CEH v13

One question per exam domain, 9 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Information Security and Ethical Hacking Overview

   A community college holds little financial data but runs a large research GPU cluster with permissive account provisioning for visiting researchers. Which threat scenario deserves the highest priority?

   1. AA hacktivist group defacing the public website to embarrass the institution
   2. BAn opportunistic actor hijacking accounts to abuse the cluster's compute
   3. CA nation state actor exfiltrating payroll records from finance systems
   4. DA ransomware crew encrypting the student records database for payment
   Show answer and explanation

   Correct answer

   An opportunistic actor hijacking accounts to abuse the cluster's compute

   Threat prioritization pairs adversary motivation with what the organization actually holds and how exposed it is, and the college's most attractive and directly monetizable asset is idle compute reachable through a weak provisioning path. Ransomware against student records is a real and common scenario, but it is not favored by this particular asset profile, and the scenario gives no indication that records are unusually exposed. Nation state interest in payroll records is a poor fit because payroll is not an intelligence target of note and the college holds little financial data. Website defacement is plausible for any public institution but produces embarrassment rather than material loss. The discriminator is fit between the adversary's incentive and the organization's specific attack surface.

   Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

2. Question 2 · Reconnaissance Techniques

   An engineer proposes blocking all ICMP at the campus edge to stop host sweeps. The network architect warns that large transfers with partners would then fail intermittently. Which recommendation is BEST?

   1. ARate limit echo requests from untrusted sources while still blocking every other ICMP type at the edge.
   2. BBlock all ICMP at the edge and ask partners to reduce transfer sizes so each fits the path.
   3. CPermit all ICMP and rely on the intrusion detection platform to alert on host sweep patterns.
   4. DPermit ICMP needed for path MTU discovery and error signalling; rate limit untrusted echo requests.
   Show answer and explanation

   Correct answer

   Permit ICMP needed for path MTU discovery and error signalling; rate limit untrusted echo requests.

   A blanket ICMP block also drops the fragmentation and error messages that path discovery depends on, which is exactly the intermittent large-transfer failure the architect predicts, so the workable policy is selective by message type. Blocking everything and asking partners to change their transfers pushes the university's configuration problem onto others and will not hold. Permitting everything and detecting afterward gives up a cheap reduction in host mapping. Rate limiting echo while still blocking the other message types preserves the original breakage, because the discovery and error messages remain unavailable.

   Source: NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy

3. Question 3 · System Hacking Phases and Attack Techniques

   A 40-person SaaS company with no patch process or asset inventory has never had security testing and can fund one external engagement this year. Which recommendation is MOST appropriate?

   1. AManaged detection and response instead of testing, since findings are useless without responders.
   2. BAn authenticated vulnerability assessment, for broad coverage of an undocumented estate.
   3. CA red team exercise, because it tests detection and response alongside technical weaknesses.
   4. DA penetration test, because demonstrated exploitation persuades executives to fund remediation.
   Show answer and explanation

   Correct answer

   An authenticated vulnerability assessment, for broad coverage of an undocumented estate.

   Testing depth should match organizational maturity. An organization with no inventory and no patch process has an unknown attack surface, and the highest-value first engagement is the one that maps and quantifies that surface across every host. A penetration test proves a handful of paths are exploitable, which is genuinely persuasive to executives and is the strongest distractor here, but it leaves most of the estate unexamined and generates findings the company has no process to act on. A red team goes further in the same wrong direction: it measures detection and response maturity that this company has not yet built, so a failure result teaches nothing new. Buying monitoring instead of testing is a defensible long-term investment and addresses a real gap, but it does not tell the company what is currently vulnerable, and monitoring an unpatched, uninventoried estate simply produces alerts about compromises that basic hygiene would have prevented.

   Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

4. Question 4 · Network and Perimeter Hacking

   A defense contractor found evidence of an exploit its perimeter sensor never reported. The capture shows delivery in small overlapping IP fragments that operating systems reassemble differently. Which change BEST closes the gap?

   1. AEnlarge the capture buffer and extend retention to record full sessions
   2. BRun the sensor inline with target-based reassembly before signatures
   3. CDrop all fragmented IP traffic at the perimeter so no split payload gets in
   4. DWrite a signature for the specific exploit used against the host
   Show answer and explanation

   Correct answer

   Run the sensor inline with target-based reassembly before signatures

   The evasion works because the sensor and the destination host resolve overlapping fragments differently, so the sensor evaluates a byte stream the host never sees. Normalizing traffic and reassembling the way the specific target would, before signatures run, removes that ambiguity and generalizes to future exploits. A signature for this one exploit leaves the technique intact for the next payload. Blanket dropping of fragments breaks legitimate traffic including some tunnelled and path constrained flows. More capture buffer improves investigation and changes nothing about what the sensor decides in real time.

   Source: NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems

5. Question 5 · Web Application Hacking

   A company learns of an actively exploited flaw in the framework behind its player account site. The vendor published a request signature but no fix, and the site serves two million players. Which is the BEST first step?

   1. AForce a password reset for all two million player accounts as a precaution
   2. BTake the account site offline until the vendor releases a patched version
   3. CWait for the official patch and rely on existing logging to detect exploitation
   4. DBlock the published signature at the edge, raise monitoring, and track the fix
   Show answer and explanation

   Correct answer

   Block the published signature at the edge, raise monitoring, and track the fix

   When no fix exists, a targeted mitigation at the edge combined with heightened monitoring reduces risk immediately while preserving the service, and it is explicitly recognized as an interim measure until the vendor update can be applied. Taking the site down is a legitimate option for extreme cases, but it inflicts certain, large harm to defend against a risk that a specific signature can substantially reduce, so it is disproportionate as a first step. A mass password reset assumes credential compromise that has not been established, generates enormous support load, and does not address the vulnerable code path. Waiting passively accepts exposure during the highest-risk window, when exploitation is already occurring in the wild. The principle is to apply proportionate interim mitigation and keep the permanent fix on the clock.

