'/%3e%3cstop%20offset='100%25'%20stop-color='var(--c-violet-500,%20%238b5cf6)'/%3e%3c/linearGradient%3e%3c/defs%3e%3cpath%20d='M32%204%20L8%2014%20V32%20C8%2044%2018%2054%2032%2060%20C46%2054%2056%2044%2056%2032%20V14%20Z'%20fill='url(%23kbGradient)'%20stroke='var(--c-ink-900,%20%230f172a)'%20stroke-width='2'%20stroke-linejoin='round'/%3e%3cpath%20d='M22%2026%20H42%20M22%2034%20H42%20M22%2042%20H34'%20stroke='%23fff'%20stroke-width='3'%20stroke-linecap='round'%20opacity='0.92'/%3e%3ccircle%20cx='32'%20cy='48'%20r='2.5'%20fill='%23fff'%20opacity='0.92'/%3e%3c/svg%3e){kind=small}
CEH v13 Practice - Consolidated Answer Key (Q1-Q125)
Section titled “CEH v13 Practice - Consolidated Answer Key (Q1-Q125)”Scope: Sets A (Q1-Q50), B (Q51-Q100), C (Q101-Q125). All 125 questions.
Sets covered:
- Set A: Q1 - Q50 -
01-mcq-set-a.md- Set B: Q51 - Q100 -
02-mcq-set-b.md- Set C: Q101 - Q125 -
03-mcq-set-c.mdFor full explanations and source URLs see the corresponding set file.
Answer distribution check: A=13, B=11, C=14, D=12 (Set A) · A=12, B=12, C=13, D=13 (Set B) · A=8, B=7, C=6, D=4 (Set C). Total: balanced across all 125 questions.
Full Answer Key (Q1 - Q125)
Section titled “Full Answer Key (Q1 - Q125)”| Q# | Answer | Domain | One-line topic |
|---|---|---|---|
| 1 | A | D1.1 | 1.1 - Threat actors, attack vectors, and MITRE ATT&CK tactics |
| 2 | D | D1.2 | 1.2 - Social engineering taxonomy |
| 3 | B | D1.3 | 1.3 - Threat modelling and risk frameworks |
| 4 | C | D2.1 | 2.1 - Incident response process (NIST SP 800-61r2) |
| 5 | D | D2.2 | 2.2 - IDS/IPS rule syntax and tuning |
| 6 | D | D2.3 | 2.3 - DoS/DDoS defence and BCP-38 |
| 7 | A | D2.4 | 2.4 - Hardening baselines (CIS, Microsoft) |
| 8 | D | 3.A.1 - Nmap TCP sca | 3.A.1 - Nmap TCP scan types |
| 9 | C | 3.A.2 - Nmap scan-ty | 3.A.2 - Nmap scan-type selection |
| 10 | A | 3.A.3 - Nmap UDP sca | 3.A.3 - Nmap UDP scanning |
| 11 | C | 3.A.4 - Stealth / fi | 3.A.4 - Stealth / firewall-evasion scan types |
| 12 | D | 3.A.5 - Idle scan me | 3.A.5 - Idle scan mechanics |
| 13 | A | 3.A.6 - Host-discove | 3.A.6 - Host-discovery controls |
| 14 | D | 3.A.7 - Decoy / spoo | 3.A.7 - Decoy / spoofed source scans |
| 15 | C | 3.A.8 - Service & ve | 3.A.8 - Service & version detection |
| 16 | A | 3.A.9 - Nmap aggress | 3.A.9 - Nmap aggressive mode |
| 17 | C | 3.A.10 - Firewall/ID | 3.A.10 - Firewall/IDS evasion with fragmentation |
| 18 | A | 3.A.11 - Source-port | 3.A.11 - Source-port spoofing for filter bypass |
| 19 | B | 3.A.12 - CEH methodo | 3.A.12 - CEH methodology phases |
| 20 | D | 3.B.1 - CEH methodol | 3.B.1 - CEH methodology (Covering Tracks) & defensive logging |
| 21 | A | 3.B.2 - LLMNR/NBNS/m | 3.B.2 - LLMNR/NBNS/mDNS poisoning |
| 22 | C | 3.B.3 - Covert chann | 3.B.3 - Covert channels / tunnelling |
| 23 | B | 3.B.4 - Physical / H | 3.B.4 - Physical / HID attacks |
