 02 for uncovering exposed documents
during footprinting without directly interacting with the target.
Q2: Which of the following is the PRIMARY purpose of WHOIS footprinting in the reconnaissance phase?
,A. To identify open ports on the target network
B. To gather domain registration details, including registrar, registrant contact, and name server
information [CORRECT]
C. To map the internal network topology
D. To determine the operating system of the target web server
Correct Answer: B
Rationale: WHOIS queries retrieve domain registration data from regional internet registries (RIRs) such
as ARIN, RIPE, or ICANN-accredited registrars. This information reveals the domain owner,
administrative and technical contacts, registration dates, and authoritative name servers, all of which
are critical for building a target profile during passive reconnaissance.
Q3: An ethical hacker is conducting footprinting and discovers that a target organization uses Amazon
Route 53 for DNS. Which reconnaissance technique would BEST reveal subdomains associated with the
target?
A. Port scanning with Nmap
B. DNS zone transfer using dig axfr
C. DNS enumeration using tools like Sublist3r or DNSrecon [CORRECT]
D. Social engineering the IT help desk
Correct Answer: C
Rationale: DNS enumeration tools such as Sublist3r, DNSrecon, and Fierce automate the discovery of
subdomains by querying search engines, certificate transparency logs, and DNS records. This is a core
footprinting technique in CEH Module 02 that expands the attack surface by identifying forgotten or
less-secured subdomains without requiring direct interaction with the target's infrastructure.
Q4: Which of the following tools is specifically designed for gathering email addresses during the
reconnaissance phase by harvesting them from search engines and web pages?
A. Nmap
B. theHarvester [CORRECT]
C. Metasploit
D. Aircrack-ng
Correct Answer: B
Rationale: theHarvester is a Python-based open-source intelligence (OSINT) tool designed to gather
email addresses, subdomains, hosts, employee names, open ports, and banners from public sources
including Google, Bing, Shodan, and PGP servers. It is a standard tool in the CEH footprinting
methodology for passive email harvesting.
,Q5: During footprinting, an ethical hacker uses Maltego to visualize relationships between domains, IP
addresses, and email addresses. Maltego is BEST classified as:
A. A vulnerability scanner
B. A network protocol analyzer
C. A link analysis and OSINT visualization tool [CORRECT]
D. A password cracking utility
Correct Answer: C
Rationale: Maltego is a proprietary link analysis and data mining tool used in CEH footprinting to
visualize relationships between entities such as domains, IP addresses, netblocks, AS numbers, and
email addresses. Its transform mechanism aggregates data from multiple OSINT sources into graphical
relationship maps, enabling pattern recognition during reconnaissance.
Q6: Which reconnaissance technique involves querying a target's DNS server to transfer all DNS records
for a domain, potentially revealing internal hostnames and IP addresses?
A. DNS zone transfer [CORRECT]
B. DNS cache snooping
C. DNS spoofing
D. DNS tunneling
Correct Answer: A
Rationale: A DNS zone transfer (AXFR) is a legitimate DNS mechanism for replicating DNS databases
between servers. When misconfigured, it allows any requester to download the complete zone file,
exposing all host records, MX records, and internal IP mappings. CEH Module 02 emphasizes testing for
misconfigured zone transfers using dig axfr @ns1.target.com target.com.
Q7: An ethical hacker discovers that a target organization's website contains a robots.txt file with
multiple disallowed directories. What is the PRIMARY intelligence value of this discovery?
A. It reveals the web server's operating system
B. It indicates directories the administrator does not want indexed by search engines, which may contain
sensitive content [CORRECT]
C. It provides direct access to the web application database
D. It confirms the presence of a web application firewall
Correct Answer: B
Rationale: The robots.txt file instructs web crawlers which directories should not be indexed. While
, intended for legitimate crawlers, ethical hackers analyze robots.txt during footprinting to identify
potentially sensitive directories (e.g., /admin/, /backup/, /config/) that administrators have attempted
to hide from search engines but may still be accessible directly.
Q8: Which of the following is a PRIMARY source of information during the competitive intelligence-
gathering phase of footprinting?
