Certified Ethical Hacker (CEH v12) Exam 2026: Professional
Certification Practice Test — Reconnaissance, Scanning,
Enumeration, System Hacking, Web Security, Malware & Penetration
Testing — 190 Multiple-Choice Questions with Answers & Detailed
Rationales
SECTION 1: Introduction to Ethical Hacking (Questions 1-20)
Question 1
A security consultant is hired by a financial institution to test its network defenses. The
consultant discovers a critical vulnerability in the online banking system that could allow
unauthorized fund transfers. Before proceeding with exploitation, what should the
consultant do FIRST?
A. Immediately exploit the vulnerability to demonstrate its severity
B. Document the finding and report it to the client's designated security contact
C. Notify law enforcement about the vulnerability
D. Post the vulnerability on public security forums for peer review
Correct Answer: B
Explanation: Ethical hackers must follow the rules of engagement and report critical findings
to authorized personnel before exploitation. This maintains trust and legal compliance.
Question 2
Which principle distinguishes an ethical hacker from a malicious attacker when both possess
identical technical skills?
,A. Ethical hackers use more sophisticated tools
B. Ethical hackers operate with explicit authorization and defined scope
C. Ethical hackers never exploit vulnerabilities
D. Ethical hackers work exclusively for government agencies
Correct Answer: B
Explanation: Authorization and scope define ethical hacking. Without permission, identical
techniques become illegal attacks regardless of intent or skill level.
Question 3
During a red team engagement, a penetration tester gains domain administrator access and
discovers evidence of an ongoing data breach by an unknown third party. What is the MOST
appropriate immediate action?
A. Continue the engagement as planned and document the finding
B. Immediately notify the client's incident response team through established channels
C. Attempt to trace and identify the third-party attacker
D. Shut down all affected systems to prevent further data loss
Correct Answer: B
Explanation: Active breaches require immediate client notification through proper channels.
Penetration testers should not interfere with ongoing criminal activity or exceed
engagement scope.
Question 4
,What is the PRIMARY purpose of establishing a "get out of jail free" letter before conducting
a penetration test?
A. It protects the tester from legal action if caught by law enforcement
B. It outlines the payment terms for the engagement
C. It provides immunity from all legal consequences
D. It serves as a non-disclosure agreement
Correct Answer: A
Explanation: This authorization document protects testers from legal consequences during
legitimate testing. It confirms the client authorized the activity and defines its scope.
Question 5
A company's security policy requires annual penetration testing. The CISO asks the security
team to conduct the test using only publicly available information without any insider
knowledge. What type of testing is being requested?
A. White-box testing
B. Gray-box testing
C. Black-box testing
D. Crystal-box testing
Correct Answer: C
Explanation: Black-box testing simulates an external attacker with no prior knowledge.
Testers must gather information through reconnaissance like real-world attackers would.
, Question 6
During a penetration test, a tester discovers that a junior administrator has been sharing
passwords via unencrypted email. This was not part of the original scope. How should the
tester handle this finding?
A. Ignore it since it's outside the defined scope
B. Report it to the client as an incidental finding
C. Use the credentials to expand access
D. Publicly disclose the administrator's behavior
Correct Answer: B
Explanation: Incidental findings should be reported to clients even if outside scope. This
provides value and demonstrates professional responsibility without exploiting unrelated
vulnerabilities.
Question 7
Which element is ESSENTIAL in a penetration testing agreement to protect both the tester
and the organization?
A. A clause allowing unlimited testing duration
B. Clearly defined scope, rules of engagement, and emergency contacts
C. Permission to test any system discovered during the engagement
D. Exclusive rights to all discovered vulnerabilities
Correct Answer: B
Certification Practice Test — Reconnaissance, Scanning,
Enumeration, System Hacking, Web Security, Malware & Penetration
Testing — 190 Multiple-Choice Questions with Answers & Detailed
Rationales
SECTION 1: Introduction to Ethical Hacking (Questions 1-20)
Question 1
A security consultant is hired by a financial institution to test its network defenses. The
consultant discovers a critical vulnerability in the online banking system that could allow
unauthorized fund transfers. Before proceeding with exploitation, what should the
consultant do FIRST?
A. Immediately exploit the vulnerability to demonstrate its severity
B. Document the finding and report it to the client's designated security contact
C. Notify law enforcement about the vulnerability
D. Post the vulnerability on public security forums for peer review
Correct Answer: B
Explanation: Ethical hackers must follow the rules of engagement and report critical findings
to authorized personnel before exploitation. This maintains trust and legal compliance.
Question 2
Which principle distinguishes an ethical hacker from a malicious attacker when both possess
identical technical skills?
,A. Ethical hackers use more sophisticated tools
B. Ethical hackers operate with explicit authorization and defined scope
C. Ethical hackers never exploit vulnerabilities
D. Ethical hackers work exclusively for government agencies
Correct Answer: B
Explanation: Authorization and scope define ethical hacking. Without permission, identical
techniques become illegal attacks regardless of intent or skill level.
Question 3
During a red team engagement, a penetration tester gains domain administrator access and
discovers evidence of an ongoing data breach by an unknown third party. What is the MOST
appropriate immediate action?
A. Continue the engagement as planned and document the finding
B. Immediately notify the client's incident response team through established channels
C. Attempt to trace and identify the third-party attacker
D. Shut down all affected systems to prevent further data loss
Correct Answer: B
Explanation: Active breaches require immediate client notification through proper channels.
Penetration testers should not interfere with ongoing criminal activity or exceed
engagement scope.
Question 4
,What is the PRIMARY purpose of establishing a "get out of jail free" letter before conducting
a penetration test?
A. It protects the tester from legal action if caught by law enforcement
B. It outlines the payment terms for the engagement
C. It provides immunity from all legal consequences
D. It serves as a non-disclosure agreement
Correct Answer: A
Explanation: This authorization document protects testers from legal consequences during
legitimate testing. It confirms the client authorized the activity and defines its scope.
Question 5
A company's security policy requires annual penetration testing. The CISO asks the security
team to conduct the test using only publicly available information without any insider
knowledge. What type of testing is being requested?
A. White-box testing
B. Gray-box testing
C. Black-box testing
D. Crystal-box testing
Correct Answer: C
Explanation: Black-box testing simulates an external attacker with no prior knowledge.
Testers must gather information through reconnaissance like real-world attackers would.
, Question 6
During a penetration test, a tester discovers that a junior administrator has been sharing
passwords via unencrypted email. This was not part of the original scope. How should the
tester handle this finding?
A. Ignore it since it's outside the defined scope
B. Report it to the client as an incidental finding
C. Use the credentials to expand access
D. Publicly disclose the administrator's behavior
Correct Answer: B
Explanation: Incidental findings should be reported to clients even if outside scope. This
provides value and demonstrates professional responsibility without exploiting unrelated
vulnerabilities.
Question 7
Which element is ESSENTIAL in a penetration testing agreement to protect both the tester
and the organization?
A. A clause allowing unlimited testing duration
B. Clearly defined scope, rules of engagement, and emergency contacts
C. Permission to test any system discovered during the engagement
D. Exclusive rights to all discovered vulnerabilities
Correct Answer: B
