5 exercises — CEH vs. CEH Practical exam formats, the Five Phases of Hacking, reconnaissance vs. enumeration vs. footprinting, white/black/grey hat classification, and privilege escalation vs. lateral movement. EC-Council CEH-specific offensive-security vocabulary.
Why precise CEH vocabulary matters
CEH vs. CEH Practical — knowledge-based multiple choice vs. live hands-on exploitation
Five Phases of Hacking — Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks
Reconnaissance vs. enumeration — passive information gathering vs. active service data extraction
White/black/grey hat — authorisation and intent define the legal and ethical boundary
Privilege escalation vs. lateral movement — same-system 'go up' vs. cross-system 'go across'
0 / 26 completed
1 / 26
EC-Council offers both a "CEH" exam and a separate "CEH (Practical)" exam. How do these two credentials differ, and why would a candidate pursue both?
The distinction between CEH (knowledge-based, multiple-choice) and CEH (Practical) (hands-on, live exploitation) is a frequent point of confusion for candidates researching the certification, since job postings sometimes list "CEH" ambiguously without specifying which. Earning both is marketed by EC-Council as achieving "CEH Master" status.
CEH exam-format vocabulary:
Standard CEH: 125 questions, 4 hours, multiple-choice, passing score varies by form (typically 60–85%, since EC-Council uses different exam forms with different difficulty weightings)
CEH Practical: 6 hours, 20 real-world hands-on challenges in a live lab environment, requiring the candidate to actually compromise systems, not just describe how to
Eligibility requires either completing official EC-Council training, or 2 years of documented information-security work experience submitted for approval
Recognising this two-tier structure matters when reading a résumé or job requirement — "CEH" alone signals theoretical knowledge, while "CEH Master" or "CEH Practical" signals demonstrated hands-on capability.
2 / 26
CEH structures its entire methodology around a defined sequence called the "Five Phases of Hacking." An exam question describes an attacker using whois lookups and reviewing a target company's public job postings to learn about their technology stack, without ever directly touching the target's network. Which phase is this?
CEH's Five Phases of Hacking are: (1) Reconnaissance, (2) Scanning, (3) Gaining Access, (4) Maintaining Access, (5) Covering Tracks — a memorised sequence tested repeatedly across the exam. The whois/job-postings example is passive reconnaissance specifically: information gathering with zero direct interaction with the target's systems, so there is nothing for the target to detect.
Full five-phase vocabulary and how each is distinguished:
Reconnaissance — passive (public sources, OSINT) vs. active (direct but low-noise probing, e.g. social engineering calls) information gathering
Scanning — actively probing with tools (Nmap, Nessus) to identify live hosts, open ports, and running services — this crosses into active, detectable interaction
Gaining Access — exploiting an identified vulnerability to obtain system access
Maintaining Access — establishing persistence (backdoors, rootkits) so access survives a reboot or session end
Covering Tracks — clearing logs and hiding evidence of the intrusion
Exam questions frequently give a short attacker-behaviour scenario and ask which phase it belongs to — the reconnaissance-vs-scanning boundary (passive/no-interaction vs. active/direct-interaction) is the single most common distinction tested.
3 / 26
A CEH question describes a penetration tester connecting to an open service (e.g. SMB or SNMP) on a target system specifically to extract usernames, share names, and system details that the service willingly reveals to any connected client. What term does CEH use for this activity, and how is it distinct from "scanning"?
CEH draws a precise sequential boundary: scanning answers "which ports/services are open?", while enumeration answers "now that I'm connected to that open service, what specific information does it hand over?" — usernames via SMB null sessions, community strings via SNMP, share names, DNS zone transfers, etc. Enumeration typically requires an active, often authenticated or semi-authenticated connection, one step beyond simply detecting that a port is open.
Related vocabulary tested in the same CEH domain:
Banner grabbing — connecting to a service and reading the response text it returns (e.g. an FTP server announcing its exact software version), used to identify exploitable software versions
NetBIOS/SMB enumeration — extracting Windows share and user information via null sessions
SNMP enumeration — extracting network device configuration data via default/guessable community strings
Footprinting — CEH sometimes uses this as a broader umbrella term covering both passive reconnaissance and some enumeration activity, so exam questions test whether you know it is the more general term, while "reconnaissance" and "enumeration" are its more specific sub-phases
Getting scanning/enumeration/footprinting boundaries right is a recurring CEH terminology test.
