CEH CERTIFICATION EXAM STUDY SET — 2026/2027
CEH CERTIFICATION EXAM STUDY SET | 2026/2027
Edition | 125 Verified Questions
Certified Ethical Hacker (CEH) Certification – All Chapters Practice EXAM LATEST 2026-
2027
100% Verified Solutions | Updated Per Latest EC-Council Guidelines | Graded A+
This comprehensive study set is designed for cybersecurity professionals preparing for the Certified
Ethical Hacker (CEH) certification examination aligned with the 2026/2027 EC-Council curriculum. The
125 questions contained herein span five core domains—Reconnaissance & Scanning, System Hacking &
Malware, Network Sniffing & Social Engineering, Web Apps & Cloud Security, and Cryptography &
IoT/OT—and have been meticulously crafted to reflect current penetration testing methodologies,
modern attack vectors, and EC-Council's latest security frameworks. Each question includes a detailed
rationale, an explanation of why distractors are incorrect, and a specific reference to the CEH course
module, EC-Council manual chapter, or industry standard from which the item is derived.
──────────────────────────────────────────────────────────────────
───────────────────
Key Features
✓ Comprehensive footprinting and reconnaissance techniques covering OSINT, DNS enumeration,
and passive information gathering
✓ Advanced scanning and enumeration methodologies including Nmap techniques, vulnerability
assessment, and firewall evasion
✓ System hacking and privilege escalation tactics with hands-on tool knowledge (Metasploit, Hashcat,
Mimikatz)
✓ Malware threats and payload analysis encompassing ransomware, rootkits, trojans, and anti-
forensics
✓ Web application and cloud security testing aligned with OWASP Top 10, container security, and
IAM exploitation
Updates for 2026
AI-Driven Attack Vectors and Defense Mechanisms: The 2026/2027 CEH curriculum introduces
modules on adversarial AI, deepfake-enabled social engineering, AI-powered vulnerability scanning, and
machine learning-based intrusion detection evasion techniques. Questions in this study set reflect the
growing intersection of artificial intelligence and offensive security operations.
Expanded IoT/OT and SCADA Hacking Modules: Updated content now covers Industrial Control
System (ICS) protocols, PLC firmware analysis, Modbus/DNP3 security weaknesses, and OT network
segmentation strategies. The expansion reflects the increasing targeting of critical infrastructure by
advanced persistent threats and the convergence of IT and OT environments.
Updated Cloud Security and Container Penetration Testing Protocols: Revised modules
address Kubernetes RBAC misconfigurations, serverless function security, cloud IAM privilege escalation
chains, and container escape techniques. These updates align with the rapid adoption of cloud-native
architectures and the evolving threat landscape in multi-cloud deployments.
Abstract
This document presents a comprehensive 125-question study set designed to assess and reinforce the
knowledge and practical competencies required for the Certified Ethical Hacker (CEH) certification
examination per the 2026/2027 EC-Council curriculum. Grounded in current penetration testing
Page 1
, CEH CERTIFICATION EXAM STUDY SET — 2026/2027
methodologies, the OWASP Top 10 framework, and the NIST Cybersecurity Framework, the study set
addresses five core domains of ethical hacking: reconnaissance and network scanning, system
compromise and malware analysis, network interception and social engineering tactics, web application
and cloud security assessment, and cryptographic implementations alongside Internet of Things (IoT) and
Operational Technology (OT) security. Each question is accompanied by an evidence-based rationale, an
analysis of distractor incorrectness, and a citation linking the item to the relevant CEH course module,
EC-Council official manual chapter, or authoritative industry standard. The study set serves as both a
formative assessment tool for self-study and a summative preparation resource for the CEH examination,
integrating recent developments in AI-driven attack vectors, expanded IoT/OT security modules, and
updated cloud penetration testing protocols to ensure alignment with the contemporary cybersecurity
threat landscape and professional certification requirements.
Keywords
CEH, Ethical Hacking, Penetration Testing, Kali Linux, Metasploit, OWASP, Vulnerability Assessment,
EC-Council, Network Security, Cryptography
Answer Format
All correct answers are presented in bold. Each question includes a detailed rationale (italicized)
explaining why the correct option is the best answer. A Why Wrong section follows each rationale,
providing concise explanations of why each distractor is incorrect. A specific Reference citation links each
question to its source CEH module, EC-Council manual chapter, or industry standard (e.g., OWASP Top
10, NIST).
