CyberRevision
Continue revision → ← Subjects
CEH v13 · 20 official modules

All 5,000 CEH questions.

Search original practice content, filter by EC-Council module or exam domain, and open any question in revision mode.

0 answered overall

Showing 301–350 of 5,000 matching questions

50 per page
0301
Module 1 · Foundation Domain 1 · Background prompt injection against AI systems Unanswered

During an authorized retail-company assessment (RET-LAB-M01-301), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Give plugins domain-administrator privileges.
  2. Treat every model response as trusted executable code.
  3. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  4. Disable logging so prompts cannot be reviewed.
Practice →
0302
Module 1 · Foundation Domain 1 · Background prompt injection against AI systems Unanswered

During a hospital incident-response exercise (HLT-SOC-M01-302), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Treat every model response as trusted executable code.
  2. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  3. Disable logging so prompts cannot be reviewed.
  4. Give plugins domain-administrator privileges.
Practice →
0303
Module 1 · Foundation Domain 1 · Background prompt injection against AI systems Unanswered

During a university cyber-range engagement (EDU-RANGE-M01-303), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Give plugins domain-administrator privileges.
  2. Disable logging so prompts cannot be reviewed.
  3. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  4. Treat every model response as trusted executable code.
Practice →
0304
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During a financial-services purple-team test (FIN-PT-M01-304), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Give plugins domain-administrator privileges.
  2. Disable logging so prompts cannot be reviewed.
  3. Treat every model response as trusted executable code.
  4. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
Practice →
0305
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During a cloud startup security audit (CLD-AUDIT-M01-305), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  2. Treat every model response as trusted executable code.
  3. Give plugins domain-administrator privileges.
  4. Disable logging so prompts cannot be reviewed.
Practice →
0306
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During a government risk-validation project (GOV-RISK-M01-306), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Treat every model response as trusted executable code.
  2. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  3. Disable logging so prompts cannot be reviewed.
  4. Give plugins domain-administrator privileges.
Practice →
0307
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During an e-commerce application review (ECOM-WEB-M01-307), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  2. Disable logging so prompts cannot be reviewed.
  3. Give plugins domain-administrator privileges.
  4. Treat every model response as trusted executable code.
Practice →
0308
Module 1 · Advanced Domain 1 · Background prompt injection against AI systems Unanswered

During a manufacturing and OT security review (MFG-OT-M01-308), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Treat every model response as trusted executable code.
  2. Disable logging so prompts cannot be reviewed.
  3. Give plugins domain-administrator privileges.
  4. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
Practice →
0309
Module 1 · Advanced Domain 1 · Background prompt injection against AI systems Unanswered

During a mobile-services penetration test (MOB-TEST-M01-309), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  2. Give plugins domain-administrator privileges.
  3. Treat every model response as trusted executable code.
  4. Disable logging so prompts cannot be reviewed.
Practice →
0310
Module 1 · Advanced Domain 1 · Background prompt injection against AI systems Unanswered

During a global-enterprise mock CEH scenario (ENT-MOCK-M01-310), which action most directly controls the risk related to "prompt injection against AI systems"?

View answer choices
  1. Separate trusted instructions from untrusted content, minimize tool privileges, validate outputs, and require approval for sensitive actions.
  2. Give plugins domain-administrator privileges.
  3. Disable logging so prompts cannot be reviewed.
  4. Treat every model response as trusted executable code.
Practice →
0311
Module 1 · Foundation Domain 1 · Background prompt injection against AI systems Unanswered

During an authorized retail-company assessment (RET-LAB-M01-311), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. A generic uptime graph.
  2. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  3. Only a server fan-speed reading.
  4. A subnet mask with no AI request context.
Practice →
0312
Module 1 · Foundation Domain 1 · Background prompt injection against AI systems Unanswered

During a hospital incident-response exercise (HLT-SOC-M01-312), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. A subnet mask with no AI request context.
  2. Only a server fan-speed reading.
  3. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  4. A generic uptime graph.
Practice →
0313
Module 1 · Foundation Domain 1 · Background prompt injection against AI systems Unanswered

