The Subject Matter

If you were to take the CEH v11 training, you would have to go through the following modules:

• Introduction to Ethical Hacking
• Footprinting and Reconnaissance
• Scanning Networks
• Enumeration
• Vulnerability Analysis
• System Hacking
• Malware Threats
• Sniffing
• Social Engineering
• Denial of Service
• Session Hijacking
• Evading IDSs, Firewalls, and Honeypots
• Hacking Web Servers
• Hacking Web Applications
• SQL Injection
• Hacking Wireless Networks
• Hacking Mobile Platforms
• IoT Hacking
• Cloud Computing
• Cryptography

As you can see, the range of subjects is broad. Beyond knowing the concepts associated with these topics, you will be expected to know about various tools that may be used to perform the actions associated with the concepts you are learning. You will need to know tools like nmap for port scanning, for example. You may need to know proxy-based web application attack tools. For wireless network attacks, you may need to know about the aircrack-ng suite of tools. For every module listed, there are potentially dozens of tools that may be used.

The subject matter of the CEH exam is very technical. This is not a field in which you can get by with theoretical knowledge. You will need to have had experience with the methods and tools that are covered within the subject matter for the CEH exam. What you may also have noticed here is that the modules all fall within the different stages mentioned earlier. While you may not necessarily be asked for a specific methodology, you will find that the contents of the exam do generally follow the methodology that the EC-Council believes to be a standard approach.

About the Exam

The CEH exam has much the same parameters as other professional certification exams. You will take a computerized, proctored exam. You will have 4 hours to complete 125 questions. That means you will have, on average, roughly 2 minutes per question. The questions are all multiple choice. The exam can be taken through the ECC Exam Center or at a Pearson VUE center. For details about VUE, please visit https://www.vue.com/eccouncil.

Should you want to take your certification even further, you could go after the CEH Practical exam. For this exam you must perform an actual penetration test and write a report at the end of it. This demonstrates that in addition to knowing the body of material covered by the exam, you can put that knowledge to use in a practical way. You will be expected to know how to compromise systems and identify vulnerabilities.

To pass the exam, you will have to correctly answer a certain number of questions, though the actual number will vary. The passing grade varies depending on the difficulty of the questions asked. The harder the questions that are asked out of the complete pool of questions, the fewer questions you need to get right to pass the exam. If you get easier questions, you will need to get more of the questions right to pass. There are some sources of information that will tell you that you need to get 70 percent of the questions right, and that may be okay for general guidance and preparation as a rough low-end marker. However, keep in mind that when you sit down to take the actual test at the testing center, the passing grade will vary. The score you will need to achieve will range from 60 to 85 percent.

The good news is that you will know whether you passed before you leave the testing center. You will get your score when you finish the exam, and you will also get a piece of paper indicating the details of your grade. You will get feedback associated with the different scoring areas and how you performed in each of them.

Who Is Eligible

Not everyone is eligible to sit for the CEH exam. Before you go too far down the road, you should check your qualifications. Just as a starting point, you have to be at least 18 years of age. The other eligibility standards are as follows:

• Anyone who has versions 1–7 of the CEH certification. The CEH certification is ANSI certified now, but early versions of the exam were available before the certification. Anyone who wants to take the ANSI-accredited certification who has the early version of the CEH certification can take the exam.
• Minimum of two years of related work experience. Anyone who has the experience will have to pay a nonrefundable application fee of $100.
• Have taken an EC-Council training.

If you meet these qualification standards, you can apply for the certification, along with paying the fee if it is applicable to you (if you take one of the EC-Council trainings, the fee is included). The application will be valid for three months.

Exam Cost

To take the certification exam, you need to pay for a Pearson VUE exam voucher. The cost of this is $1,199. You could also obtain an EC-Council voucher for $950, but that requires that you have taken EC-Council training and can provide a Certificate of Attendance.

1. Which header field is used to reassemble fragmented IP packets?
   1. Destination address
   2. IP identification
   3. Don't fragment bit
   4. ToS field
2. If you were to see the following in a packet capture, what would you expect was happening?