Content Area Overview
Content Area Questions Key Topics Weight
Reconnaissance & 30 Active/passive reconnaissance, OSINT, Footprinting 24.0%
Scanning tools (Maltego, Recon-ng), DNS enumeration,
WHOIS, Google dorking, Nmap scanning, Port
scanning, Vulnerability scanning (Nessus,
OpenVAS), Banner grabbing, SNMP/SMB
enumeration, Firewall evasion
System Hacking & 25 Password cracking (Hashcat, John the Ripper), 20.0%
Malware Privilege escalation, Keyloggers, Rootkits, Trojans,
Ransomware, Malware analysis, Viruses/worms,
Covering tracks, Metasploit, Post-exploitation,
Lateral movement, Persistence, Anti-forensics
Network Sniffing & 25 Packet sniffing (Wireshark, tcpdump), ARP spoofing, 20.0%
Social Engineering MAC flooding, DNS spoofing, MITM attacks,
SSL/TLS stripping, Phishing, Pretexting, Baiting,
Tailgating, Vishing, Session hijacking, Social
engineering countermeasures
Web Apps & Cloud 25 OWASP Top 10, SQL injection, XSS, CSRF, Directory 20.0%
Security traversal, LFI/RFI, Command injection, Broken
authentication, XXE, SSRF, Cloud security
(AWS/Azure/GCP), Container security, API security,
WAF evasion, IAM exploitation
Cryptography & IoT/OT 20 Symmetric/asymmetric encryption, Hashing, Digital 16.0%
signatures, PKI, SSL/TLS, VPN (IPsec),
Cryptographic attacks, IoT hacking, OT/SCADA
security, Side-channel attacks, Quantum threats,
Blockchain security, Post-quantum cryptography
TOTAL 125 Comprehensive Ethical Hacking Competency 100%
──────────────────────────────────────────────────────────────────
───────────────────
Page 2
, CEH CERTIFICATION EXAM STUDY SET — 2026/2027
Examination Questions
Domain: Reconnaissance & Scanning
1. A penetration tester wants to perform a stealthy scan of a target network without
sending packets directly from their own IP address. Which Nmap scan technique should
the tester use?
A. TCP connect scan (-sT)
B. UDP scan (-sU)
C. Idle scan (-sI)
D. FIN scan (-sF)
Correct Answer: C
Rationale: The idle scan (-sI) is a stealthy scanning technique that uses a zombie host to send packets
to the target, making the scan appear to originate from the zombie machine rather than the
attacker's IP. This technique exploits the predictable IPID increment behavior of the zombie host to
determine open ports indirectly. It is the only Nmap scan type that allows the attacker to remain
completely hidden from the target.
Why Wrong: Option A (-sT) is a full TCP connection scan that directly reveals the tester's IP address.
Option B (-sU) is a UDP scan that also sends packets directly from the tester. Option D (-sF) sends
FIN packets directly from the tester, which while stealthier than SYN scans, still reveals the source IP.
Reference: EC-Council CEH v13 Module 03: Scanning Networks; Nmap Documentation: Idle Scan
Technique (https://nmap.org/book/idlescan.html)
2. During a passive reconnaissance engagement, a security analyst wants to collect email
addresses, subdomains, and IP ranges associated with a target organization without
directly interacting with the target's systems. Which tool is best suited for this task?
A. theHarvester
B. Nmap
C. Nessus
D. Metasploit
Correct Answer: A
Rationale: theHarvester is an OSINT tool specifically designed to gather email addresses,
subdomains, IP addresses, and URLs from public sources such as search engines, PGP key servers,
and SHODAN without directly interacting with the target. It operates entirely through passive
reconnaissance by querying third-party data sources. This makes it ideal for collecting intelligence
while maintaining stealth.
Why Wrong: Option A (Nmap) is an active scanning tool that directly probes target systems. Option
C (Nessus) is a vulnerability scanner that requires active interaction with targets. Option D
(Metasploit) is an exploitation framework used for active penetration testing, not passive OSINT
gathering.
