CEH v13 Domain 3.2 Practice Test 002

This practice test covers Domain 3 (System Hacking Phases and Attack Techniques) Subdomain 2 (System Hacking) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link.

CEH v13 Domain 3.2 Practice Test 002

10 questions • 8 single-answer, 2 multi-select

Question 1

Kevin, a threat actor, has successfully compromised a Windows domain controller during a targeted attack against a financial institution. He extracts the NTDS.dit file and the SYSTEM registry hive from the domain controller and transfers both files to his remote attack machine running Kali Linux. Kevin then uses impacket-secretsdump to pull the NTLM hashes from the offline database files. He feeds the resulting hash list into hashcat along with the rockyou.txt wordlist and executes a cracking session against all extracted hashes. Which password cracking technique is Kevin using when he runs hashcat against the extracted NTLM hashes using the rockyou.txt wordlist?

A. Pass-the-hash — Kevin is replaying the extracted NTLM hashes directly against target systems without needing to reverse them to plaintext B. Dictionary attack — Kevin is attempting to crack the hashes by hashing each word in the wordlist and comparing the result against the captured NTLM hashes C. Rainbow table attack — Kevin is using precomputed hash chains stored in the rockyou.txt file to reverse the hashes to plaintext instantly D. Brute force attack — Kevin is systematically generating and testing every possible character combination to match the extracted hashes

Question 2

A penetration tester gains initial access to a Linux server as a low-privileged service account during a red team engagement targeting a retail company. During post-exploitation enumeration, she runs 'sudo -l' and discovers that the service account has NOPASSWD sudo rights for /usr/bin/vim. She opens vim using sudo and types ':!/bin/bash' from within the editor to spawn an interactive root shell without entering any password. The engagement report must accurately classify this privilege escalation technique for the client. What type of privilege escalation did the penetration tester achieve, and what is the root cause vulnerability?

A. Horizontal privilege escalation via process injection — the tester injected shellcode into a running privileged process to inherit its access token and user context B. Vertical privilege escalation via sudo misconfiguration — the tester exploited improperly configured sudo permissions that allowed a standard user to run a GTFOBin-capable application as root without a password C. Kernel exploitation — the tester leveraged a published vulnerability in the Linux kernel to bypass access controls and gain root privileges directly D. Pass-the-ticket — the tester captured and replayed a Kerberos service ticket to impersonate a privileged account on the Linux system

Question 3

Select all that apply

Clark has successfully compromised a Windows 10 endpoint inside a corporate network using a Metasploit exploit and obtained a Meterpreter session with SYSTEM-level privileges. The target organization conducts regular system reboots as part of patch maintenance cycles, and Clark wants to ensure his access survives reboots and does not depend on the original exploit path remaining available. He evaluates several post-exploitation options from his toolkit before selecting persistence mechanisms. Which TWO of the following techniques would most effectively allow Clark to maintain persistent access to the compromised Windows endpoint across reboots? (Choose two)

A. Adding a registry run key entry under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun pointing to his backdoor executable so it launches automatically on every system startup B. Disabling Windows Defender real-time protection using a PowerShell Set-MpPreference command during the current active session C. Creating a scheduled task using schtasks.exe configured to execute Clark's payload at user logon or on a defined recurring time interval D. Running Wireshark on the compromised host to capture network traffic and harvest credentials transmitted in cleartext across the wire E. Clearing the Windows Security event log using 'wevtutil cl Security' to remove all evidence of the initial compromise and ongoing activity

Question 4

A digital forensics analyst is called in to investigate a suspected breach at a regional bank. Upon examining a compromised Windows Server 2019 system, the analyst discovers that the Windows Security, System, and Application event logs are entirely empty. The server has been in active production for three years with auditing policies confirmed enabled via Group Policy. No log rotation or archiving policy is configured on the system, and the SIEM platform shows a complete gap in log data from the server beginning at a specific timestamp three weeks prior. The analyst correlates the log gap with confirmed indicators of compromise on the network perimeter. Which activity most accurately explains the state of the Windows event logs on the compromised server?

