312-50 exam dumps: 473 free Certified Ethical Hacker (CEH) practice questions

Correct answer: B

• A. Incorrect.

  This is incorrect. Confidentiality focuses on preventing unauthorized access or disclosure of information. While patient-related data often has confidentiality requirements, the scenario specifically states that the main concern is unauthorized alteration of records rather than data exposure.

• B. Correct.

  This is correct. Integrity ensures that data remains accurate, complete, and unaltered except by authorized actions. In this scenario, management is specifically worried that appointment records could be changed by unauthorized users, which is a direct integrity issue within the CIA triad.

• C. Incorrect.

  This is incorrect. Availability ensures systems and data are accessible when needed. The scenario explicitly says the concern remains even if the system stays online, meaning uptime is not the primary issue being tested here.

• D. Incorrect.

  This is incorrect. Non-repudiation provides evidence of an action so a user cannot later deny performing it, often through logs, digital signatures, and audit trails. Although useful for accountability, it does not directly address the main requirement of preventing unauthorized modification in the first place.

Correct answer: A

• A. Correct.

  Correct. The scenario directly maps to the three core principles of the CIA triad: confidentiality protects patient data from unauthorized disclosure, integrity ensures records are not altered improperly, and availability ensures the portal remains accessible to authorized users when needed. In CEH and general security practice, the CIA triad is the foundational model used to describe these primary information security objectives.

• B. Incorrect.

  Incorrect. AAA is an important access control and identity management framework, but it does not directly summarize the three broad security goals described in the scenario. Authentication verifies identity, authorization determines permitted actions, and accounting logs activity. These controls support security, but they are not the overarching objectives being asked about here.

• C. Incorrect.

  Incorrect. The Parkerian Hexad is a broader model that extends beyond the CIA triad and includes additional concepts such as possession, authenticity, and utility. While it is a legitimate information security model, the question asks for the model that best summarizes the three specific objectives stated by management. Those objectives exactly align with the CIA triad, making this option unnecessarily broad and not the best answer.

• D. Incorrect.

  Incorrect. Non-repudiation is a specific security property that helps prove that an action or communication occurred and cannot later be denied. Although accountability-related controls are useful in healthcare environments, they do not represent the three main objectives listed in the scenario. This option reflects a common misconception of confusing one security service with the full set of core information security goals.

Correct answer: A

• A. Correct.

  Correct. The scenario directly maps to the CIA triad: confidentiality protects patient records from unauthorized disclosure, integrity ensures records are not improperly modified, and availability keeps the portal accessible to authorized users. In an information security overview context, the CIA triad is the foundational model used to evaluate whether security controls address the organization's primary protection goals.

• B. Incorrect.

  Incorrect. These are commonly cited phases of an attack or penetration-testing workflow, not the primary framework for defining information security objectives. An ethical hacker may use these phases when planning an engagement, but they do not describe the core protection goals the organization is trying to achieve.

• C. Incorrect.

  Incorrect. Nonrepudiation, accounting, and auditing are important security concepts and control areas, but they are not the complete foundational model for information security objectives. A candidate might select this because healthcare environments require logging and proof of actions, but those controls support broader goals such as integrity and accountability rather than replacing the CIA triad.

• D. Incorrect.

  Incorrect. Patch management, asset inventory, and backup scheduling are valuable operational security practices. However, they are specific control activities, not the overarching framework used to categorize and assess the security objectives in the scenario. For example, backups mainly support availability and recovery, but they do not by themselves define all core information security goals.

Correct answer: B

• A. Incorrect.

  This is incorrect because jumping directly to exploitation bypasses important methodology stages such as pre-engagement validation, rules of engagement, intelligence gathering, and vulnerability analysis. In a professional ethical hacking engagement, exploiting a system simply because it appears vulnerable can create unnecessary risk, scope violations, and weak documentation. A likely misconception is that speed is more valuable than process, but recognized frameworks emphasize controlled, repeatable testing.

• B. Correct.

  This is correct. PTES (Penetration Testing Execution Standard) is a well-known framework that defines a logical flow: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. This sequence supports disciplined testing, clear documentation, and defensible results. It also aligns with the client's requirement for a recognized methodology and controlled execution.

• C. Incorrect.

  This is incorrect because NIST SP 800-61 is primarily an incident response guide, not a penetration testing execution framework. It is valuable for preparing for and handling security incidents, but it does not provide the full offensive testing lifecycle needed to plan and execute a penetration test. A candidate might choose this option because NIST publications are authoritative, but this specific document addresses a different security function.

