Certified Ethical Hacker (Ceh)
Professional Certification Exam
Questions And Correct Answers (Verified
Answers) Plus Rationales 2026 Q&A |
Instant Download Pdf
1. Which of the following phases of the ethical hacking process involves
gathering information about the target system to identify potential
vulnerabilities? A. Scanning B. Enumeration C. Reconnaissance D. Gaining
Access Rationale: Reconnaissance is the preliminary phase where an
attacker collects intelligence, such as network topography and host
information, to map out the attack surface.
2. An ethical hacker is using Nmap to identify open ports and services on a
remote server. Which Nmap flag would be most appropriate for a stealthy
TCP SYN scan? A. -sS B. -sT C. -sU D. -sA Rationale: The -sS flag initiates a
SYN scan, which is half-open because it does not complete the TCP three-
way handshake, making it less likely to be logged by simple applications.
3. Which cryptographic algorithm is commonly used for secure key exchange
in VPN connections? A. AES B. Diffie-Hellman C. RSA D. Blowfish Rationale:
Diffie-Hellman is a fundamental key-agreement protocol that allows two
parties to establish a shared secret over an insecure channel, which is then
used to encrypt subsequent communications.
4. You are analyzing network traffic and notice several packets with the same
source and destination IP addresses and ports, commonly known as a SYN
flood. This is an example of what type of attack? A. Buffer Overflow B.
Denial of Service (DoS) C. Man-in-the-Middle D. Cross-Site Scripting
Rationale: A SYN flood consumes system resources by initiating incomplete
, TCP connections, preventing legitimate users from accessing services, which
characterizes a Denial of Service attack.
5. Which of the following SQL injection techniques is used to extract data by
observing how the application responds to true or false conditions? A.
Error-based B. Union-based C. Blind SQL Injection D. Out-of-band Rationale:
Blind SQL injection occurs when an attacker asks the database true/false
questions and determines the answer based on the application's response or
delay, even if the database does not return raw data directly.
6. What is the primary purpose of a honeypot in a corporate network
architecture? A. To block unauthorized incoming traffic B. To provide a
backup for critical databases C. To act as a decoy to lure and observe
attackers D. To encrypt all traffic leaving the perimeter Rationale: A
honeypot is a security mechanism designed to detect, deflect, or study
unauthorized attempts to access information systems by presenting itself as
a legitimate target.
7. Which wireless security protocol is considered the most secure and uses
CCMP (Counter Mode Cipher Block Chaining Message Authentication Code
Protocol) based on AES? A. WEP B. WPA C. WPA2 D. WPA3 Rationale: WPA2
(specifically with AES-CCMP) addresses the cryptographic weaknesses of
previous standards like WEP and TKIP, offering robust encryption and
integrity checks.
8. When performing a buffer overflow attack, what is the primary objective of
overwriting the return address in the stack? A. To crash the application B. To
redirect execution to malicious code (shellcode) C. To increase the privilege
level of the user D. To bypass the firewall Rationale: By overwriting the
return address on the stack, an attacker can control the Instruction Pointer
(EIP/RIP) to point to their injected shellcode, causing the CPU to execute it.
9. Which tool is best suited for intercepting and modifying HTTP/HTTPS traffic
between a browser and a web server? A. Wireshark B. Nmap C. Burp Suite
D. Metasploit Rationale: Burp Suite acts as an intercepting proxy, allowing
, the ethical hacker to pause, inspect, and modify web traffic in real-time
before it reaches the server or the client.
10.A polymorphic virus is characterized by which of the following features? A.
It changes its own code signature with every infection B. It encrypts the
entire hard drive C. It uses a variable decryption routine to mutate its
appearance D. It resides only in the system memory Rationale: Polymorphic
code uses an engine to encrypt the main body of the malware and changes
the decryption stub every time it propagates, making signature-based
detection difficult.
11.Which layer of the OSI model does an ICMP flood attack primarily target? A.
Data Link Layer B. Network Layer C. Transport Layer D. Application Layer
Rationale: ICMP operates at the Network Layer (Layer 3), and an ICMP flood
involves sending excessive Echo Request packets to overwhelm the target's
network processing capabilities.
12.During a penetration test, you obtain a set of password hashes from a Linux
system. Which tool would be the most effective for performing a dictionary
or brute-force attack on these hashes? A. John the Ripper B. Wireshark C.
Netcat D. Nessus Rationale: John the Ripper is a widely used, powerful
password recovery tool designed specifically to crack various password hash
types through dictionary attacks, brute force, and rainbow tables.
13.Which concept in information security ensures that an individual cannot
deny having performed an action? A. Confidentiality B. Integrity C.
Availability D. Non-repudiation Rationale: Non-repudiation provides proof
of the origin and integrity of data, ensuring that the sender cannot later
deny sending the message, often achieved through digital signatures.
