CEH Ethical Hacker Prep Exam Questions & Answers 2026 (11–20)

Question 1

Which of the following mechanisms can be used by employees to verify the authenticity of an internal company email to prevent phishing attacks?

TheoryPractice · Accepted Answer

Codeword. Answer: Codeword A codeword is a pre-agreed word or phrase that is used to authenticate the sender of an email within a company. This can help employees verify the legitimacy of the email and prevent falling victim to phishing attacks. A steganographic message is hidden within another medium, such as a photo or video, to conceal its presence. An encrypted hash is typically used for integrity verification rather than initial authentication. A digital ID is an electronic credential used to identify a user, often within PKI systems, but may not be easily verified by all employees in daily communications.

Question 2

Which of the following attacks involves intercepting Wi-Fi traffic to gather sensitive information?

TheoryPractice · Accepted Answer

Evil Twin. Answer: Evil Twin An Evil Twin attack involves creating a rogue Wi-Fi access point that mimics a legitimate one to intercept and gather sensitive information from unsuspecting users. This is a type of sniffing attack because it captures data from the network traffic traversing the rogue access point.

Question 3

What is the purpose of a honeypot in network security?

TheoryPractice · Accepted Answer

To lure and analyze potential attackers. A honeypot is designed to attract potential attackers by simulating a target. It allows network administrators to observe, analyze, and understand malicious activities without risking valuable internal data.

Question 4

During a penetration test, which technique involves appending malicious SQL commands to the end of a URL query string?

TheoryPractice · Accepted Answer

Piggybacking. Piggybacking involves adding malicious SQL commands to a legitimate query, often appended to the URL. Spoofing impersonates another user or device, Tunneling encapsulates one protocol within another, and Phishing is a social engineering attack to steal sensitive information.

Question 5

An attacker is sniffing the network for communications operating over port 443. Which of the following services would they MOST LIKELY be attempting to obtain information about?

TheoryPractice · Accepted Answer

SSL (HTTPS). Answer: SSL (HTTPS) HTTP services are often scanned during an attacker's reconnaissance phase on web applications. Of the typical services, SSL (HTTPS) operates on port 443. Other commonly used HTTP service ports include: Port Typical HTTP services 80 World Wide Web standard port 81 Alternate WWW 88 Kerberos 443 SSL (HTTPS) 900 IBM Websphere administration client 2301 Compaq Insight Manager 2381 Compaq Insight Manager over SSL 4242 Microsoft App. Center Remote Mgmt 7001 BEA Weblogic 7002 BEA Weblogic over SSL 7070 Sun Java Web Server over SSL 8000 Alternate web server, or web cache 8001 Alternate web server or mgmt 8005 Apache Tomcat 9090 Sun Java Web Server admin module 10000 Netscape Administrator interface

Question 6

What is the MOST effective method to prevent SQL injection attacks in web applications?

TheoryPractice · Accepted Answer

Prepared statements. Answer: Prepared statements Prepared statements help to prevent SQL injection by parameterizing the SQL queries so that the input data is treated as data and not as part of the SQL code. This process avoids SQL injection by ensuring that input data cannot modify the intent of the query.

Question 7

Which server component should a hacker target if they want to intercept and manipulate web application traffic between the client and the server?

TheoryPractice · Accepted Answer

Proxy server. Correct answer: Proxy server. A proxy server acts as an intermediary for requests from clients seeking resources from other servers. By targeting the proxy server, a hacker can intercept and manipulate traffic between the client and the web application, making it a critical point for compromising data integrity and security.

Question 8

In the context of modern web development, which feature of Single Page Applications (SPAs) increases their vulnerability to attacks?

TheoryPractice · Accepted Answer

Client-side scripts. Answer: Client-side scripts Client-side scripts in SPAs increase vulnerability because they often run directly in the user's browser and can interact dynamically with server-side resources. This introduces the possibility for exploits like cross-site scripting (XSS) and increases the attack surface compared to static or server-rendered content.

Question 9

Which of the following is a web security tool that enables you to intercept, inspect, and modify raw HTTP/HTTPS traffic between the client and the server?

TheoryPractice · Accepted Answer

Burp Suite. Answer: Burp Suite Burp Suite is a comprehensive toolset for web security testing that allows you to intercept, inspect, and modify raw HTTP/HTTPS traffic between the client and the server. It is widely used by security professionals for testing the security of web applications. Wireshark is a network protocol analyzer for network troubleshooting and analysis. Nmap is a network scanner used to discover hosts and services on a computer network. OpenVAS is a framework of several services and tools offering vulnerability scanning and vulnerability management.

Question 10

Which encryption tool does Apple provide to encrypt macOS data volumes?

TheoryPractice · Accepted Answer

FileVault. Answer: FileVault FileVault is an encryption utility included with MacOS. It provides encryption for all data on the drive to help protect against unauthorized access to the information on your startup disk.

CEH Ethical Hacker Prep Exam Questions & Answers 2026 (11–20)

More CEH Ethical Hacker Prep practice questions

Free practice here. Timed mocks when you are ready.