4 / 26
CEH materials classify attackers by ethics and authorisation. A tester who has explicit written permission from an organisation to attempt to breach its systems, strictly within an agreed scope, is called a _____ hat hacker — the category the CEH credential itself certifies candidates to operate as.
A white hat hacker operates with explicit, documented authorisation and stays within an agreed scope — this is precisely the professional role the CEH certification exists to formalise and legitimise (an "ethical hacker" performing authorised penetration testing).
The full hat-colour vocabulary CEH tests:
White hat — authorised, ethical, operates within a defined scope of engagement
Black hat — unauthorised, malicious intent, no permission sought
Grey hat — operates without explicit authorisation but without malicious intent (e.g. finding and reporting a vulnerability without being asked) — technically unauthorised and legally risky despite good intentions, a nuance CEH exam questions specifically test
Separately, CEH also tests the phrase "rules of engagement" — the formal document defining exactly what a white-hat tester is and is not permitted to do (which systems, what techniques, what time windows), and "scope creep" — when testing activity accidentally or deliberately extends beyond that agreed scope, a serious professional and legal violation even for an otherwise-authorised white-hat engagement.
5 / 26
A CEH exam question describes an attacker who has already gained a low-privilege foothold on a system and is now attempting to exploit a misconfigured scheduled task running as SYSTEM to gain administrator-level control. What is this technique called, and how does it differ from "lateral movement"?
Privilege escalation is a same-system, "go up" concept (low-privilege user → administrator/SYSTEM), typically exploiting misconfigurations, unpatched local vulnerabilities, or weak permissions on services/scheduled tasks. Lateral movement is a different-system, "go across" concept — using access or credentials gained on one machine to reach another machine on the network. CEH tests both as distinct, sequential post-exploitation techniques within the "Maintaining Access" phase.
Related post-exploitation vocabulary tested on CEH:
Vertical privilege escalation — explicitly the "low-privilege to admin" direction described above
Horizontal privilege escalation — gaining access to another account at the same privilege level (e.g. one regular user account accessing another regular user's data), distinct from vertical escalation
Pass-the-hash — a specific lateral movement technique using a captured password hash to authenticate to another system without ever cracking the actual plaintext password
Pivoting — using a compromised system as a relay point to reach otherwise-unreachable internal network segments, closely related to but not identical to lateral movement
Distinguishing "escalation" (same system, more power) from "lateral movement" (different system, using existing access) is one of the most consistently tested vocabulary pairs on the exam.
6 / 26
// Slack message from a security analyst during a code review
@john.doe - Just noticed this API endpoint is exposing the internal database schema in the response headers. This isn't ideal; we should be masking sensitive information like that. Also, consider adding rate limiting to prevent brute-force attempts on this route. Let's discuss how to mitigate these vulnerabilities before merging this PR.
The Slack message describes an issue where an API endpoint is revealing internal database details. This directly corresponds to 'noise pollution' – unnecessary and potentially harmful data being exposed. While 'opaque' refers to a specific technique for hiding data, and 'data leakage' is the broader concept, the question focuses on the *communication* of this vulnerability within a dev team context. 'Red herring' doesn't fit the scenario at all.
7 / 26
PR Description
Subject: API v2 - Initial Release
This PR implements the initial release of the new API v2 endpoint for retrieving user profile data. The endpoint utilizes a direct database query to retrieve all fields from the users table, including passwords (hashed). We've included minimal input validation.
@team-dev - Please review and approve.
The correct answer highlights the critical issue of exposing the entire users table schema directly in the API response. This exposes sensitive data like hashed passwords, which is a severe vulnerability. The wrong options either misinterpret the scenario (incorrectly praising the PR) or focus on secondary concerns (logging/monitoring) while ignoring the fundamental security flaw—the lack of proper data masking and validation. A CEH would immediately recognize this as a significant risk requiring immediate remediation.
8 / 26
During a code review for a new microservice designed to manage user authentication, Sarah (a developer) flags a potential issue. The service's logging module is configured to output raw API request details – including usernames and passwords – directly to a file on the server's filesystem. Mark (another developer) argues that this detailed logging is crucial for debugging performance issues and identifying unusual access patterns. Which of the following best describes the ethical concern Sarah raises, within the context of CEH principles regarding information security?
