Certified Ethical Hacker (CEH) Practice Exam: 100 Offensive Security Questions

Certified Ethical Hacker (CEH) Practice Exam & Penetration Testing Quiz

Validate your penetration testing expertise and prepare for the EC-Council Certified Ethical Hacker (CEH) certification exam with this 100-question practice test. Covering defensive and offensive methodologies, this assessment reinforces concepts across reconnaissance, vulnerability assessment, system exploitation, privilege escalation, and wireless attack vectors.

Penetration Testing Phases & Exam Domains

This assessment evaluates knowledge across standard ethical hacking methodology:

• Information Gathering & Reconnaissance: Passive footprinting, OSINT tools (theHarvester, Shodan, Maltego), WHOIS reconnaissance, DNS zone transfers (dig axfr), Google dorking syntax, and competitive threat intelligence analysis.
• Scanning Networks & Enumeration: Nmap scanning flags (-sS SYN stealth, -sU UDP, -sV version detection, -O OS fingerprinting, -A aggressive), TCP three-way handshake manipulation, banner grabbing with Netcat, and service enumeration (SNMPwalk, NetBIOS, RPC, SMB via enum4linux).
• Vulnerability Analysis: CVSS v3.1 scoring metrics, vulnerability database queries (CVE, NVD), authenticated vs unauthenticated vulnerability scanner audits (Nessus, OpenVAS), and exploitation feasibility evaluation.
• System Hacking & Exploitation: Password cracking techniques (rainbow tables, dictionary, hybrid, pass-the-hash), privilege escalation on Linux (SUID binaries, sudo misconfigurations) and Windows (Token impersonation, Unquoted Service Paths), buffer overflow execution, and rootkit persistence.
• Malware Threats & Evasion: Virus architectures, worm propagation mechanisms, polymorphic/metamorphic code engines, trojans (RATs, banking), defense evasion (disabling AV, DLL side-loading), and packer inspection.
• Sniffing, Web Server & Wireless Attacks: ARP poisoning via arpspoof, rogue DHCP servers, Wi-Fi cracking (WPA2 handshake 4-way capture, PMKID attacks, aircrack-ng), SQL injection, cross-site scripting (XSS), and session hijacking.

Realistic Tools & Syntax Evaluation

The questions feature actual syntax from industry-standard tools including Metasploit, Nmap, Wireshark, Burp Suite, John the Ripper, and Hydra. You will review packet captures, evaluate exploit payloads, and identify vulnerabilities from server command responses.