   ' or 1=1; 

   1. Cross-site scripting
   2. Command injection
   3. SQL injection
   4. XML external entity injection
3. What method might you use to successfully get malware onto a mobile device?
   1. Through the Apple Store or Google Play Store
   2. External storage on an Android
   3. Third-party app store
   4. Jailbreaking
4. What protocol is used to take a destination IP address and get a packet to a destination on the local network?
   1. DHCP
   2. ARP
   3. DNS
   4. RARP
5. What would be the result of sending the string AAAAAAAAAAAAAAAAA into a variable that has been allocated space for 8 bytes?
   1. Heap spraying
   2. SQL injection
   3. Buffer overflow
   4. Slowloris attack
6. If you were to see the subnet mask 255.255.248.0, what CIDR notation (prefix) would you use to indicate the same thing?
   1. /23
   2. /22
   3. /21
   4. /20
7. What is the primary difference between a worm and a virus?
   1. A worm uses polymorphic code.
   2. A virus uses polymorphic code.
   3. A worm can self-propagate.
   4. A virus can self-propagate.
8. How would you calculate risk?
   1. Probability * loss
   2. Probability * mitigation factor
   3. (Loss + mitigation factor) * (loss/probability)
   4. Probability * mitigation factor
9. How does an evil twin attack work?
   1. Phishing users for credentials
   2. Spoofing an SSID
   3. Changing an SSID
   4. Injecting four-way handshakes
10. To remove malware in the network before it gets to the endpoint, you would use which of the following?
    1. Antivirus
    2. Application layer gateway
    3. Unified threat management appliance
    4. Stateful firewall
11. What is the purpose of a security policy?
    1. Providing high-level guidance on the role of security
    2. Providing specific direction to security workers
    3. Increasing the bottom line of a company
    4. Aligning standards and practices
12. What has been done to the following string?

    %3Cscript%3Ealert('wubble');%3C/script%3E

    1. Base64 encoding
    2. URL encoding
    3. Encryption
    4. Cryptographic hashing
13. What would you get from running the command dig ns domain.com?
    1. Mail exchanger records for domain.com
    2. Name server records for domain.com
    3. Caching name server for domain.com
    4. IP address for the hostname ns
14. What technique would you ideally use to get all of the hostnames associated with a domain?
    1. DNS query
    2. Zone copy
    3. Zone transfer
    4. Recursive request
15. If you were to notice operating system commands inside a DNS request while looking at a packet capture, what might you be looking at?
    1. Tunneling attack
    2. DNS amplification
    3. DNS recursion
    4. XML entity injection
16. What would be the purpose of running a ping sweep?
    1. You want to identify responsive hosts without a port scan.
    2. You want to use something that is light on network traffic.
    3. You want to use a protocol that may be allowed through the firewall.
    4. All of the above.
17. How many functions are specified by NIST's cybersecurity framework?
    1. 0
    2. 3
    3. 5
    4. 4
18. What would be one reason not to write malware in Python?
    1. The Python interpreter is slow.
    2. The Python interpreter may not be available.
    3. There is inadequate library support.
    4. Python is a hard language to learn.
19. If you saw the following command line, what would you be capturing?

    tcpdump -i eth2 host 192.168.10.5

    1. Traffic just from 192.168.10.5
    2. Traffic to and from 192.168.10.5
    3. Traffic just to 192.168.10.5
    4. All traffic other than from 192.168.86.5
20. What is Diffie-Hellman used for?
    1. Key management
    2. Key isolation
    3. Key exchange
    4. Key revocation
21. Which social engineering principle may allow a phony call from the help desk to be effective?
    1. Social proof
    2. Imitation
    3. Scarcity
    4. Authority
22. How do you authenticate with SNMPv1?
    1. Username/password
    2. Hash
    3. Public string
    4. Community string
23. What is the process Java programs identify themselves to if they are sharing procedures over the network?
    1. RMI registry
    2. RMI mapper
    3. RMI database
    4. RMI process
24. What do we call an ARP response without a corresponding ARP request?
    1. Is-at response
    2. Who-has ARP
    3. Gratuitous ARP
    4. IP response
25. What are the three times that are typically stored as part of file metadata?
    1. Moves, adds, changes
    2. Modified, accessed, deleted
    3. Moved, accessed, changed
    4. Modified, accessed, created
26. Which of these is a reason to use an exploit against a local vulnerability?
    1. Pivoting
    2. Log manipulation
    3. Privilege escalation
    4. Password collection
27. What principle is used to demonstrate that a signed message came from the owner of the key that signed it?
    1. Nonrepudiation
    2. Nonverifiability
    3. Integrity
    4. Authority
28. What is a viable approach to protecting against tailgating?
    1. Biometrics
    2. Badge access
    3. Phone verification
    4. Man traps
29. Why is bluesnarfing potentially more dangerous than bluejacking?
    1. Bluejacking sends, while bluesnarfing receives.
    2. Bluejacking receives, while bluesnarfing sends.
    3. Bluejacking installs keyloggers.
    4. Bluesnarfing installs keyloggers.
30. Which of the security triad properties does the Biba security model relate to?
    1. Confidentiality
    2. Integrity
    3. Availability
    4. All of them

