Certified Ethical Hacker (CEH v13, "Powered by AI")

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Malware Threats

   Which characteristic distinguishes a worm from a virus?

   1. AA worm needs a user to open an infected document before it can spread to other systems
   2. BA worm spreads across networks on its own, without attaching itself to a host program or file
   3. CA worm can spread only through removable media such as USB flash drives and optical discs
   4. DA worm always encrypts files for ransom, while a virus is limited to stealing data
   Show answer and explanationHide answer

   Correct answer: B

   A worm is self-propagating over network paths and does not need a host file, which is the key difference from a virus. Requiring user action, ransom behavior and removable media are traits of other malware types or delivery methods.

2. Question 2Introduction to Ethical Hacking

   During an authorized web application test, the tester finds that the app calls a third-party payment API hosted by another company. The rules of engagement do not mention that provider. What should the tester do?

   1. AContinue testing the API, since the client's application calls it and therefore it is in scope
   2. BStop testing that API and obtain written authorization from the provider before continuing
   3. CTest the API only at night to reduce the chance of disruption to the provider's other customers
   4. DRun the scanner quietly against the API, then decide later whether the results will be reported
   Show answer and explanationHide answer

   Correct answer: B

   Testing a system you do not have authority over is unauthorized, even when a client's application depends on it, so the test must stop until the provider consents in writing. Timing the test or testing quietly does not create permission.

3. Question 3Footprinting and Reconnaissance

   Which technique gathers information about a target without sending traffic to the target's own systems?

   1. APort scanning with SYN packets against the target's public address range
   2. BPassive OSINT using certificate transparency logs and public records
   3. CBanner grabbing from the target's web server by sending an HTTP request
   4. DZone transfer attempts against the target's authoritative name servers
   Show answer and explanationHide answer

   Correct answer: B

   Passive reconnaissance uses public data sources such as certificate transparency logs and public records, so the target's systems never see the query. Port scans, banner grabs and zone transfer attempts all send traffic to the target's infrastructure.

4. Question 4Hacking Web Applications

   Which control best prevents stored cross-site scripting in a web application?

   1. ABlocking all HTML tags in the database so that no markup can be stored by the application at all
   2. BIncreasing the session timeout so that users remain signed in longer and see fewer login prompts
   3. CContext-aware output encoding of untrusted data, combined with a strict Content Security Policy
   4. DUsing GET rather than POST for every form submission across the whole application to hide inputs
   Show answer and explanationHide answer

   Correct answer: C

   Encoding untrusted data for its output context stops injected markup from executing, and a strict CSP limits what a script can do if one gets through. Blocking tags in storage, longer sessions and changing request methods do not address the injection.

5. Question 5Cloud Computing

   Under the shared responsibility model, who patches the guest operating system on an IaaS virtual machine?

   1. AThe cloud provider, for every operating system version offered across its whole platform
   2. BThe customer, who owns the guest operating system and is responsible for its patching
   3. CNobody, because IaaS virtual machines are patched by the platform during its scheduled maintenance
   4. DThe provider's hypervisor team, which patches each guest operating system automatically overnight
   Show answer and explanationHide answer

   Correct answer: B

   In IaaS the provider secures the physical and hypervisor layers, while the customer is responsible for the guest OS, its patches and its configuration. Automatic patching by the provider applies to managed services, not to a customer-owned guest OS.