Questions & answers (free, no sign-in needed)

10 beginner questions on the CEH Exam Blueprint v5.0 domains: authorization before testing, passive footprinting and Nmap SYN scans, password salting and worms, ARP poisoning and social engineering, SQL injection defenses, WPA3 and symmetric encryption.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

1. A company hires an ethical hacker to test its network. What must the tester have before starting any testing?

   • A. A list of the employees' personal passwords
   • B. A copy of the company's annual financial report
   • C. Written authorization that defines the scope and rules of engagement ✔ correct
   • D. Administrator access to every server in the company

   Answer: C. Testing without permission is illegal hacking. NIST SP 800-115 stresses documented approval and rules of engagement that define what may be tested, when and how, before any assessment begins.

   Source: csrc.nist.gov/pubs/sp/800/115/final · Domain: Information Security and Ethical Hacking Overview

2. Which footprinting activity gathers information about a target organization without sending any traffic to the organization's own systems?

   • A. Running a TCP SYN scan against its public IP range
   • B. Querying public WHOIS data for its registered domain ✔ correct
   • C. Grabbing the banner from its web server on port 80
   • D. Sending a ping sweep across its office network

   Answer: B. WHOIS data is held by registries and registrars, and anyone can query it for details such as IP blocks, contacts and name servers, so the target sees no traffic. Scans, banner grabbing and ping sweeps all touch the target directly (active reconnaissance).

   Source: attack.mitre.org/techniques/T1596/002/ · Domain: Reconnaissance Techniques

3. Which Nmap option runs a TCP SYN scan, also called a "half-open" scan because the three-way handshake is never completed?

   • A. -sU
   • B. -sV
   • C. -O
   • D. -sS ✔ correct

   Answer: D. -sS sends a SYN and reads the reply (SYN/ACK means open, RST means closed) without completing the handshake. -sU scans UDP ports, -sV detects service versions and -O detects the operating system.

   Source: nmap.org/book/synscan.html · Domain: Reconnaissance Techniques

4. A developer stores user passwords as hashes. Which measure stops attackers from using precomputed rainbow tables against the stolen hashes?

   • A. Adding a unique random salt to each password before hashing ✔ correct
   • B. Storing the hashes in a different database table
   • C. Converting all passwords to uppercase before hashing
   • D. Using a shorter hash output to save storage space

   Answer: A. A unique salt per password means precomputed tables no longer match, and identical passwords produce different hashes. OWASP also recommends slow algorithms such as Argon2id, bcrypt or PBKDF2.

   Source: cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html · Domain: System Hacking Phases and Attack Techniques

5. A computer worm can spread to other systems on a network by itself, without a user opening an infected file.

   • A. True ✔ correct
   • B. False

   Answer: A. True. A worm is a self-replicating program that propagates through a network to other systems without needing a host program or user action. A virus, by contrast, attaches to a host file and usually needs that file to run.

   Source: csrc.nist.gov/glossary/term/worm · Domain: System Hacking Phases and Attack Techniques

6. An attacker on the same LAN as a user sends forged ARP replies so that the user's traffic to the default gateway passes through the attacker's machine. What is this attack called?

   • A. DNS tunneling
   • B. SYN flooding
   • C. ARP cache poisoning ✔ correct
   • D. MAC address filtering

   Answer: C. ARP cache poisoning (ARP spoofing) links the attacker's MAC address to another host's IP address in victims' ARP caches, putting the attacker in the middle of the traffic. A SYN flood is a denial-of-service attack.

   Source: attack.mitre.org/techniques/T1557/002/ · Domain: Network and Perimeter Hacking

7. Which two are social engineering techniques? (Select TWO)

   • A. Phishing emails that pose as a trusted organization ✔ correct
   • B. Vishing calls that trick people over the phone ✔ correct
   • C. SQL injection through a website login form
   • D. A SYN flood against a public web server
   • E. Port scanning a firewall from the internet

   Answer: A, B. Social engineering uses human interaction to obtain information. Phishing uses email or fake websites posing as trusted organizations, and vishing uses voice calls. SQL injection, SYN floods and port scans are technical attacks.

   Source: www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks · Domain: Network and Perimeter Hacking

8. Which defense is the primary way to prevent SQL injection in an application's database queries?

   • A. Hiding database error messages from users
   • B. Prepared statements with parameterized queries ✔ correct
   • C. Renaming the database tables regularly
   • D. Running the web server on a non-standard port

   Answer: B. Prepared statements with parameterized queries keep user input as data, so it cannot change the SQL command. OWASP lists them as the first defense. Hiding errors or renaming tables only slows an attacker down.

   Source: cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html · Domain: Web Application Hacking

9. A small business wants its office Wi-Fi to give the strongest protection against password guessing on a personal (pre-shared password) network. Which security option should it choose?

   • A. WEP
   • B. WPA with TKIP
   • C. An open network with MAC filtering
   • D. WPA3-Personal ✔ correct

   Answer: D. The Wi-Fi Alliance states that WPA3 gives personal networks stronger protection against password guessing and disallows outdated legacy protocols. WEP and WPA-TKIP are legacy, and MAC filtering is easy to bypass.

   Source: www.wi-fi.org/discover-wi-fi/security · Domain: Wireless Network Hacking

10. Which type of cryptographic algorithm uses the same secret key to both encrypt and decrypt data?

    • A. A symmetric-key algorithm, such as AES ✔ correct
    • B. An asymmetric algorithm, such as RSA
    • C. A hash function, such as SHA-256
    • D. A digital signature scheme, such as ECDSA

    Answer: A. A symmetric-key algorithm employs the same secret key for an operation and its complement, such as encryption and decryption. Asymmetric algorithms use a public and private key pair, and hash functions use no decryption key at all.

    Source: csrc.nist.gov/glossary/term/symmetric_key_algorithm · Domain: Cryptography

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public EC-Council exam objectives (CEH v13 (CEH AI), CEH Exam Blueprint v5.0), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by EC-Council; exam names are trademarks of their owners. Official exam page: cert.eccouncil.org/certified-ethical-hacker.html.