What is the primary responsibility of an ethical hacker when performing exploitation?

To exploit as many systems as possible to prove skills.

To avoid causing damage and to report findings responsibly.

To use the most aggressive techniques to ensure success.

To keep findings confidential and not share them with the client.

In the exploitation methodology, what is the primary purpose of the enumeration phase?

To gather detailed information about the target, such as open ports, services, and user accounts.

To install a backdoor for persistent access.

To test the target's physical security controls.

To immediately exploit any known vulnerability without further investigation.

You are conducting a penetration test and have completed the enumeration phase. You have identified a web server running Apache Tomcat with the manager interface exposed. You suspect a weak password on the manager account. What is the most logical next step in the exploitation methodology?

Immediately run the `exploit/multi/http/tomcat_mgr_upload` exploit.

Move directly to post-exploitation by running `post/multi/gather/env`.

Use the `auxiliary/scanner/http/tomcat_enum` module to enumerate usernames.

Attempt to brute-force the manager credentials using a Metasploit auxiliary module.

EC-CouncilCertified Ethical Hacker

Domain 3Objective 3

Vulnerability Exploitation and Metasploit CEH Practice Questions (Page 5)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

14concepts

14 Concepts in This Objective

Vulnerability Exploitation Fundamentals
Exploitation Phases and Methodology
Metasploit Framework Architecture
Metasploit Module Types
Metasploit Command-Line Interface
Exploit Selection and Configuration
Payload Generation and Selection
Running Exploits and Handling Sessions
Post-Exploitation Techniques
Metasploit Auxiliary Modules
Evasion and Anti-Virus Bypass
Metasploit Database Integration
Metasploit Scripting and Automation
Ethical and Legal Considerations

Questions 21–25

21foundation · easy
After a successful exploit in Metasploit, what command is used to interact with the resulting session?
Select an answer first
22foundation · easy
What is the primary responsibility of an ethical hacker when performing exploitation?
Select an answer first
23foundation · easy
In the exploitation methodology, what is the primary purpose of the enumeration phase?
Select an answer first
24application · medium
You are conducting a penetration test and have completed the enumeration phase. You have identified a web server running Apache Tomcat with the manager interface exposed. You suspect a weak password on the manager account. What is the most logical next step in the exploitation methodology?
Select an answer first
25foundation · easy
Which of the following is NOT a core component of the Metasploit Framework?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Vulnerability Exploitation and Metasploit CEH Practice Questions (Page 5)

Questions 21–25

After a successful exploit in Metasploit, what command is used to interact with the resulting session?

What is the primary responsibility of an ethical hacker when performing exploitation?

In the exploitation methodology, what is the primary purpose of the enumeration phase?

You are conducting a penetration test and have completed the enumeration phase. You have identified a web server running Apache Tomcat with the manager interface exposed. You suspect a weak password on the manager account. What is the most logical next step in the exploitation methodology?

Which of the following is NOT a core component of the Metasploit Framework?

Keep studying — System Hacking Phases and Attack Techniques