Reference: EC-Council CEH v13 Module 02: Footprinting and Reconnaissance; theHarvester GitHub
Documentation (https://github.com/laramies/theHarvester)
3. A penetration tester runs the command `nmap -sS -O 10.0.0.1` against a target. The scan
returns the result 'OS: Linux 3.x - 4.x' but no open ports are shown. What is the most likely
explanation for this result?
A. The target is running a honeypot that responds to OS detection but blocks port scans
B. The target firewall is allowing some packets through for OS fingerprinting while blocking port scan
responses
C. The SYN scan is incompatible with OS detection and produced unreliable results
D. The target has all ports filtered, but OS detection uses different packet types that evaded the
firewall
Correct Answer: D
Page 3
, CEH CERTIFICATION EXAM STUDY SET — 2026/2027
Rationale: OS fingerprinting (-O) in Nmap uses a combination of TCP, UDP, and ICMP probes that
differ from the standard SYN scan packets, which can sometimes bypass firewall rules that block SYN
scan responses. When all ports appear filtered but OS detection succeeds, it typically means the
firewall is specifically blocking SYN packets to ports while allowing other probe types through.
Nmap's OS detection sends specially crafted packets that may not match the firewall's filtering rules.
Why Wrong: Option A is unlikely because a honeypot would typically show open ports to attract
attackers. Option B incorrectly suggests the firewall is selectively allowing OS detection; firewalls
filter based on packet types, not the intent of the scan. Option C is incorrect because SYN scan (-sS) is
fully compatible with OS detection (-O) and they are commonly used together.
Reference: EC-Council CEH v13 Module 03: Scanning Networks; Nmap Documentation: OS
Detection (https://nmap.org/book/man-os-detection.html)
4. A security analyst is performing OSINT and wants to discover relationships between
people, organizations, and infrastructure using data from social media, DNS records, and
other public sources. Which tool provides a visual graph-based approach to link analysis
for this purpose?
A. Recon-ng
B. Wireshark
C. Nikto
D. Maltego
Correct Answer: D
Rationale: Maltego is a graphical link analysis tool that visualizes relationships between entities such
as people, organizations, domains, IP addresses, and infrastructure using data from public sources
and APIs. It uses transforms to automatically query OSINT databases and present results in an
interactive graph format. This visual approach makes it uniquely suited for discovering and mapping
complex relationships during reconnaissance.
Why Wrong: Option A (Recon-ng) is a command-line reconnaissance framework that does not
provide native visual graph-based link analysis. Option C (Nikto) is a web server vulnerability
scanner, not an OSINT or link analysis tool. Option D (Wireshark) is a network packet analyzer used
for traffic inspection, not OSINT gathering or relationship mapping.
Reference: EC-Council CEH v13 Module 02: Footprinting and Reconnaissance; Maltego
Documentation (https://docs.maltego.com/)
5. A penetration tester needs to enumerate DNS records for a target domain to discover
subdomains, mail servers, and name servers. They execute the command `dig axfr
target.com @ns1.target.com` and receive a full zone transfer. What does this indicate
about the target's DNS configuration?
A. The target is using DNSSEC for authentication
B. The target is using round-robin DNS load balancing
C. The DNS server is configured to allow unrestricted zone transfers to any requester
D. The DNS server has been compromised by an attacker
Correct Answer: C
Rationale: A successful AXFR (full zone transfer) query to a DNS server indicates that the server is
misconfigured to allow zone transfers to unauthorized or any IP addresses. Zone transfers should
normally be restricted to trusted secondary DNS servers only. When a server allows unrestricted
zone transfers, it exposes the entire DNS zone data including all subdomains, mail servers, and
internal network information, which is a significant security misconfiguration.
Why Wrong: Option A is incorrect because DNSSEC provides data integrity and authentication but
does not control zone transfer permissions. Option C is incorrect because round-robin DNS is a load-
balancing technique unrelated to zone transfer access control. Option D is incorrect because a
successful zone transfer indicates misconfiguration, not necessarily compromise; this is a common
default or oversight rather than evidence of an attack.
