CEH: 498 practice exam questions with explanations
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

CEH practice exam: 498 questions with full explanations

6 domains 498 questions 240 min exam
Questions on the exam
125
Time allowed
240 minutes format →
Exam fee
$1,199 — vendor, checked September 4, 2026 detail →

498 practice exam questions for CEH, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min CEH readiness check →

CEH exam format →  ·  CEH passing score →  · CEH exam cost →

Questions by domain

Sample questions

Injection: What vulnerability category does this represent according to OWASP?

Web Application Hacking Medium
A web application passes user-supplied input directly to an OS shell command without sanitization. An attacker enters `; cat /etc/passwd` as input. What vulnerability category does this represent according to OWASP?
  1. Injection (A03:2021) ✓
    Correct. OS command injection is a subcategory of OWASP Injection. Untrusted data sent to an interpreter (OS shell in this case) without sanitization allows the attacker to execute arbitrary commands.
  2. Broken Access Control (A01:2021)
    Incorrect. Broken Access Control involves insufficient enforcement of permissions (e.g., accessing other users' data without authorization). Command injection exploits an interpreter flaw, not an access control policy failure.
  3. Security Misconfiguration (A05:2021)
    Incorrect. Security misconfiguration involves improper system/application configuration (default credentials, exposed debug endpoints). The command injection here is a code-level flaw, not a configuration issue.
  4. Insecure Design (A04:2021)
    Incorrect. Insecure Design covers architectural flaws in threat modeling. While poor design may have led to this function, the specific exploitable flaw is an injection vulnerability — the technical classification takes precedence.
The trap
SQL injection and OS command injection are both Injection (OWASP A03) — the category is 'Injection' regardless of which interpreter is targeted.

All 100 Web Application Hacking questions →

9.0–10.0: Which CVSS v3.1 base score range does this vulnerability most likely fall into?

System Hacking Phases and Attack Techniques Medium
A vulnerability requires the attacker to have network access, no authentication, and no user interaction to exploit, resulting in complete loss of confidentiality, integrity, and availability. Which CVSS v3.1 base score range does this vulnerability most likely fall into?
  1. 9.0–10.0 (Critical) ✓
    Correct. Network-accessible, no authentication, no user interaction, and complete CIA impact (C:H/I:H/A:H) yields a 9.8 base score — Critical. CVSS scores highest when Attack Vector = Network, Privileges Required = None, User Interaction = None, and all three impact metrics are High.
  2. 7.0–8.9 (High)
    Incorrect. High (7.0–8.9) results when there is one mitigating factor — e.g. some authentication required, local-only access, or only a single impact metric High (a confidentiality-only RCE scores 7.5). The described vulnerability has full exploitability AND complete impact across all three metrics.
  3. 4.0–6.9 (Medium)
    Incorrect. Medium vulnerabilities require some prerequisites such as local access or user interaction. The described vulnerability requires neither.
  4. 0.1–3.9 (Low)
    Incorrect. Low severity vulnerabilities have minimal impact or require significant prerequisites. This vulnerability meets none of those limiting criteria.
The trap
CVSS Critical scores require both high exploitability (no auth, network access) AND high impact — high impact alone with local-only access scores lower.

All 96 System Hacking Phases and Attack Techniques questions →

Maltego: Which OSINT tool is best suited for this task?

Reconnaissance Techniques Medium
A penetration tester wants to map relationships between an organization's employees, their email addresses, associated social media accounts, and affiliated companies using a visual graph. Which OSINT tool is best suited for this task?
  1. theHarvester
    Incorrect. theHarvester collects emails, subdomains, and IP addresses from public sources but outputs a flat list — it does not provide relationship mapping or graph visualization.
  2. Recon-ng
    Incorrect. Recon-ng is a modular OSINT framework for gathering data but its output is tabular/database-oriented, not visual relationship graphs.
  3. Maltego ✓
    Correct. Maltego is specifically designed to visualize relationships between entities (people, domains, IP addresses, organizations) through graph-based link analysis using 'transforms'.
  4. Shodan
    Incorrect. Shodan is an internet-connected device search engine. It reveals exposed devices and services but does not map human/organizational relationships.
The trap
theHarvester and Maltego both collect email addresses, but only Maltego provides graph-based relationship visualization using transforms.

