CEH System Hacking Phases and Attack Techniques: 96 practice questions

12 of the 96 System Hacking Phases and Attack Techniques questions in the Certsqill CEH bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CEH? Take the free 5-min readiness check →

1. 9.0–10.0: Which CVSS v3.1 base score range does this vulnerability most likely fall into?

1. 9.0–10.0 (Critical) ✓

   Correct. Network-accessible, no authentication, no user interaction, and complete CIA impact (C:H/I:H/A:H) yields a 9.8 base score — Critical. CVSS scores highest when Attack Vector = Network, Privileges Required = None, User Interaction = None, and all three impact metrics are High.
2. 7.0–8.9 (High)

   Incorrect. High (7.0–8.9) results when there is one mitigating factor — e.g. some authentication required, local-only access, or only a single impact metric High (a confidentiality-only RCE scores 7.5). The described vulnerability has full exploitability AND complete impact across all three metrics.
3. 4.0–6.9 (Medium)

   Incorrect. Medium vulnerabilities require some prerequisites such as local access or user interaction. The described vulnerability requires neither.
4. 0.1–3.9 (Low)

   Incorrect. Low severity vulnerabilities have minimal impact or require significant prerequisites. This vulnerability meets none of those limiting criteria.

A remotely exploitable, zero-authentication, no-user-interaction vulnerability with complete confidentiality, integrity, and availability impact (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) scores Critical (9.0–10.0) in CVSS v3.1.

2. Rainbow table attack: This technique is known as:

1. Rainbow table attack ✓

   Correct. Rainbow tables are pre-computed lookup tables of hash values for known plaintexts. They trade storage space for cracking speed by eliminating the need to compute hashes at crack time.
2. Brute-force attack

   Incorrect. A brute-force attack computes hashes in real time during the attack, trying all combinations sequentially. Pre-computation is not involved — this is the key difference.
3. Dictionary attack

   Incorrect. A dictionary attack uses a wordlist of likely passwords but computes hashes during the attack — it does not use pre-computed lookup tables.
4. Pass-the-hash attack

   Incorrect. Pass-the-hash uses a captured hash directly for authentication without cracking it. Pre-computation of a lookup table is not involved.

Rainbow tables pre-compute hash values for large plaintext spaces to enable O(1) hash lookups during cracking, trading disk space for speed.

3. Vertical privilege escalation: This is an example of:

1. Vertical privilege escalation ✓

   Correct. Vertical privilege escalation means gaining higher-level privileges than currently held — moving from a standard user account to root is a classic vertical escalation.
2. Horizontal privilege escalation

   Incorrect. Horizontal escalation means gaining access to resources belonging to another account at the same privilege level (e.g., accessing another user's files without gaining admin rights).
3. Lateral movement

   Incorrect. Lateral movement refers to moving between different systems on the network, not gaining higher privileges on the same system.
4. Persistence

   Incorrect. Persistence refers to techniques that maintain attacker access across reboots (e.g., cron jobs, startup scripts). Exploiting a SUID binary grants elevated access but is not inherently a persistence mechanism.

Exploiting a SUID binary to gain root from a standard user account is vertical privilege escalation — increasing privilege level on the same system.

4. Remote Access Trojan: Which category of malware BEST describes the tool the attacker deployed?

1. Remote Access Trojan (RAT) ✓

   Correct. RATs provide covert remote control of infected systems including screen capture, keylogging, file access, and command execution. They operate silently in the background and typically phone home to an attacker's C2 server.
2. Ransomware

   Incorrect. Ransomware encrypts files and demands payment for decryption. It does not provide remote control capabilities and makes its presence known to demand ransom.
3. Rootkit

   Incorrect. Rootkits hide attacker tools and activity on a system but don't inherently provide remote control functionality. A rootkit may be used to hide a RAT, but the remote control feature belongs to the RAT.
4. Adware

   Incorrect. Adware displays unwanted advertisements but does not provide keylogging, screen capture, or remote command execution capabilities.

A RAT provides covert, full remote control of infected systems — including screen viewing, keylogging, and command execution — without victim awareness.

5. Set HISTSIZE=0 and HISTFILE=/dev/null before running: Which action is MOST effective for removing traces of co

1. Set HISTSIZE=0 and HISTFILE=/dev/null before running commands, then clear ~/.bash_history ✓

   Correct. Setting HISTSIZE=0 prevents any commands from being stored in memory. Setting HISTFILE=/dev/null redirects history writes to /dev/null. Clearing ~/.bash_history removes existing history. Together these prevent new commands from being logged.
2. Delete the /var/log/syslog file

   Incorrect. Deleting syslog removes system event logs but does not affect bash command history stored in ~/.bash_history. The two are independent logging mechanisms.
3. Uninstall bash and use sh instead

   Incorrect. Uninstalling bash is disruptive and detectable — it would also remove shell capabilities needed for the attacker's session. sh also logs commands to its own history file.
4. Change the file permissions of ~/.bash_history to 000

   Incorrect. Making the file unreadable doesn't prevent new history from being written (bash re-creates the file if it doesn't exist or if permissions allow). The root user can also override file permissions.