Reference: EC-Council CEH v13 Module 02: Footprinting and Reconnaissance; RFC 5936: DNS Zone
Transfer Protocol
Page 4
CEH CERTIFICATION EXAM STUDY SET | 2026/2027
Edition | 125 Verified Questions
Certified Ethical Hacker (CEH) Certification – All Chapters Practice EXAM LATEST 2026-
2027
100% Verified Solutions | Updated Per Latest EC-Council Guidelines | Graded A+
This comprehensive study set is designed for cybersecurity professionals preparing for the Certified
Ethical Hacker (CEH) certification examination aligned with the 2026/2027 EC-Council curriculum. The
125 questions contained herein span five core domains—Reconnaissance & Scanning, System Hacking &
Malware, Network Sniffing & Social Engineering, Web Apps & Cloud Security, and Cryptography &
IoT/OT—and have been meticulously crafted to reflect current penetration testing methodologies,
modern attack vectors, and EC-Council's latest security frameworks. Each question includes a detailed
rationale, an explanation of why distractors are incorrect, and a specific reference to the CEH course
module, EC-Council manual chapter, or industry standard from which the item is derived.
──────────────────────────────────────────────────────────────────
───────────────────
Key Features
✓ Comprehensive footprinting and reconnaissance techniques covering OSINT, DNS enumeration,
and passive information gathering
✓ Advanced scanning and enumeration methodologies including Nmap techniques, vulnerability
assessment, and firewall evasion
✓ System hacking and privilege escalation tactics with hands-on tool knowledge (Metasploit, Hashcat,
Mimikatz)
✓ Malware threats and payload analysis encompassing ransomware, rootkits, trojans, and anti-
forensics
✓ Web application and cloud security testing aligned with OWASP Top 10, container security, and
IAM exploitation
Updates for 2026
AI-Driven Attack Vectors and Defense Mechanisms: The 2026/2027 CEH curriculum introduces
modules on adversarial AI, deepfake-enabled social engineering, AI-powered vulnerability scanning, and
machine learning-based intrusion detection evasion techniques. Questions in this study set reflect the
growing intersection of artificial intelligence and offensive security operations.
Expanded IoT/OT and SCADA Hacking Modules: Updated content now covers Industrial Control
System (ICS) protocols, PLC firmware analysis, Modbus/DNP3 security weaknesses, and OT network
segmentation strategies. The expansion reflects the increasing targeting of critical infrastructure by
advanced persistent threats and the convergence of IT and OT environments.
Updated Cloud Security and Container Penetration Testing Protocols: Revised modules
address Kubernetes RBAC misconfigurations, serverless function security, cloud IAM privilege escalation
chains, and container escape techniques. These updates align with the rapid adoption of cloud-native
architectures and the evolving threat landscape in multi-cloud deployments.
Abstract
This document presents a comprehensive 125-question study set designed to assess and reinforce the
knowledge and practical competencies required for the Certified Ethical Hacker (CEH) certification
examination per the 2026/2027 EC-Council curriculum. Grounded in current penetration testing
Page 1
, CEH CERTIFICATION EXAM STUDY SET — 2026/2027
methodologies, the OWASP Top 10 framework, and the NIST Cybersecurity Framework, the study set
addresses five core domains of ethical hacking: reconnaissance and network scanning, system
compromise and malware analysis, network interception and social engineering tactics, web application
and cloud security assessment, and cryptographic implementations alongside Internet of Things (IoT) and
Operational Technology (OT) security. Each question is accompanied by an evidence-based rationale, an
analysis of distractor incorrectness, and a citation linking the item to the relevant CEH course module,
EC-Council official manual chapter, or authoritative industry standard. The study set serves as both a
formative assessment tool for self-study and a summative preparation resource for the CEH examination,
integrating recent developments in AI-driven attack vectors, expanded IoT/OT security modules, and
updated cloud penetration testing protocols to ensure alignment with the contemporary cybersecurity
threat landscape and professional certification requirements.
Keywords
CEH, Ethical Hacking, Penetration Testing, Kali Linux, Metasploit, OWASP, Vulnerability Assessment,
EC-Council, Network Security, Cryptography
Answer Format
All correct answers are presented in bold. Each question includes a detailed rationale (italicized)
explaining why the correct option is the best answer. A Why Wrong section follows each rationale,
providing concise explanations of why each distractor is incorrect. A specific Reference citation links each
question to its source CEH module, EC-Council manual chapter, or industry standard (e.g., OWASP Top
10, NIST).
