ECCouncil Certified Ethical Hacker Exam (CEHv13) Sample Questions:

1. During a security assessment in San Francisco, an ethical hacker is tasked with evaluating a network ' s resilience against stealthy reconnaissance attempts. The hacker needs to employ a scanning technique that leverages TCP flags to evade detection by intrusion detection systems, relying on the target ' s response behavior to infer port states without completing a full connection. Which approach best aligns with this strategy, ensuring minimal visibility during the assessment?

A) TCP Connect Scan
B) NULL Scan
C) FIN Scan
D) Network Scanning

2. A Certified Ethical Hacker (CEH) is auditing a company's web server that employs virtual hosting. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server's document directory (containing critical HTML files) is named "certrcx" and stored in /admin/web. The server root (containing configuration, error, executable, and log files) is also identified. The CEH also notes that the server uses a virtual document tree for additional storage. Which action would most likely increase the security of the web server?

A) Implementing an open-source web server architecture such as LAMP
B) Regularly updating and patching the server software
C) Changing the server's IP address regularly
D) Moving the document root directory to a different disk

3. During a security penetration test at ABC Financial Services in Miami, Florida, on July 9, 2025, ethical hacker Javier Morales targets the company's online banking portal to assess its resilience. Over several hours, the portal's web server begins to falter, with legitimate users reporting inability to log in or complete transactions. The IT team notices the server is struggling to accept new connections, as its maximum connection limit is nearly reached, despite no significant spike in overall network traffic. Javier's controlled test, run from a secure system, logs interactions to simulate a real attack, aiming to evaluate the IT team's ability to identify the threat.
What DoS or DDoS attack technique is Javier's exercise primarily simulating?

A) Peer-to-Peer Attack
B) Slowloris Attack
C) SYN Flood Attack
D) UDP Flood Attack

4. You are leading an internal red team assessment for a multinational bank with a highly complex and distributed IT infrastructure. Your team is required to simulate attacks across cloud services, servers, and remote endpoints. Due to the sheer scale of the environment, you deploy an AI-based platform that automatically scans the entire network, flags anomalies based on prior breach data, and adjusts its threat detection models as new attack behaviors are encountered.
What key benefit of AI-driven ethical hacking is most critical to your success in this scenario?

A) Simulation and testing
B) Scalability
C) Predictive analysis
D) Enhanced reporting

5. During a red team assessment at a retail bank in New York, ethical hacker Aisha launches a flood of TCP connection initiation packets against the bank ' s online portal. The target accepts each initial handshake packet but never receives the final ACK to complete the three-way handshake, exhausting the server ' s backlog of half-open connections and preventing legitimate users from establishing new sessions.
Which type of DoS attack is Aisha most likely simulating?

A) SYN Flood Attack
B) TCP SACK Panic
C) ACK Flood
D) APT Attack

Solutions: