Question bank
Certified Ethical Hacker v13
44 Certified Ethical Hacker v13 questions with the correct answer and a written explanation, organised across 9 exam domains.
- 44 questions
- 9 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
AI & Machine Learning
4 questions in this domain
- Question 1Single Choice
In a public key infrastructure, what is the primary responsibility of the Certificate Authority (CA) as the root of trust?
- AIssues, signs, and manages digital certificatesCorrect answer
- BVerifies identities before certificate issuance
- CStores users' private keys in a central database
- DProvides real-time certificate status checks
Why this is the answer
The CA is the trusted third party that issues, signs, and manages certificates. A compromised CA invalidates the entire security domain and all certificates it issued.
- Question 2Multiple Select
Which two duties are typically assigned to the Registration Authority (RA) during the certificate issuance lifecycle?
- AVets certificate requests before issuanceCorrect answer
- BVerifies identity of certificate applicantsCorrect answer
- CCryptographically signs issued certificates
- DMaintains the root trust anchor
Why this is the answer
The RA verifies identities and acts as the administrative vetting layer; it does not sign certificates. Cryptographic signing is performed by the CA.
- Question 3Interactive
Based on the code block, which certificate validation mechanism is being used to check whether a specific certificate has been revoked?
- AOnline Certificate Status Protocol (OCSP)Correct answer
- BCertificate Revocation List (CRL)
- CRegistration Authority (RA) vetting
- DCertificate Authority (CA) signing
Why this is the answer
The code queries an OCSP responder for a single certificate's status. OCSP is real-time and avoids downloading the complete CRL list.
- Question 4Single Choice
In a certificate-based trust model, which entity is regarded as the root of trust whose compromise would invalidate the entire security domain?
- ACertificate Authority (CA)Correct answer
- BRegistration Authority (RA)
- COCSP responder
- DEnd-user certificate client
Why this is the answer
The CA is the trusted third party and root of trust. If the CA is compromised, all certificates issued under it become untrusted.
Cloud Hacking
3 questions in this domain
- Question 5Single Choice
Which entity is responsible for issuing and signing digital certificates?
- ACertificate Authority (CA)Correct answer
- BRegistration Authority (RA)
- CCertificate Revocation List (CRL)
- DPublic key
Why this is the answer
The CA is the trusted third-party entity responsible for issuing, signing, and managing digital certificates. The RA verifies identity but does not sign certificates, while CRLs and public keys are not certificate issuers.
- Question 6Multiple Select
Which two statements accurately describe a Certificate Revocation List (CRL)?
- AContains certificates revoked before expirationCorrect answer
- BUpdated periodically and cachedCorrect answer
- CProvides real-time status responses
- DMore efficient than OCSP
Why this is the answer
A CRL is a periodically updated list of revoked certificates. It is not real-time and is generally less efficient than OCSP, which queries a single certificate status on demand.
- Question 7Interactive
The command shown in the code block is used to inspect what type of file?
- ADigital certificateCorrect answer
- BPrivate key
- CCRL file
- DEncrypted password hash
Why this is the answer
The command displays the contents of an X.509 digital certificate, including subject, issuer, validity, and public key information.
Cryptography
3 questions in this domain
- Question 8Single Choice
In a public key infrastructure, which entity serves as the trusted third party that issues and signs digital certificates?
- ACertificate Authority (CA)Correct answer
- BRegistration Authority (RA)
- COnline Certificate Status Protocol (OCSP) responder
- DCertificate Revocation List (CRL) distributor
Why this is the answer
The CA is the root of trust; it issues, signs, and manages digital certificates. The RA only verifies identity, while CRL and OCSP handle revocation status.
- Question 9Multiple Select
Which statements accurately describe certificate revocation mechanisms? Select all that apply.
- AA CRL is a periodically updated list of certificates revoked before their expiration date.Correct answer
- BOCSP queries a responder to check the real-time status of a single certificate.Correct answer
- CCRL provides real-time revocation information immediately after a certificate is revoked.
- DOCSP requires clients to download the entire list of revoked certificates.
Why this is the answer
CRLs are cached and updated periodically, making them technically stale. OCSP is a real-time, single-certificate status protocol and does not require full list downloads.
- Question 10Interactive
Examine the code snippet. Which PKI status-checking mechanism is being implemented?
- AOnline Certificate Status Protocol (OCSP)Correct answer
- BCertificate Revocation List (CRL)
- CRegistration Authority (RA) validation
- DX.509 certificate issuance
Why this is the answer
The code sends a certificate identifier to an online endpoint and prints the returned status. This is characteristic of OCSP, not CRL or RA validation.