Sarah's concern stems from exposing sensitive data—usernames and passwords—that could be exploited if the log files were compromised. The CEH framework emphasizes protecting information confidentiality; logging raw credentials directly violates this principle and creates a significant attack surface. While encryption and access controls are important safeguards, proactively logging such details is fundamentally risky and demonstrates a lack of awareness regarding potential vulnerabilities – Mark's argument prioritizes debugging over fundamental security considerations.
9 / 26
You're reviewing a PR for a new payment processing microservice. The developer has implemented a feature to automatically log all incoming API requests, including user credentials and transaction details, to a file accessible via the server's filesystem. During your review, you raise concerns about potential data breaches. Which of the following best illustrates the ethical concern from a CEH perspective regarding this logging implementation?
Code Review Comment: 'I'm concerned that logging raw API requests, including usernames and passwords, to disk is a significant security risk. This could expose sensitive information if the file isn't properly secured or compromised.'
The correct answer highlights the core CEH concern: unnecessarily exposing sensitive data. The problem isn't just that logging exists; it's that logging raw credentials to an accessible file violates principle of least privilege and creates a highly vulnerable attack surface. Options A and B represent misunderstandings about security best practices, while option C is a weak mitigation – input validation alone doesn't address the immediate risk of exposed credentials.
10 / 26
// Slack message from a security analyst during a code review
@john.doe - Just noticed this API endpoint is exposing the internal database schema in the response headers. This isn't ideal; we should be masking sensitive information like that. Also, consider adding rate limiting to prevent brute-force attempts on this route. Let's discuss how to mitigate these vulnerabilities before merging this PR.
The Slack message describes an issue where an API endpoint is revealing internal database details. This directly corresponds to 'noise pollution' – unnecessary and potentially harmful data being exposed. While 'opaque' refers to a specific technique for hiding data, and 'data leakage' is the broader concept, the question focuses on the *communication* of this vulnerability within a dev team context. 'Red herring' doesn't fit the scenario at all.
11 / 26
PR Description
Subject: API v2 - Initial Release
This PR implements the initial release of the new API v2 endpoint for retrieving user profile data. The endpoint utilizes a direct database query to retrieve all fields from the users table, including passwords (hashed). We've included minimal input validation.
@team-dev - Please review and approve.
The correct answer highlights the critical issue of exposing the entire users table schema directly in the API response. This exposes sensitive data like hashed passwords, which is a severe vulnerability. The wrong options either misinterpret the scenario (incorrectly praising the PR) or focus on secondary concerns (logging/monitoring) while ignoring the fundamental security flaw—the lack of proper data masking and validation. A CEH would immediately recognize this as a significant risk requiring immediate remediation.
12 / 26
During a code review for a new microservice designed to manage user authentication, Sarah (a developer) flags a potential issue. The service's logging module is configured to output raw API request details – including usernames and passwords – directly to a file on the server's filesystem. Mark (another developer) argues that this detailed logging is crucial for debugging performance issues and identifying unusual access patterns. Which of the following best describes the ethical concern Sarah raises, within the context of CEH principles regarding information security?
Sarah's concern stems from exposing sensitive data—usernames and passwords—that could be exploited if the log files were compromised. The CEH framework emphasizes protecting information confidentiality; logging raw credentials directly violates this principle and creates a significant attack surface. While encryption and access controls are important safeguards, proactively logging such details is fundamentally risky and demonstrates a lack of awareness regarding potential vulnerabilities – Mark's argument prioritizes debugging over fundamental security considerations.
13 / 26
You're reviewing a PR for a new payment processing microservice. The developer has implemented a feature to automatically log all incoming API requests, including user credentials and transaction details, to a file accessible via the server's filesystem. During your review, you raise concerns about potential data breaches. Which of the following best illustrates the ethical concern from a CEH perspective regarding this logging implementation?
Code Review Comment: 'I'm concerned that logging raw API requests, including usernames and passwords, to disk is a significant security risk. This could expose sensitive information if the file isn't properly secured or compromised.'
The correct answer highlights the core CEH concern: unnecessarily exposing sensitive data. The problem isn't just that logging exists; it's that logging raw credentials to an accessible file violates principle of least privilege and creates a highly vulnerable attack surface. Options A and B represent misunderstandings about security best practices, while option C is a weak mitigation – input validation alone doesn't address the immediate risk of exposed credentials.
14 / 26
// Slack message from a security analyst during a code review
@john.doe - Just noticed this API endpoint is exposing the internal database schema in the response headers. This isn't ideal; we should be masking sensitive information like that. Also, consider adding rate limiting to prevent brute-force attempts on this route. Let's discuss how to mitigate these vulnerabilities before merging this PR.