| 24 | B | 3.B.5 - Malware beha | 3.B.5 - Malware behaviour & MITRE ATT&CK |
| 25 | C | 3.B.6 - DNS tunnelli | 3.B.6 - DNS tunnelling & exfiltration |
| 26 | D | 3.B.7 - Man-in-the-m | 3.B.7 - Man-in-the-middle / ARP poisoning |
| 27 | C | 3.B.8 - DoS / applic | 3.B.8 - DoS / application-layer attacks |
| 28 | B | 3.B.8 - Active Direc | 3.B.8 - Active Directory attacks |
| 29 | B | 3.B.9 - Lateral move | 3.B.9 - Lateral movement & credential reuse |
| 30 | D | 3.B.10 - Exploitatio | 3.B.10 - Exploitation & CVE-driven attacks |
| 31 | A | 3.B.11 - Wireless at | 3.B.11 - Wireless attacks (WPA2) |
| 32 | A | 3.B.12 - Defence eva | 3.B.12 - Defence evasion via process injection |
| 33 | C | 3.B.13 - OWASP / Log | 3.B.13 - OWASP / Log4Shell / JNDI injection |
| 34 | B | 3.B.14 - WAF evasion | 3.B.14 - WAF evasion + DoS combinations |
| 35 | B | 3.B.15 - Wireless ev | 3.B.15 - Wireless evil-twin / WPA-Enterprise |
| 36 | B | 3.B.16 - Session hij | 3.B.16 - Session hijacking |
| 37 | A | 3.C.1 - OWASP A10:20 | 3.C.1 - OWASP A10:2021 SSRF + Capital One |
| 38 | D | 3.C.2 - OWASP A06:20 | 3.C.2 - OWASP A06:2021 Vulnerable & Outdated Components + SolarWinds |
| 39 | C | 3.C.3 - OWASP A03:20 | 3.C.3 - OWASP A03:2021 Injection + Log4Shell RCE |
| 40 | D | 3.C.4 - OWASP A05:20 | 3.C.4 - OWASP A05:2021 Security Misconfiguration + S3 |
| 41 | C | 3.C.5 - Wireless cry | 3.C.5 - Wireless crypto / WPA3 |
| 42 | B | 3.C.6 - Mobile / MDM | 3.C.6 - Mobile / MDM |
| 43 | C | 3.C.7 - OT/ICS (Purd | 3.C.7 - OT/ICS (Purdue Model / IEC 62443) |
| 44 | A | 3.C.8 - Cloud (AWS I | 3.C.8 - Cloud (AWS IMDSv2) |
| 45 | A | 3.C.9 - Crypto / TLS | 3.C.9 - Crypto / TLS downgrade |
| 46 | C | 3.C.10 - AI-era thre | 3.C.10 - AI-era threats / FraudGPT / WormGPT |
| 47 | B | 3.C.11 - Prompt inje | 3.C.11 - Prompt injection |
| 48 | D | 3.C.12 - CEH methodo | 3.C.12 - CEH methodology (advanced phase identification) |
| 49 | A | D4.1 | 4.1 - Singapore PDPA / PDPC notification |
| 50 | C | D4.2 | 4.2 - Singapore Cybersecurity Act 2018 / CSA |
| 51 | A | 1 - Threats & Attack | 1 - Threats & Attack Vectors (supply chain, APT) |
| 52 | B | 1 - Threats & Attack | 1 - Threats & Attack Vectors (kill chain) |
| 53 | C | 2 - Defense (Zero Tr | 2 - Defense (Zero Trust architecture) |
| 54 | D | 2 - Defense (IDS vs | 2 - Defense (IDS vs IPS) |
| 55 | A | 2 - Defense (EDR / X | 2 - Defense (EDR / XDR) |
| 56 | B | 3.A - Recon (passive | 3.A - Recon (passive vs active) |
| 57 | C | 3.A - Recon (nmap fl | 3.A - Recon (nmap flags) |
| 58 | B | 3.A - Recon (OSINT t | 3.A - Recon (OSINT tooling) |
| 59 | A | 3.A - Recon (Shodan | 3.A - Recon (Shodan / Censys) |
| 60 | B | 3.B - System/Network | 3.B - System/Network (Slowloris / L7 DoS) |
| 61 | C | 3.B - System/Network | 3.B - System/Network (ARP poisoning / MitM) |
| 62 | A | 3.B - System/Network | 3.B - System/Network (Linux privesc - SUID) |
| 63 | A | 3.B - System/Network | 3.B - System/Network (pass-the-hash) |