• D. Incorrect.

  This is incorrect because internet exposure does not remove the need for threat modeling, validation, and vulnerability analysis. Even when a system is in scope, testers should confirm attack paths, business impact, constraints, and safe test procedures before exploitation. This option reflects the misconception that scope approval alone justifies direct exploitation without following methodology.

Correct answer: B

• A. Incorrect.

  This is incorrect. In common ethical hacking and penetration testing methodologies, denial-of-service testing is typically excluded or tightly controlled because it can disrupt production systems. The scenario explicitly says to avoid unnecessary disruption. After reconnaissance and scanning, the next logical phase is not stress testing but validating vulnerabilities in a controlled manner.

• B. Correct.

  This is correct. Standard hacking methodologies used in CEH-style workflows generally progress from reconnaissance to scanning/enumeration, then to gaining access (controlled exploitation), followed by maintaining access/post-exploitation where authorized, and finally reporting/covering tracks in attacker models. Because the consultant has already completed reconnaissance and active scanning and has identified likely weaknesses, the next step is to attempt controlled exploitation within scope to validate whether the findings are actually exploitable.

• C. Incorrect.

  This is incorrect. Covering tracks is associated with attacker behavior, not a normal next step in an ethical hacking engagement. In a legitimate penetration test, evidence collection and preservation are important, and testers should not erase logs unless the objective explicitly includes testing detection and anti-forensics under tightly defined approval. Skipping exploitation would also prevent validation of the identified weaknesses.

• D. Incorrect.

  This is incorrect. Persistence or maintaining access comes after successful exploitation and only if explicitly authorized in the scope. Starting persistence activities before validating initial access does not follow recognized methodology and would exceed what is necessary at this stage. It also increases operational risk on production systems.

Correct answer: A

• A. Correct.

  Correct. In common ethical hacking methodologies, after reconnaissance comes scanning and enumeration before exploitation. Using a credentialed or otherwise carefully configured vulnerability scan with safe checks is consistent with a controlled assessment approach, especially when production stability is a requirement. Manual validation of significant findings reduces false positives and ensures that any later exploitation is justified, targeted, and within scope. This approach aligns with standard phases used in CEH-style methodology: reconnaissance, scanning/enumeration, gaining access, maintaining access, and covering tracks, while also respecting the rules of engagement.

• B. Incorrect.

  Incorrect. Password spraying is an active attack technique that can affect availability, trigger account lockouts, and create unnecessary operational risk if used prematurely. While credential attacks may be in scope during some engagements, they are not the typical next step immediately after passive reconnaissance when the engagement requires minimizing disruption and following a defined methodology. A more appropriate next phase is controlled scanning and enumeration to understand the environment before attempting authentication attacks.

• C. Incorrect.

  Incorrect. Jumping directly from reconnaissance to exploitation skips the scanning and enumeration phase that standard hacking methodologies rely on to identify and prioritize realistic attack paths. Immediate exploitation increases the chance of service disruption and may violate the requirement for traceable, phase-based testing. In professional assessments, exploitation should generally be targeted and supported by prior evidence from enumeration or validated vulnerability findings.

• D. Incorrect.

  Incorrect. Clearing logs is associated with anti-forensics or the covering tracks phase, which is discussed in attacker methodologies but is not appropriate in a legitimate authorized assessment unless explicitly authorized for a specific objective, and even then it would be handled with extreme caution. Deleting files or logs on production systems would introduce unnecessary risk, reduce traceability, and conflict with the requirement that all tester actions be documented and non-disruptive.

Correct answer: A

• A. Correct.

  Correct. On a local subnet, an attacker can use ARP spoofing/poisoning to position themselves between the victim and gateway, enabling a man-in-the-middle attack. HTTPS normally protects credentials, but if the attacker presents a fraudulent certificate and the user ignores or accepts the certificate warning, the browser may establish a session through the attacker, allowing credential interception. This is a classic practical risk in local network attacks and demonstrates that encryption is only effective when certificate validation is enforced.

• B. Incorrect.

  Incorrect. Capturing network traffic does not allow an attacker to recover passwords from 'server-stored TLS session keys.' TLS session keys are negotiated between endpoints and are not exposed on the wire in a way that would let an attacker simply derive the original password. This option reflects a misunderstanding of how TLS protects session data.

• C. Incorrect.

  Incorrect. A SYN flood is a denial-of-service technique intended to exhaust resources by sending large numbers of half-open TCP connection requests. It does not cause browsers to disclose cached credentials in cleartext. This distractor confuses availability attacks with credential interception techniques.

• D. Incorrect.

  Incorrect. Passive packet sniffing alone is not sufficient to read credentials sent over properly implemented HTTPS because the application data is encrypted. Without breaking TLS, compromising an endpoint, or successfully inserting into the connection with certificate abuse, the attacker cannot directly read usernames and passwords from captured packets.

Correct answer: A

• A. Correct.

  Correct. After obtaining low-privilege access, the next ethical and methodical step is to assess whether privilege escalation is possible, but to do so in a controlled and non-destructive manner. This aligns with standard post-exploitation goals: validating the security impact of the foothold while minimizing operational risk. Safe enumeration of token privileges, local group membership, unquoted service paths, weak service permissions, scheduled task misconfigurations, or missing patches can demonstrate exploitability without causing instability. If a proof-of-concept is used, it should be authorized, targeted, and low risk.

• B. Incorrect.

  Incorrect. Password spraying may be useful in some assessments, but in this scenario the tester already has an internal foothold on a workstation and needs to determine whether that foothold can lead to deeper compromise. A network-wide spray also introduces a higher risk of account lockouts, alerting defenders, and exceeding the least-disruptive approach required by the rules of engagement. It is not the most appropriate immediate next step.

• C. Incorrect.

  Incorrect. Disabling endpoint protection is typically outside scope unless explicitly authorized and can materially change the security posture being tested. It also risks operational impact and may invalidate assessment results because the tester is no longer evaluating the environment as deployed. Ethical hacking methodology emphasizes working within authorization boundaries and avoiding unnecessary disruption.

• D. Incorrect.

  Incorrect. Deploying ransomware simulation code as an immediate next step is not appropriate for validating whether the current low-privilege compromise can be escalated. Even simulated ransomware can create operational and legal concerns if not specifically approved in scope. The tester should first evaluate privilege escalation and lateral movement feasibility using controlled, minimally invasive techniques.

Correct answer: B

• A. Incorrect.

  This is incorrect because copying the entire customer database exceeds what is typically necessary to prove access and introduces unnecessary risk to confidentiality, privacy, and scope compliance. In an ethical hacking engagement, the tester should follow data minimization principles and collect only the minimum evidence required to demonstrate impact. A candidate might choose this option because it seems like the strongest proof, but on a production system it is not the safest or most professional approach.

• B. Correct.

  This is correct because it demonstrates controlled post-exploitation activity with minimal operational impact. Creating a harmless artifact in an approved location and documenting limited access to non-sensitive information proves the tester obtained meaningful access without unnecessarily exposing customer data or disrupting service. This aligns with core ethical hacking concepts: operate within authorization, minimize harm, preserve evidence, and demonstrate impact safely.

• C. Incorrect.

  This is incorrect because installing persistence changes the target environment in a way that can create operational and security risk. Unless persistence is explicitly authorized in scope and carefully coordinated, adding a remote access service is not an appropriate default action on a production server. A candidate might select this because persistence is a real attacker behavior, but CEH emphasizes controlled, authorized actions rather than unnecessary emulation of destructive or risky attacker techniques.

• D. Incorrect.

  This is incorrect because modifying firewall rules on a production system can affect availability, segmentation, and downstream services. Even if the goal is to prove pivoting or control over host networking, this action is more invasive than necessary and can violate the requirement to avoid disruption. Testers should prefer non-destructive evidence collection over configuration changes that may alter security posture.

Correct answer: C

• A. Incorrect.

  This is incorrect because ownership alone does not make adjacent systems in scope. Ethical hacking requires strict adherence to the defined scope and rules of engagement. Testing other applications without explicit authorization could expose the consultant and client to legal, operational, and compliance risk, especially in a shared cloud environment.

• B. Incorrect.

  This is incorrect because the scenario explicitly prohibits denial-of-service testing. Even if availability is important, an ethical hacker must follow the signed authorization and testing constraints. Conducting DoS testing outside the agreed terms would violate professional and contractual boundaries.

• C. Correct.

  This is correct because ethical hacking is defined by authorization, scope control, and compliance with the rules of engagement. The consultant should test only the public web application and supporting APIs that are explicitly in scope, avoid touching other cloud-hosted assets, and formally request written approval if expanded testing is needed. Documenting the shared-environment concern is appropriate because it preserves the finding without exceeding authorization.

• D. Incorrect.

  This is incorrect because the statement of work explicitly prohibits access to production patient records. Ethical hackers should use nonproduction data or approved test accounts whenever possible. Accessing real patient records, even in a limited way, could violate privacy requirements and exceed the authorized objective.