EC-Council Certified Ethical Hacker (CEH) v13

The EC-Council Certified Ethical Hacker (CEH) v13 validates the technical skills required to identify and exploit vulnerabilities in a manner that helps organizations strengthen their defenses. it covers modern hacking techniques and tools used by malicious actors, allowing professionals to proactively secure systems. Professionals with the symbol ECC_CEH are recognized as experts in offensive security and threat mitigation.

---------- Question 1

A newly hired security analyst is tasked with understanding the fundamental legal and ethical boundaries of penetration testing within their organization. The company operates under strict compliance regulations and aims to ensure all security assessments adhere to legal standards and best practices. Before initiating any engagement, the analyst must confirm that all necessary permissions and documentation are in place, clearly defining the scope, duration, and acceptable methods for the assessment. Which of the following core principles is paramount for an ethical hacker when conducting security assessments to avoid legal repercussions and maintain professional integrity?

1. Conducting tests on any system found vulnerable, regardless of explicit authorization, to demonstrate proactive security measures to management.
2. Focusing solely on technical exploitation techniques while delegating the legal and contractual obligations to the legal department without personal oversight.
3. Obtaining explicit, written permission from the system owner or management before initiating any form of security assessment or penetration test.
4. Assuming implicit consent for internal systems since the objective is to enhance the organizations overall security posture.

---------- Question 2

A red team operator needs to exfiltrate a small amount of sensitive data from a highly secured internal network protected by stateful firewalls and an advanced Intrusion Detection System IDS. Direct TCP connections to external IPs are heavily monitored and blocked. The operator observes that DNS queries are allowed to external public DNS servers. Which evasion technique could the operator leverage to establish a covert channel for data exfiltration while minimizing the likelihood of detection by the existing security controls?

1. Using IP fragmentation to split TCP packets, making them harder for the IDS to reassemble and inspect.
2. Performing a Nmap NULL scan or FIN scan to bypass stateless firewalls and IDS rules.
3. Implementing DNS tunneling, encoding the data within DNS query and response packets to bypass the firewall and IDS.
4. Encrypting the data and sending it over standard HTTPS, hoping the firewall will not perform deep packet inspection.

---------- Question 3

An attacker has successfully gained unauthorized access to a victim's workstation and is now attempting to maintain persistence and hide their presence. To achieve this, the attacker decides to embed a malicious executable file within an innocent-looking image file, making it less likely to be detected by casual inspection or basic file analysis tools. The plan is to later extract and run this executable from the compromised system. This technique leverages a method of concealing data within other non-suspicious files. What specific technique is the attacker employing to hide the malicious file?

1. Cryptography
2. Steganography
3. Data Loss Prevention
4. Digital Forensics

---------- Question 4

An attacker intercepts encrypted communication and notices that the same ciphertext is generated every time the user sends the word 'YES', even though the encryption key is theoretically secure. Upon further analysis, the attacker discovers that the encryption scheme being used lacks a proper initialization vector (IV) or uses a static one, resulting in deterministic encryption for identical plaintext blocks. This weakness allows the attacker to potentially infer information about the plaintext by observing patterns in the ciphertext. What type of cryptographic attack is primarily being facilitated by this vulnerability?

1. Brute-Force Attack, systematically trying all possible keys.
2. Known-Plaintext Attack, where the attacker has some plaintext-ciphertext pairs.
3. Ciphertext-Only Attack, where the attacker only has ciphertext.
4. Replay Attack, where valid data transmission is maliciously or fraudulently repeated.

---------- Question 5

A secure communication channel is established between two parties, Alice and Bob, using a cryptographic system that relies on a pair of mathematically linked keys: a public key for encryption and a private key for decryption. Alice encrypts a message using Bobs public key, and Bob then decrypts it using his corresponding private key. This ensures confidentiality. Additionally, Alice can digitally sign a message using her private key, and Bob can verify her identity and the messages integrity using Alices public key. What cryptographic concept is demonstrated here, and what fundamental security properties does it primarily enable?