| 64 | B | 3.B - System/Network | 3.B - System/Network (buffer overflow) |
| 65 | C | 3.B - System/Network | 3.B - System/Network (reverse shell) |
| 66 | A | 3.B - System/Network | 3.B - System/Network (Kerberoasting) |
| 67 | A | 3.B - System/Network | 3.B - System/Network (Metasploit) |
| 68 | B | 3.B - System/Network | 3.B - System/Network (DNS tunneling) |
| 69 | C | 3.C - Web (IDOR / Br | 3.C - Web (IDOR / Broken Access Control) |
| 70 | D | 3.C - Web + Crypto ( | 3.C - Web + Crypto (Cryptographic Failures) |
| 71 | B | 3.C - Crypto (PKI / | 3.C - Crypto (PKI / OCSP stapling) |
| 72 | B | 3.C - Web (Insecure | 3.C - Web (Insecure Design) |
| 73 | C | 3.C - Cloud + Web (S | 3.C - Cloud + Web (Security Misconfiguration) |
| 74 | D | 3.C - Cloud + Web (S | 3.C - Cloud + Web (SSRF / Capital One / IMDSv1) |
| 75 | C | 3.C - Web/SQLi (in-b | 3.C - Web/SQLi (in-band UNION) |
| 76 | B | 3.C - Web/SQLi (bool | 3.C - Web/SQLi (boolean blind) |
| 77 | C | 3.C - Web/SQLi (time | 3.C - Web/SQLi (time-based blind) |
| 78 | C | 3.C - Web/SQLi (out- | 3.C - Web/SQLi (out-of-band) |
| 79 | D | 3.C - Wireless (WEP | 3.C - Wireless (WEP IV reuse) |
| 80 | B | 3.C - Wireless (WPA2 | 3.C - Wireless (WPA2-PSK offline brute) |
| 81 | C | 3.C - Wireless (KRAC | 3.C - Wireless (KRACK) |
| 82 | D | 3.C - Wireless (evil | 3.C - Wireless (evil twin / WPA3) |
| 83 | A | 3.C - IoT (Mirai) | 3.C - IoT (Mirai) |
| 84 | B | 3.C - OT (Purdue mod | 3.C - OT (Purdue model) |
| 85 | D | 3.C - OT (Stuxnet fa | 3.C - OT (Stuxnet family) |
| 86 | C | 3.C - OT/ICS + Cloud | 3.C - OT/ICS + Cloud (Modbus / DNP3) |
| 87 | D | 3.C - Cloud (S3 misc | 3.C - Cloud (S3 misconfiguration) |
| 88 | D | 3.C - Cloud (Kuberne | 3.C - Cloud (Kubernetes RBAC) |
| 89 | D | 3.C - Crypto (RSA vs | 3.C - Crypto (RSA vs ECC) |
| 90 | D | 3.C - Crypto (Heartb | 3.C - Crypto (Heartbleed / padding oracle) |
| 91 | A | 4 - Procedures (PTES | 4 - Procedures (PTES) |
| 92 | A | 4 - Procedures (NIST | 4 - Procedures (NIST 800-115) |
| 93 | C | 4 - Legal (Singapore | 4 - Legal (Singapore CMCA) |
| 94 | D | 4 - Legal (Singapore | 4 - Legal (Singapore PDPA - NRIC) |
| 95 | D | 4 - Legal (Singapore | 4 - Legal (Singapore CSA / CII) |
| 96 | B | 4 - Legal/Regulatory | 4 - Legal/Regulatory (DoD 8140 / 8570 mapping) |
| 97 | A | 4 - Procedures (Rule | 4 - Procedures (Rules of Engagement) |
| 98 | A | 4 - Procedures (Repo | 4 - Procedures (Report structure) |
| 99 | C | 4 - Procedures + AI | 4 - Procedures + AI (LLM Prompt Injection) |
| 100 | D | 4 - Procedures + AI | 4 - Procedures + AI (Adversarial ML / data poisoning) |
| 101 | A | D1.5 | 1.5 - Emerging Threats (AI/LLM attack surface) |
| 102 | A | D1.1 | 1.1 - Threat Actors & Attributes |
| 103 | C | D2.1 | 2.1 - Defense Principles (Zero Trust) |
| 104 | D | D2.4 | 2.4 - IDS / IPS Detection Methodologies |
| 105 | B | 3.A.2 - Scanning (Nm | 3.A.2 - Scanning (Nmap NULL scan) |
