CERTIFIED ETHICAL HACKER • 2026/2027
CEH V12 Exam Version 4 2026/2027 —
Questions and Answers | Verified |
Grade A — Pass Guaranteed — A+
Graded
Complete Guide with Questions and Verified Answers
A+
W H AT ' S I N S I D E
50 application/analysis questions on Certified Ethical Hacker V12 topics
Verified correct answers with detailed rationales for each item
Coverage of ethical hacking fundamentals, reconnaissance, exploitation, web security, and network defense
Compact answer key plus per-question rationale index
Aligned with CEH V12 syllabus and Version 4 exam blueprint
PA G E S DOMAINS / SECTIONS
Multi-Page A+ 5 Sections
STUVIA ACTUAL EXAM • Original Educational Material
,CEH V12 Version 4 CEH-V12-V4 | Pass: 70% | Bloom: Application / Analysis
CEH V12 Exam Version 4 (Latest 2026/2027
Update)
Complete Guide with Questions and Verified Answers
Code: CEH-V12-V4 • Total Questions: 50 • Sections: 5 • Passing Score: 70% • Difficulty: Challenging • Bloom:
Application / Analysis
Instructions: Each question has four options (A–D). Select the single best answer. The correct answer
and rationale appear immediately below each question. A complete answer key and rationale index follow
the final question.
SECTION 1 of 5 | Ethical Hacking Fundamentals | 10 Questions
Application/analysis questions on hacking phases, ethics, and legal frameworks.
1. A penetration tester has just finished extracting database records from a compromised web server
and is now removing log entries to hide activity before the engagement closes. Which phase of the
standard ethical hacking methodology does this action represent? [ethical_hacking_five_phases_sequence]
A. Covering tracks, the fifth phase that follows maintaining access
B. Gaining access, the third phase in which exploitation occurs
C. Reconnaissance, the first passive phase of footprinting
D. Scanning, the second phase focused on enumerating live hosts and ports
Correct Answer: A The five phases are reconnaissance, scanning, gaining access, maintaining access, and
covering tracks. Clearing logs to evade detection is the final covering-tracks phase, performed only after access
has been maintained and objectives met.
2. A client hires a consultancy to test a public web application. Before any scanning begins, which
document must explicitly list in-scope IP ranges, prohibited techniques, and the engagement time
window? [written_authorization_scope_of_work]
A. The vendor's standard nondisclosure agreement (NDA)
B. The scope of work (SOW) and rules of engagement (ROE) signed by an authorized officer
C. The penetration tester's personal liability insurance certificate
D. The client's publicly posted privacy policy
Correct Answer: B The SOW/ROE, signed by an authorized representative, defines what may be tested, when,
and how. Without it, scanning or exploitation can constitute unauthorized access under laws such as the CFAA,
regardless of the tester's intent.
3. An attacker alters patient discharge instructions stored in a hospital's EHR so that conflicting
medication doses appear in the chart. Even though the data remains available to clinicians, which
element of the CIA triad was directly violated, and which is at greatest patient-safety risk?
[cia_triad_priority_scenario]
A. Confidentiality was violated; integrity was not affected
B. Availability was violated; integrity was unaffected because records still display
C. Integrity was violated; the altered medication data endangers patients despite availability
D. All three elements were equally compromised simultaneously
Correct Answer: C Integrity concerns the trustworthiness and correctness of data. Tampering with discharge
instructions degrades integrity even though the system remains available; confidentiality is only affected if
unauthorized viewing occurred.
Original Educational Material Verified Answers • Grade A Page 1
, CEH V12 Version 4 CEH-V12-V4 | Pass: 70% | Bloom: Application / Analysis
4. A network administrator wants to ensure that after a user authenticates to a VPN, every command
they issue on internal routers is recorded for later audit. Which component of the AAA framework
provides this audit trail? [aaa_accounting_definition]
A. Authentication, because it verifies the user identity
B. Authorization, because it grants permission to issue commands
C. Accounting, because it logs resource usage and actions for audit
D. Availability, because it ensures logs are accessible
Correct Answer: D In the AAA model (Authentication, Authorization, Accounting), Accounting records what
users do — sessions, commands, and resource consumption — enabling non-repudiation and forensic review.
Authentication verifies identity, while Authorization decides what identity may do.