1. B. The destination address is used as the address to send messages to. The don't fragment bit is used to tell network devices not to fragment the packet. The Type of Service (ToS) field can be used to perform quality of service. The IP identification field is used to identify fragments of the same packet, as they would all have the same IP identification number.
2. C. A SQL injection attack makes use of SQL queries, which can include logic that may alter the flow of the application. In the example provided, the intent is to force the result of the SQL query to always return a true. It is quoted the way it is to escape the existing query already in place in the application. None of the other attacks uses a syntax that looks like the example.
3. C. The Apple App Store and the Google Play Store are controlled by Apple and Google. It's not impossible to get malware onto mobile devices that way, but it's very difficult because apps get run through a vetting process. While some Android devices will support external storage, it's not an effective way to get malware onto a smartphone or other mobile device. Jailbreaking can lead to malware being installed, but it's not the means to get malware onto a mobile device. Third-party app stores can be a good means to get malware onto mobile devices because some third-party app stores don't vet apps that are submitted.
4. B. DHCP is used to get IP configuration to endpoints. DNS is used to resolve a hostname to an IP address and vice versa. RARP is the reverse address protocol used to take a MAC address and resolve it to an IP address. ARP is used to resolve an IP address to a MAC address. Communication on a local network requires the use of a MAC address. The IP address is used to get to systems off the local network.
5. C. Heap spraying uses dynamically allocated space to store attack code. A slowloris attack is used to hold open web server connection buffers. A SQL injection will be used to inject SQL queries to the database server. A buffer overflow sends more data into the application than space has been allocated for.
6. B. A /23 network would be 255.255.254.0. A /22 would be 255.255.252. A /20 would be 255.255.240.0. Only a /21 would give you a 255.255.248.0 subnet mask.
7. C. Both worms and viruses could be written to use polymorphic code, which means they could modify what they look like as they propagate. A worm, though, could self-propagate. It's the one distinction between worms and viruses. Viruses require some intervention on the part of the user to propagate and execute.
8. A. Risk is the probability of the occurrence of an event multiplied by the dollar value of loss. There is no mitigation factor that is quantified, so it could be put into a risk calculation.
9. B. An evil twin attack uses an access point masquerading to be the point of connection for stations trying to connect to a legitimate wireless network. Stations reach out to make connections to this access point masquerading as another access point. While you may phish for credentials as part of an evil twin attack, credential phishing is not how evil twin attacks work. SSIDs don't get changed as part of an evil twin attack, meaning no SSID that exists will become another SSID. Injecting four-way handshakes won't do much, since four-way assumes both ends are communicating, so the injection of a full communication stream will get ignored.
10. C. Antivirus solutions are used on endpoints or maybe on email servers. Stateful firewalls add the ability to factor in the state of the connection—new, related, established. An Application layer gateway knows about Application layer protocols. A unified threat management appliance adds capabilities on top of firewall functions, including antivirus.
11. A. Standards and practices should be derived from a security policy, which is the high-level guidance on the role of security within an organization. Security does not generally increase the bottom line of a company. Policies are not for providing specific directions, which would be the role of procedures.
12. B. Base64 encoding takes nonprintable characters and encodes them in a way that they can be rendered in text. Encryption would generally render text unreadable to people. A cryptographic hash is a way of generating a fixed-length value to identify a value. URL encoding takes text and uses hexadecimal values to represent the characters. This is text that has been converted into hexadecimal so they can be used in a URL.
13. B. Mail exchanger records would be identified as MX records. A name server record is identified with the tag ns. While an enterprise may have one or even several caching name servers, the caching name server wouldn't be said to belong to the domain since it doesn't have any domain identification associated with it.
14. C. A DNS query can be used to identify an IP address from a hostname, or vice versa. You could potentially use a brute-force technique to identify hostnames, though you may not get everything using that method. A recursive request is common from a caching server to get an authoritative response. The term for getting all the contents of the zone is a zone transfer.