| 106 | B | 3.A.4 - Vulnerabilit | 3.A.4 - Vulnerability Analysis (CVSS 3.1) |
| 107 | A | D3.B.1 | 3.B.1 - System Hacking (session analysis) |
| 108 | B | 3.B.1 - System Hacki | 3.B.1 - System Hacking (NTLM relay + MITRE ATT&CK mapping) |
| 109 | B | 3.B.3 - Sniffing (AR | 3.B.3 - Sniffing (ARP poisoning defence) |
| 110 | A | 3.B.1 - Privilege es | 3.B.1 - Privilege escalation / lateral movement (Kerberos abuse) |
| 111 | B | 3.C.2 - SQL Injectio | 3.C.2 - SQL Injection |
| 112 | D | 3.C.1 - Web Applicat | 3.C.1 - Web Application Attacks (XSS in attribute context) |
| 113 | C | 3.C.3 - Wireless Att | 3.C.3 - Wireless Attacks (KRACK vs Dragonblood) |
| 114 | B | 3.C.5 - Cloud Comput | 3.C.5 - Cloud Computing Attacks (SSRF + IMDSv1) |
| 115 | D | 3.C.6 - Cryptography | 3.C.6 - Cryptography (hash function selection) |
| 116 | C | 3.C.6 - Cryptography | 3.C.6 - Cryptography (3DES / Sweet32) |
| 117 | C | 3.C.4 - IoT Attacks | 3.C.4 - IoT Attacks (Mirai botnet) |
| 118 | C | 3.C.4 - Mobile, IoT | 3.C.4 - Mobile, IoT & OT Attacks (Purdue Model) |
| 119 | A | D4.1 | 4.1 - Pen-Test Methodology (ROE) |
| 120 | A | D4.3 | 4.3 - Legal & Regulatory (GDPR + PDPA) |
| 121 | C | D4.3 | 4.3 - Legal & Regulatory (Singapore CMCA) |
| 122 | B | D4.5 | 4.5 - Engagement Types (pen-test vs red team vs bug bounty vs vuln assessment) |
| 123 | D | AI / v13 - Prompt in | AI / v13 - Prompt injection (indirect) + OWASP LLM Top 10 |
| 124 | A | AI / v13 - AI in off | AI / v13 - AI in offence (phishing at scale) |
| 125 | A | AI / v13 - Adversari | AI / v13 - Adversarial ML (evasion) |
Summary Statistics
Section titled “Summary Statistics”| Set | Questions | Distribution | Notes |
|---|---|---|---|
| A | 50 | A=32 B=30 C=33 D=29 | Mixed difficulty, all 9 domains |
| B | 50 | weighted | Heavy Domain 3.C + Domain 4 |
| C | 25 | hardest tier | Scenario/code/packet-reading |
| Total | 125 | A=32 B=30 C=33 D=29 | - |
Domain Coverage Index
Section titled “Domain Coverage Index”Each question is tagged with the CEH blueprint domain in column 3. To focus on a single domain, filter the table by the domain prefix:
- D1.x - Information Security Threats & Attack Vectors (~6% of exam)
- D2.x - Attack Detection & Prevention (~8%)
- D3.A.x - Recon, Scanning, Enumeration, Vuln Analysis (~10%)
- D3.B.x - System & Network Attacks (~16%)
- D3.C.x - Web/DB/Wireless/Mobile/IoT/OT/Cloud/Crypto (~28%)
- D4.x - Procedures, Reporting, Legal/Regulatory (~12%)
- AI/v13 - Distributed across sets; flagged where relevant
How to use
Section titled “How to use”- Take Set A under exam conditions (no notes, 75 min target).
- Score against this key (don’t peek at the explanations in the source files).
- Questions you missed → re-read the corresponding
research/file. - Repeat for Set B and Set C.
- After Sets A + B + C (i.e., 125 questions), you should be hitting 80%+ to be exam-ready.