The Slack message describes an issue where an API endpoint is revealing internal database details. This directly corresponds to 'noise pollution' – unnecessary and potentially harmful data being exposed. While 'opaque' refers to a specific technique for hiding data, and 'data leakage' is the broader concept, the question focuses on the *communication* of this vulnerability within a dev team context. 'Red herring' doesn't fit the scenario at all.
15 / 26
PR Description
Subject: API v2 - Initial Release
This PR implements the initial release of the new API v2 endpoint for retrieving user profile data. The endpoint utilizes a direct database query to retrieve all fields from the users table, including passwords (hashed). We've included minimal input validation.
@team-dev - Please review and approve.
The correct answer highlights the critical issue of exposing the entire users table schema directly in the API response. This exposes sensitive data like hashed passwords, which is a severe vulnerability. The wrong options either misinterpret the scenario (incorrectly praising the PR) or focus on secondary concerns (logging/monitoring) while ignoring the fundamental security flaw—the lack of proper data masking and validation. A CEH would immediately recognize this as a significant risk requiring immediate remediation.
16 / 26
During a code review for a new microservice designed to manage user authentication, Sarah (a developer) flags a potential issue. The service's logging module is configured to output raw API request details – including usernames and passwords – directly to a file on the server's filesystem. Mark (another developer) argues that this detailed logging is crucial for debugging performance issues and identifying unusual access patterns. Which of the following best describes the ethical concern Sarah raises, within the context of CEH principles regarding information security?
Sarah's concern stems from exposing sensitive data—usernames and passwords—that could be exploited if the log files were compromised. The CEH framework emphasizes protecting information confidentiality; logging raw credentials directly violates this principle and creates a significant attack surface. While encryption and access controls are important safeguards, proactively logging such details is fundamentally risky and demonstrates a lack of awareness regarding potential vulnerabilities – Mark's argument prioritizes debugging over fundamental security considerations.
17 / 26
You're reviewing a PR for a new payment processing microservice. The developer has implemented a feature to automatically log all incoming API requests, including user credentials and transaction details, to a file accessible via the server's filesystem. During your review, you raise concerns about potential data breaches. Which of the following best illustrates the ethical concern from a CEH perspective regarding this logging implementation?
Code Review Comment: 'I'm concerned that logging raw API requests, including usernames and passwords, to disk is a significant security risk. This could expose sensitive information if the file isn't properly secured or compromised.'
The correct answer highlights the core CEH concern: unnecessarily exposing sensitive data. The problem isn't just that logging exists; it's that logging raw credentials to an accessible file violates principle of least privilege and creates a highly vulnerable attack surface. Options A and B represent misunderstandings about security best practices, while option C is a weak mitigation – input validation alone doesn't address the immediate risk of exposed credentials.
18 / 26
// Slack message from a security analyst during a code review
@john.doe - Just noticed this API endpoint is exposing the internal database schema in the response headers. This isn't ideal; we should be masking sensitive information like that. Also, consider adding rate limiting to prevent brute-force attempts on this route. Let's discuss how to mitigate these vulnerabilities before merging this PR.
The Slack message describes an issue where an API endpoint is revealing internal database details. This directly corresponds to 'noise pollution' – unnecessary and potentially harmful data being exposed. While 'opaque' refers to a specific technique for hiding data, and 'data leakage' is the broader concept, the question focuses on the *communication* of this vulnerability within a dev team context. 'Red herring' doesn't fit the scenario at all.
19 / 26
PR Description
Subject: API v2 - Initial Release
This PR implements the initial release of the new API v2 endpoint for retrieving user profile data. The endpoint utilizes a direct database query to retrieve all fields from the users table, including passwords (hashed). We've included minimal input validation.
@team-dev - Please review and approve.
The correct answer highlights the critical issue of exposing the entire users table schema directly in the API response. This exposes sensitive data like hashed passwords, which is a severe vulnerability. The wrong options either misinterpret the scenario (incorrectly praising the PR) or focus on secondary concerns (logging/monitoring) while ignoring the fundamental security flaw—the lack of proper data masking and validation. A CEH would immediately recognize this as a significant risk requiring immediate remediation.
