CEH v13

One question per exam domain, 9 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Information Security and Ethical Hacking Overview

   Blue Ridge Community College holds little financial data but runs a large research GPU cluster with permissive account provisioning for visiting researchers. Which threat scenario deserves the highest priority?

   1. AA hacktivist group defacing the public marketing website to embarrass the institution
   2. BAn opportunistic actor compromising accounts to abuse the research cluster's compute
   3. CA nation state actor exfiltrating payroll records from the college's finance systems
   4. DA ransomware crew encrypting the student records database and demanding payment for it
   Show answer and explanation

   Correct answer

   An opportunistic actor compromising accounts to abuse the research cluster's compute

   Threat prioritization pairs adversary motivation with what the organization actually holds and how exposed it is, and the college's most attractive and directly monetizable asset is idle compute reachable through a weak provisioning path. Ransomware against student records is a real and common scenario, but it is not favored by this particular asset profile, and the scenario gives no indication that records are unusually exposed. Nation state interest in payroll records is a poor fit because payroll is not an intelligence target of note and the college holds little financial data. Website defacement is plausible for any public institution but produces embarrassment rather than material loss. The discriminator is fit between the adversary's incentive and the organization's specific attack surface.

   Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

2. Question 2 · Reconnaissance Techniques

   An engineer at Ellery State University proposes blocking the control protocol carrying echo requests at the campus edge. The architect warns that large partner transfers would fail intermittently. Which recommendation is BEST?

   1. ARate limit echo requests from untrusted sources while continuing to block every other message type of the protocol at the campus edge.
   2. BBlock the protocol entirely at the campus edge and ask the partners to reduce their transfer sizes so that every transfer fits within the path.
   3. CPermit all of the protocol's traffic and rely on the intrusion detection platform to alert on the host sweep patterns as they appear.
   4. DPermit the message types that path maximum transmission unit discovery and error signalling need, and rate limit untrusted echo requests.
   Show answer and explanation

   Correct answer

   Permit the message types that path maximum transmission unit discovery and error signalling need, and rate limit untrusted echo requests.

   A blanket block of the control protocol also drops the fragmentation and error messages that path discovery depends on, which is exactly the intermittent large-transfer failure the architect predicts, so the workable policy is selective by message type. Blocking everything and asking partners to change their transfers pushes the university's configuration problem onto others and will not hold. Permitting everything and detecting afterward gives up a cheap reduction in host mapping. Rate limiting echo while still blocking the other message types preserves the original breakage, because the discovery and error messages remain unavailable.

   Source: NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy

3. Question 3 · System Hacking Phases and Attack Techniques

   A 40-person logistics SaaS company with no patch process and no asset inventory has never had security testing and can fund exactly one external engagement this year. Which recommendation is MOST appropriate?

   1. AA managed detection and response subscription instead of testing, because findings are worthless without a team to respond.
   2. BAn authenticated vulnerability assessment, because breadth of coverage against an undocumented estate yields more actionable findings.
   3. CA red team exercise, because it exercises detection and response alongside technical weaknesses and shows overall readiness.
   4. DA penetration test, because only demonstrated exploitation persuades executives to fund the remediation program that follows.
   Show answer and explanation

   Correct answer

   An authenticated vulnerability assessment, because breadth of coverage against an undocumented estate yields more actionable findings.

   Testing depth should match organizational maturity. An organization with no inventory and no patch process has an unknown attack surface, and the highest-value first engagement is the one that maps and quantifies that surface across every host. A penetration test proves a handful of paths are exploitable, which is genuinely persuasive to executives and is the strongest distractor here, but it leaves most of the estate unexamined and generates findings the company has no process to act on. A red team goes further in the same wrong direction: it measures detection and response maturity that this company has not yet built, so a failure result teaches nothing new. Buying monitoring instead of testing is a defensible long-term investment and addresses a real gap, but it does not tell the company what is currently vulnerable, and monitoring an unpatched, uninventoried estate simply produces alerts about compromises that basic hygiene would have prevented.

   Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

4. Question 4 · Network and Perimeter Hacking

   Trellis Defense Integration found evidence of an exploit its perimeter sensor never reported. The capture shows delivery in small overlapping IP fragments that reassemble differently by operating system. Which change BEST closes the gap?

   1. AIncrease the sensor's capture buffer and extend packet retention so full sessions are recorded
   2. BPlace the sensor inline and enable target based reassembly and defragmentation before signatures run
   3. CDrop all fragmented IP traffic at the perimeter so no split payload ever reaches an internal host at all
   4. DWrite and deploy a signature for the specific exploit that was used against the affected host
   Show answer and explanation

   Correct answer

   Place the sensor inline and enable target based reassembly and defragmentation before signatures run

   The evasion works because the sensor and the destination host resolve overlapping fragments differently, so the sensor evaluates a byte stream the host never sees. Normalizing traffic and reassembling the way the specific target would, before signatures run, removes that ambiguity and generalizes to future exploits. A signature for this one exploit leaves the technique intact for the next payload. Blanket dropping of fragments breaks legitimate traffic including some tunnelled and path constrained flows. More capture buffer improves investigation and changes nothing about what the sensor decides in real time.

   Source: NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems

5. Question 5 · Web Application Hacking

   Anvil Interactive learns of an actively exploited flaw in the framework behind its player account site. The vendor published a request signature but no fix, and the site serves two million players. Which is the BEST first step?

   1. AForce a password reset for all two million player accounts as a precaution against compromise
   2. BTake the account site offline entirely until the vendor releases a patched framework version
   3. CWait for the official patch and rely on existing logging to detect exploitation attempts
   4. DDeploy an edge rule blocking the published exploit signature, raise monitoring, and track the fix
   Show answer and explanation

   Correct answer

   Deploy an edge rule blocking the published exploit signature, raise monitoring, and track the fix

   When no fix exists, a targeted mitigation at the edge combined with heightened monitoring reduces risk immediately while preserving the service, and it is explicitly recognized as an interim measure until the vendor update can be applied. Taking the site down is a legitimate option for extreme cases, but it inflicts certain, large harm to defend against a risk that a specific signature can substantially reduce, so it is disproportionate as a first step. A mass password reset assumes credential compromise that has not been established, generates enormous support load, and does not address the vulnerable code path. Waiting passively accepts exposure during the highest-risk window, when exploitation is already occurring in the wild. The principle is to apply proportionate interim mitigation and keep the permanent fix on the clock.

   Source: NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning

6. Question 6 · Wireless Network Hacking

   Pelham Mills runs its production wireless in mixed mode so vintage label printers can use the older cipher while other clients use AES-CCMP. The plant manager will not replace the printers this year. Which recommendation is best?

   1. AKeep mixed mode and compensate with a much longer passphrase rotated every quarter across the plant
   2. BKeep mixed mode but confine the legacy cipher to the 2.4 GHz radio, where only the label printers operate today
   3. CRetire the legacy cipher on production and move the label printers to a separate filtered network or a wired link
   4. DDisable the 2.4 GHz radio entirely so that only modern 5 GHz capable clients can associate to production
   Show answer and explanation

   Correct answer

   Retire the legacy cipher on production and move the label printers to a separate filtered network or a wired link

   A network that advertises both a strong and a deprecated cipher gives every client on it the security of the weaker option, because negotiation is driven by what is offered. Removing the legacy cipher from production and quarantining the printers on their own tightly scoped network preserves operations while ending the shared exposure, and it makes the remaining risk visible and bounded. Confining the legacy cipher to one band still leaves it available on a network that carries production clients, so the mixed-mode weakness survives. A longer passphrase strengthens resistance to offline guessing but does nothing about a cipher whose integrity and keying weaknesses are structural. Disabling the 2.4 GHz radio would strand the printers, which is the outcome the plant manager explicitly ruled out this year, and it does not address cipher negotiation on the remaining band.