During a university cyber-range engagement (EDU-RANGE-M01-313), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. A subnet mask with no AI request context.
  2. A generic uptime graph.
  3. Only a server fan-speed reading.
  4. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
Practice →
0314
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During a financial-services purple-team test (FIN-PT-M01-314), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  2. A subnet mask with no AI request context.
  3. A generic uptime graph.
  4. Only a server fan-speed reading.
Practice →
0315
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During a cloud startup security audit (CLD-AUDIT-M01-315), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. Only a server fan-speed reading.
  2. A generic uptime graph.
  3. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  4. A subnet mask with no AI request context.
Practice →
0316
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During a government risk-validation project (GOV-RISK-M01-316), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  2. Only a server fan-speed reading.
  3. A subnet mask with no AI request context.
  4. A generic uptime graph.
Practice →
0317
Module 1 · Applied Domain 1 · Background prompt injection against AI systems Unanswered

During an e-commerce application review (ECOM-WEB-M01-317), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. Only a server fan-speed reading.
  2. A subnet mask with no AI request context.
  3. A generic uptime graph.
  4. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
Practice →
0318
Module 1 · Advanced Domain 1 · Background prompt injection against AI systems Unanswered

During a manufacturing and OT security review (MFG-OT-M01-318), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. A subnet mask with no AI request context.
  2. A generic uptime graph.
  3. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  4. Only a server fan-speed reading.
Practice →
0319
Module 1 · Advanced Domain 1 · Background prompt injection against AI systems Unanswered

During a mobile-services penetration test (MOB-TEST-M01-319), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. Only a server fan-speed reading.
  2. A generic uptime graph.
  3. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  4. A subnet mask with no AI request context.
Practice →
0320
Module 1 · Advanced Domain 1 · Background prompt injection against AI systems Unanswered

During a global-enterprise mock CEH scenario (ENT-MOCK-M01-320), which evidence best supports an assessment of "prompt injection against AI systems"?

View answer choices
  1. A subnet mask with no AI request context.
  2. Only a server fan-speed reading.
  3. Prompt and tool-call traces showing the injected text, instruction conflict, model decision, and attempted action.
  4. A generic uptime graph.
Practice →
0321
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During an authorized retail-company assessment (RET-LAB-M01-321), which statement most accurately defines "vulnerability"?

View answer choices
  1. The confidentiality, integrity, and availability objectives used to reason about information security.
  2. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  3. A staged model describing adversary activity from reconnaissance through actions on objectives.
  4. A weakness that could be exploited to violate a security requirement.
Practice →
0322
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During a hospital incident-response exercise (HLT-SOC-M01-322), which statement most accurately defines "vulnerability"?

View answer choices
  1. A staged model describing adversary activity from reconnaissance through actions on objectives.
  2. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  3. A weakness that could be exploited to violate a security requirement.
  4. The confidentiality, integrity, and availability objectives used to reason about information security.
Practice →
0323
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During a university cyber-range engagement (EDU-RANGE-M01-323), which statement most accurately defines "vulnerability"?

View answer choices
  1. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  2. A weakness that could be exploited to violate a security requirement.
  3. The confidentiality, integrity, and availability objectives used to reason about information security.
  4. A staged model describing adversary activity from reconnaissance through actions on objectives.
Practice →
0324
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a financial-services purple-team test (FIN-PT-M01-324), which statement most accurately defines "vulnerability"?

View answer choices
  1. A staged model describing adversary activity from reconnaissance through actions on objectives.
  2. The confidentiality, integrity, and availability objectives used to reason about information security.
  3. A weakness that could be exploited to violate a security requirement.
  4. A knowledge base that organizes adversary tactics and techniques from observed behavior.
Practice →
0325
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a cloud startup security audit (CLD-AUDIT-M01-325), which statement most accurately defines "vulnerability"?

View answer choices
  1. The confidentiality, integrity, and availability objectives used to reason about information security.
  2. A staged model describing adversary activity from reconnaissance through actions on objectives.
  3. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  4. A weakness that could be exploited to violate a security requirement.
Practice →
0326
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a government risk-validation project (GOV-RISK-M01-326), which statement most accurately defines "vulnerability"?