15. A. Tunneling attacks can be used to hide one protocol inside another. This may be used to send operating system commands using a tunnel system. A DNS amplification attack is where a small DNS request results in much larger responses sent to the target. DNS recursion is used to look up information from DNS servers. An XML entity injection attack is a web-based attack and wouldn't be found inside a DNS request.
16. D. There may be several reasons for performing a ping sweep. You likely want to identify responsive hosts on the network segment you are targeting. You may not, though, want to use a full port scan. ICMP is a lightweight protocol, and there is a chance it will be allowed through the firewall, since it's used for troubleshooting and diagnostics.
17. C. The NIST cybersecurity framework specifies five functions—identify, protect, detect, respond, recover.
18. B. Python interpreters may be considered to be slower to execute than a compiled program; however, the difference is negligible, and generally speed of execution isn't much of a concern when it comes to malware. Python is not a hard language to learn, and there are a lot of community-developed libraries. One challenge, though, is that you may need a Python interpreter, unless you go through the step of getting a Python compiler and compiling your script. Windows systems wouldn't commonly have a Python interpreter installed.
19. B. The expression host 192.168.10.5 is BPF indicating that tcpdump should only capture packets to and from 192.168.10.5. If you wanted to only get it to or from, you would need to modify host with src or dest.
20. C. Certificates can be revoked, but that's not what Diffie-Hellman is used for. Key management is a much broader topic than what Diffie-Hellman is used for. Diffie-Hellman is used for key exchange. It is a process that allows parties to an encrypted conversation to mutually derive the same key starting with the same base value.
21. D. While you might be imitating someone, imitation is not a social engineering principle. Neither social proof nor scarcity is at play in this situation. However, if you are calling from the help desk, you may be considered to be in a position of authority.
22. D. SNMPv3 implemented username and password authentication. With version 1, you used a cleartext community string. SNMP doesn't use hashes, and while the word public is often used as a community string, a public string is not a way to authenticate with SNMPv1.
23. A. Interprocess communications across systems using a network is called remote method invocation. The process that programs have to communicate with to get a dynamic port allocation is the RMI registry. This is the program you query to identify services that are available on a system that has implemented RMI.
24. C. When an ARP response is sent without a corresponding ARP request, it's an unexpected or unnecessary message, so it is a gratuitous ARP.
25. D. There are three date and time stamps commonly used in file metadata. When the file is created, that moment is stored. When a file is accessed by a user, that moment is stored. When a file is modified, that moment is stored. Accessed is not the same as modified since accessing a file could be read-only. You could open a file, expecting to modify it but not ending up doing the modification. The access time still changes. While moves, adds, and changes may sometimes be referred to as MAC like modified, accessed, and created, those are not tasks associated with file times.
26. C. Local vulnerabilities are used against applications that are not listening on the network. This means they require you to be “local” to the machine and not remote. In other words, you have to be logged in somehow. A local vulnerability would not be used to collect passwords since you don't need a vulnerability to do that. Similarly, you don't need to make use of a vulnerability to manipulate logs or to pivot. Most of those would require you to have elevated permissions, though. A local vulnerability may be exploited to get you those elevated permissions.
27. A. Integrity is part of the CIA triad but isn't the principle that ties a signed message back to the subject of the signing certificate. Nonverifiability is nonsense, and authority isn't relevant here. Instead, nonrepudiation means someone can't say they didn't send a message if it was signed with their key and that key was in their possession and password-protected.
28. D. Biometrics and badge access are forms of physical access control. Phone verification could possibly be used as a way of verifying identity, but it won't protect against tailgating. A man trap, however, will protect against tailgating because a man trap allows only one person in at a time.
29. B. Bluesnarfing is an attack that connects to a Bluetooth device to grab data from that device. Bluejacking can be used to send information to a Bluetooth device that is receiving from the attacker, such as a text message. Neither of these attacks installs keyloggers. The victim device sends information to the attacker in a bluesnarfing attack.
30. B. The Biba security model covers data integrity. While other models cover confidentiality, none of them covers availability.