A security audit reveals that several network devices (routers, switches) are still using their factory-default credentials. Which immediate action is most critical to reduce risk?

Change all default passwords to unique, strong passwords

Disable unused management interfaces

Monitor logs for failed login attempts

Implement network segmentation to isolate the devices

A security team is evaluating whether to use rainbow tables to test the strength of their password hashes. The hashes are stored with a per-user salt. Which conclusion is correct?

Rainbow tables are effective if the salt is short (e.g., 4 bits)

Rainbow tables are ineffective because the salt changes the hash output for the same password

Rainbow tables are effective because they can be reversed with a GPU

Rainbow tables are still effective because they can be generated for each salt

A penetration tester has a list of password hashes and a wordlist. The tester suspects that users have appended a year (e.g., '2023', '2024') to their base password. The tester wants to crack as many hashes as possible in the shortest time. Which approach is most efficient?

Run a dictionary attack with the wordlist as-is

Run a pure brute-force attack for all passwords up to 10 characters

Run a rule-based attack that appends common years to each wordlist entry

Use a rainbow table for the entire keyspace

Why are default passwords considered a significant security risk?

They are always longer than user-chosen passwords

They are widely known and often remain unchanged after installation

They are only used on legacy systems

They are encrypted with a weak algorithm

EC-CouncilCertified Ethical Hacker

Domain 3Objective 2

Password Cracking and Attacks CEH Practice Questions (Page 3)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 11–15

11application · medium
A security audit reveals that several network devices (routers, switches) are still using their factory-default credentials. Which immediate action is most critical to reduce risk?
Select an answer first
12expert · hard
A security team is evaluating whether to use rainbow tables to test the strength of their password hashes. The hashes are stored with a per-user salt. Which conclusion is correct?
Select an answer first
13foundation · easy
Which of the following is an example of a weak password that attackers commonly exploit?
Select an answer first
14expert · hard
A penetration tester has a list of password hashes and a wordlist. The tester suspects that users have appended a year (e.g., '2023', '2024') to their base password. The tester wants to crack as many hashes as possible in the shortest time. Which approach is most efficient?
Select an answer first
15foundation · easy
Why are default passwords considered a significant security risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.