Network & Perimeter
10 questions in this domain
- Question 11Single Choice
What is the primary responsibility of a Certificate Authority in a PKI?
- AIssuing, signing, and managing digital certificatesCorrect answer
- BVerifying the identity of certificate requestors
- CGenerating all users' private keys
- DStoring private keys on behalf of users
Why this is the answer
The Certificate Authority is the trusted third-party issuer and manager of digital certificates. The RA handles identity verification, and private key storage is not the CA core role.
- Question 12Multiple Select
Which statements correctly describe the Registration Authority?
- AVerifies the identity of entities requesting certificatesCorrect answer
- BSigns certificates using the CA's private key
- CActs as an intermediary vetting layer before issuanceCorrect answer
- DPerforms cryptographic key generation for all certificates
Why this is the answer
The RA verifies identities and acts as a vetting layer but does not sign certificates. The CA handles the cryptographic side of issuance.
- Question 13Interactive
Examine the provided command. What artifact is being inspected?
- ADigital certificate detailsCorrect answer
- BCertificate revocation list
- CEncrypted private key
- DOCSP response
Why this is the answer
The command displays the contents of an X.509 certificate, including identity, public key, expiration, and CA signature.
- Question 14Single Choice
What is the main purpose of a Certificate Revocation List?
- ALists certificates revoked before expirationCorrect answer
- BProvides real-time certificate status
- CSigns digital certificates
- DEncrypts network traffic
Why this is the answer
A CRL is a periodically updated list of certificates revoked before their scheduled expiration. Real-time status is provided by OCSP.
- Question 15Multiple Select
Which statements correctly contrast CRL and OCSP?
- AOCSP provides real-time certificate statusCorrect answer
- BCRL is periodically updated and cachedCorrect answer
- COCSP requires downloading the full revocation list
- DCRL provides real-time revocation updates
Why this is the answer
OCSP queries a responder for real-time status of a single certificate, while CRL is cached and periodically updated, making it stale.
- Question 16Interactive
What does the command in the code block perform?
- AChecks real-time revocation statusCorrect answer
- BDownloads the complete revocation list
- CCreates a new digital certificate
- DEncrypts the user's private key
Why this is the answer
This OCSP command queries an OCSP responder to check whether a specific certificate is valid or revoked in real time.
- Question 17Single Choice
Which key is distributed to other parties through a digital certificate?
- APublic keyCorrect answer
- BPrivate key
- CSymmetric key
- DPre-shared key
Why this is the answer
The certificate distributes the public key, while the private key must never leave the owner's secure storage.
- Question 18Multiple Select
What are valid consequences if a certificate authority is compromised?
- AThe entire security domain is invalidatedCorrect answer
- BThe CA is no longer a trusted root authorityCorrect answer
- CCertificates issued by that CA become unreliableCorrect answer
- DUser private keys are automatically regenerated
Why this is the answer
A compromised CA invalidates the entire security domain and undermines trust in all certificates it issued. Private keys are not automatically regenerated.
- Question 19Interactive
The code block illustrates an attack that tries every possible numeric combination. Which attack is this?
- ABrute-forceCorrect answer
- BDictionary
- CBirthday
- DSide-channel
Why this is the answer
The code systematically tries every possible numeric combination until the correct hash is found, which matches brute-force behavior.
- Question 20Single Choice
What human behavior does a dictionary attack primarily exploit?
- AUse of predictable passwordsCorrect answer
- BHigh entropy key generation
- CPhysical device leakage
- DHash collision probability
Why this is the answer
Dictionary attacks exploit human psychology and the tendency to choose predictable passwords or phrases, making them highly efficient.
Reconnaissance & Footprinting
5 questions in this domain
- Question 21Single Choice
Which entity acts as the trusted third party that issues, signs, and manages digital certificates?
- ACertificate AuthorityCorrect answer
- BRegistration Authority
- CCertificate Revocation List
- DOnline Certificate Status Protocol
Why this is the answer
The CA is the trusted third party that issues, signs, and manages certificates. If the CA is compromised, the entire security domain is invalidated.
- Question 22Multiple Select
Which statements correctly describe the Registration Authority (RA)? Select all that apply.
- AVerifies requester identitiesCorrect answer
- BSigns certificates
- CVetting layer before issuanceCorrect answer
- DMaintains the CRL
Why this is the answer
The RA verifies identity and acts as an administrative vetting layer, but it does not sign certificates or maintain CRLs.