14.What is the main difference between a vulnerability assessment and a
penetration test? A. Penetration testing is always automated B. Penetration
testing exploits vulnerabilities to prove existence C. Vulnerability
assessments are only done on hardware D. Penetration testing does not
require permission Rationale: A vulnerability assessment identifies and lists
Professional Certification Exam
Questions And Correct Answers (Verified
Answers) Plus Rationales 2026 Q&A |
Instant Download Pdf
1. Which of the following phases of the ethical hacking process involves
gathering information about the target system to identify potential
vulnerabilities? A. Scanning B. Enumeration C. Reconnaissance D. Gaining
Access Rationale: Reconnaissance is the preliminary phase where an
attacker collects intelligence, such as network topography and host
information, to map out the attack surface.
2. An ethical hacker is using Nmap to identify open ports and services on a
remote server. Which Nmap flag would be most appropriate for a stealthy
TCP SYN scan? A. -sS B. -sT C. -sU D. -sA Rationale: The -sS flag initiates a
SYN scan, which is half-open because it does not complete the TCP three-
way handshake, making it less likely to be logged by simple applications.
3. Which cryptographic algorithm is commonly used for secure key exchange
in VPN connections? A. AES B. Diffie-Hellman C. RSA D. Blowfish Rationale:
Diffie-Hellman is a fundamental key-agreement protocol that allows two
parties to establish a shared secret over an insecure channel, which is then
used to encrypt subsequent communications.
4. You are analyzing network traffic and notice several packets with the same
source and destination IP addresses and ports, commonly known as a SYN
flood. This is an example of what type of attack? A. Buffer Overflow B.
Denial of Service (DoS) C. Man-in-the-Middle D. Cross-Site Scripting
Rationale: A SYN flood consumes system resources by initiating incomplete
, TCP connections, preventing legitimate users from accessing services, which
characterizes a Denial of Service attack.
5. Which of the following SQL injection techniques is used to extract data by
observing how the application responds to true or false conditions? A.
Error-based B. Union-based C. Blind SQL Injection D. Out-of-band Rationale:
Blind SQL injection occurs when an attacker asks the database true/false
questions and determines the answer based on the application's response or
delay, even if the database does not return raw data directly.
6. What is the primary purpose of a honeypot in a corporate network
architecture? A. To block unauthorized incoming traffic B. To provide a
backup for critical databases C. To act as a decoy to lure and observe
attackers D. To encrypt all traffic leaving the perimeter Rationale: A
honeypot is a security mechanism designed to detect, deflect, or study
unauthorized attempts to access information systems by presenting itself as
a legitimate target.
7. Which wireless security protocol is considered the most secure and uses
CCMP (Counter Mode Cipher Block Chaining Message Authentication Code
Protocol) based on AES? A. WEP B. WPA C. WPA2 D. WPA3 Rationale: WPA2
(specifically with AES-CCMP) addresses the cryptographic weaknesses of
previous standards like WEP and TKIP, offering robust encryption and
integrity checks.
8. When performing a buffer overflow attack, what is the primary objective of
overwriting the return address in the stack? A. To crash the application B. To
redirect execution to malicious code (shellcode) C. To increase the privilege
level of the user D. To bypass the firewall Rationale: By overwriting the
return address on the stack, an attacker can control the Instruction Pointer
(EIP/RIP) to point to their injected shellcode, causing the CPU to execute it.
9. Which tool is best suited for intercepting and modifying HTTP/HTTPS traffic
between a browser and a web server? A. Wireshark B. Nmap C. Burp Suite
D. Metasploit Rationale: Burp Suite acts as an intercepting proxy, allowing
, the ethical hacker to pause, inspect, and modify web traffic in real-time
before it reaches the server or the client.
10.A polymorphic virus is characterized by which of the following features? A.
It changes its own code signature with every infection B. It encrypts the
entire hard drive C. It uses a variable decryption routine to mutate its
appearance D. It resides only in the system memory Rationale: Polymorphic
code uses an engine to encrypt the main body of the malware and changes
the decryption stub every time it propagates, making signature-based
detection difficult.
11.Which layer of the OSI model does an ICMP flood attack primarily target? A.
Data Link Layer B. Network Layer C. Transport Layer D. Application Layer
Rationale: ICMP operates at the Network Layer (Layer 3), and an ICMP flood
involves sending excessive Echo Request packets to overwhelm the target's
network processing capabilities.
12.During a penetration test, you obtain a set of password hashes from a Linux
system. Which tool would be the most effective for performing a dictionary
or brute-force attack on these hashes? A. John the Ripper B. Wireshark C.
Netcat D. Nessus Rationale: John the Ripper is a widely used, powerful
password recovery tool designed specifically to crack various password hash
types through dictionary attacks, brute force, and rainbow tables.
13.Which concept in information security ensures that an individual cannot
deny having performed an action? A. Confidentiality B. Integrity C.
Availability D. Non-repudiation Rationale: Non-repudiation provides proof
of the origin and integrity of data, ensuring that the sender cannot later
deny sending the message, often achieved through digital signatures.
14.What is the main difference between a vulnerability assessment and a
penetration test? A. Penetration testing is always automated B. Penetration
testing exploits vulnerabilities to prove existence C. Vulnerability
assessments are only done on hardware D. Penetration testing does not
require permission Rationale: A vulnerability assessment identifies and lists