Setting HISTSIZE=0 and HISTFILE=/dev/null before executing commands prevents bash from recording command history. Clearing the existing history file removes prior traces.

6. Metamorphic virus: What category of malware does this describe?

1. Metamorphic virus ✓

   Correct. Metamorphic viruses rewrite their entire code body on each iteration using code substitution, transposition, and register reassignment. There is no decryption stub — the code itself changes, making signature detection extremely difficult.
2. Polymorphic virus

   Incorrect. Polymorphic viruses use encryption to hide their body, with a mutating decryption stub. A static decryption engine must be present — the key difference is that polymorphic viruses have an encrypted payload, while metamorphic viruses rewrite the actual code.
3. Macro virus

   Incorrect. Macro viruses are written in macro languages (VBA) and spread through document files. They do not have mutation engines for code rewriting.
4. Fileless malware

   Incorrect. Fileless malware resides in memory and uses legitimate tools (PowerShell, WMI) for execution — it avoids writing to disk. Code mutation between infections is not a defining characteristic of fileless malware.

Metamorphic viruses rewrite their entire code on each infection using a mutation engine — no encryption stub, the code itself changes each time to evade signature detection.

7. Credentialed scans authenticate to the system and perform: What is the primary reason for this discrepancy?

1. Credentialed scans authenticate to the system and perform local checks on installed software, patch levels, and configuration — finding vulnerabilities invisible to network-only scans ✓

   Correct. Credentialed scans log in to the target system and perform deep local analysis: registry checks, installed patch verification, service configuration audits, and file permission checks. Non-credentialed scans only see what is exposed to the network.
2. The non-credentialed scan uses outdated plugin definitions and misses current CVEs

   Incorrect. Both scans use the same Nessus plugin definitions. The discrepancy is structural — scan type, not plugin currency. Nessus plugins are updated regardless of credential configuration.
3. The credentialed scan has a longer timeout and is able to probe more ports

   Incorrect. Port scanning coverage is not the differentiating factor. Credentialed scans provide deeper host-level analysis through authenticated local checks, not broader port coverage.
4. Non-credentialed scans are blocked by the Windows firewall for most ports

   Incorrect. While firewall filtering can reduce non-credentialed scan coverage, the primary reason for the vulnerability count difference is local patch-level analysis available only with credentials — not simply port accessibility.

Credentialed Nessus scans authenticate locally and check patch levels, registry settings, and configurations that are not visible from the network — finding significantly more vulnerabilities.

8. Steganography: Which technique is the attacker using?

1. Steganography ✓

   Correct. Steganography hides the existence of a message by embedding it within ordinary-looking carrier data (in this case, a JPEG image). The goal is concealment, not encryption — the existence of the secret data is hidden.
2. Cryptography

   Incorrect. Cryptography makes data unreadable but does not hide its existence. An encrypted file is obviously 'secret' — steganography hides the secret in plain sight.
3. Data masking

   Incorrect. Data masking replaces real data with fictitious but realistic values (e.g., replacing real SSNs with random ones) for testing purposes. It does not hide data within image files.
4. Covert channel communication

   Partially related but not the specific technique. Steganography in an image is a specific implementation of a covert channel. 'Covert channel' is a broader category — 'steganography' is the precise term for hiding data within media files.

Steganography hides data inside ordinary files (images, audio, video) so that the existence of the secret data is not apparent. It is concealment, not encryption.

9. Fileless malware using living-off-the-land binaries: Which malware category and evasion technique are demonstr

1. Fileless malware using living-off-the-land binaries (LOLBins) — evades disk-based AV scanning ✓

   Correct. Fileless malware operates in memory using built-in OS tools (PowerShell, WMI, certutil). Traditional AV scans files on disk — memory-resident payloads are invisible to signature-based disk scanners.
2. Rootkit — conceals malicious files from the filesystem to evade AV

   Incorrect. Rootkits hide files already on disk by intercepting filesystem calls. Fileless malware never writes to disk at all — rootkit-level hiding is unnecessary when there is no file to hide.
3. Polymorphic malware — changes its signature on each execution

   Incorrect. Polymorphic malware mutates its code to evade file signature detection — but it still writes to disk. Fileless malware's evasion is based on in-memory execution, not signature mutation.
4. Spyware — silently monitors user activity without detection

   Incorrect. Spyware is defined by its purpose (monitoring user activity), not its execution method. The question focuses on execution technique (memory-only) and evasion method (no disk writes).

