Free CEHPC Practice Test Questions and Answers (2026)

Yes, it is possible to clone a web page. This process involves copying the client-side code (HTML, CSS, JavaScript, and images) of a website to create a pixel-perfect replica. Attackers commonly use this technique to set up phishing websites that mimic legitimate sites, such as online banking portals or email login pages. The goal is to deceive users into entering their credentials or other sensitive information on the fraudulent page. Ethical hackers use website cloning tools, like the Social-Engineer Toolkit (SET) or HTTrack, to demonstrate the risk of phishing attacks during security assessments.

A. This is incorrect. The client-side components of a webpage are sent to the user's browser for rendering, making them accessible and relatively easy to copy.

1. OWASP Foundation. (n.d.). Phishing. OWASP Community Pages. Retrieved from https://owasp.org/www-community/Phishing. The page describes the mechanics of phishing, which often involves "creating a replica of a legitimate web page."

2. Zwicky, E. D., Cooper, S., & Chapman, D. B. (2000). Building Internet Firewalls, 2nd Edition. O'Reilly & Associates. While an older text, foundational concepts like web page replication for malicious purposes are discussed in the context of web-based attacks. Chapter 16 discusses web security and the mechanisms that make such cloning possible.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology. Lecture 15, "Web Security," discusses the browser security model and how web content is rendered, which implicitly explains why client-side code can be saved and replicated.

In the Metasploit Framework, RHOST is the standard variable name for "Remote Host." It is a critical parameter for most exploits, scanners, and other modules that target a remote system. The user must set this option to the IP address or hostname of the intended target machine for the module to function correctly. For modules that can target multiple systems at once, the plural version, RHOSTS, is used.

B. The variable for the attacker's machine (local host) is LHOST. The term "local root variable" is not a standard Metasploit convention.

C. While the target is a host, the 'R' in RHOST specifically denotes "Remote" to distinguish it from the local host (LHOST).

1. Rapid7. (n.d.). Metasploit Framework Terminology. Metasploit Documentation. Retrieved from https://docs.metasploit.com/docs/using-metasploit/basics/terminology.html. (The official vendor documentation defines RHOST as "The remote host, or target IP address").

2. Kennedy, D., O'Gorman, J., Kearns, D., & Aharoni, M. (2011). Metasploit: The Penetration Tester's Guide. No Starch Press. Chapter 3, "Getting Cozy with the Metasploit Framework," consistently defines RHOST as the remote target host.

3. MIT Computer Science and Artificial Intelligence Laboratory. (2017). 6.858 Computer Systems Security, Fall 2017. Lab 2: Exploiting a web server. Massachusetts Institute of Technology. (University lab materials frequently instruct students to set the RHOST variable to the target's IP address).

HTTPS (Hypertext Transfer Protocol Secure) uses TLS/SSL to encrypt the communication between a user's browser and the web server. This ensures the confidentiality and integrity of the data in transit, preventing eavesdropping or tampering. However, it does not verify the legitimacy or trustworthiness of the website's owner or content. Cybercriminals frequently obtain SSL/TLS certificates for phishing websites to create a false sense of security, tricking users into believing the site is authentic because it displays a padlock icon. Therefore, while HTTPS is a crucial security feature, it is not a guarantee of a site's legitimacy.

B. The padlock icon merely indicates an active and valid TLS/SSL encryption session; it does not validate the trustworthiness of the site operator.

C. The presence of HTTPS does not make a site "100% secure" from all threats, such as application-level vulnerabilities, nor does it prove its legitimacy.

1. Sheng, S., Holbrook, M., Kumaraguru, P., Cranor, L., & Downs, J. (2010). Who falls for phish?: a demographic analysis of phishing vulnerability and susceptibility. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, 373–382. https://doi.org/10.1145/1753326.1753383 (Discusses how visual cues like HTTPS are misinterpreted by users).

2. University of California, Berkeley - Information Security Office. (n.d.). Top 10 Secure Web Browsing Tips. Phishing & Suspicious Email. Retrieved from https://security.berkeley.edu/education-awareness/phishing-suspicious-email/top-10-secure-web-browsing-tips (Advises users to look beyond the padlock and verify the site's identity).

SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior. This is achieved by inserting malicious SQL code into a data input field.