5. An attacker breaches an e-commerce database, exfiltrates customer credit card numbers, and
sells the dump on a dark-web marketplace without ever notifying the merchant. Which hacker
classification best describes this behavior? [white_grey_black_hat_distinction]
A. Black hat, because the actor acts without authorization for personal gain and malicious intent
B. Grey hat, because the attacker may later disclose the breach to the vendor
C. White hat, because the attacker demonstrated a real vulnerability in the merchant's systems
D. Suicide hacker, because no ransom was demanded from the merchant
Correct Answer: A Black-hat hackers act without authorization and with malicious intent for financial or
personal gain, as in stealing and reselling card data. Grey hats, by contrast, operate without explicit
authorization but typically disclose vulnerabilities responsibly rather than monetizing them maliciously.
6. During scoping, a client tells the engagement lead that the production ERP system must not be
scanned because even a brief outage causes major losses. Where must this restriction be formally
captured to be enforceable during testing? [rules_of_engagement_content]
A. The vendor's corporate website terms of service
B. The rules of engagement (ROE) document listing exclusions and prohibited actions
C. The tester's internal ticketing system notes only
D. The OWASP Top 10 reference list
Correct Answer: B The ROE formalizes exclusions such as 'do not scan the ERP production system.'
Capturing it there gives testers a defensible boundary and protects the client; informal notes do not carry
contractual weight.
7. A vulnerability scan reports a critical flaw in a server that is reachable only from an internal
management VLAN with no outbound path. A threat actor would need physical presence on that
VLAN to exploit it. Using the formula risk = threat × vulnerability × impact, which statement is most
accurate? [risk_threat_vulnerability_impact]
A. Risk is maximal because the vulnerability is rated critical
B. Risk is low because the threat factor (likelihood of exploitation on the isolated VLAN) is low
C. Risk cannot be calculated without a CVE identifier
D. Risk equals the CVSS base score regardless of threat context
Correct Answer: C Risk depends on the product of threat (likelihood of an actor exploiting the flaw),
vulnerability (its existence/severity), and impact. The isolated VLAN reduces the threat component, lowering
overall risk even though the technical vulnerability itself is critical.
8. A researcher identifies a buffer overflow in an unpatched DNS daemon. They have working PoC
code that crashes the service. Which term describes the PoC code itself?
[vulnerability_threat_exploit_definitions]
A. The vulnerability, because it is the underlying flaw
B. The threat, because it is the actor and capability using it
C. The risk register entry, because it tracks management action
Original Educational Material Verified Answers • Grade A Page 2
CEH V12 Exam Version 4 2026/2027 —
Questions and Answers | Verified |
Grade A — Pass Guaranteed — A+
Graded
Complete Guide with Questions and Verified Answers
A+
W H AT ' S I N S I D E
50 application/analysis questions on Certified Ethical Hacker V12 topics
Verified correct answers with detailed rationales for each item
Coverage of ethical hacking fundamentals, reconnaissance, exploitation, web security, and network defense
Compact answer key plus per-question rationale index
Aligned with CEH V12 syllabus and Version 4 exam blueprint
PA G E S DOMAINS / SECTIONS
Multi-Page A+ 5 Sections
STUVIA ACTUAL EXAM • Original Educational Material
,CEH V12 Version 4 CEH-V12-V4 | Pass: 70% | Bloom: Application / Analysis
CEH V12 Exam Version 4 (Latest 2026/2027
Update)
Complete Guide with Questions and Verified Answers
Code: CEH-V12-V4 • Total Questions: 50 • Sections: 5 • Passing Score: 70% • Difficulty: Challenging • Bloom:
Application / Analysis
Instructions: Each question has four options (A–D). Select the single best answer. The correct answer
and rationale appear immediately below each question. A complete answer key and rationale index follow
the final question.
SECTION 1 of 5 | Ethical Hacking Fundamentals | 10 Questions
Application/analysis questions on hacking phases, ethics, and legal frameworks.
1. A penetration tester has just finished extracting database records from a compromised web server
and is now removing log entries to hide activity before the engagement closes. Which phase of the
standard ethical hacking methodology does this action represent? [ethical_hacking_five_phases_sequence]
A. Covering tracks, the fifth phase that follows maintaining access
B. Gaining access, the third phase in which exploitation occurs
C. Reconnaissance, the first passive phase of footprinting
D. Scanning, the second phase focused on enumerating live hosts and ports
Correct Answer: A The five phases are reconnaissance, scanning, gaining access, maintaining access, and
covering tracks. Clearing logs to evade detection is the final covering-tracks phase, performed only after access
has been maintained and objectives met.
