01. An organization discovers that employees are uploading company files to dozens of cloud storage and collaboration services that the IT team never approved.
Which security control is designed to give the organization visibility into this cloud use and enforce its policies on it?
a) Cloud access security broker (CASB)
b) Cloud security posture management (CSPM)
c) Web application firewall (WAF)
d) Intrusion prevention system (IPS)
02. After identifying open ports and services, a security tester exploits a weakness to get into the target system.
Which phase of the hacking cycle is being performed?
a) Scanning
b) Reconnaissance
c) Gaining access
d) Maintaining access
03. A database administrator who is about to leave the company uses legitimate access to copy customer records to a personal storage account.
Which class of attack is this?
a) Close-in attack
b) Insider attack
c) Passive attack
d) Distribution attack
04. An attacker on the same network captures a user's password as it travels in cleartext during a login to an unencrypted service, without sending anything to the server.
Which category of password attack is this?
a) Active online attack
b) Offline attack
c) Non-electronic attack
d) Passive online attack
05. Hoping to finish a report at home, an employee emails a file of customer records to his personal email account, unaware that this breaks company policy and exposes the data.
Which type of insider threat is this?
a) Professional insider
b) Compromised insider
c) Negligent insider
d) Malicious insider
06. A fast, tool-driven test of an online store found no issues, yet a shopper later applied the same discount twice by completing the checkout steps in an unexpected order.
Which testing approach is BEST suited to finding this kind of business-logic flaw?
a) Automated testing
b) Announced testing
c) External testing
d) Manual testing
07. An attacker on the same network captures a user's password as it travels in cleartext during a login to an unencrypted service, without sending anything to the server.
Which category of password attack is this?
a) Active online attack
b) Passive online attack
c) Offline attack
d) Non-electronic attack
08. An employee's phone silently reconnects to any open Wi-Fi network whose name it has seen before, so an attacker's hotspot using a familiar café name can capture its traffic.
Which setting change addresses THIS behavior most directly?
a) Enabling full-device encryption
b) Setting a longer screen-lock passcode
c) Turning off automatic joining of open networks
d) Enrolling the phone for remote wipe
09. On an unencrypted public Wi-Fi network, an attacker sets up no access point of their own but silently captures the traffic passing between other users' devices and the access point to pull out passwords and messages.
What type of attack is this?
a) Wireless sniffing
b) Wardriving
c) Evil twin
d) Rogue access point
10. A switch keeps dropping into a mode where it sends frames out of every port. Each time, its address table has filled with thousands of unfamiliar MAC addresses arriving on a single port.
Which feature should be enabled on the switch ports to stop this?
a) DHCP snooping
b) Port security
c) Dynamic ARP Inspection
d) Static ARP entries
The purpose of this Sample Question Set is to provide you with information about the EC-Council Ethical Hacking Essentials exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the 112-52 certification test. To get familiar with real exam environment, we suggest you try our Sample EC-Council EHE Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual EC-Council Ethical Hacking Essentials (EHE) certification exam.