Content Area Overview
Content Area Questions Key Topics Weight
Reconnaissance & 30 Active/passive reconnaissance, OSINT, Footprinting 24.0%
Scanning tools (Maltego, Recon-ng), DNS enumeration,
WHOIS, Google dorking, Nmap scanning, Port
scanning, Vulnerability scanning (Nessus,
OpenVAS), Banner grabbing, SNMP/SMB
enumeration, Firewall evasion
System Hacking & 25 Password cracking (Hashcat, John the Ripper), 20.0%
Malware Privilege escalation, Keyloggers, Rootkits, Trojans,
Ransomware, Malware analysis, Viruses/worms,
Covering tracks, Metasploit, Post-exploitation,
Lateral movement, Persistence, Anti-forensics
Network Sniffing & 25 Packet sniffing (Wireshark, tcpdump), ARP spoofing, 20.0%
Social Engineering MAC flooding, DNS spoofing, MITM attacks,
SSL/TLS stripping, Phishing, Pretexting, Baiting,
Tailgating, Vishing, Session hijacking, Social
engineering countermeasures
Web Apps & Cloud 25 OWASP Top 10, SQL injection, XSS, CSRF, Directory 20.0%
Security traversal, LFI/RFI, Command injection, Broken
authentication, XXE, SSRF, Cloud security
(AWS/Azure/GCP), Container security, API security,
WAF evasion, IAM exploitation
Cryptography & IoT/OT 20 Symmetric/asymmetric encryption, Hashing, Digital 16.0%
signatures, PKI, SSL/TLS, VPN (IPsec),
Cryptographic attacks, IoT hacking, OT/SCADA
security, Side-channel attacks, Quantum threats,
Blockchain security, Post-quantum cryptography
TOTAL 125 Comprehensive Ethical Hacking Competency 100%
──────────────────────────────────────────────────────────────────
───────────────────
Page 2
, CEH CERTIFICATION EXAM STUDY SET — 2026/2027
Examination Questions
Domain: Reconnaissance & Scanning
1. A penetration tester wants to perform a stealthy scan of a target network without
sending packets directly from their own IP address. Which Nmap scan technique should
the tester use?
A. TCP connect scan (-sT)
B. UDP scan (-sU)
C. Idle scan (-sI)
D. FIN scan (-sF)
Correct Answer: C
Rationale: The idle scan (-sI) is a stealthy scanning technique that uses a zombie host to send packets
to the target, making the scan appear to originate from the zombie machine rather than the
attacker's IP. This technique exploits the predictable IPID increment behavior of the zombie host to
determine open ports indirectly. It is the only Nmap scan type that allows the attacker to remain
completely hidden from the target.
Why Wrong: Option A (-sT) is a full TCP connection scan that directly reveals the tester's IP address.
Option B (-sU) is a UDP scan that also sends packets directly from the tester. Option D (-sF) sends
FIN packets directly from the tester, which while stealthier than SYN scans, still reveals the source IP.
Reference: EC-Council CEH v13 Module 03: Scanning Networks; Nmap Documentation: Idle Scan
Technique (https://nmap.org/book/idlescan.html)
2. During a passive reconnaissance engagement, a security analyst wants to collect email
addresses, subdomains, and IP ranges associated with a target organization without
directly interacting with the target's systems. Which tool is best suited for this task?
A. theHarvester
B. Nmap
C. Nessus
D. Metasploit
Correct Answer: A
Rationale: theHarvester is an OSINT tool specifically designed to gather email addresses,
subdomains, IP addresses, and URLs from public sources such as search engines, PGP key servers,
and SHODAN without directly interacting with the target. It operates entirely through passive
reconnaissance by querying third-party data sources. This makes it ideal for collecting intelligence
while maintaining stealth.
Why Wrong: Option A (Nmap) is an active scanning tool that directly probes target systems. Option
C (Nessus) is a vulnerability scanner that requires active interaction with targets. Option D
(Metasploit) is an exploitation framework used for active penetration testing, not passive OSINT
gathering.