Fileless malware runs entirely in memory using LOLBins like PowerShell, leaving no disk artifacts for signature-based AV to scan — detection requires memory scanning, behavioral analysis, or AMSI.

10. The account has an empty or blank password: What does this hash value indicate?

1. The account has an empty or blank password — this is the known LM hash for an empty string ✓

   Correct. aad3b435b51404eeaad3b435b51404ee is the well-known LM hash for an empty password. When Windows stores NTLM-only (LM disabled), it stores this placeholder value for the LM portion.
2. The hash is corrupted and the password cannot be recovered

   Incorrect. This is a valid, well-documented hash value — it is the LM hash for an empty string (no password). It is not indicative of corruption.
3. The account password is 'Password1' — a commonly pre-computed hash

   Incorrect. The LM hash for 'PASSWORD1' is a different value. aad3b435b51404eeaad3b435b51404ee is specifically the empty/null LM hash, not 'Password1'.
4. The account is disabled and the password hash has been zeroed out by Active Directory

   Incorrect. Disabled accounts in AD still retain their password hash. Windows uses the specific value aad3b435b51404eeaad3b435b51404ee as the LM hash placeholder when LM hashing is disabled, regardless of account status.

aad3b435b51404eeaad3b435b51404ee is the fixed LM hash for an empty password string. When LM hashing is disabled, Windows stores this value as an LM hash placeholder.

11. Prioritize by CVSS score combined with asset criticality: How should they prioritize?

1. Prioritize by CVSS score combined with asset criticality and active exploit availability ✓

   Correct. Effective vulnerability prioritization combines: technical severity (CVSS), business impact (asset criticality), and exploit availability (whether a working exploit exists in the wild). A medium-CVSS CVE on a critical server with a public exploit outranks a high-CVSS on a non-critical test system.
2. Remediate all Critical CVSS vulnerabilities first, then High, regardless of asset type

   Incorrect. CVSS alone without asset context leads to misaligned prioritization — a Critical CVE on a decommissioned test system should rank below a High CVE on the payment processing server.
3. Prioritize the most recently discovered vulnerabilities as they are most likely to be exploited

   Incorrect. Recency alone is not a valid prioritization criterion. Old vulnerabilities with public exploits are actively exploited — recency is a factor but must be combined with other metrics.
4. Patch systems alphabetically by hostname to ensure consistent remediation tracking

   Incorrect. Alphabetical ordering has no security merit — it completely ignores risk factors. Security prioritization must be risk-based.

Vulnerability prioritization should be risk-based: combining CVSS severity, asset criticality to the business, and whether active exploits exist in the wild.

12. Command and Control phase: In which phase does ransomware most commonly establish communication with the attac

1. Command and Control (C2) phase — after initial execution, ransomware beacons to the C2 server to receive the public encryption key or Key Encryption Key (KEK) ✓

   Correct. Modern ransomware connects to C2 infrastructure to retrieve or register an encryption key. Without C2 contact, some ransomware variants cannot encrypt (designed to fail-safe), providing a defense opportunity — blocking C2 at the network level.
2. Initial access phase — the encryption key is embedded in the ransomware executable before delivery

   Incorrect. Embedding a static decryption key in the ransomware binary would allow researchers to extract and use it for decryption without paying the ransom. Modern ransomware uses asymmetric key exchange via C2 to prevent this.
3. Lateral movement phase — the key is shared between infected hosts via SMB protocol

   Incorrect. Ransomware lateral movement spreads the infection between hosts; it does not share encryption keys between hosts. Each host typically encrypts its own keys separately.
4. Exfiltration phase — the key is only created after all target files are identified and their metadata exfiltrated

   Incorrect. Double-extortion ransomware (Maze, REvil) exfiltrates data before encryption, but key generation/retrieval happens at C2 contact, not at exfiltration completion.

Ransomware connects to C2 infrastructure after execution to retrieve or register encryption keys — blocking C2 communication is a critical defensive control that can prevent encryption.

Other CEH domains

• Web Application Hacking — 100 questions →
• Reconnaissance Techniques — 84 questions →
• Network and Perimeter Hacking — 81 questions →
• Mobile Platform, IoT, and OT Hacking — 38 questions →
• Cryptography — 35 questions →
• All 498 CEH questions →