CEH v13 Domain 3.1 Practice Test 002

This practice test covers Domain 3 (System Hacking Phases and Attack Techniques) Subdomain 1 (Vulnerability Analysis) from the CEH v13 (312-50v13) exam blueprint (v5).

These questions are inspired by the EC-Council CEH exam and are designed to help you test your knowledge of ethical hacking tools, techniques, and methodologies. Some questions require multiple correct answers.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the skills and knowledge tested in the CEH exam.

Note: CEH and Certified Ethical Hacker are registered trademarks of EC-Council. This content is not affiliated with or endorsed by EC-Council.

To choose CEH practice tests based on specific domains and subdomains, click that link.

CEH v13 Domain 3.1 Practice Test 002

10 questions • 8 single-answer, 2 multi-select

Question 1

Elijah, a security engineer contracted by a mid-sized healthcare provider, is tasked with conducting a comprehensive vulnerability assessment across all Windows servers in the environment. The organization has strict compliance requirements under HIPAA and needs a thorough inventory of software vulnerabilities, missing patches, and configuration weaknesses. Elijah configures his Nessus scanner with local administrator credentials for each target system rather than running an unauthenticated scan. The credentialed assessment returns 312 findings, while a prior unauthenticated scan of the same targets returned only 47 findings. Why does the credentialed scan return significantly more vulnerability findings than the unauthenticated scan?

A. Credentialed scans bypass firewall rules and IDS signatures, allowing the scanner to transmit more probe packets per second B. Credentialed scans authenticate to the target and enumerate installed software, patch levels, registry settings, and local configurations that are not exposed over the network C. Credentialed scans use a separate, larger vulnerability database that contains CVEs not available to unauthenticated scan profiles D. Credentialed scans perform live exploitation of discovered vulnerabilities to confirm their presence, producing a higher finding count

Question 2

A security analyst is reviewing the output of a Qualys vulnerability scan performed against a production web server. She notices a critical finding flagged with a CVSS v3.1 base score of 9.8, calculated with an attack vector of Network, attack complexity of Low, privileges required of None, and user interaction of None. She must prioritize remediation and explain the severity to the development team in a team briefing. Which CVSS v3.1 qualitative severity rating corresponds to a base score of 9.8, and what does the 'Attack Vector: Network' metric indicate about exploitability?

A. High severity — the vulnerability requires an attacker to be on the same local network segment to exploit it B. Critical severity — the vulnerability is remotely exploitable over any network connection and does not require physical or local access to the target C. Medium severity — the vulnerability requires user interaction and can be exploited only from within the internal corporate network D. Critical severity — the vulnerability can only be triggered by an attacker who already has valid user credentials on the system

Question 3

A security team at an enterprise financial institution is designing their annual vulnerability assessment strategy. The CISO has expressed concerns about potential disruption to legacy systems running critical transaction-processing applications during scanning. The team is evaluating active versus passive vulnerability assessment approaches to minimize operational risk. A junior analyst recommends passive assessment for initial baseline discovery. Which of the following best describes a defining characteristic of passive vulnerability assessment that distinguishes it from active vulnerability assessment?

A. Passive assessment sends specially crafted probe packets to each target to elicit banners and service responses for fingerprinting B. Passive assessment monitors and analyzes existing network traffic and system logs without directly interacting with or probing target systems C. Passive assessment authenticates to each target using service account credentials to enumerate local patch levels and installed software D. Passive assessment deploys lightweight agents on each endpoint that perform scheduled local configuration checks and report back to a central console

Question 4

Select all that apply

A cloud security analyst at a SaaS company is establishing a vulnerability management program across a hybrid environment consisting of AWS EC2 instances, on-premises Windows and Linux servers, and containerized microservices. She needs to select dedicated vulnerability assessment tools that can perform authenticated network scans, generate risk-prioritized reports tied to CVE data, and integrate with ticketing systems for remediation workflows. The tools must specialize in vulnerability detection and reporting rather than exploitation. The organization's procurement team has shortlisted five tools for evaluation. Which of the following tools are primarily designed for vulnerability assessment and scanning? (Choose two)

A. Nessus B. Metasploit Framework C. OpenVAS D. Aircrack-ng E. John the Ripper

Question 5

Kevin, a junior security analyst at a managed security service provider, is reviewing a vulnerability report generated by a Nessus scan. The report references identifiers including CVE-2021-44228, CWE-502, and supplemental data pulled from the NVD. His senior colleague asks him to explain the purpose of each identifier during a team knowledge-sharing session. Kevin must correctly distinguish the roles of CVE, CWE, and NVD in the vulnerability classification ecosystem. Which of the following correctly describes the relationship between CVE, CWE, and NVD?

