You are a penetration tester hired by a company to assess their internal network. During the assessment, you discover a critical vulnerability in a legacy system that is not in the scope of the engagement. What is the most appropriate action?

Add the system to the scope and continue testing it.

Document the vulnerability and inform the client immediately, but do not exploit it.

Exploit the system to prove the risk and include it in the final report.

Ignore the vulnerability because it is out of scope.

What is the main difference between a reverse shell and a bind shell payload?

A reverse shell opens a port on the target; a bind shell connects back to the attacker.

A reverse shell is used only for Windows; a bind shell is used only for Linux.

A reverse shell is a type of encoder; a bind shell is a type of exploit.

A reverse shell connects back to the attacker's machine; a bind shell opens a port on the target for the attacker to connect to.

What is the primary purpose of using an encoder in Metasploit?

To make the payload smaller in size.

To increase the speed of the exploit.

To ensure the payload works on all operating systems.

To obfuscate the payload to evade signature-based detection.

You have gained a Meterpreter session on a Windows target, but you need to escalate privileges to SYSTEM. The `getsystem` command fails. You suspect the target has User Account Control (UAC) enabled and your current process is not elevated. Which technique is most likely to succeed?

Use `shell` and run `net user` to add yourself to the Administrators group.

Use `migrate` to move to a process running as SYSTEM, such as `winlogon.exe`.

Run `getsystem` again with a different technique, such as `-t 1`.

Use the `bypassuac` exploit module to spawn a process with elevated privileges, then run `getsystem`.

EC-CouncilCertified Ethical Hacker

Domain 3Objective 3

Vulnerability Exploitation and Metasploit CEH Practice Questions (Page 8)

Part of the System Hacking Phases and Attack Techniques domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 2–3 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

14concepts

14 Concepts in This Objective

Vulnerability Exploitation Fundamentals
Exploitation Phases and Methodology
Metasploit Framework Architecture
Metasploit Module Types
Metasploit Command-Line Interface
Exploit Selection and Configuration
Payload Generation and Selection
Running Exploits and Handling Sessions
Post-Exploitation Techniques
Metasploit Auxiliary Modules
Evasion and Anti-Virus Bypass
Metasploit Database Integration
Metasploit Scripting and Automation
Ethical and Legal Considerations

Questions 36–40

36application · medium
You are a penetration tester hired by a company to assess their internal network. During the assessment, you discover a critical vulnerability in a legacy system that is not in the scope of the engagement. What is the most appropriate action?
Select an answer first
37foundation · easy
What is the main difference between a reverse shell and a bind shell payload?
Select an answer first
38foundation · easy
Which Metasploit module type is used for port scanning and service enumeration?
Select an answer first
39foundation · easy
What is the primary purpose of using an encoder in Metasploit?
Select an answer first
40expert · hard
You have gained a Meterpreter session on a Windows target, but you need to escalate privileges to SYSTEM. The `getsystem` command fails. You suspect the target has User Account Control (UAC) enabled and your current process is not elevated. Which technique is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.