Free Certified Ethical Hacker (CEH v13, "Powered by AI") practice test: 30 questions with answers

A worm is self-propagating over network paths and does not need a host file, which is the key difference from a virus. Requiring user action, ransom behavior and removable media are traits of other malware types or delivery methods.

Rootkits modify kernel, driver or boot components so that their own files, processes and network activity stay hidden from normal tools. Adware, keyloggers and ransomware are not defined by concealment at that level.

Testing a system you do not have authority over is unauthorized, even when a client's application depends on it, so the test must stop until the provider consents in writing. Timing the test or testing quietly does not create permission.

The rules of engagement set scope, timing, permitted techniques and escalation contacts, and both parties sign them before testing starts. A license, a network diagram and a threat report inform the test but do not authorize or bound it.

Passive reconnaissance uses public data sources such as certificate transparency logs and public records, so the target's systems never see the query. Port scans, banner grabs and zone transfer attempts all send traffic to the target's infrastructure.

MX records name the mail exchangers for a domain and their preference order, which is what determines where mail is delivered. SPF text, reverse pointers and SOA timers relate to email policy, reverse lookups or zone maintenance rather than the mail hosts themselves.

Encoding untrusted data for its output context stops injected markup from executing, and a strict CSP limits what a script can do if one gets through. Blocking tags in storage, longer sessions and changing request methods do not address the injection.

A Content-Security-Policy limits where scripts and resources can come from, which reduces the impact of injection, and HSTS enforces HTTPS on future visits. Version banners reveal information, and a wildcard CORS policy on authenticated endpoints weakens cross-origin protection.

In IaaS the provider secures the physical and hypervisor layers, while the customer is responsible for the guest OS, its patches and its configuration. Automatic patching by the provider applies to managed services, not to a customer-owned guest OS.

Closing the exposure stops further access, and reviewing logs shows whether data was already read, which determines the breach assessment. Versioning, deletion rules and waiting for a reply leave the data exposed while the team deliberates.

Argon2id is a memory-hard password hashing function, and a unique salt with tuned costs slows offline cracking. Fast hashes, shared salts and encoding are reversible or easily attacked, so they do not protect stored passwords.

A MAC uses a shared secret, so either party could have created it, while a signature uses a private key only the signer holds, which supports non-repudiation. MACs and signatures both give integrity, and neither encrypts the message by itself.

A filtered result means the probe received no response, which is typical when a firewall silently drops it. A crashed service would show as closed, while a wrong sequence number or a scanner error would not produce a consistent filtered state.

A FIN-only probe receives a RST from closed ports and no response from open or filtered ones, which helps infer port state without a full handshake. Connect scans, UDP scans and ARP scans use different mechanisms to answer different questions.

Active Directory exposes user objects through LDAP, and a low-privilege account can usually read them, which is why this is a standard enumeration step. A DNS cache, SNMP community strings and login banners do not expose the domain's user list.

Verifying identity through a known channel and never giving credentials to a caller defeats pretexting, the core of this attack. An employee ID is easy to obtain, and emailing or resetting to a shared default both expose the account.

A SYN flood leaves many half-open connections in the backlog, so legitimate clients cannot complete new connections. Smurf is a broadcast amplification attack, while session fixation and cache poisoning target different weaknesses.

Distributions often backport fixes without changing the upstream version number, so the vendor advisory and the installed package build must be checked before a finding is confirmed or closed. Blind upgrades, disabling the scanner or accepting risk without evidence each skip that verification.

Salted, slow hashing makes each guess expensive, and a strong password policy makes successful guesses less likely. Screen timeouts, port changes and logging do not protect a stolen credential store from offline attacks.

ARP poisoning convinces hosts to send traffic for other addresses to the attacker, which makes man-in-the-middle capture possible on a switch. Ping sweeps, banner grabs and zone transfers gather information but do not redirect another host's traffic.

A session ID in a URL is recorded in history, logs and Referer headers, so anyone who reads those can reuse the session. Page speed, cookie use and session table size are not the main risk from putting the identifier in the URL.

Splitting content across fragments or packets can stop a signature from matching in any single packet unless the IDS reassembles the stream. Spoofing and port knocking address different controls, and tunneling evades inspection only where the IDS cannot decrypt, which is a separate issue.

WPA3-Enterprise provides modern authentication and a 192-bit security mode, replacing protocols with known weaknesses. A longer WEP key does not fix WEP's design, and shared passphrases, open networks and MAC filtering all provide weak protection.

OT systems can fail unsafely when scanned or stressed, so testing is passive where possible and non-disruptive, with safety staff present. Aggressive scans, continuous fuzzing and remote reboots can stop or damage the physical process.

Imaging the disk and capturing memory with hashes preserves the state of the system before anything changes, which supports later analysis. Rebooting clears volatile memory, deleting files and running a modifying scan all alter the evidence.

Default content and unused modules add attack surface, and patching closes known flaws in the server software. Directory listing, root privileges and detailed banners each expose data or increase the impact of a compromise.

A database error triggered by a quote suggests the input reaches a SQL statement without parameterization, which is the condition for injection. Strong validation would normally reject the input without a database error, and the other options do not explain the error.

Allowlisting and blocking sideloads through MDM limit installs to vetted apps, which removes most malicious installation paths. Unknown sources, disabled encryption and blanket permissions each widen the attack surface.

Parameterized queries keep user data out of the SQL grammar, and least-privilege database accounts limit what an injection can reach. Concatenation with quote filtering is easily bypassed, while verbose errors and DBA rights each give attackers more information or more power.

Bluesnarfing gains unauthorized access to data on a Bluetooth device through weak pairing or authentication. Bluejacking only sends messages, war driving maps Wi-Fi, and jamming disrupts radio rather than reading data.