A. CVE identifies specific vulnerability instances in real-world products; CWE classifies underlying types of software weaknesses; NVD enriches CVE data with CVSS scores, remediation guidance, and affected product lists B. CVE assigns CVSS severity scores to vulnerabilities; CWE tracks active exploit code available in the wild; NVD maintains a database of affected vendor contact information C. CVE and CWE are both maintained by NIST; NVD is operated by MITRE and assigns unique exploit identifiers to vulnerabilities for law enforcement use D. CVE describes attacker techniques and tactics; CWE provides patch availability timelines; NVD scores vulnerabilities using the OWASP Risk Rating Methodology

Question 6

A web application security assessor is engaged by a regional e-commerce company to perform an external vulnerability assessment of their customer-facing Apache web server. The assessor needs a tool specifically designed to detect common web server misconfigurations, outdated server software versions, dangerous HTTP methods such as PUT and DELETE, default files and scripts left on the server, and known CGI vulnerabilities. The target is running Apache 2.4.29 on Ubuntu 18.04 and is externally accessible over HTTPS on port 443. Which tool is best suited for this web server vulnerability assessment?

A. Nmap with default scripts for port scanning and operating system version detection B. Nikto, a web server scanner designed to detect server misconfigurations, outdated server software, dangerous HTTP methods, and known vulnerable default files C. Wireshark for passive capture and analysis of HTTP/HTTPS traffic to identify unencrypted sensitive data in transit D. Burp Suite Intruder for brute-forcing authentication forms and testing input validation on the web application login page

Question 7

A vulnerability management team at a large hospital network is designing their assessment strategy to comply with HIPAA Security Rule requirements. They must conduct both internal and external vulnerability assessments quarterly. The security architect briefs the CISO on the difference between the two assessment types, explaining that they simulate completely different threat perspectives and should not be used interchangeably. The CISO asks for a clear explanation of what distinguishes an external vulnerability assessment from an internal one in terms of scope, attacker perspective, and targets evaluated. Which of the following best describes the primary distinction between external and internal vulnerability assessments?

A. External assessments are always performed without any prior knowledge of the target, while internal assessments are always performed with full network architecture documentation B. External assessments simulate an outside attacker targeting internet-facing systems such as web servers, firewalls, and DMZ hosts, while internal assessments simulate threats originating from within the network perimeter such as malicious insiders or compromised internal hosts C. External assessments scan only web servers and email gateways, while internal assessments focus exclusively on routers, switches, and network infrastructure D. External assessments must always be unauthenticated, while internal assessments must always use domain administrator credentials for all scans

Question 8

Select all that apply

Jane, a security consultant, is performing a vulnerability assessment of an industrial control system (ICS) environment at a power generation facility. After completing the scan using a specialized OT-aware scanner, she must classify the discovered vulnerabilities into categories for the executive risk report. Her methodology requires alignment with recognized vulnerability classification frameworks used in professional vulnerability assessments. The facility's compliance officer asks Jane to confirm which categories are valid, industry-recognized vulnerability types used to classify findings. Which of the following represent valid, recognized vulnerability classification categories used in vulnerability assessment methodologies? (Choose two)

A. Misconfiguration vulnerabilities B. Exploit chain vulnerabilities C. Default installation vulnerabilities D. Protocol overthrow vulnerabilities E. Lateral movement vulnerabilities

Question 9

A penetration testing firm has just completed a comprehensive vulnerability assessment for a large retail organization covering over 500 hosts across three geographic locations. The engagement generated thousands of raw findings that must now be compiled into a formal deliverable. The lead assessor explains that the report must serve two distinct audiences simultaneously: the executive leadership team, who need to understand business risk, compliance exposure, and strategic recommendations without deep technical jargon; and the IT security operations team, who need specific CVE numbers, affected host IPs, tool output, and step-by-step remediation guidance. Which of the following correctly identifies the two primary structural components of a standard vulnerability assessment report?

A. Remediation roadmap and patch deployment schedule B. Executive summary and technical report C. Risk matrix and asset inventory D. Raw scan logs and automated vulnerability export data

Question 10

An enterprise IT security team is implementing a formal vulnerability management program for the first time across a 2,000-node corporate network. The program manager wants to ensure the team follows a structured, repeatable lifecycle to continuously discover, evaluate, prioritize, and remediate vulnerabilities rather than performing ad-hoc scans in response to incidents. She describes the lifecycle as a continuous loop that starts with understanding what assets exist in the environment and ends with confirming that identified vulnerabilities have been successfully resolved before moving on. Which of the following best represents the correct sequence of phases in a standard vulnerability management lifecycle?

A. Identify assets → Classify vulnerabilities → Prioritize by risk → Remediate → Verify and report B. Scan → Exploit → Patch → Retest → Archive scan logs C. Enumerate hosts → Analyze exploitability → Generate CVEs → Submit to NVD → Close tickets D. Risk assess → Mitigate → Monitor alerts → Escalate incidents → Emergency patch

ByThe Test Master

Related Post

CEH v13 Domain 3.3 Practice Test 002

CEH v13 Domain 3.2 Practice Test 002

CEH v13 Domain 2.3 Practice Test 002