Ethical Hacking & Penetration Testing (CEH) Final Exam Test Bank 2026 –
190 Multiple Choice Questions & Answers | Complete University &
Professional Certification Study Guide, Practice Examination, Exam Review
& Test Preparation | 4-Option MCQs (A, B, C, D) | CEH Concepts,
Cybersecurity, Network Security, Vulnerability Assessment, Penetration
Testing, Threats, Attacks & Security Techniques
1. A penetration tester is reviewing a contract that defines the scope of an upcoming engagement. The
contract explicitly states that the client will not hold the tester liable for any accidental data corruption
or service disruption that occurs during the test. Which key legal document is being described?
A. Service Level Agreement (SLA)
B. Non-Disclosure Agreement (NDA)
C. Rules of Engagement (RoE)
D. Indemnification Clause
Correct Answer: D
Explanation: An indemnification clause is a contractual provision where one party agrees to compensate
the other for certain losses or damages, protecting the tester from liability.
,2. During the reconnaissance phase, a security analyst uses a tool to query DNS servers and discovers
that www.example.com is an alias for server1.example.com. Which type of DNS record was used to
provide this information?
A. A
B. MX
C. CNAME
D. TXT
Correct Answer: C
Explanation: A Canonical Name (CNAME) record is used to create an alias from one domain name to
another, mapping www.example.com to its true name.
3. A penetration tester is attempting to identify live hosts on a target subnet without generating
traditional ICMP echo requests, which are often blocked by firewalls. Which scanning technique would
be most effective for this purpose?
A. TCP SYN Scan
B. ICMP Sweep
C. ARP Scan
D. UDP Scan
,Correct Answer: C
Explanation: An ARP scan operates at Layer 2 and is highly effective on local subnets, as ARP requests
are typically not filtered by host-based firewalls.
4. An ethical hacker has gained a low-privileged shell on a Linux server. They discover a binary file with
the SUID bit set, owned by root. What is the primary security risk associated with this finding?
A. The file can be modified by any user, leading to a denial of service.
B. The file can be executed by any user with the privileges of the root user.
C. The file's contents are unencrypted and can be read by any user.
D. The file creates a backdoor that allows for remote access without authentication.
Correct Answer: B
Explanation: An SUID binary runs with the permissions of its owner (root), so if it's vulnerable, an
attacker can exploit it to execute commands with root privileges.
5. A web application is vulnerable to SQL injection. The tester inputs the string ' OR '1'='1 into a login
form's username field and successfully bypasses authentication. What is the underlying cause of this
vulnerability?
A. The application uses client-side validation for input sanitization.
, B. The application stores user credentials in plaintext.
C. The application fails to properly sanitize user input before including it in a SQL query.
D. The application uses a weak hashing algorithm for passwords.
Correct Answer: C
Explanation: SQL injection occurs when untrusted user input is improperly concatenated into a database
query, allowing the input to be interpreted as SQL code.
6. During a black-box penetration test, a tester uses nmap -sS -p- <target_ip>. What is the primary
purpose of the -sS flag in this command?
A. To perform a UDP scan on all ports.
B. To perform a stealthy TCP SYN scan.
C. To perform a service version detection scan.
D. To perform a scan using the TCP connect() method.
Correct Answer: B
Explanation: The -sS flag initiates a TCP SYN scan, also known as a half-open scan, which is stealthier as it
never completes the TCP handshake.
190 Multiple Choice Questions & Answers | Complete University &
Professional Certification Study Guide, Practice Examination, Exam Review
& Test Preparation | 4-Option MCQs (A, B, C, D) | CEH Concepts,
Cybersecurity, Network Security, Vulnerability Assessment, Penetration
Testing, Threats, Attacks & Security Techniques
1. A penetration tester is reviewing a contract that defines the scope of an upcoming engagement. The
contract explicitly states that the client will not hold the tester liable for any accidental data corruption
or service disruption that occurs during the test. Which key legal document is being described?
A. Service Level Agreement (SLA)
B. Non-Disclosure Agreement (NDA)
C. Rules of Engagement (RoE)
D. Indemnification Clause
Correct Answer: D
Explanation: An indemnification clause is a contractual provision where one party agrees to compensate
the other for certain losses or damages, protecting the tester from liability.
,2. During the reconnaissance phase, a security analyst uses a tool to query DNS servers and discovers
that www.example.com is an alias for server1.example.com. Which type of DNS record was used to
provide this information?
A. A
B. MX
C. CNAME
D. TXT
Correct Answer: C
Explanation: A Canonical Name (CNAME) record is used to create an alias from one domain name to
another, mapping www.example.com to its true name.
3. A penetration tester is attempting to identify live hosts on a target subnet without generating
traditional ICMP echo requests, which are often blocked by firewalls. Which scanning technique would
be most effective for this purpose?
A. TCP SYN Scan
B. ICMP Sweep
C. ARP Scan
D. UDP Scan
,Correct Answer: C
Explanation: An ARP scan operates at Layer 2 and is highly effective on local subnets, as ARP requests
are typically not filtered by host-based firewalls.
4. An ethical hacker has gained a low-privileged shell on a Linux server. They discover a binary file with
the SUID bit set, owned by root. What is the primary security risk associated with this finding?
A. The file can be modified by any user, leading to a denial of service.
B. The file can be executed by any user with the privileges of the root user.
C. The file's contents are unencrypted and can be read by any user.
D. The file creates a backdoor that allows for remote access without authentication.
Correct Answer: B
Explanation: An SUID binary runs with the permissions of its owner (root), so if it's vulnerable, an
attacker can exploit it to execute commands with root privileges.
5. A web application is vulnerable to SQL injection. The tester inputs the string ' OR '1'='1 into a login
form's username field and successfully bypasses authentication. What is the underlying cause of this
vulnerability?
A. The application uses client-side validation for input sanitization.
, B. The application stores user credentials in plaintext.
C. The application fails to properly sanitize user input before including it in a SQL query.
D. The application uses a weak hashing algorithm for passwords.
Correct Answer: C
Explanation: SQL injection occurs when untrusted user input is improperly concatenated into a database
query, allowing the input to be interpreted as SQL code.
6. During a black-box penetration test, a tester uses nmap -sS -p- <target_ip>. What is the primary
purpose of the -sS flag in this command?
A. To perform a UDP scan on all ports.
B. To perform a stealthy TCP SYN scan.
C. To perform a service version detection scan.
D. To perform a scan using the TCP connect() method.
Correct Answer: B
Explanation: The -sS flag initiates a TCP SYN scan, also known as a half-open scan, which is stealthier as it
never completes the TCP handshake.