All 84 Reconnaissance Techniques questions →

To intercept traffic between the victim and the gateway: What is the primary goal of this attack?

Network and Perimeter Hacking Medium
An attacker on a switched network sends gratuitous ARP replies telling the gateway that the victim's IP address belongs to the attacker's MAC address. What is the primary goal of this attack?
  1. To intercept traffic between the victim and the gateway (Man-in-the-Middle attack) ✓
    Correct. ARP poisoning corrupts the ARP cache on the gateway, causing it to forward traffic destined for the victim to the attacker's MAC. The attacker forwards it onward, becoming a transparent MITM.
  2. To cause a Denial-of-Service by flooding the network with ARP traffic
    Incorrect. While ARP flooding can cause DoS, the described attack sends targeted gratuitous replies to specific hosts — the goal is traffic interception (MITM), not service disruption.
  3. To enumerate usernames from the victim's NetBIOS name service
    Incorrect. NetBIOS enumeration uses nbtstat and UDP port 137. ARP poisoning operates at Layer 2 and has no relationship to NetBIOS name service queries.
  4. To prevent the victim from connecting to the internet by corrupting routing tables
    Incorrect. ARP poisoning corrupts Layer 2 MAC address tables, not Layer 3 routing tables. Routing table manipulation requires different techniques (e.g., BGP hijacking).
The trap
ARP poisoning is specifically valuable on switched networks where simple promiscuous mode sniffing doesn't capture other hosts' unicast traffic.

All 81 Network and Perimeter Hacking questions →

Default credentials that cannot be changed: Which vulnerability represents the HIGHEST risk?

Mobile Platform, IoT, and OT Hacking Medium
A security assessment of an IoT smart thermostat finds: default admin credentials that cannot be changed, firmware updates transmitted over HTTP without integrity verification, and an exposed Telnet interface on the local network. Which vulnerability represents the HIGHEST risk?
  1. Default credentials that cannot be changed ✓
    Correct. Unchangeable default credentials (OWASP IoT #1: Weak/Hardcoded Passwords) represent the highest risk because they provide persistent, trivial access to any attacker who looks up the model's default credentials — with no remediation path available to the owner.
  2. Firmware updates over HTTP without integrity verification
    Incorrect. Insecure update mechanisms are serious (OWASP IoT #9) but require a network MITM position to exploit. Unchangeable default credentials provide direct, immediate access to anyone on the network with no prerequisites.
  3. Exposed Telnet interface on the local network
    Incorrect. An exposed Telnet interface is a significant risk but requires credentials to log in (unless they are default/hardcoded). The Telnet exposure is less severe if strong unique credentials were possible — but combined with unchangeable defaults, it amplifies the default credential risk.
  4. Lack of encrypted storage for configuration data
    Incorrect. This vulnerability is not mentioned in the scenario. Evaluating unlisted vulnerabilities against those described in the scenario is not appropriate.
The trap
Insecure updates require a MITM position. Default credentials only require network access. The accessibility gap makes default credentials the higher immediate risk.

All 38 Mobile Platform, IoT, and OT Hacking questions →

Symmetric encryption using AES-256: Which approach is MOST appropriate?

Cryptography Medium
A company needs to encrypt 10 TB of data at rest on their file servers. They require fast encryption/decryption with minimal computational overhead. Which approach is MOST appropriate?
  1. Symmetric encryption using AES-256 ✓
    Correct. Symmetric encryption (AES) uses a single key for both encryption and decryption and is extremely fast — hardware-accelerated AES can process gigabytes per second, making it ideal for bulk data encryption.
  2. Asymmetric encryption using RSA-4096
    Incorrect. RSA is computationally expensive for bulk data — it is typically 1000x slower than AES for the same data volume. RSA is used for key exchange and digital signatures, not bulk data encryption.
  3. Hashing using SHA-256
    Incorrect. SHA-256 is a one-way hash function — it cannot decrypt data. Hashing provides integrity verification, not confidentiality protection.
  4. Asymmetric encryption using ECC-256
    Incorrect. ECC is more efficient than RSA for asymmetric operations but is still significantly slower than symmetric AES for bulk data encryption. ECC is used for key agreement and digital signatures.
The trap
Larger asymmetric keys (RSA-4096) provide more security but are drastically slower. For 10 TB of data, AES-256 is the only practical choice for bulk encryption.