   Source: NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning

6. Question 6 · Wireless Network Hacking

   Pelham Mills runs its production wireless in mixed mode so vintage label printers can use the older cipher while other clients use AES-CCMP. The plant manager will not replace the printers this year. Which recommendation is best?

   1. AKeep mixed mode and compensate with a much longer passphrase rotated every quarter across the plant
   2. BKeep mixed mode but confine the legacy cipher to the 2.4 GHz radio, where only the label printers operate today
   3. CRetire the legacy cipher on production and move the label printers to a separate filtered network or a wired link
   4. DDisable the 2.4 GHz radio entirely so that only modern 5 GHz capable clients can associate to production
   Show answer and explanation

   Correct answer

   Retire the legacy cipher on production and move the label printers to a separate filtered network or a wired link

   A network that advertises both a strong and a deprecated cipher gives every client on it the security of the weaker option, because negotiation is driven by what is offered. Removing the legacy cipher from production and quarantining the printers on their own tightly scoped network preserves operations while ending the shared exposure, and it makes the remaining risk visible and bounded. Confining the legacy cipher to one band still leaves it available on a network that carries production clients, so the mixed-mode weakness survives. A longer passphrase strengthens resistance to offline guessing but does nothing about a cipher whose integrity and keying weaknesses are structural. Disabling the 2.4 GHz radio would strand the printers, which is the outcome the plant manager explicitly ruled out this year, and it does not address cipher negotiation on the remaining band.

   Source: NIST SP 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i

7. Question 7 · Mobile, IoT, and OT Hacking

   Logs show a full program download sent to a filling-line controller at 02:14 Sunday, outside any change window and with no change ticket. Production ran normally the next morning. What should the analyst do next?

   1. ABlock the engineering workstation from the controller network until its owner explains the Sunday activity
   2. BClose the finding, since the line ran normally and no process upset or quality deviation occurred
   3. CReimage the engineering workstation immediately to remove any implant before it sends another download
   4. DTreat it as possibly unauthorized and have engineering compare running logic to the approved baseline
   Show answer and explanation

   Correct answer

   Treat it as possibly unauthorized and have engineering compare running logic to the approved baseline

   A program download replaces the logic the controller executes, and malicious logic can be written to behave normally under observed conditions, so normal production is not evidence of integrity and the decisive step is comparing running logic against the approved baseline with the engineers who own it. Closing the finding assumes the absence of a visible upset means the absence of change, which is exactly the assumption this technique exploits. Reimaging the workstation destroys the forensic record of who initiated the download and how, before anyone knows whether the controller was altered. Blocking the workstation is a reasonable containment measure to run in parallel, but on its own it leaves possibly modified logic executing on a production line.

   Source: Program Download, Technique T0843, MITRE ATT&CK for ICS

8. Question 8 · Cloud Computing

   A night manager's phone showed nine approval prompts at 2 a.m., and she tapped approve to stop them. A console sign-in from an unfamiliar device followed. Which control would MOST effectively prevent a repeat?

   1. AReplace simple approval prompts with an origin-bound authenticator, or at minimum require number matching
   2. BLower the number of push prompts an account may receive before it is automatically locked out entirely
   3. CChange the second factor from push notification to one-time codes delivered by text message instead
   4. DShorten the length of time a push approval request remains valid on the phone before it expires
   Show answer and explanation

   Correct answer

   Replace simple approval prompts with an origin-bound authenticator, or at minimum require number matching

   The weakness is that a single undifferentiated tap can approve an authentication the user did not start, so the fix is an authenticator the attacker cannot drive remotely, or failing that a challenge that forces the user to transcribe a value only the real session shows. A lockout threshold converts the technique into a reliable denial of service against any administrator an attacker chooses. Text message codes remove the blind approval but introduce interception and number porting weaknesses and remain phishable in real time. A shorter validity window only compresses the timing of the same prompt flood.

   Source: NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management

9. Question 9 · Cryptography

   A port terminal must protect crane telemetry between two sites over a leased circuit. A dozen legacy protocols are involved, several UDP-based, and the vendors will not modify their software. Which mechanism fits BEST?

   1. AA pair of TLS proxies in front of each application, since TLS is the most widely reviewed transport protection
   2. BAn SSH port-forwarding tunnel per protocol, since tunnels can be scripted and need no vendor change
   3. CNetwork-layer security associations protecting all IP traffic between the sites, transparent to applications
   4. DApplication-layer encryption via a middleware shim on each endpoint, encrypting payloads before transmission
   Show answer and explanation

   Correct answer

   Network-layer security associations protecting all IP traffic between the sites, transparent to applications

   The binding constraints are unmodifiable applications, a dozen protocols and connectionless traffic, which points at protection below the application layer. A network layer security association between the two sites encrypts and authenticates every IP packet regardless of the protocol above it and requires no change to any application. TLS proxies are excellent for stream oriented protocols but map poorly onto connectionless control traffic and mean a bespoke termination for each of the twelve protocols. SSH forwarding shares that limitation, adds a per protocol tunnel to operate and is generally unsuitable for latency sensitive UDP control traffic. A middleware shim on each endpoint is exactly the vendor change that has been ruled out and multiplies the code that must be assured.

   Source: NIST SP 800-77 Rev. 1: Guide to IPsec VPNs