CEH v12 Exam Version 4 Certified Ethical Hacker
Practice Test Actual 2025/2026 with Detailed
Rationales | 100% Verified | Pass Guaranteed – A+
Graded
SECTION 1: Footprinting & Reconnaissance (10 Questions)
Q1: Which DNS record type is used to identify the mail server responsible for
accepting email messages on behalf of a domain?
A. A record
B. MX record
C. NS record
D. CNAME record
Correct Answer: B
Rationale: The MX (Mail Exchange) record specifies the mail server responsible for
accepting email messages on behalf of a domain, making it essential for email
reconnaissance.
Q2: An ethical hacker wants to gather information about a target organization using
only publicly available sources without directly interacting with the target's systems.
Which technique is being employed?
A. Active reconnaissance
B. Passive reconnaissance
,C. Social engineering
D. Network scanning
Correct Answer: B
Rationale: Passive reconnaissance involves gathering information from publicly
available sources without directly interacting with the target's systems, reducing the
risk of detection.
Q3: During a footprinting exercise, an attacker queries a DNS server and receives
multiple internal IP addresses and hostnames that should not be publicly exposed.
Which misconfiguration allowed this information disclosure?
A. DNS cache poisoning
B. Zone transfer misconfiguration
C. Reverse DNS lookup failure
D. DNSSEC misconfiguration
Correct Answer: B
Rationale: A DNS zone transfer misconfiguration allows unauthorized users to
download the entire DNS zone file, revealing internal network topology and
hostnames.
Q4: A penetration tester uses the Google search query site:target.com
filetype:pdf to locate sensitive documents. What is this technique commonly
called?
A. DNS enumeration
B. Google hacking / Google dorking
,C. Metadata extraction
D. Web spidering
Correct Answer: B
Rationale: Google hacking (or Google dorking) uses advanced search operators to
locate sensitive information, files, and vulnerabilities indexed by search engines.
Q5: Which tool is specifically designed to extract metadata from documents such as
author names, software versions, and creation dates?
A. Nmap
B. Metagoofil
C. Wireshark
D. Burp Suite
Correct Answer: B
Rationale: Metagoofil is an information gathering tool designed to extract metadata
from public documents (PDF, DOC, XLS, etc.) available on the target's website.
Q6: An attacker wants to determine the network range owned by a target
organization. Which registry query would provide this information?
A. WHOIS lookup on the domain name
B. ARIN lookup on the organization's name
C. DNS zone transfer
D. SMTP banner grabbing
, Correct Answer: B
Rationale: ARIN (American Registry for Internet Numbers) and other regional internet
registries (RIPE, APNIC, LACNIC, AFRINIC) provide IP address allocation information
for organizations.
Q7: During email reconnaissance, an ethical hacker collects valid email addresses
from the target domain using automated tools. Which of the following is the primary
risk associated with this exposed information?
A. Network topology mapping
B. Targeted phishing and social engineering attacks
C. Encryption key discovery
D. Physical security breaches
Correct Answer: B
Rationale: Collected email addresses are commonly used to launch targeted
phishing campaigns, spear-phishing attacks, and social engineering operations
against specific individuals.
Q8: Which technique involves creating a complete offline copy of a target website to
analyze its structure, content, and potential vulnerabilities without repeatedly
accessing the live server?
A. WHOIS enumeration
B. Website mirroring
C. DNS footprinting
D. Banner grabbing
Practice Test Actual 2025/2026 with Detailed
Rationales | 100% Verified | Pass Guaranteed – A+
Graded
SECTION 1: Footprinting & Reconnaissance (10 Questions)
Q1: Which DNS record type is used to identify the mail server responsible for
accepting email messages on behalf of a domain?
A. A record
B. MX record
C. NS record
D. CNAME record
Correct Answer: B
Rationale: The MX (Mail Exchange) record specifies the mail server responsible for
accepting email messages on behalf of a domain, making it essential for email
reconnaissance.
Q2: An ethical hacker wants to gather information about a target organization using
only publicly available sources without directly interacting with the target's systems.
Which technique is being employed?
A. Active reconnaissance
B. Passive reconnaissance
,C. Social engineering
D. Network scanning
Correct Answer: B
Rationale: Passive reconnaissance involves gathering information from publicly
available sources without directly interacting with the target's systems, reducing the
risk of detection.
Q3: During a footprinting exercise, an attacker queries a DNS server and receives
multiple internal IP addresses and hostnames that should not be publicly exposed.
Which misconfiguration allowed this information disclosure?
A. DNS cache poisoning
B. Zone transfer misconfiguration
C. Reverse DNS lookup failure
D. DNSSEC misconfiguration
Correct Answer: B
Rationale: A DNS zone transfer misconfiguration allows unauthorized users to
download the entire DNS zone file, revealing internal network topology and
hostnames.
Q4: A penetration tester uses the Google search query site:target.com
filetype:pdf to locate sensitive documents. What is this technique commonly
called?
A. DNS enumeration
B. Google hacking / Google dorking
,C. Metadata extraction
D. Web spidering
Correct Answer: B
Rationale: Google hacking (or Google dorking) uses advanced search operators to
locate sensitive information, files, and vulnerabilities indexed by search engines.
Q5: Which tool is specifically designed to extract metadata from documents such as
author names, software versions, and creation dates?
A. Nmap
B. Metagoofil
C. Wireshark
D. Burp Suite
Correct Answer: B
Rationale: Metagoofil is an information gathering tool designed to extract metadata
from public documents (PDF, DOC, XLS, etc.) available on the target's website.
Q6: An attacker wants to determine the network range owned by a target
organization. Which registry query would provide this information?
A. WHOIS lookup on the domain name
B. ARIN lookup on the organization's name
C. DNS zone transfer
D. SMTP banner grabbing
, Correct Answer: B
Rationale: ARIN (American Registry for Internet Numbers) and other regional internet
registries (RIPE, APNIC, LACNIC, AFRINIC) provide IP address allocation information
for organizations.
Q7: During email reconnaissance, an ethical hacker collects valid email addresses
from the target domain using automated tools. Which of the following is the primary
risk associated with this exposed information?
A. Network topology mapping
B. Targeted phishing and social engineering attacks
C. Encryption key discovery
D. Physical security breaches
Correct Answer: B
Rationale: Collected email addresses are commonly used to launch targeted
phishing campaigns, spear-phishing attacks, and social engineering operations
against specific individuals.
Q8: Which technique involves creating a complete offline copy of a target website to
analyze its structure, content, and potential vulnerabilities without repeatedly
accessing the live server?
A. WHOIS enumeration
B. Website mirroring
C. DNS footprinting
D. Banner grabbing