All 35 Cryptography questions →

Boolean-based blind SQL injection: What type of SQL injection is this?

Web Application Hacking Hard
An attacker tests a login page with the inputs `' AND 1=1--` (returns a normal page) and `' AND 1=2--` (returns an error page). No data is echoed back. The attacker then systematically asks true/false questions to infer the database version. What type of SQL injection is this?
  1. Boolean-based blind SQL injection ✓
    Correct. Boolean-based blind SQLi infers information by observing differences in application behavior (normal vs. error page) based on true/false conditions — no data is directly returned to the attacker.
  2. Error-based SQL injection
    Incorrect. Error-based SQLi extracts data through database error messages (e.g., MySQL verbose errors revealing table names). In the described scenario, an error page is returned but no data is echoed in the error message itself.
  3. Time-based blind SQL injection
    Incorrect. Time-based blind SQLi uses SLEEP() or WAITFOR DELAY commands to infer true/false answers through response delays. The described attack uses page behavior changes (normal/error), not timing differences.
  4. Union-based SQL injection
    Incorrect. UNION-based SQLi appends a SELECT statement to retrieve and display data directly in the response. Data being echoed back is a prerequisite — which the question explicitly states does not occur here.
The trap
If the error page reveals SQL error messages with data, it's error-based SQLi. Boolean-based requires only a behavioral difference (normal vs. error) with no data leakage.

All 100 Web Application Hacking questions →

Rainbow table attack: This technique is known as:

System Hacking Phases and Attack Techniques Medium
An attacker has a hashed password file and wants to crack it as quickly as possible. They pre-compute hash values for all possible plaintext passwords up to 8 characters using alphanumeric characters, then look up the target hash. This technique is known as:
  1. Rainbow table attack ✓
    Correct. Rainbow tables are pre-computed lookup tables of hash values for known plaintexts. They trade storage space for cracking speed by eliminating the need to compute hashes at crack time.
  2. Brute-force attack
    Incorrect. A brute-force attack computes hashes in real time during the attack, trying all combinations sequentially. Pre-computation is not involved — this is the key difference.
  3. Dictionary attack
    Incorrect. A dictionary attack uses a wordlist of likely passwords but computes hashes during the attack — it does not use pre-computed lookup tables.
  4. Pass-the-hash attack
    Incorrect. Pass-the-hash uses a captured hash directly for authentication without cracking it. Pre-computation of a lookup table is not involved.
The trap
Salting defeats rainbow table attacks. If a password database uses per-user salts, pre-computed rainbow tables are useless.

All 96 System Hacking Phases and Attack Techniques questions →

CEH exam: the facts

How many questions are on the CEH exam?

125, as published by the exam vendor.

How long is the CEH exam?

240 minutes. Across 125 questions that is about 115 seconds per question.

What topics does the CEH exam cover?

9 domains: Network and Perimeter Hacking, Reconnaissance Techniques, System Hacking Phases and Attack Techniques, Web Application Hacking, Mobile Platform, IoT, and OT Hacking, Information Security and Ethical Hacking Overview, Cryptography, Cloud Computing, Wireless Network Hacking. Weights: Network and Perimeter Hacking 0.24%, Reconnaissance Techniques 0.17%, System Hacking Phases and Attack Techniques 0.15%, Web Application Hacking 0.14%, Mobile Platform, IoT, and OT Hacking 0.1%, Information Security and Ethical Hacking Overview 0.06%, Cryptography 0.05%, Cloud Computing 0.05%, Wireless Network Hacking 0.05%.

How many CEH practice exam questions does Certsqill have?

498, spread across 6 exam domains. Every one shows all options, which is correct, and why each of the others is not.

Would you pass CEH today?

Five minutes, and you get a score per domain — not one number, but which section to open tonight.

Test your CEH readiness — free
Certsqill CEH question bank · 498 questions across 6 domains · Every answer, right and wrong, comes with its own explanation.