50 Free CEH Practice Questions — Certified Ethical Hacker

Preparing for the CEH? These 50 free practice questions cover all CEH domains.

---

Footprinting and Reconnaissance (Questions 1–9)

Question 1

What is Google dorking used for?

a) Finding Google vulnerabilities
b) Using advanced search operators to discover sensitive information
c) Hacking Google's servers
d) Indexing websites

Show Answer

Answer: b) Using advanced search operators to discover sensitive information

Explanation: Google dorking uses operators like site:, filetype:, intitle:, inurl: to discover exposed information (login pages, config files, exposed databases).

Question 2

Which tool is used for DNS enumeration and zone transfer attempts?

a) Nmap
b) dig
c) nslookup
d) All of the above

Show Answer

Answer: d) All of the above

Explanation: dig, nslookup, and specialized tools like dnsrecon and dnsenum perform DNS enumeration. Zone transfers can reveal all domain records.

Questions 3–9

[Full set covers OSINT, Shodan, whois, social media recon, email harvesting, and DNS reconnaissance]

---

Scanning and Enumeration (Questions 10–25)

Question 3

Which Nmap scan type sends SYN packets and doesn't complete the TCP handshake?

a) TCP connect scan (-sT)
b) SYN scan (-sS)
c) UDP scan (-sU)
d) Ping sweep (-sn)

Show Answer

Answer: b) SYN scan (-sS)

Explanation: SYN scan (half-open scan) sends SYN packets; if SYN/ACK is received, the port is open but the handshake is never completed (RST sent). It's stealthier than full connect.

Question 4

Which enumeration technique connects to a Windows system to list users?

a) SNMP enumeration
b) NetBIOS/SMB enumeration
c) LDAP enumeration
d) DNS enumeration

Show Answer

Answer: b) NetBIOS/SMB enumeration

Explanation: Tools like enum4linux enumerate Windows systems via SMB/NetBIOS to list users, shares, groups, and policies.

Questions 5–25

[Full set covers port scanning, OS fingerprinting, service detection, banner grabbing, SNMP, LDAP, NFS enumeration]

---

Exploitation (Questions 26–38)

Question 5

Which Metasploit module searches for exploits?

a) search
b) find
c) locate
d) scan

Show Answer

Answer: a) search

Explanation: In msfconsole, search <query> finds exploits, payloads, and auxiliary modules. use <module> selects it, show options displays configurable parameters.

Question 6

What is a reverse shell?

a) Target connects back to attacker's machine
b) Attacker connects to target directly
c) Shell through a web application
d) Encrypted shell connection

Show Answer

Answer: a) Target connects back to attacker's machine

Explanation: A reverse shell has the target initiate the connection back to the attacker, bypassing firewalls that block inbound connections.

Questions 7–38

[Full set covers Metasploit, Burp Suite, SQL injection, XSS, file inclusion, buffer overflows, and password cracking]

---

Post-Exploitation (Questions 39–50)

Question 7

What is privilege escalation?

a) Gaining initial access
b) Obtaining higher-level permissions after initial access
c) Covering tracks
d) Scanning for vulnerabilities

Show Answer

Answer: b) Obtaining higher-level permissions after initial access

Explanation: Privilege escalation moves from lower permissions (user) to higher (root/admin). Vertical = same user, higher privilege. Horizontal = different user, same privilege level.

Question 8

Which Windows tool dumps password hashes?

a) Mimikatz
b) John the Ripper
c) Hashcat
d) Hydra

Show Answer

Answer: a) Mimikatz

Explanation: Mimikatz extracts plaintext passwords, hash dumps, and Kerberos tickets from Windows memory. It's the most common post-exploitation credential tool.

Questions 9–50

[Full set covers persistence, lateral movement, pass-the-hash, covering tracks, logging, and pivoting]

---

How Did You Score?

Access all CEH practice questions →