Which of the following sequences correctly represents the systematic phases of exploitation?

Enumeration → Gaining Access → Vulnerability Identification

Vulnerability Identification → Gaining Access → Enumeration

Enumeration → Vulnerability Identification → Gaining Access

Gaining Access → Enumeration → Vulnerability Identification

You have launched an exploit against a target and received a Meterpreter session. You need to perform a quick check of the system's network configuration and then move the session to the background so you can continue working in msfconsole. Which commands should you use?

`ifconfig` then `sessions -i 1`

You are testing a network and need to identify a vulnerable service. You have a list of IP addresses and want to use Metasploit to scan for SMB vulnerabilities and store the results. Which combination of commands is most efficient?

Use `hosts -R` to load the IPs, then run `exploit/windows/smb/ms17_010_eternalblue` against all of them.

Use `db_nmap` to scan the IPs, then use `search` to find SMB-related auxiliary modules, and run `auxiliary/scanner/smb/smb_ms17_010` against the hosts.

Use `db_import` to load the IPs, then run `vulns` to see the vulnerabilities.

Use `auxiliary/scanner/smb/smb_ms17_010` directly with a range of IPs, then manually record the results.

You have gained a Meterpreter session on a Windows server with low privileges. Your goal is to extract the password hashes and maintain access. The server has User Account Control (UAC) enabled, and you are not in the Administrators group. Which sequence of actions should you take?

Run `shell` and manually add a new user to the Administrators group, then `hashdump`.

Run `hashdump` first, then `getsystem`, and then `run persistence`.

Run `getsystem` to attempt privilege escalation, then `hashdump` to extract hashes, and finally `run persistence` to maintain access.

Run `run post/windows/gather/win_privs` to check privileges, then `background` the session.

EC-CouncilCertified Ethical Hacker

Domain 3Objective 3

Vulnerability Exploitation and Metasploit CEH Practice Questions (Page 7)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

14concepts

14 Concepts in This Objective

Vulnerability Exploitation Fundamentals
Exploitation Phases and Methodology
Metasploit Framework Architecture
Metasploit Module Types
Metasploit Command-Line Interface
Exploit Selection and Configuration
Payload Generation and Selection
Running Exploits and Handling Sessions
Post-Exploitation Techniques
Metasploit Auxiliary Modules
Evasion and Anti-Virus Bypass
Metasploit Database Integration
Metasploit Scripting and Automation
Ethical and Legal Considerations

Questions 31–35

31foundation · easy
Which of the following sequences correctly represents the systematic phases of exploitation?
Select an answer first
32application · medium
You have launched an exploit against a target and received a Meterpreter session. You need to perform a quick check of the system's network configuration and then move the session to the background so you can continue working in msfconsole. Which commands should you use?
Select an answer first
33expert · hard
You are testing a network and need to identify a vulnerable service. You have a list of IP addresses and want to use Metasploit to scan for SMB vulnerabilities and store the results. Which combination of commands is most efficient?
Select an answer first
34expert · hard
You have gained a Meterpreter session on a Windows server with low privileges. Your goal is to extract the password hashes and maintain access. The server has User Account Control (UAC) enabled, and you are not in the Administrators group. Which sequence of actions should you take?
Select an answer first
35foundation · easy
Which of the following is a post-exploitation activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.