A. The Windows Event Log service crashed due to a disk quota limit, which caused the operating system to automatically purge all historical log entries to free disk space B. An attacker executed 'wevtutil cl' commands against each event log channel — or used a tool such as Metasploit's clearev command — to wipe all log entries as part of a covering-tracks phase during system hacking C. The attacker used Windows auditpol.exe to selectively disable auditing for specific event categories, which retroactively deleted previously recorded events from the existing log files D. A misconfigured Group Policy Object overwrote the local event log settings and caused all logs to be reset to empty on the next Group Policy refresh cycle

Question 5

A CEH candidate is studying the EC-Council system hacking methodology in preparation for the 312-50v13 exam. The methodology defines a structured sequence of phases that an attacker follows when targeting a system after gaining initial network-level access. The candidate encounters a practice question asking them to arrange the system hacking phases in their correct sequential order as defined by EC-Council. Understanding this sequence is critical both for the exam and for recognizing attacker behavior during incident response activities. Which of the following sequences correctly represents the EC-Council system hacking phases in order?

A. Maintaining Access → Gaining Access → Escalating Privileges → Clearing Logs B. Gaining Access → Escalating Privileges → Maintaining Access → Clearing Logs C. Escalating Privileges → Gaining Access → Maintaining Access → Clearing Logs D. Gaining Access → Clearing Logs → Escalating Privileges → Maintaining Access

Question 6

Jane, a senior penetration tester contracted by a manufacturing company, identifies during an external vulnerability scan that a Windows Server 2016 system is running an unpatched SMB service susceptible to MS17-010 (EternalBlue). She opens Metasploit on her Kali Linux attack machine, selects the exploit/windows/smb/ms17_010_eternalblue module, configures RHOSTS with the target IP and LHOST with her machine's IP, and executes the exploit. Within seconds she receives an active Meterpreter shell displaying NT AUTHORITYSYSTEM — no credentials were supplied at any point. In the context of the CEH system hacking methodology, what phase does Jane's activity represent, and what makes this exploitation particularly significant?

A. Escalating Privileges — Jane already had low-level authenticated access to the server and used EternalBlue to elevate from a standard user account to SYSTEM privilege B. Gaining Access via active vulnerability exploitation — Jane leveraged a known, unpatched remote code execution vulnerability to obtain SYSTEM-level access on the target without supplying any credentials, demonstrating the severe impact of neglecting SMB patch management C. Maintaining Access — Jane used Metasploit to install a persistent Meterpreter backdoor on the Windows server designed to survive reboots and remediation attempts D. Password Cracking — Jane used the EternalBlue exploit module to extract and offline-crack the NTLM hashes stored in the Windows SAM database on the target server

Question 7

Select all that apply

A forensic team investigating a prolonged intrusion in an operational technology (OT) environment discovers that an attacker maintained covert access to a Windows HMI workstation for over four months without triggering any alerts. Forensic analysis of the compromised workstation reveals the attacker used multiple techniques to hide malicious tools and exfiltrated data from both local administrators and the monitoring team. The forensic team must accurately document the file-hiding techniques used by the attacker in their incident report. Which TWO of the following methods would most effectively allow an attacker to conceal files on a compromised Windows system within an OT environment? (Choose two)

A. Using the Windows command 'attrib +h +s malware.exe' to assign both the hidden and system file attributes, making the file invisible to standard Windows Explorer views and basic 'dir' command output B. Configuring Windows Firewall inbound rules to block all incoming connections on port 445 to prevent further SMB-based attacks against the compromised host C. Embedding malicious payloads or exfiltrated data within legitimate-looking image files such as JPEG or PNG using steganography tools like Steghide or OpenStego to conceal them from casual inspection D. Running Nmap with the -A flag from the compromised host to perform aggressive OS detection and service enumeration against neighboring OT devices on the same network segment E. Enabling BitLocker full-disk encryption on the system drive to prevent forensic investigators from accessing files stored on the workstation after seizure

Question 8

During an authorized cloud penetration test of an AWS environment, a security tester discovers that a publicly accessible EC2 instance running a web application is vulnerable to server-side request forgery (SSRF). He crafts a malicious payload and sends it through a vulnerable URL parameter, causing the application server to query the AWS Instance Metadata Service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/WebAppRole. The response returns a valid AccessKeyId, SecretAccessKey, and SessionToken belonging to the IAM role attached to the instance. The tester then configures the AWS CLI with these credentials and successfully lists and downloads files from private S3 buckets containing sensitive PII. In the context of the CEH system hacking methodology, what phase does this technique represent?