   Source: NIST SP 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i

7. Question 7 · Mobile, IoT, and OT Hacking

   Harrowgate Foods logs show a full program download sent to a filling-line controller at 02:14 Sunday, outside any change window and with no change ticket. Production ran normally the next morning. What should the analyst do next?

   1. ABlock the engineering workstation's access to the controller network until its owner accounts for the Sunday activity
   2. BClose the finding, since the line ran normally the next morning and no process upset or product quality deviation occurred
   3. CReimage the engineering workstation immediately to remove any implant before it can send another program download to the controller
   4. DTreat it as a possible unauthorized program download and have engineering compare the running logic against the approved baseline
   Show answer and explanation

   Correct answer

   Treat it as a possible unauthorized program download and have engineering compare the running logic against the approved baseline

   A program download replaces the logic the controller executes, and malicious logic can be written to behave normally under observed conditions, so normal production is not evidence of integrity and the decisive step is comparing running logic against the approved baseline with the engineers who own it. Closing the finding assumes the absence of a visible upset means the absence of change, which is exactly the assumption this technique exploits. Reimaging the workstation destroys the forensic record of who initiated the download and how, before anyone knows whether the controller was altered. Blocking the workstation is a reasonable containment measure to run in parallel, but on its own it leaves possibly modified logic executing on a production line.

   Source: Program Download, Technique T0843, MITRE ATT&CK for ICS

8. Question 8 · Cloud Computing

   A night manager's phone showed nine approval prompts at two in the morning and she tapped approve to stop them; a console sign in from an unfamiliar device followed. Which control would MOST effectively prevent a repeat?

   1. AReplace simple approval prompts with an origin bound authenticator, or at minimum require number matching
   2. BLower the number of push prompts an account may receive before it is automatically locked out entirely
   3. CChange the second factor from push notification to one time codes delivered by text message instead
   4. DShorten the length of time a push approval request remains valid on the phone before it expires
   Show answer and explanation

   Correct answer

   Replace simple approval prompts with an origin bound authenticator, or at minimum require number matching

   The weakness is that a single undifferentiated tap can approve an authentication the user did not start, so the fix is an authenticator the attacker cannot drive remotely, or failing that a challenge that forces the user to transcribe a value only the real session shows. A lockout threshold converts the technique into a reliable denial of service against any administrator an attacker chooses. Text message codes remove the blind approval but introduce interception and number porting weaknesses and remain phishable in real time. A shorter validity window only compresses the timing of the same prompt flood.

   Source: NIST SP 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management

9. Question 9 · Cryptography

   A port terminal must protect crane telemetry between two sites over a leased circuit. A dozen legacy protocols are involved, several UDP based, and the vendors will not modify their software. Which mechanism fits BEST?

   1. ATerminate each application behind a pair of TLS proxies, since TLS is the most widely reviewed transport protection available today
   2. BCreate an SSH port forwarding tunnel for each protocol, since tunnels can be scripted and need no vendor change at all
   3. CEstablish network layer security associations protecting all IP traffic between the two sites, transparently to the applications
   4. DAdd application layer encryption through a middleware shim on each endpoint so payloads are encrypted before transmission
   Show answer and explanation

   Correct answer

   Establish network layer security associations protecting all IP traffic between the two sites, transparently to the applications

   The binding constraints are unmodifiable applications, a dozen protocols and connectionless traffic, which points at protection below the application layer. A network layer security association between the two sites encrypts and authenticates every IP packet regardless of the protocol above it and requires no change to any application. TLS proxies are excellent for stream oriented protocols but map poorly onto connectionless control traffic and mean a bespoke termination for each of the twelve protocols. SSH forwarding shares that limitation, adds a per protocol tunnel to operate and is generally unsuitable for latency sensitive UDP control traffic. A middleware shim on each endpoint is exactly the vendor change that has been ruled out and multiplies the code that must be assured.

   Source: NIST SP 800-77 Rev. 1: Guide to IPsec VPNs