A financial institution is investigating a fraudulent transaction. The transaction was made using a valid user account, but the user claims they did not authorize it. The institution wants to determine whether the user's credentials were stolen or if the user is lying. Which evidence would best support accountability and non-repudiation?

A timestamp from the server showing when the transaction occurred

A record of the user's password hash

A digital signature on the transaction using the user's private key

The user's IP address at the time of the transaction

A law firm stores case files in a cloud repository. The managing partner wants to ensure that only the assigned attorneys can open a specific case file, and that they cannot share it with others. Which combination of controls should the IT team implement?

Apply a digital signature to each file and verify it on access

Use a strong password policy and require periodic password changes

Encrypt the files and use role-based access control with per-file permissions

Enable versioning and keep a full audit log of all file downloads

In the context of information security, what does privacy primarily focus on?

Protecting personal data from unauthorized access and disclosure

Ensuring data is accurate and unaltered

Guaranteeing systems are available when needed

A company is implementing a new access control system for its data center. They want to ensure that only authorized personnel can enter, but they also want to avoid long delays at the entrance. Which approach best balances security and usability?

Use a security guard who visually verifies each person

Use a biometric retina scanner for every entry

Use a simple keypad with a shared code

Use a proximity card plus a PIN code

What is the primary goal of fault tolerance in an information system?

To ensure that users cannot deny their actions

To verify that data has not been altered

To ensure that the system continues to operate in the event of a component failure

To prevent unauthorized access to sensitive data

EC-CouncilCertified Ethical Hacker

Domain 1Objective 1

Elements of Information Security CEH Practice Questions (Page 5)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 21–25

21expert · hard
A financial institution is investigating a fraudulent transaction. The transaction was made using a valid user account, but the user claims they did not authorize it. The institution wants to determine whether the user's credentials were stolen or if the user is lying. Which evidence would best support accountability and non-repudiation?
Select an answer first
22application · medium
A law firm stores case files in a cloud repository. The managing partner wants to ensure that only the assigned attorneys can open a specific case file, and that they cannot share it with others. Which combination of controls should the IT team implement?
Select an answer first
23foundation · easy
In the context of information security, what does privacy primarily focus on?
Select an answer first
24application · medium
A company is implementing a new access control system for its data center. They want to ensure that only authorized personnel can enter, but they also want to avoid long delays at the entrance. Which approach best balances security and usability?
Select an answer first
25foundation · easy
What is the primary goal of fault tolerance in an information system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.