ECCouncil Certified Ethical Hacker Exam (CEHv13) Sample Questions:

1. A retail brand based in San Diego, California, authorized a controlled mobile security exercise to evaluate risks associated with third-party application distribution channels. Testers acquired a version of the company ' s customer rewards application from an unofficial marketplace frequently used by overseas customers. The application ' s visual layout and functionality were indistinguishable from the officially released version available in mainstream app stores. Behavioral monitoring conducted in a sandbox environment revealed that, in addition to its normal operations, the application initiated outbound connections unrelated to its documented features. A binary comparison against the vendor-supplied build confirmed structural differences between the two versions. What mobile-based social engineering technique does this scenario most accurately represent?

A) Conducting SMiShing campaigns through fraudulent text messages
B) Repackaging Legitimate Apps after modifying their internal structure
C) Deploying Fake Security Applications disguised as protection tools
D) Publishing Malicious Apps designed to mimic trusted brands

2. Maria is conducting passive reconnaissance on a competitor without interacting with their systems. Which method would be least appropriate and potentially risky?

A) Reviewing forums and social media
B) Examining patent databases and public records
C) Using the Wayback Machine
D) Running an intensive port scan on public IPs

3. You discover multiple NetBIOS responses during an nbtscan, but only one host returns a < 1B > entry. What does this indicate?

A) It is the local system
B) NetBIOS over TCP/IP is disabled
C) It is a rogue DHCP server
D) It is the domain master browser / Primary Domain Controller (PDC)

4. A penetration tester is assessing an IoT thermostat used in a smart home system. The device communicates with a cloud server for updates and commands. The tester discovers that communication between the device and the cloud server is not encrypted. What is the most effective way to exploit this vulnerability?

A) Conduct a Cross-Site Scripting (XSS) attack on the thermostat's web interface
B) Execute a SQL injection attack on the cloud server ' s login page
C) Perform a brute-force attack on the thermostat's local admin login
D) Use a man-in-the-middle (MitM) attack to intercept and manipulate unencrypted communication

5. A regional healthcare provider in Portland, Oregon, recently migrated its patient scheduling portal to a new cloud platform. Within days, multiple patients reported that when searching online for the clinic ' s appointment system, they were directed to a website that looked identical to the official portal. The fraudulent page appeared prominently in search engine results and prompted users to log in using their patient credentials. The URL closely resembled the legitimate domain name, and no internal DNS servers had been altered within the organization ' s infrastructure. Security analysts later determined that the attacker had created a convincing replica of the portal and manipulated search visibility so that unsuspecting users would voluntarily navigate to the malicious site. Which type of social engineering technique best explains this attack?

A) Search Engine Phishing
B) Spear Phishing
C) Pharming
D) Whaling

Solutions: