CEH Ethical Hacker Prep practice questions and answers 2026. Tap an option to test yourself — you'll see the correct answer and a plain-English explanation for every question. Free, no login.
Q21Which of the following is the essential requirement for a secure symmetric encryption algorithm?
✓ Correct answer: D. Strong key management
The essential requirement for a secure symmetric encryption algorithm is strong key management. Efficiently managing keys ensures that unauthorized parties cannot easily decipher the encrypted information. Key management includes the generation, storage, distribution, and eventual destruction of keys.
Q22Your organization recently integrated a series of robotic systems into your manufacturing processes from ABB, a global leader in automation technologies. What industrial protocol is used that you need to put anti-hacking countermeasures in place for?
✓ Correct answer: A. IRC5
Answer: IRC5 IRC5 stands for the Industrial Robot Controller 5, which is ABB's proprietary communication protocol for their robotic systems. Hackers can target and compromise communications utilizing this protocol.
Q23According to the EC-Council, which of the following is NOT considered a core component in the typical Operational Technology (OT) architecture?
✓ Correct answer: C. User Interface Layer
Answer: User Interface Layer The typical Operational Technology (OT) architecture generally includes the following layers: Layer Function Control Layer Manages and controls the operation of field devices Network Layer Facilitates communication between devices and systems Field Devices Layer Consists of the physical devices like sensors and actuators The User Interface Layer, while important for user interactions in many technologies, is not traditionally considered a core layer in OT architecture.
Q24You plan to perform a Man-in-the-Middle (MitM) attack on an Android device. Which of the following tools would you use to accomplish this?
✓ Correct answer: C. dSploit
Answer: dSploit dSploit is a powerful tool used to perform network security assessments, including Man-in-the-Middle attacks on Android devices.
Q25Which of the following is NOT a common security risk associated with jailbreaking a device?
✓ Correct answer: A. Enhanced user experience
Answer: Enhanced user experience Jailbreaking a device involves bypassing manufacturer restrictions to gain root access, which can expose the device to various security risks such as malware, voided warranties, and instability. These risks undermine the device's security and reliability.
Q26Which of the following is NOT a recommended way to secure Operational Technology (OT) systems from cyber threats?
✓ Correct answer: C. Connect OT systems directly to the corporate network for seamless data flow
Answer: Connect OT systems directly to the corporate network for seamless data flow. Operational Technology (OT) systems should be isolated from the IT network to enhance security. Directly connecting OT systems to the corporate network can expose them to additional vulnerabilities. It is recommended to implement strong controls, such as network segmentation, disabling unnecessary accounts, and using robust authentication mechanisms.
Q27Which tool is typically used for DNS zone transfers to gather domain information during footprinting?
✓ Correct answer: D. Dig
Answer: Dig Dig is a network administration command-line tool for querying DNS name servers. It is commonly used for DNS zone transfers, which can gather extensive information about a domain's DNS records.
Q28What type of network scanning method does not trigger IDS alerts and remains unnoticed?
✓ Correct answer: D. Passive
Answer: Passive Passive network scanning involves the collection of data from network traffic without actively probing the network. It is less likely to be detected because it does not generate noticeable traffic.
Q29Which protocol assists with translating domain names into IP addresses, facilitating communication between clients and servers on a network?
✓ Correct answer: B. DNS
Answer: DNS Domain Name System (DNS) is a protocol that translates domain names into IP addresses, enabling clients to locate servers on a network. Enumerating DNS records can help attackers identify internal structures and potential vulnerabilities within an organization's network.
Q30You need to find the active connections and their established states on your Debian server. What command would you use to achieve this?
✓ Correct answer: D. netstat -an
Answer: netstat -an The `netstat` command is used for monitoring network connections (incoming and outgoing), as well as routing tables, interface statistics, masquerade connections, and multicast memberships. The `-an` parameter displays all connections and their established states. This information is invaluable for identifying active connections on the server, which can be crucial for troubleshooting and security audits.
Use the free CEH Ethical Hacker Prep sample, download the PDF, then unlock web-based timed mock exams for a full exam rehearsal.
Theory