CEH Exam V1 | Certified Ethical Hacker
(CEH) | Q&A with Rationale (CEH Exam) |
EC-Council
1. An ethical hacker is performing a network scan and wants to identify the operating system
of the target devices without completing a full TCP connection. Which Nmap flag should be
utilized?
A. -sT
B. -sP
C. -sU
D. -sS
Correct Answer: D
Rationale: The -sS flag initiates a TCP SYN scan, commonly referred to as a half-open scan
because it does not complete the three-way handshake. This method is effective for
identifying open ports and gathering OS fingerprints while remaining relatively stealthy
compared to a full connect scan. By monitoring the responses to SYN packets, Nmap can
infer the target’s operating system characteristics.
2. When conducting a footprinting exercise, which DNS record would provide an ethical
hacker with information regarding the organization’s mail server?
A. A record
,B. PTR record
C. NS record
D. MX record
Correct Answer: D
Rationale: The MX (Mail Exchanger) record specifies the mail servers responsible for
receiving email on behalf of a domain. Identifying these servers is a critical step in the
reconnaissance phase as it reveals potential targets for email-based attacks. Ethical hackers
use this information to map out the infrastructure and determine where communication
traffic is directed.
3. An attacker uses a specialized tool to capture network traffic and discovers that a device is
communicating via SNMPv1. What is the primary security vulnerability associated with this
protocol?
A. Encryption is too weak
B. Community strings are sent in cleartext
C. It uses TCP instead of UDP
D. Lack of support for MIBs
Correct Answer: B
Rationale: SNMPv1 and SNMPv2c transmit community strings, which act as passwords, in
cleartext across the network. If an attacker can sniff the network traffic, they can easily
,capture these strings to gain unauthorized access to device configurations. Modern security
standards recommend upgrading to SNMPv3, which provides robust encryption and
authentication mechanisms.
4. In the context of the Vulnerability Management Life Cycle, which phase involves the actual
implementation of patches and configuration changes?
A. Remediation
B. Assessment
C. Verification
D. Detection
Correct Answer: A
Rationale: The Remediation phase is the stage where identified vulnerabilities are
addressed through patching, configuration hardening, or decommissioning of systems. This
step follows the assessment phase, where vulnerabilities are categorized and prioritized
based on risk. After remediation, a verification step is necessary to ensure the fixes were
successful and did not introduce new issues.
5. Which type of password attack involves the use of a precomputed table of cryptographic
hashes to quickly reverse a hashed password?
A. Brute-force attack
B. Dictionary attack
C. Rainbow table attack
, D. Birthday attack
Correct Answer: C
Rationale: A rainbow table attack uses large, precomputed tables of hashes to reduce the
time needed to crack a password by looking up the hash instead of calculating it. This
method is highly effective against systems that use weak hashing algorithms without salts.
To mitigate this risk, security professionals implement salting, which makes precomputed
tables useless.
6. A malware analyst discovers a piece of software that encrypts user files and demands
payment in cryptocurrency to restore access. How is this malware categorized?
A. Trojan
B. Spyware
C. Ransomware
D. Adware
Correct Answer: C
Rationale: Ransomware is a specific type of malicious software designed to block access to
a computer system or files until a sum of money is paid. It typically utilizes strong
encryption to lock data, making recovery nearly impossible without the decryption key.
This form of attack has become a major threat to both individuals and large organizations
globally.
(CEH) | Q&A with Rationale (CEH Exam) |
EC-Council
1. An ethical hacker is performing a network scan and wants to identify the operating system
of the target devices without completing a full TCP connection. Which Nmap flag should be
utilized?
A. -sT
B. -sP
C. -sU
D. -sS
Correct Answer: D
Rationale: The -sS flag initiates a TCP SYN scan, commonly referred to as a half-open scan
because it does not complete the three-way handshake. This method is effective for
identifying open ports and gathering OS fingerprints while remaining relatively stealthy
compared to a full connect scan. By monitoring the responses to SYN packets, Nmap can
infer the target’s operating system characteristics.
2. When conducting a footprinting exercise, which DNS record would provide an ethical
hacker with information regarding the organization’s mail server?
A. A record
,B. PTR record
C. NS record
D. MX record
Correct Answer: D
Rationale: The MX (Mail Exchanger) record specifies the mail servers responsible for
receiving email on behalf of a domain. Identifying these servers is a critical step in the
reconnaissance phase as it reveals potential targets for email-based attacks. Ethical hackers
use this information to map out the infrastructure and determine where communication
traffic is directed.
3. An attacker uses a specialized tool to capture network traffic and discovers that a device is
communicating via SNMPv1. What is the primary security vulnerability associated with this
protocol?
A. Encryption is too weak
B. Community strings are sent in cleartext
C. It uses TCP instead of UDP
D. Lack of support for MIBs
Correct Answer: B
Rationale: SNMPv1 and SNMPv2c transmit community strings, which act as passwords, in
cleartext across the network. If an attacker can sniff the network traffic, they can easily
,capture these strings to gain unauthorized access to device configurations. Modern security
standards recommend upgrading to SNMPv3, which provides robust encryption and
authentication mechanisms.
4. In the context of the Vulnerability Management Life Cycle, which phase involves the actual
implementation of patches and configuration changes?
A. Remediation
B. Assessment
C. Verification
D. Detection
Correct Answer: A
Rationale: The Remediation phase is the stage where identified vulnerabilities are
addressed through patching, configuration hardening, or decommissioning of systems. This
step follows the assessment phase, where vulnerabilities are categorized and prioritized
based on risk. After remediation, a verification step is necessary to ensure the fixes were
successful and did not introduce new issues.
5. Which type of password attack involves the use of a precomputed table of cryptographic
hashes to quickly reverse a hashed password?
A. Brute-force attack
B. Dictionary attack
C. Rainbow table attack
, D. Birthday attack
Correct Answer: C
Rationale: A rainbow table attack uses large, precomputed tables of hashes to reduce the
time needed to crack a password by looking up the hash instead of calculating it. This
method is highly effective against systems that use weak hashing algorithms without salts.
To mitigate this risk, security professionals implement salting, which makes precomputed
tables useless.
6. A malware analyst discovers a piece of software that encrypts user files and demands
payment in cryptocurrency to restore access. How is this malware categorized?
A. Trojan
B. Spyware
C. Ransomware
D. Adware
Correct Answer: C
Rationale: Ransomware is a specific type of malicious software designed to block access to
a computer system or files until a sum of money is paid. It typically utilizes strong
encryption to lock data, making recovery nearly impossible without the decryption key.
This form of attack has become a major threat to both individuals and large organizations
globally.
