Free Certified Ethical Hacker knowledge exam practice questions

Sample question 1. An assessment plan states that during the first week the team may build a picture of the client’s external footprint but must not send any traffic to systems the client owns or operates, so that nothing appears in the client’s own logs. Which activity is consistent with that restriction?

1. Collecting hostnames and organizational detail from third-party sources such as domain registration records, certificate transparency logs, and public code repositories.
2. Running a slow, low-rate TCP port sweep across the client’s published address ranges, timed to stay under intrusion detection thresholds.
3. Connecting once to each discovered service to read the banner it returns and identify its version, without sending any exploit or login attempt.
4. Requesting a full zone transfer (AXFR) from the client’s authoritative DNS servers, which returns every record in the zone, including internal hostnames, in a single query.

Sample question 2. A server shows unexplained outbound traffic, yet the operating system's own process, file and network listings display nothing unusual. Which approach is MOST likely to expose a kernel-level rootkit hiding the activity?

1. Review the process list using the tools built into the compromised operating system itself, repeatedly.
2. Reboot the server and watch whether the outbound traffic resumes afterward.
3. Add a firewall rule blocking the destination address seen in the traffic.
4. Examine a memory image and an offline boot of the disk, then compare with the live view.

Sample question 3. A tester notices that a product page shows the same output for every input, but responses take noticeably longer when specially crafted conditions are included in one search parameter. The page never displays database errors or data. What does this behavior MOST likely indicate?

1. Reflected cross-site scripting in the search parameter of the page.
2. Time-based blind SQL injection, where input reaches the database query.
3. A cross-site request forgery weakness in the search form of the page.
4. A server that is simply slow because of high overall traffic volume.