CEH Exam V2 | Certified Ethical Hacker
(CEH) | Q&A with Rationale (CEH Exam) |
EC-Council
1. An ethical hacker is using a Google Dork to find publicly accessible configuration files on a
target’s web server. Which of the following operators would be most effective for this task?
A. cache:target.com config
B. link:target.com admin
C. related:target.com login
D. site:target.com filetype:conf
Correct Answer: D
Rationale: The ‘filetype:’ operator is specifically designed to filter search results by a
specific file extension. Combined with ‘site:’, it narrows the search to a specific domain.
This technique is a standard part of passive reconnaissance to identify sensitive files.
2. Which Nmap scan type is known as the ‘Half-Open’ scan because it does not complete the
three-way handshake?
A. TCP Connect Scan (-sT)
B. UDP Scan (-sU)
C. TCP SYN Scan (-sS)
,D. Xmas Scan (-sX)
Correct Answer: C
Rationale: The TCP SYN scan (-sS) is referred to as half-open because it sends a SYN packet
and waits for a SYN/ACK response. Once the response is received, the scanner sends an
RST packet instead of an ACK. This prevents a full connection from being established and
logged by some applications.
3. An attacker is sending spoofed ICMP Echo Request packets to a network’s broadcast
address with the source IP set to the victim’s IP. What type of attack is this?
A. SYN Flood
B. Smurf Attack
C. Fraggle Attack
D. Ping of Death
Correct Answer: B
Rationale: A Smurf attack uses ICMP Echo Requests sent to a broadcast address to
overwhelm a victim with responses. By spoofing the source IP, all devices on the network
reply to the victim simultaneously. This leads to a massive denial-of-service condition for
the targeted host.
4. Which layer of the OSI model does an ARP poisoning attack primarily target?
A. Layer 2 - Data Link
, B. Layer 1 - Physical
C. Layer 3 - Network
D. Layer 4 - Transport
Correct Answer: A
Rationale: Address Resolution Protocol (ARP) operates at the Data Link layer to map IP
addresses to MAC addresses. ARP poisoning involves sending malicious ARP messages to a
local area network. This allows an attacker to intercept or modify traffic between two hosts
on the same segment.
5. In the CVSS v3.1 scoring system, which metric evaluates the requirement for an attacker to
possess specific privileges before exploiting a vulnerability?
A. Attack Vector (AV)
B. Attack Complexity (AC)
C. Privileges Required (PR)
D. User Interaction (UI)
Correct Answer: C
Rationale: The Privileges Required metric measures the level of privileges an attacker
must have to successfully exploit the vulnerability. It ranges from None to Low or High.
This metric is crucial for determining the overall severity and impact of a security flaw.
(CEH) | Q&A with Rationale (CEH Exam) |
EC-Council
1. An ethical hacker is using a Google Dork to find publicly accessible configuration files on a
target’s web server. Which of the following operators would be most effective for this task?
A. cache:target.com config
B. link:target.com admin
C. related:target.com login
D. site:target.com filetype:conf
Correct Answer: D
Rationale: The ‘filetype:’ operator is specifically designed to filter search results by a
specific file extension. Combined with ‘site:’, it narrows the search to a specific domain.
This technique is a standard part of passive reconnaissance to identify sensitive files.
2. Which Nmap scan type is known as the ‘Half-Open’ scan because it does not complete the
three-way handshake?
A. TCP Connect Scan (-sT)
B. UDP Scan (-sU)
C. TCP SYN Scan (-sS)
,D. Xmas Scan (-sX)
Correct Answer: C
Rationale: The TCP SYN scan (-sS) is referred to as half-open because it sends a SYN packet
and waits for a SYN/ACK response. Once the response is received, the scanner sends an
RST packet instead of an ACK. This prevents a full connection from being established and
logged by some applications.
3. An attacker is sending spoofed ICMP Echo Request packets to a network’s broadcast
address with the source IP set to the victim’s IP. What type of attack is this?
A. SYN Flood
B. Smurf Attack
C. Fraggle Attack
D. Ping of Death
Correct Answer: B
Rationale: A Smurf attack uses ICMP Echo Requests sent to a broadcast address to
overwhelm a victim with responses. By spoofing the source IP, all devices on the network
reply to the victim simultaneously. This leads to a massive denial-of-service condition for
the targeted host.
4. Which layer of the OSI model does an ARP poisoning attack primarily target?
A. Layer 2 - Data Link
, B. Layer 1 - Physical
C. Layer 3 - Network
D. Layer 4 - Transport
Correct Answer: A
Rationale: Address Resolution Protocol (ARP) operates at the Data Link layer to map IP
addresses to MAC addresses. ARP poisoning involves sending malicious ARP messages to a
local area network. This allows an attacker to intercept or modify traffic between two hosts
on the same segment.
5. In the CVSS v3.1 scoring system, which metric evaluates the requirement for an attacker to
possess specific privileges before exploiting a vulnerability?
A. Attack Vector (AV)
B. Attack Complexity (AC)
C. Privileges Required (PR)
D. User Interaction (UI)
Correct Answer: C
Rationale: The Privileges Required metric measures the level of privileges an attacker
must have to successfully exploit the vulnerability. It ranges from None to Low or High.
This metric is crucial for determining the overall severity and impact of a security flaw.
