Try 9 Real Questions From Certified Ethical Hacker (CEH) v13 2026 Updated Practice Questions & Answers - 1200 Original Questions with Full Rationales
These are unedited questions from the full 1200-question set, pulled from across every exam domain. Click a question to reveal the answer and the full rationale for every option, exactly as it appears in the PDF.
During an internal assessment, a tester discovers that an AI-powered SOC assistant will summarize alerts, suggest containment steps, and answer analysts' questions using data from internal case notes. Which risk should concern the defender most if the assistant lacks strong prompt and data-access controls?
Show answer & full rationale
A (Correct): If prompt and data-access controls are weak, an attacker may coerce the assistant into revealing case notes, credentials, or investigative steps it should not disclose — an AI-specific confidentiality failure with direct operational impact.
B: CPU usage may affect performance, but it is not the primary security concern described in the scenario.
C: Wireless throughput is unrelated to the core risk of an AI assistant exposing sensitive internal content.
D: DHCP renewal problems are network operations issues, not the central AI-security weakness in this case.
A tester is performing passive reconnaissance against a target organization and wants to identify employee email naming conventions without directly interacting with the target's infrastructure. Which approach is most appropriate?
Show answer & full rationale
A: An aggressive UDP scan directly touches target infrastructure and is active reconnaissance, not passive. It also risks detection.
B (Correct): Public documents, cached pages, and search-engine results often reveal naming conventions without generating target-side traffic, making this passive and low-noise.
C: Password spraying is an attack technique, not passive information gathering. It is intrusive and can trigger controls.
D: ARP scanning requires local network presence and is active enumeration, not usable for passive internet-based reconnaissance.
An assessor is attempting to map a target's network perimeter and identify filtering behavior without fully establishing TCP connections. Which scan is most appropriate?
Show answer & full rationale
A: Full-connect scans complete the handshake and are more conspicuous — not the best fit for the stated goal.
B: Banner grabbing occurs after service reachability is already known; it isn't primarily a perimeter-mapping technique.
C: Idle scans are specialized and don't inherently require packet fragmentation by the tester — the option is misleading.
D (Correct): A SYN scan infers port state using half-open connection behavior, making it efficient for perimeter mapping and firewall analysis — less complete than full-connect but often stealthier and faster.
An assessor gains a low-privilege shell on a Linux server and wants to escalate privileges. Which misconfiguration provides the strongest direct privilege-escalation opportunity?
Show answer & full rationale
A: A non-default SSH port changes service location, not privilege boundaries; it doesn't itself enable escalation.
B (Correct): If a root-owned scheduled task runs a script that low-privilege users can modify, the attacker can inject commands and gain root execution — a direct and common Linux privilege-escalation path.
C: NTP synchronization is normal operations behavior and not a direct privilege-escalation weakness.
D: Allowing ping replies aids troubleshooting and reconnaissance but grants no elevated execution by itself.
A tester retrieves hashed Windows passwords from a compromised host. Which attack is designed to use the hash directly for authentication rather than cracking it first?
Show answer & full rationale
A: Salting is a defensive measure that strengthens stored hashes against precomputed attacks; it is not an attack method.
B: Tokenization is a data-protection approach unrelated to Windows hash abuse.
C: ARP poisoning manipulates local traffic flows on a network segment; it does not authenticate with a stolen hash.
D (Correct): Pass-the-hash uses a valid password hash to authenticate to certain services without recovering the cleartext password — a post-compromise lateral movement technique.
A tester wants to evaluate how resilient an organization's users are to AI-assisted phishing campaigns that generate highly personalized lures. Which control most directly reduces the success of such attacks?
Show answer & full rationale
A: Switch port density has no meaningful relationship to phishing resilience; it addresses capacity, not user deception.
B (Correct): AI can produce convincing phishing content at scale, so user training and mandatory out-of-band verification for risky requests directly reduce social-engineering success.
C: Disabling JavaScript may break many workflows and doesn't stop credential theft through persuasive messaging.
D: MD5 is weaker than SHA-256 and would worsen security, not improve it, and is unrelated to phishing defense.
A tester identifies that a web application reflects unsanitized user input into an HTML page, but no server-side code execution is observed. Which vulnerability is most likely present?
Show answer & full rationale
A: SSRF causes the server to make unintended outbound requests; the scenario describes reflected browser-side behavior instead.
B: Command injection would imply OS command execution on the server, but the prompt specifically notes no server-side code execution.
C: XXE involves unsafe XML parsing; nothing in the scenario indicates XML processing.
D (Correct): When user input is reflected into HTML without proper sanitization and executes in the browser context, the issue is cross-site scripting — client-side code execution in the victim's browser.
Which type of SQL injection allows an attacker to receive database error messages directly in the application's response, revealing table names, column names, or query structure?
Show answer & full rationale
A (Correct): Error-based SQL injection deliberately triggers database errors that are reflected back to the attacker, often revealing valuable schema and query structure information directly in the response.
B: Blind boolean-based injection infers information indirectly from true/false application behavior differences, not from directly visible error messages.
C: Time-based blind injection infers data from response delays, not from visible error output.
D: Out-of-band injection relies on a separate channel (like DNS) to exfiltrate data, not on errors shown in the application's direct response.
A consultant is reviewing a cryptographic design and notes that the application uses a hardcoded symmetric key shared by all installations. What is the biggest weakness?
Show answer & full rationale
A: Perfect forward secrecy is generally associated with ephemeral key exchange, not static shared symmetric keys embedded in all clients — the design does the opposite.
B: Authentication requirements remain necessary even if encryption exists; a static key does not replace identity assurance.
C (Correct): A shared hardcoded symmetric key creates systemic risk: once exposed in one environment or binary, the same secret may be abused everywhere it is reused, breaking compartmentalization.
D: Symmetric cryptography does not provide nonrepudiation the way digital signatures do; shared secrets cannot uniquely prove authorship.
Certified Ethical Hacker (CEH) v13 2026 Updated Practice Questions & Answers - 1200 Original Questions with Full Rationales — $39.99, instant PDF download with full rationale on every answer.
View the practice questions →