1. Symmetric cryptography, enabling efficient bulk encryption but requiring a shared secret key.
2. Hashing, enabling data integrity verification but not encryption or digital signatures.
3. Public Key Infrastructure PKI and Asymmetric Cryptography, enabling confidentiality, integrity, non-repudiation, and authentication.
4. Steganography, enabling hidden communication by embedding data within other files, not direct encryption.

---------- Question 6

An ethical hacker is tasked with gathering as much information as possible about a target company without directly interacting with their systems or alerting them to the reconnaissance effort. The hacker decides to use publicly available resources to map out the companys infrastructure, employee details, and technologies in use. This includes searching public records, social media, news articles, job postings, and archived versions of their website. Which of the following best describes the type of reconnaissance being performed and a common tool or technique used for gathering historical website data?

1. Active Reconnaissance; using Nmap to scan open ports.
2. Passive Reconnaissance; using the Wayback Machine for historical website snapshots.
3. Direct Reconnaissance; performing a brute-force attack on login pages.
4. Internal Reconnaissance; accessing internal network shares.

---------- Question 7

A security team is conducting a network vulnerability assessment and suspects that certain internal systems might be configured with default or weak administrative credentials. They want to perform a thorough scan to identify open ports and services, and then attempt to enumerate service versions to pinpoint potential weaknesses. To avoid overloading the network and to remain as stealthy as possible while gathering detailed information, which Nmap scan type and associated flag would be most appropriate for the initial port scanning phase, followed by service version detection?

1. SYN scan with -sS, followed by version detection with -sV.
2. FIN scan with -sF, followed by a full TCP connect scan with -sT.
3. UDP scan with -sU, followed by OS detection with -O.
4. XMAS scan with -sX, followed by script scanning with -sC.

---------- Question 8

A security analyst is investigating a suspected data exfiltration incident from a compromised internal system. Initial forensic analysis reveals that several seemingly innocuous image files were recently modified and uploaded to an external cloud storage service. There is no clear indication of traditional malware or overt data transfer logs. However, the size of these image files is slightly larger than their original versions, and their metadata appears somewhat altered. The analyst suspects a covert communication channel or hidden data within these files. Which technique would be the MOST relevant for uncovering the hidden information within these images?

1. Performing a traditional file signature analysis to identify known malware signatures.
2. Using a network protocol analyzer like 'Wireshark' to capture and inspect network traffic.
3. Employing steganalysis tools to detect and extract data hidden using steganography techniques.
4. Analyzing the system's event logs for unusual login attempts or privilege escalation activities.

---------- Question 9

A penetration tester is tasked with assessing the security of a custom Android application developed for a financial institution. The tester discovers that the application stores sensitive user data, including personal identifiable information PII, in an unencrypted format within the device is local storage, accessible to other applications if the device is rooted or if permissions are not properly managed. Which common mobile application security vulnerability does this scenario represent, and what is a critical security guideline violated?

1. Insecure data storage, where sensitive information is stored without proper encryption or access controls on the mobile device, violating the principle of data at rest protection.
2. Broken cryptography, where weak or improperly implemented encryption algorithms lead to data compromise during transmission.
3. Insufficient transport layer protection, indicating a lack of secure communication protocols like HTTPS for data in transit.
4. Client-side injection, similar to web application injection vulnerabilities, but targeting mobile application input fields for code execution.

---------- Question 10

A company is migrating its applications to a public cloud provider. They utilize serverless functions and containerized microservices. During a security review, it is discovered that one of the serverless functions has overly permissive Identity and Access Management IAM roles, allowing it to access and modify data in S3 buckets that are unrelated to its intended function. This misconfiguration could lead to unauthorized data access or modification if the function is compromised, representing a significant security risk. This specific type of cloud security risk is an example of what, where resources have more permissions than required for their legitimate operations?

1. Distributed Denial-of-Service (DDoS) attack
2. Cloud account takeover
3. Insecure APIs
4. Over-privileged IAM roles

---

Are they useful?

Click here to get 750 more questions to pass this certification at the first try! Explanation for each answer is included!

Follow the below LINKEDIN channel to stay updated about 89+ exams!

Security Engineering Network