- Question 23Interactive
Referring to the code block, what certificate field is printed by the script?
- ASubject
- BIssuerCorrect answer
- CSerial number
- DValidity period
Why this is the answer
The code loads a certificate and prints cert.issuer, which is the issuing CA's identifier.
- Question 24Single Choice
How does OCSP differ from a Certificate Revocation List (CRL)?
- AQueries single certificate statusCorrect answer
- BDownloads full revoked list
- CUpdates only once per week
- DPerforms certificate enrollment
Why this is the answer
OCSP provides real-time, single-certificate status checks, while CRLs are periodically updated lists that can be stale.
- Question 25Multiple Select
Which situations can require a certificate to be revoked before expiration? Select all that apply.
- APrivate key compromiseCorrect answer
- BCA compromiseCorrect answer
- CChange in user affiliationCorrect answer
- DCached CRL entry
Why this is the answer
Revocation is required when a key is compromised, the CA is compromised, or a user's affiliation changes. Cached CRL entries do not trigger revocation.
Scanning & Enumeration
5 questions in this domain
- Question 26Single Choice
What is the primary responsibility of a Certificate Authority (CA) in a PKI?
- AIssuing, signing, and managing digital certificatesCorrect answer
- BVerifying identity without signing certificates
- CCreating private keys for every user
- DMaintaining a list of common passwords
Why this is the answer
A Certificate Authority is the trusted third party responsible for issuing, signing, and managing digital certificates. It acts as the root of trust in a PKI.
- Question 27Multiple Select
Which statements correctly describe the role of a Registration Authority (RA)?
- AIt verifies the identity of entities requesting certificates.Correct answer
- BIt signs certificates before they are issued.
- CIt acts as a vetting layer in the certificate lifecycle.Correct answer
- DIt is the trusted third-party root of trust.
Why this is the answer
The Registration Authority verifies identities and acts as the administrative vetting layer, but it does not sign certificates. The Certificate Authority performs cryptographic issuance.
- Question 28Interactive
Use the command output to determine which standard defines the digital certificate structure shown.
- AX.509Correct answer
- BPKCS#12
- CCRL
- DOCSP
Why this is the answer
The command displays an X.509 certificate's standard fields such as subject, issuer, and public key algorithm.
- Question 29Single Choice
What is a Certificate Revocation List (CRL)?
- AA periodically updated list of certificates revoked before their expiration dateCorrect answer
- BA real-time query response for a single certificate status
- CA list of all trusted root certificates
- DA digital certificate used to prove ownership of a public key
Why this is the answer
A CRL is a periodically updated list of certificates revoked early. It is not real-time; OCSP provides real-time status.
- Question 30Multiple Select
Which circumstances may require the CA to revoke an existing digital certificate?
- AThe certificate's private key has been compromised.Correct answer
- BThe issuing CA has been compromised.Correct answer
- CThe user's affiliation with the organization has changed.Correct answer
- DThe certificate is about to expire naturally.
Why this is the answer
Revocation is performed due to key compromise, CA compromise, or changes in affiliation. Natural expiration does not require revocation.
System Hacking
6 questions in this domain
- Question 31Single Choice
Which entity is the trusted third-party responsible for issuing, signing, and managing digital certificates?
- ACertificate AuthorityCorrect answer
- BRegistration Authority
- CCertificate Revocation List
- DOnline Certificate Status Protocol
Why this is the answer
The Certificate Authority is the trusted third-party that issues, signs, and manages digital certificates; compromise of the CA invalidates the security domain.
- Question 32Multiple Select
Which responsibilities are performed by a Registration Authority? Select all that apply.
- AVerifies the identity of entities requesting certificatesCorrect answer
- BSigns digital certificates using the CA private key
- CActs as an intermediary vetting layer before certificate issuanceCorrect answer
- DMaintains the Certificate Revocation List
Why this is the answer
The RA handles administrative identity verification and vetting, but it does not sign certificates or maintain the CRL; those duties belong to the CA.
- Question 33Interactive
Review the X.509 certificate structure in the code block. Which field most directly proves that the holder owns the public key?
- Apublic_keyCorrect answer
- Bsignature_algorithm
- Cissuer
- Dvalidity
Why this is the answer
The public_key field carries the key itself inside the X.509 certificate, and the certificate is the electronic document used to prove ownership of that public key.
