WGU CEH exam examples EXAM QUESTIONS AND VERIFIED CORRECT ANSWERS GRADED A+ -LATEST - GUARANTEED PASS.docx

CEH exam examples D483
EXAM QUESTIONS AND
VERIFIED CORRECT
ANSWERS GRADED A+
[LATEST 2026-2027] 100%
GUARANTEED PASS

What is a NULL scan? - CORRECT ANSWER-A scan in which all flags are turned off



What is the proper response for a NULL scan if the port is open? - CORRECT ANSWER-No
response



802.11b is considered a ________________protocol. - CORRECT ANSWER-Unsecure



What do Trinoo, TFN2k, WinTrinoo, T-Sight, and Stracheldraht have in common? - CORRECT
ANSWER-All are DDOS tools



You find the following entries in your web log. Each shows attempted access to either root.exe
or

cmd.exe. What caused this?



GET /scripts/root.exe?/c+dir

,GET /MSADC/root.exe?/c+dir

GET /c/winnt/system32/cmd.exe?/c+dir

GET /d/winnt/system32/cmd.exe?/c+dir

GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir

GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir

GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir

GET /msadc/..%5c../..%5c../..%5c/..xc1x1c../..xc1x1c../..xc1x1c../winnt/system32/cmd.exe?/
c+dir

GET /scripts/..xc1x1c../winnt/system32/cmd.exe?/c+dir

GET /scripts/..xc0/../winnt/system32/cmd.exe?/c+dir

GET /scripts/..xc0xaf../winnt/system32/cmd.exe?/c+dir

GET /scripts/..xc1x9c../winnt/system32/cmd.exe?/c+dir

GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir

GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir

GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir

GET /scripts/..%2f../w - CORRECT ANSWER-Nimda



Which type of Nmap scan is the most reliable, but also the most visible, and likely to be picked
up

by and IDS? - CORRECT ANSWER-Connect scan



_________ is a tool that can hide processes from the process list, can hide files, registry entries,

and intercept keystrokes. - CORRECT ANSWER-RootKit



What is the BEST alternative if you discover that a rootkit has been installed on one of your

computers? - CORRECT ANSWER-Reload from known good media

,What is Form Scalpel used for? - CORRECT ANSWER-Dissecting HTML Forms



What is a primary advantage a hacker gains by using encryption or programs such as Loki? -
CORRECT ANSWER-IDS systems are unable to decrypt it



What is Hunt used for? - CORRECT ANSWER-to intercept traffic i.e. man-in-the-middle traffic



________ is an automated vulnerability assessment tool. - CORRECT ANSWER-Nessus



What is the disadvantage of an automated vulnerability assessment tool? - CORRECT ANSWER-
Noisy



What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming
through

the firewall if your network is comprised of Windows NT, 2000, and XP? - CORRECT ANSWER-
135, 139 and 445



What does black box examing mean? - CORRECT ANSWER-You have no knowledge of the
environment



What does white box examing mean? - CORRECT ANSWER-You have full knowledge of the
environment



Under what conditions does a secondary name server request a zone transfer from a primary

name server? - CORRECT ANSWER-When a primary SOA is higher that a secondary SOA



Pandora is used to attack __________ network operating systems. - CORRECT ANSWER-
Netware

, ____________ will let you assume a users identity at a dynamically generated web page or site.
- CORRECT ANSWER-Cross site scripting



One of your team members has asked you to analyze the following SOA record. What is the

TTL? Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400. -
CORRECT ANSWER-2400



One of your team members has asked you to analyze the following SOA record. What is the

version?

Rutgers.edu.SOA NS1.Rutgers.edu ipad.college.edu (200302028 3600 3600 604800 2400. -
CORRECT ANSWER-200303028



MX record priority increases as the number increases. - CORRECT ANSWER-False



Which of the following tools can be used to perform a zone transfer? - CORRECT ANSWER-
NSLookup, Dig, Sam Spade and Host



_______ is one of the programs used to wardial. - CORRECT ANSWER-ToneLoc



What are the default passwords used by SNMP?( - CORRECT ANSWER-Private and Public



What is the following command used for?

net use \targetipc$ "" /u:"" - CORRECT ANSWER-Connecting to a Linux computer through
Samba.



What is the proper response for a NULL scan if the port is closed? - CORRECT ANSWER-RST