A. Exploit databases such as Exploit-DB
B. Public financial reports, press releases, and job postings on the target's website [CORRECT]
C. Internal network traffic captures
D. Brute-force password attacks against the target's login portal
Correct Answer: B
Rationale: Competitive intelligence gathering during footprinting focuses on publicly available business
information such as SEC filings (10-K, 10-Q), press releases, job postings (which reveal technologies
used), partner/vendor relationships, and organizational structure. These sources are entirely passive,
legal, and provide valuable context for social engineering and targeted attacks.
Q9: During footprinting, an ethical hacker uses Shodan to search for internet-facing devices belonging to
a target organization. Shodan is BEST described as:
A. A vulnerability scanner
B. A search engine for internet-connected devices and services [CORRECT]
C. A social media monitoring platform
D. A web application firewall
Correct Answer: B
Rationale: Shodan is an IoT and internet-connected device search engine that indexes banners, services,
and metadata from devices exposed to the internet. CEH Module 02 teaches Shodan queries (e.g.,
org:"Target Corp", net:192.168.1.0/24) to identify exposed webcams, routers, industrial control systems,
and servers without directly scanning the target.
Q10: Which of the following is the MOST effective method for determining the physical location of a
target organization's data center during footprinting?
A. Brute-forcing the target's VPN gateway
B. Analyzing BGP routing data, traceroute results, and IP geolocation databases [CORRECT]
C. Sending phishing emails to the IT staff
D. Performing a SYN flood against the target's web server
2026/2027 | Certified Ethical Hacker (EC-
Council) | 125 Verified Questions with
Detailed Rationales
Table of Contents
Section 1: Footprinting & Reconnaissance (Questions 1–15) ...... 2
Section 2: Scanning Networks & Enumeration (Questions 16–30) ...... 2
Section 3: System Hacking (Questions 31–50) ...... 2
Section 4: Malware, Sniffing, Social Engineering, & DoS (Questions 51–70) ...... 2
Section 5: Web Application Hacking & Session Hijacking (Questions 71–85) ...... 2
Section 6: Wireless, Mobile, & IoT Hacking (Questions 86–100) ...... 2
Section 7: Cloud Computing, Cryptography, & Penetration Testing (Questions 101–125) ...... 2
Section 1: Footprinting & Reconnaissance
Q1: During the passive reconnaissance phase, an ethical hacker uses a search engine query to find
sensitive files exposed on a target domain. Which Google search operator would BEST locate Excel
spreadsheets containing the word "password" on example.com?
A. site:example.com filetype:xls password [CORRECT]
B. inurl:example.com password xls
C. intitle:password site:example.com
D. cache:example.com password filetype:xlsx
Correct Answer: A
Rationale: The site: operator restricts results to a specific domain, filetype:xls filters for Excel
spreadsheet files, and the keyword password targets potentially sensitive content. This combination is a
standard Google hacking (GHDB) technique taught in CEH Module 02 for uncovering exposed documents
during footprinting without directly interacting with the target.
Q2: Which of the following is the PRIMARY purpose of WHOIS footprinting in the reconnaissance phase?
,A. To identify open ports on the target network
B. To gather domain registration details, including registrar, registrant contact, and name server
information [CORRECT]
C. To map the internal network topology
D. To determine the operating system of the target web server
Correct Answer: B
Rationale: WHOIS queries retrieve domain registration data from regional internet registries (RIRs) such
as ARIN, RIPE, or ICANN-accredited registrars. This information reveals the domain owner,
administrative and technical contacts, registration dates, and authoritative name servers, all of which
are critical for building a target profile during passive reconnaissance.
Q3: An ethical hacker is conducting footprinting and discovers that a target organization uses Amazon
Route 53 for DNS. Which reconnaissance technique would BEST reveal subdomains associated with the
target?
A. Port scanning with Nmap
B. DNS zone transfer using dig axfr
C. DNS enumeration using tools like Sublist3r or DNSrecon [CORRECT]
D. Social engineering the IT help desk
Correct Answer: C
Rationale: DNS enumeration tools such as Sublist3r, DNSrecon, and Fierce automate the discovery of
subdomains by querying search engines, certificate transparency logs, and DNS records. This is a core
footprinting technique in CEH Module 02 that expands the attack surface by identifying forgotten or
less-secured subdomains without requiring direct interaction with the target's infrastructure.