Reference: EC-Council CEH v13 Module 02: Footprinting and Reconnaissance; theHarvester GitHub
Documentation (https://github.com/laramies/theHarvester)
3. A penetration tester runs the command `nmap -sS -O 10.0.0.1` against a target. The scan
returns the result 'OS: Linux 3.x - 4.x' but no open ports are shown. What is the most likely
explanation for this result?
A. The target is running a honeypot that responds to OS detection but blocks port scans
B. The target firewall is allowing some packets through for OS fingerprinting while blocking port scan
responses
C. The SYN scan is incompatible with OS detection and produced unreliable results
D. The target has all ports filtered, but OS detection uses different packet types that evaded the
firewall
Correct Answer: D
Page 3
, CEH CERTIFICATION EXAM STUDY SET — 2026/2027
Rationale: OS fingerprinting (-O) in Nmap uses a combination of TCP, UDP, and ICMP probes that
differ from the standard SYN scan packets, which can sometimes bypass firewall rules that block SYN
scan responses. When all ports appear filtered but OS detection succeeds, it typically means the
firewall is specifically blocking SYN packets to ports while allowing other probe types through.
Nmap's OS detection sends specially crafted packets that may not match the firewall's filtering rules.
Why Wrong: Option A is unlikely because a honeypot would typically show open ports to attract
attackers. Option B incorrectly suggests the firewall is selectively allowing OS detection; firewalls
filter based on packet types, not the intent of the scan. Option C is incorrect because SYN scan (-sS) is
fully compatible with OS detection (-O) and they are commonly used together.
Reference: EC-Council CEH v13 Module 03: Scanning Networks; Nmap Documentation: OS
Detection (https://nmap.org/book/man-os-detection.html)
4. A security analyst is performing OSINT and wants to discover relationships between
people, organizations, and infrastructure using data from social media, DNS records, and
other public sources. Which tool provides a visual graph-based approach to link analysis
for this purpose?
A. Recon-ng
B. Wireshark
C. Nikto
D. Maltego
Correct Answer: D
Rationale: Maltego is a graphical link analysis tool that visualizes relationships between entities such
as people, organizations, domains, IP addresses, and infrastructure using data from public sources
and APIs. It uses transforms to automatically query OSINT databases and present results in an
interactive graph format. This visual approach makes it uniquely suited for discovering and mapping
complex relationships during reconnaissance.
Why Wrong: Option A (Recon-ng) is a command-line reconnaissance framework that does not
provide native visual graph-based link analysis. Option C (Nikto) is a web server vulnerability
scanner, not an OSINT or link analysis tool. Option D (Wireshark) is a network packet analyzer used
for traffic inspection, not OSINT gathering or relationship mapping.
Reference: EC-Council CEH v13 Module 02: Footprinting and Reconnaissance; Maltego
Documentation (https://docs.maltego.com/)
5. A penetration tester needs to enumerate DNS records for a target domain to discover
subdomains, mail servers, and name servers. They execute the command `dig axfr
target.com @ns1.target.com` and receive a full zone transfer. What does this indicate
about the target's DNS configuration?
A. The target is using DNSSEC for authentication
B. The target is using round-robin DNS load balancing
C. The DNS server is configured to allow unrestricted zone transfers to any requester
D. The DNS server has been compromised by an attacker
Correct Answer: C
Rationale: A successful AXFR (full zone transfer) query to a DNS server indicates that the server is
misconfigured to allow zone transfers to unauthorized or any IP addresses. Zone transfers should
normally be restricted to trusted secondary DNS servers only. When a server allows unrestricted
zone transfers, it exposes the entire DNS zone data including all subdomains, mail servers, and
internal network information, which is a significant security misconfiguration.
Why Wrong: Option A is incorrect because DNSSEC provides data integrity and authentication but
does not control zone transfer permissions. Option C is incorrect because round-robin DNS is a load-
balancing technique unrelated to zone transfer access control. Option D is incorrect because a
successful zone transfer indicates misconfiguration, not necessarily compromise; this is a common
default or oversight rather than evidence of an attack.
Reference: EC-Council CEH v13 Module 02: Footprinting and Reconnaissance; RFC 5936: DNS Zone
Transfer Protocol
Page 4
