Free C)PEH Practice Questions

Question 1

Two customer accounts are authorized for an API assessment. Using account A's valid token, a tester requests account B's order by changing only the order identifier. The API returns B's complete order. Requests without a token are rejected, and both customers are entitled to use the order-viewing endpoint for their own orders. Where has the security boundary failed?

Accepted Answer

Authorization to access the particular order requested

Answer

Verification of the caller's identity

Answer

Authorization to invoke an administrative function

Answer

Authorization to modify protected properties within an order

Question 2

An authorized Nmap UDP scan produces this line:
53/udp  open|filtered  domain
No UDP reply or ICMP error was received, and service/version detection was not performed. What can the tester record without overstating the evidence?

Accepted Answer

The port may be open or filtered; the service label alone does not confirm that DNS is running.

Answer

A DNS service is listening on UDP 53, but it did not disclose enough information to identify its version.

Answer

UDP 53 is reachable, but no DNS application is listening; the service name identifies the expected protocol.

Answer

A firewall has been shown to block UDP 53; the missing response confirms that the service is inaccessible.

Question 3

A service has an asset value of $600,000. Each successful incident is estimated to cause a 30% loss, with one incident expected every four years. A proposed control would reduce the frequency to once every ten years without changing the loss per incident. It costs $18,000 annually. For this decision, the company uses annualized loss reduction minus annual control cost; no other requirements or costs apply. Which recommendation follows from these estimates?

Accepted Answer

Adopt; a $27,000 reduction in expected annual losses yields a $9,000 net annual benefit.

Answer

Adopt; the control's estimated net annual benefit is $27,000.

Answer

Defer; expected annual costs exceed the benefits by $9,000.

Answer

Adopt; the control generates an estimated net annual benefit of $72,000.

Question 4

During an approved assessment of a warehouse control application, operators report delayed conveyor-stop commands just as an active protocol check begins. The rules of engagement assign operational recovery to the warehouse team. The tester can immediately terminate the check. What is the tester's first responsibility?

Accepted Answer

Stop the check, notify operations, and preserve the test logs.

Answer

Lower the probe rate and finish the active check.

Answer

Restart the controller before notifying operations.

Answer

Disconnect the controller from the network to prevent further test traffic.

Question 5

A storage service uses AES-256-GCM. Its worker processes share an encryption key, but each restarts its nonce counter at zero after a reboot. A review confirms that different records have been encrypted with the same key and nonce. Their authentication tags still verify. Which cryptographic conclusion should drive remediation?

Accepted Answer

Nonce reuse can compromise both confidentiality and authentication.

Answer

Valid tags show that the repeated nonce has not weakened the records' security.

Answer

The weakness is limited to revealing whether two records contain identical plaintext.

Answer

The 256-bit key preserves confidentiality despite the repeated counter values.

Question 6

A vulnerability dashboard shows a CVSS v3.1 Base score of 8.2, an EPSS probability of 0.12, and an EPSS percentile of 0.96. A service owner describes this as a '96% chance that our server will be compromised this month.' Which interpretation should replace that statement?

Accepted Answer

High technical severity, with an estimated 12% probability of exploitation activity in the wild over the next 30 days.

Answer

High technical severity, with a 96% probability that this particular server will be compromised during the next 30 days.

Answer

Critical technical severity, because the 96th-percentile exploitation ranking moves the finding above the critical cutoff.

Answer

A 12% residual business risk, because EPSS already accounts for the server's exposure and its compensating controls.

Question 7

Before powering on a deliberately vulnerable server VM, a tester reviews its network design. The server and a testing VM will run on the same laptop and must communicate with each other, but neither may reach the corporate LAN or the Internet. All exercise materials are already available locally. Choose the arrangement that meets those requirements.

Accepted Answer

Attach both VMs only to the same internal network, with no additional adapter or routed uplink.

Answer

Place both VMs on a NAT network and disable its inbound port-forwarding rules.

Answer

Bridge both VMs to Ethernet and assign addresses from an unused private subnet.

Answer

Use host-only adapters, retaining additional NAT adapters for software updates during testing.

Question 8

A tester has an authorized low-privilege session on a relay host. An internal inventory service cannot be reached directly from the tester's laptop, but its login page loads through a TCP port forward using that session. The inventory service is in scope; no credentials have been submitted and no exploit has been attempted against it. The demonstrated capability is:

Accepted Answer

A pivoted connection to the inventory service, without evidence of its compromise

Answer

Privilege escalation on the relay host, demonstrated by access to a protected network

Answer

Lateral compromise of the inventory host through its reachable web interface

Answer

An authentication bypass on the inventory service through the forwarded connection

Question 9

Finance receives a bank-account-change request from a supplier's usual email address. SPF, DKIM, and DMARC checks pass, and the message accurately references an unpaid invoice. The sender asks for the change before a payment due in two hours. Which verification most directly addresses the remaining fraud risk?

Accepted Answer

Call the supplier at a previously verified number before changing the bank details.

Answer

Reply to the sender requesting written confirmation of the new bank details.

Answer

Match the invoice number and amount against the purchase ledger.

Answer

Have a second finance employee verify that the message passed every email-authentication check before releasing payment.

Question 10

A complete, valid WPA2-Personal four-way handshake has been captured from an approved access point during a normal client connection. The SSID is known. The engagement permits passive capture and offline password auditing but excludes active wireless tests. How should the tester evaluate a supplied list of candidate passphrases?

Accepted Answer

Test the candidates against the existing handshake capture offline.

Answer

Deauthenticate the client to obtain a fresh handshake before comparing the candidate passphrases.

Answer

Try each candidate by associating with the access point and recording its authentication response.

Answer

Pause the password audit until a disruptive-testing window can be approved.

Free C)PEH Practice Questions

Domain 1: Course Introduction

Question 1

Domain 2: Introduction to Ethical Hacking

Question 2

Domain 3: Cybersecurity Foundation

Question 3

Domain 4: Reconnaissance & Enumeration

Question 4

Domain 5: Cryptography

Question 5

Domain 6: Vulnerability Scanning & Analysis

Question 6

Domain 7: Web and Application Attacks

Question 7

Domain 8: Exploitation and Post-Exploitation

Question 8

Domain 9: Social Engineering

Question 9

Domain 10: Wireless Pentesting

Question 10

The rest of the C)PEH blueprint

That's 10 of 1,030