20 / 26
During a code review for a new microservice designed to manage user authentication, Sarah (a developer) flags a potential issue. The service's logging module is configured to output raw API request details – including usernames and passwords – directly to a file on the server's filesystem. Mark (another developer) argues that this detailed logging is crucial for debugging performance issues and identifying unusual access patterns. Which of the following best describes the ethical concern Sarah raises, within the context of CEH principles regarding information security?
Sarah's concern stems from exposing sensitive data—usernames and passwords—that could be exploited if the log files were compromised. The CEH framework emphasizes protecting information confidentiality; logging raw credentials directly violates this principle and creates a significant attack surface. While encryption and access controls are important safeguards, proactively logging such details is fundamentally risky and demonstrates a lack of awareness regarding potential vulnerabilities – Mark's argument prioritizes debugging over fundamental security considerations.
21 / 26
You're reviewing a PR for a new payment processing microservice. The developer has implemented a feature to automatically log all incoming API requests, including user credentials and transaction details, to a file accessible via the server's filesystem. During your review, you raise concerns about potential data breaches. Which of the following best illustrates the ethical concern from a CEH perspective regarding this logging implementation?
Code Review Comment: 'I'm concerned that logging raw API requests, including usernames and passwords, to disk is a significant security risk. This could expose sensitive information if the file isn't properly secured or compromised.'
The correct answer highlights the core CEH concern: unnecessarily exposing sensitive data. The problem isn't just that logging exists; it's that logging raw credentials to an accessible file violates principle of least privilege and creates a highly vulnerable attack surface. Options A and B represent misunderstandings about security best practices, while option C is a weak mitigation – input validation alone doesn't address the immediate risk of exposed credentials.
22 / 26
During a code review of a new microservice handling user registration, David comments: 'The `user_data` payload is being logged to disk in its entirety. This includes sensitive information like credit card details and social security numbers – a significant risk!'. What does David most likely mean by 'logging to disk in its entirety'?
David is highlighting a critical security vulnerability: persistent logging of sensitive data. Storing credit card details or social security numbers on disk creates a significant risk of exposure if the system is compromised. The incorrect options misunderstand the implications of logging this type of information – it's not about performance optimization or encryption in this context.
23 / 26
Mark sends the following Slack message to his team during a review of an API endpoint: 'Looks like we're just returning the raw JSON response from the database. That includes the internal table names and column definitions – potential reconnaissance for attackers!' What is Mark warning about?
Mark's concern centers around 'schema exposure'. Revealing internal table names and column definitions provides attackers with valuable intelligence about the database. This information can be used to craft more targeted attacks or exploit vulnerabilities related to data access. The other options relate to API design issues rather than security vulnerabilities.
24 / 26
You are analyzing the response from a newly deployed microservice that handles user profile updates. The response contains the following JSON: `{"user_id": "12345", "email": "john.doe@example.com", "hashed_password": "..."}`. What is the primary security risk associated with this response format?
The most significant risk is the inclusion of sensitive information – specifically the `hashed_password` – in plaintext. Even if the API uses hashing, exposing the hashed password directly makes it vulnerable to attacks like rainbow table lookups. While lacking a standard error code could be an issue, it doesn't represent the core security vulnerability.
25 / 26
A developer submits a PR with the following description: 'This commit implements improved logging for all API requests. We're now capturing more details about user sessions and transaction IDs to aid in debugging.' What potential security issue does this description implicitly raise?
While improved logging can be beneficial for debugging, capturing detailed session IDs and transaction IDs presents a significant security risk. Attackers could use this information to track user activity, monitor system behavior, or potentially identify vulnerabilities. The other options represent legitimate concerns but don't directly address the core issue of sensitive data exposure through logging.
26 / 26
"During today's stand-up, Sarah reported that she's implemented a new feature to log all incoming API requests. She noted the logs include full user credentials and transaction details and are being written directly to the file system.". What's the immediate concern from a security perspective?
Sarah's description highlights a critical security vulnerability: logging sensitive user credentials and transaction details directly to the file system. This creates an immediate risk of data exposure if the system is compromised or if logs are accessed without authorization. The concern isn't about compliance (although that should be considered) but the immediate threat of unauthorized access.
What will I practice in "Certified Ethical Hacker (CEH) Vocabulary — EC-Council Exam Language"?
This is a Certification Prep exercise set. It walks through 26 scenario-based multiple-choice questions built around real usage of Certification Prep terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 26 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the Certification Prep vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Certification Prep exercises?
See the Certification Prep exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — Certification Prep vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.