Q4: Which of the following tools is specifically designed for gathering email addresses during the
reconnaissance phase by harvesting them from search engines and web pages?
A. Nmap
B. theHarvester [CORRECT]
C. Metasploit
D. Aircrack-ng
Correct Answer: B
Rationale: theHarvester is a Python-based open-source intelligence (OSINT) tool designed to gather
email addresses, subdomains, hosts, employee names, open ports, and banners from public sources
including Google, Bing, Shodan, and PGP servers. It is a standard tool in the CEH footprinting
methodology for passive email harvesting.
,Q5: During footprinting, an ethical hacker uses Maltego to visualize relationships between domains, IP
addresses, and email addresses. Maltego is BEST classified as:
A. A vulnerability scanner
B. A network protocol analyzer
C. A link analysis and OSINT visualization tool [CORRECT]
D. A password cracking utility
Correct Answer: C
Rationale: Maltego is a proprietary link analysis and data mining tool used in CEH footprinting to
visualize relationships between entities such as domains, IP addresses, netblocks, AS numbers, and
email addresses. Its transform mechanism aggregates data from multiple OSINT sources into graphical
relationship maps, enabling pattern recognition during reconnaissance.
Q6: Which reconnaissance technique involves querying a target's DNS server to transfer all DNS records
for a domain, potentially revealing internal hostnames and IP addresses?
A. DNS zone transfer [CORRECT]
B. DNS cache snooping
C. DNS spoofing
D. DNS tunneling
Correct Answer: A
Rationale: A DNS zone transfer (AXFR) is a legitimate DNS mechanism for replicating DNS databases
between servers. When misconfigured, it allows any requester to download the complete zone file,
exposing all host records, MX records, and internal IP mappings. CEH Module 02 emphasizes testing for
misconfigured zone transfers using dig axfr @ns1.target.com target.com.
Q7: An ethical hacker discovers that a target organization's website contains a robots.txt file with
multiple disallowed directories. What is the PRIMARY intelligence value of this discovery?
A. It reveals the web server's operating system
B. It indicates directories the administrator does not want indexed by search engines, which may contain
sensitive content [CORRECT]
C. It provides direct access to the web application database
D. It confirms the presence of a web application firewall
Correct Answer: B
Rationale: The robots.txt file instructs web crawlers which directories should not be indexed. While
, intended for legitimate crawlers, ethical hackers analyze robots.txt during footprinting to identify
potentially sensitive directories (e.g., /admin/, /backup/, /config/) that administrators have attempted
to hide from search engines but may still be accessible directly.
Q8: Which of the following is a PRIMARY source of information during the competitive intelligence-
gathering phase of footprinting?
A. Exploit databases such as Exploit-DB
B. Public financial reports, press releases, and job postings on the target's website [CORRECT]
C. Internal network traffic captures
D. Brute-force password attacks against the target's login portal
Correct Answer: B
Rationale: Competitive intelligence gathering during footprinting focuses on publicly available business
information such as SEC filings (10-K, 10-Q), press releases, job postings (which reveal technologies
used), partner/vendor relationships, and organizational structure. These sources are entirely passive,
legal, and provide valuable context for social engineering and targeted attacks.
Q9: During footprinting, an ethical hacker uses Shodan to search for internet-facing devices belonging to
a target organization. Shodan is BEST described as:
A. A vulnerability scanner
B. A search engine for internet-connected devices and services [CORRECT]
C. A social media monitoring platform
D. A web application firewall
Correct Answer: B
Rationale: Shodan is an IoT and internet-connected device search engine that indexes banners, services,
and metadata from devices exposed to the internet. CEH Module 02 teaches Shodan queries (e.g.,
org:"Target Corp", net:192.168.1.0/24) to identify exposed webcams, routers, industrial control systems,
and servers without directly scanning the target.
Q10: Which of the following is the MOST effective method for determining the physical location of a
target organization's data center during footprinting?
A. Brute-forcing the target's VPN gateway
B. Analyzing BGP routing data, traceroute results, and IP geolocation databases [CORRECT]
C. Sending phishing emails to the IT staff
D. Performing a SYN flood against the target's web server