A. SQL Injection is an unauthorized attack vector exploited by malicious actors, not a legitimate function restricted to administrators.

B. SQL is a language and SQL Injection is an attack type; neither is a database product used by hackers.

1. OWASP Foundation. (n.d.). SQL Injection. OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/SQLInjectionPreventionCheatSheet.html (Provides a definitive explanation of the vulnerability).

2. National Institute of Standards and Technology (NIST). (2007). NIST Special Publication 800-95: Guide to Secure Web Services. Section 4.3.2 discusses SQL injection as a major threat to web services.

3. University of California, Berkeley. (n.d.). CS 161: Computer Security - Lecture 15: Web Security II. Lecture notes detail SQL injection mechanics. Retrieved from https://inst.eecs.berkeley.edu/~cs161/fa21/notes/15-web-security-2.pdf (Page 2 defines SQL Injection).

SQL Injection (SQLi) is a code injection technique used to attack data-driven applications. It occurs when an attacker inserts or "injects" malicious SQL statements into an entry field for execution by the backend database. A successful SQLi exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), and in some cases, issue commands to the operating system. It is one of the most prevalent and critical web application vulnerabilities.

B. SQL is a standard language for managing databases, not a system exclusively used by hackers.

C. SQL injection is characterized by unauthorized execution of code, bypassing normal application and administrative controls.

1. OWASP Foundation. (2021). A03:2021-Injection. OWASP Top 10:2021. Retrieved from https://owasp.org/Top10/A032021-Injection/ (See "Description" section, paragraph 1).

2. Halfond, W. G., Viegas, J., & Orso, A. (2006). A classification of SQL-injection attacks and countermeasures. Proceedings of the IEEE International Symposium on Secure Software Engineering, 13-22. (See Section 2, "SQL INJECTION ATTACKS," paragraph 1). DOI: 10.1109/ISSSE.2006.20

3. Stanford University. (n.d.). CS 155: Computer and Network Security - Lecture 5: Web Security Model, SQL Injection. Retrieved from https://crypto.stanford.edu/cs155/lectures/05-web-security-2.pdf (See Slides 28-30, "SQL Injection Attacks").

Malware, a portmanteau of "malicious software," is a general term for any software or firmware intentionally designed to cause disruption, steal data, or gain unauthorized access to a computer system. It operates against the user's interests and without their explicit consent. This broad category includes viruses, worms, trojan horses, ransomware, spyware, and adware. The defining characteristic of malware is its malicious intent to harm or exploit the target system, its data, or its user.

A: This describes protective software, such as antivirus or data loss prevention (DLP) tools, which are designed to defend against malware.

C: Antivirus is software designed to detect and remove malware; it is a security countermeasure, not a type of malware itself.

1. National Institute of Standards and Technology (NIST) Special Publication 800-83 Rev. 1, "Guide to Malware Incident Prevention and Handling for Desktops and Laptops," Section 2.1, defines malware as "a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system or of otherwise annoying or disrupting the victim."

2. Carnegie Mellon University, Software Engineering Institute (SEI), "Defining Malware: A Vexing Problem," (CMU/SEI-2011-TN-003), provides a detailed academic analysis of malware definitions, confirming its nature as software with malicious intent.

The results report is the primary deliverable of a security assessment or ethical hacking engagement. This formal document comprehensively details the methodology, scope, and, most importantly, the findings of the test. It lists all identified vulnerabilities, categorizes them by severity, provides evidence (e.g., screenshots, logs), and offers actionable recommendations for remediation. Its purpose is to provide the client with a clear understanding of their security posture and a roadmap for improvement.

A. While a report might mention scope limitations, its main purpose is to document findings, not just list unfinished tasks.

C. The agreement with the client is a pre-engagement document, such as a Statement of Work (SOW) or Rules of Engagement, not the post-engagement results report.

1. Scarfone, K., Souppaya, M., & Cody, A. (2008). Technical Guide to Information Security Testing and Assessment. NIST Special Publication 800-115. Section 6 (Reporting). Retrieved from https://doi.org/10.6028/NIST.SP.800-115

2. Engebretson, P. (2013). The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy. Syngress. Chapter 8 (Reporting). (This text, used in university curricula, details the critical components and purpose of the final report).