- Question 34Single Choice
Which mechanism is the primary method for handling digital certificates that have been compromised before their expiration date?
- ACertificate Revocation ListCorrect answer
- BRegistration Authority log
- CX.509 extension
- DDigital signature
Why this is the answer
A CRL is a periodically updated list of certificates revoked by the CA, normally due to key compromise or affiliation changes.
- Question 35Multiple Select
Which statements correctly compare OCSP with CRL? Select all that apply.
- AOCSP provides real-time certificate statusCorrect answer
- BOCSP requires downloading the full certificate list
- COCSP queries a responder about a single certificateCorrect answer
- DOCSP reduces latency and bandwidth compared with CRLCorrect answer
Why this is the answer
OCSP is a real-time protocol that queries a responder about a specific certificate, consuming less bandwidth than downloading a CRL.
- Question 36Interactive
Based on the certificate status output in the code block, what does KEY_COMPROMISE represent?
- AThe reason the certificate was revokedCorrect answer
- BThe certificate's expiration date
- CThe name of the OCSP responder
- DThe public key value
Why this is the answer
The output shows REVOKED with KEY_COMPROMISE as the reason, meaning the certificate was revoked before expiration due to a compromised key.
Web Application Hacking
4 questions in this domain
- Question 37Single Choice
What is the primary responsibility of a Certificate Authority in a public key infrastructure?
- AIssue, sign, and manage digital certificatesCorrect answer
- BVerify certificate requesters' identities
- CProvide real-time certificate revocation status
- DStore users' private keys
Why this is the answer
The CA issues, signs, and manages certificates. Identity verification before issuance is the RA's role, while OCSP handles real-time status. The CA is the root of trust.
- Question 38Multiple Select
Which statements about CRL and OCSP are correct? Select all that apply.
- ACRLs are cached and updated periodicallyCorrect answer
- BOCSP queries the status of a single certificate in real timeCorrect answer
- CCRL provides faster real-time updates than OCSP
- DOCSP requires downloading a complete list of revoked certificates
Why this is the answer
CRLs are periodically updated, stale lists; OCSP responds in real time for one certificate. Therefore the first two choices are correct.
- Question 39Interactive
Analyze the provided code snippet. Which security mechanism is being demonstrated?
- ADigital signature verificationCorrect answer
- BSymmetric encryption
- CHash-only integrity check
- DCertificate revocation
Why this is the answer
The code decrypts the signature with the public key and compares it to the message's hash. This is the standard digital signature verification process.
- Question 40Single Choice
Which key is contained in an X.509 digital certificate for distribution?
- APublic keyCorrect answer
- BPrivate key
- CSymmetric key
- DSession key
Why this is the answer
The X.509 certificate carries the owner's public key. The private key must remain in secure storage and is never distributed through the certificate.
Wireless, Mobile & IoT Hacking
4 questions in this domain
- Question 41Single Choice
Which trusted third-party entity is responsible for issuing, signing, and managing digital certificates in a typical PKI environment?
- ARegistration Authority
- BCertificate AuthorityCorrect answer
- CCertificate Revocation List
- DOnline Certificate Status Protocol
Why this is the answer
The CA issues, signs, and manages digital certificates. RA vets requests but does not sign; CRL and OCSP are status mechanisms.
- Question 42Multiple Select
Which tasks are performed by a Registration Authority before a certificate is issued by the certificate authority?
- AVerifies identity of certificate requestersCorrect answer
- BSigns certificates with its own private key
- CHandles administrative vetting before issuanceCorrect answer
- DActs as the ultimate root of trust
Why this is the answer
The RA verifies identity and handles administrative vetting, but does not sign certificates. The CA signs and is the ultimate root of trust.
- Question 43Interactive
Review the certificate structure in the code block. Which required X.509 certificate element is missing from the displayed data?
- ADigital signature of the issuing CACorrect answer
- BIssuer's private key
- CRegistration Authority's certificate
- DOwner's password hash
Why this is the answer
X.509 includes subject, public key, issuer, validity, and the CA signature. The displayed structure is missing the issuing CA's digital signature.
- Question 44Single Choice
Which mechanism provides real-time certificate status information when a client must check a single certificate's validity?
- ACertificate Revocation List
- BOnline Certificate Status ProtocolCorrect answer
- CDigital Certificate
- DRegistration Authority
Why this is the answer
OCSP queries a responder for a single certificate's real-time status. CRLs are periodic and can be stale.
Frequently asked questions
Everything about the Certified Ethical Hacker v13 question bank and how to use it.