A. Enumeration — the tester is performing passive reconnaissance of the AWS environment to build an asset and IAM inventory before initiating any exploitation B. Gaining Access — the tester leveraged an SSRF vulnerability to steal valid IAM credentials from the cloud metadata service and used them to authenticate to AWS and access protected cloud storage resources C. Establishing Persistence — the tester created new IAM users with AdministratorAccess policies attached to maintain long-term access to the AWS environment independent of the SSRF vulnerability D. Clearing Logs — the tester used the obtained IAM credentials to disable AWS CloudTrail logging and delete CloudWatch log groups to remove evidence of the intrusion

Question 9

Elijah, a red team operator, has an active Meterpreter session on a Windows 11 enterprise workstation in the finance department. The target user regularly authenticates to the organization's banking portal and internal ERP system throughout the workday. Elijah wants to silently capture every keystroke the user types into these applications. Before running the Meterpreter keyscan_start command, Elijah runs 'ps' to list processes, identifies explorer.exe running under the target user's account, and executes 'migrate ' to move his Meterpreter session into the explorer.exe process space. What is the primary operational reason Elijah migrates into explorer.exe before activating the keylogger?

A. Migrating into explorer.exe grants Meterpreter direct access to the Windows Credential Manager vault, enabling extraction of all saved browser and application passwords without needing to intercept live keystrokes B. Process migration moves Meterpreter into an interactive user-context process that has visibility into all keyboard input events on the desktop session, enabling the keylogger to capture keystrokes from every application the user interacts with, while also evading detection by hiding the malicious activity inside a legitimate Windows process C. Migrating into explorer.exe is a mandatory prerequisite required by the Metasploit Framework before executing any post-exploitation module on a Windows 11 target, regardless of the specific module being used D. Explorer.exe runs with SYSTEM privileges on Windows 11, and migrating into it allows Elijah to escalate from a user-context Meterpreter session to full SYSTEM-level access before the keylogger is deployed

Question 10

During a post-engagement debrief, a penetration testing team presents findings to the CISO of a mid-sized enterprise. The report describes a technique in which the testers extracted NTLM password hashes from a compromised server's SAM database using Mimikatz and then used those hash values directly in SMB authentication requests to move laterally across multiple Windows servers in the domain — all without ever converting the hashes to plaintext passwords. The CISO asks the lead tester to explain why this attack succeeds even though the organization enforces a 16-character minimum password complexity policy. Which of the following best identifies the attack technique and explains why strong password policies do not prevent it?

A. Dictionary attack — password complexity policies reduce the success rate of wordlist-based attacks, but the testers found that some passwords still matched entries in commonly available wordlists B. Pass-the-hash attack — NTLM authentication accepts the hash value itself as proof of identity during the challenge-response handshake, so the attacker never needs to know or recover the plaintext password; password complexity makes hashes harder to crack but does not prevent them from being replayed directly for authentication C. Brute force attack — even passwords meeting 16-character complexity requirements can eventually be cracked given sufficient GPU processing power, making complexity policies fundamentally insufficient against modern password cracking hardware D. Golden ticket attack — the testers forged a Kerberos ticket-granting ticket using the NTLM hash to impersonate any domain user across the environment without needing plaintext credentials

ByThe Test Master

Related Post

CEH v13 Domain 3.3 Practice Test 002

CEH v13 Domain 3.1 Practice Test 002

CEH v13 Domain 2.3 Practice Test 002