A vulnerability scan is an automated process that inspects computer systems, networks, and applications for known security weaknesses. The process involves using a scanning tool that checks for thousands of potential vulnerabilities, such as outdated software, missing patches, or insecure configurations. After identification, the results are typically compiled into a report that quantifies the findings (e.g., assigning a CVSS score) and helps prioritize them for remediation based on severity and potential impact. It is a key component of a proactive vulnerability management program.

B. This describes network discovery or network mapping, which is a preliminary step but is not the vulnerability scan itself.

C. This is incorrect because it includes "exploiting," which is characteristic of a penetration test, not a vulnerability scan.

1. National Institute of Standards and Technology (NIST). (2008). Technical Guide to Information Security Testing and Assessment. Special Publication 800-115. (Section 5.2, "Vulnerability Scanning," defines the process as scanning for potential vulnerabilities and differentiating it from penetration testing).

2. Mell, P., Scarfone, K., & Romanosky, S. (2005). A Complete Guide to the Common Vulnerability Scoring System (CVSS). (This document provides the framework for "quantifying" vulnerabilities, a key part of the process mentioned in the correct answer).

3. Purdue University. Cybersecurity - Vulnerability Scanning. Courseware documentation. (Defines vulnerability scanning as the process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened).

Practicing with VulnHub machines is legal and a widely accepted method for cybersecurity education. These are virtual machines intentionally designed with vulnerabilities for security professionals and enthusiasts to practice their skills in a controlled setting. The key principle is that the user downloads and runs the machine on their own hardware, creating an isolated, local network environment. This constitutes an authorized use case, as the user is the owner and administrator of the lab environment. It is a fundamental practice in ethical hacking to only test systems for which you have explicit permission.

A. This is incorrect because you are running the system yourself. You have implicit authorization to test it within your own isolated network environment.

C. This is factually wrong. The entire purpose of VulnHub machines is that they are intentionally built with vulnerabilities to be discovered and exploited for learning.

1. Mohan, A., et al. (2021). A survey of cybersecurity education in the US. In 2021 ASEE Virtual Annual Conference Content Access. "Platforms like VulnHub and Hack The Box provide safe, legal environments for students to practice offensive security techniques on intentionally vulnerable systems." (Section: Hands-on Learning Platforms).

2. Hay, B., & Nuseibeh, B. (2007). A Rigorous Approach to Building a Penetration Testing Lab. SANS Institute InfoSec Reading Room. "The use of intentionally vulnerable operating systems (e.g., from the VulnHub project) within a virtualized lab provides a safe and legal means to practice exploitation techniques." (Section: Lab Components).

3. Stanford University. (CS 155: Computer and Network Security). Project 2: Exploiting a Web Application. "To practice these skills legally, we will use a self-contained, intentionally vulnerable virtual machine... similar to those found on platforms like VulnHub."

Have I Been Pwned? (https://haveibeenpwned.com/) is a widely respected and authoritative resource created by security researcher Troy Hunt. It aggregates and analyzes hundreds of database dumps and data breaches containing billions of leaked accounts. The service allows anyone to check if their email address or phone number has been compromised in a known data breach. Reputable organizations, including government cybersecurity agencies and universities, frequently recommend this site as a tool for individuals to assess their exposure and take remedial action, such as changing compromised passwords.

A. https://rincondelvago.com/ is a Spanish-language website for students to share academic notes and is unrelated to cybersecurity or data breach checking.

C. https://facebook.com/ is a social media platform. While it has security features for Facebook accounts, it is not a public service for checking email compromise across external data breaches.

1. Carnegie Mellon University - Information Security Office. (n.d.). Have I Been Pwned? Retrieved from https://www.cmu.edu/iso/news/2018/have-i-been-pwned.html (Recommends the service for checking account compromise).

2. Hunt, T. (n.d.). About Have I Been Pwned. Have I Been Pwned. Retrieved from https://haveibeenpwned.com/About (Official documentation from the service creator explaining its purpose and function).

3. Federal Trade Commission (FTC). (2021, October). Data Breach Response: A Guide for Business. Retrieved from https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business (While not directly naming the site, it advises actions that services like HIBP facilitate for consumers).