2. A client hires a consultancy to test a public web application. Before any scanning begins, which
document must explicitly list in-scope IP ranges, prohibited techniques, and the engagement time
window? [written_authorization_scope_of_work]
A. The vendor's standard nondisclosure agreement (NDA)
B. The scope of work (SOW) and rules of engagement (ROE) signed by an authorized officer
C. The penetration tester's personal liability insurance certificate
D. The client's publicly posted privacy policy
Correct Answer: B The SOW/ROE, signed by an authorized representative, defines what may be tested, when,
and how. Without it, scanning or exploitation can constitute unauthorized access under laws such as the CFAA,
regardless of the tester's intent.
3. An attacker alters patient discharge instructions stored in a hospital's EHR so that conflicting
medication doses appear in the chart. Even though the data remains available to clinicians, which
element of the CIA triad was directly violated, and which is at greatest patient-safety risk?
[cia_triad_priority_scenario]
A. Confidentiality was violated; integrity was not affected
B. Availability was violated; integrity was unaffected because records still display
C. Integrity was violated; the altered medication data endangers patients despite availability
D. All three elements were equally compromised simultaneously
Correct Answer: C Integrity concerns the trustworthiness and correctness of data. Tampering with discharge
instructions degrades integrity even though the system remains available; confidentiality is only affected if
unauthorized viewing occurred.
Original Educational Material Verified Answers • Grade A Page 1
, CEH V12 Version 4 CEH-V12-V4 | Pass: 70% | Bloom: Application / Analysis
4. A network administrator wants to ensure that after a user authenticates to a VPN, every command
they issue on internal routers is recorded for later audit. Which component of the AAA framework
provides this audit trail? [aaa_accounting_definition]
A. Authentication, because it verifies the user identity
B. Authorization, because it grants permission to issue commands
C. Accounting, because it logs resource usage and actions for audit
D. Availability, because it ensures logs are accessible
Correct Answer: D In the AAA model (Authentication, Authorization, Accounting), Accounting records what
users do — sessions, commands, and resource consumption — enabling non-repudiation and forensic review.
Authentication verifies identity, while Authorization decides what identity may do.
5. An attacker breaches an e-commerce database, exfiltrates customer credit card numbers, and
sells the dump on a dark-web marketplace without ever notifying the merchant. Which hacker
classification best describes this behavior? [white_grey_black_hat_distinction]
A. Black hat, because the actor acts without authorization for personal gain and malicious intent
B. Grey hat, because the attacker may later disclose the breach to the vendor
C. White hat, because the attacker demonstrated a real vulnerability in the merchant's systems
D. Suicide hacker, because no ransom was demanded from the merchant
Correct Answer: A Black-hat hackers act without authorization and with malicious intent for financial or
personal gain, as in stealing and reselling card data. Grey hats, by contrast, operate without explicit
authorization but typically disclose vulnerabilities responsibly rather than monetizing them maliciously.
6. During scoping, a client tells the engagement lead that the production ERP system must not be
scanned because even a brief outage causes major losses. Where must this restriction be formally
captured to be enforceable during testing? [rules_of_engagement_content]
A. The vendor's corporate website terms of service
B. The rules of engagement (ROE) document listing exclusions and prohibited actions
C. The tester's internal ticketing system notes only
D. The OWASP Top 10 reference list
Correct Answer: B The ROE formalizes exclusions such as 'do not scan the ERP production system.'
Capturing it there gives testers a defensible boundary and protects the client; informal notes do not carry
contractual weight.
7. A vulnerability scan reports a critical flaw in a server that is reachable only from an internal
management VLAN with no outbound path. A threat actor would need physical presence on that
VLAN to exploit it. Using the formula risk = threat × vulnerability × impact, which statement is most
accurate? [risk_threat_vulnerability_impact]
A. Risk is maximal because the vulnerability is rated critical
B. Risk is low because the threat factor (likelihood of exploitation on the isolated VLAN) is low
C. Risk cannot be calculated without a CVE identifier
D. Risk equals the CVSS base score regardless of threat context
Correct Answer: C Risk depends on the product of threat (likelihood of an actor exploiting the flaw),
vulnerability (its existence/severity), and impact. The isolated VLAN reduces the threat component, lowering
overall risk even though the technical vulnerability itself is critical.
8. A researcher identifies a buffer overflow in an unpatched DNS daemon. They have working PoC
code that crashes the service. Which term describes the PoC code itself?
[vulnerability_threat_exploit_definitions]
A. The vulnerability, because it is the underlying flaw
B. The threat, because it is the actor and capability using it
C. The risk register entry, because it tracks management action
Original Educational Material Verified Answers • Grade A Page 2