View answer choices
  1. A weakness that could be exploited to violate a security requirement.
  2. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  3. A staged model describing adversary activity from reconnaissance through actions on objectives.
  4. The confidentiality, integrity, and availability objectives used to reason about information security.
Practice →
0327
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During an e-commerce application review (ECOM-WEB-M01-327), which statement most accurately defines "vulnerability"?

View answer choices
  1. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  2. A weakness that could be exploited to violate a security requirement.
  3. The confidentiality, integrity, and availability objectives used to reason about information security.
  4. A staged model describing adversary activity from reconnaissance through actions on objectives.
Practice →
0328
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a manufacturing and OT security review (MFG-OT-M01-328), which statement most accurately defines "vulnerability"?

View answer choices
  1. A weakness that could be exploited to violate a security requirement.
  2. A staged model describing adversary activity from reconnaissance through actions on objectives.
  3. The confidentiality, integrity, and availability objectives used to reason about information security.
  4. A knowledge base that organizes adversary tactics and techniques from observed behavior.
Practice →
0329
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a mobile-services penetration test (MOB-TEST-M01-329), which statement most accurately defines "vulnerability"?

View answer choices
  1. The confidentiality, integrity, and availability objectives used to reason about information security.
  2. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  3. A staged model describing adversary activity from reconnaissance through actions on objectives.
  4. A weakness that could be exploited to violate a security requirement.
Practice →
0330
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a global-enterprise mock CEH scenario (ENT-MOCK-M01-330), which statement most accurately defines "vulnerability"?

View answer choices
  1. The confidentiality, integrity, and availability objectives used to reason about information security.
  2. A knowledge base that organizes adversary tactics and techniques from observed behavior.
  3. A weakness that could be exploited to violate a security requirement.
  4. A staged model describing adversary activity from reconnaissance through actions on objectives.
Practice →
0331
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During an authorized retail-company assessment (RET-LAB-M01-331), which risk is most directly associated with "vulnerability"?

View answer choices
  1. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  2. Unmapped detections can leave important adversary techniques without coverage.
  3. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  4. A control focused on only one objective can leave the other security objectives exposed.
Practice →
0332
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During a hospital incident-response exercise (HLT-SOC-M01-332), which risk is most directly associated with "vulnerability"?

View answer choices
  1. A control focused on only one objective can leave the other security objectives exposed.
  2. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  3. Unmapped detections can leave important adversary techniques without coverage.
  4. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
Practice →
0333
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During a university cyber-range engagement (EDU-RANGE-M01-333), which risk is most directly associated with "vulnerability"?

View answer choices
  1. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  2. A control focused on only one objective can leave the other security objectives exposed.
  3. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  4. Unmapped detections can leave important adversary techniques without coverage.
Practice →
0334
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a financial-services purple-team test (FIN-PT-M01-334), which risk is most directly associated with "vulnerability"?

View answer choices
  1. A control focused on only one objective can leave the other security objectives exposed.
  2. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  3. Unmapped detections can leave important adversary techniques without coverage.
  4. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
Practice →
0335
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a cloud startup security audit (CLD-AUDIT-M01-335), which risk is most directly associated with "vulnerability"?

View answer choices
  1. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  2. Unmapped detections can leave important adversary techniques without coverage.
  3. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  4. A control focused on only one objective can leave the other security objectives exposed.
Practice →
0336
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a government risk-validation project (GOV-RISK-M01-336), which risk is most directly associated with "vulnerability"?

View answer choices
  1. A control focused on only one objective can leave the other security objectives exposed.
  2. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  3. Unmapped detections can leave important adversary techniques without coverage.
  4. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
Practice →
0337
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During an e-commerce application review (ECOM-WEB-M01-337), which risk is most directly associated with "vulnerability"?

View answer choices
  1. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  2. A control focused on only one objective can leave the other security objectives exposed.
  3. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  4. Unmapped detections can leave important adversary techniques without coverage.
Practice →
0338
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a manufacturing and OT security review (MFG-OT-M01-338), which risk is most directly associated with "vulnerability"?

View answer choices
  1. A control focused on only one objective can leave the other security objectives exposed.
  2. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  3. Unmapped detections can leave important adversary techniques without coverage.
  4. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
Practice →
0339
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a mobile-services penetration test (MOB-TEST-M01-339), which risk is most directly associated with "vulnerability"?

View answer choices
  1. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  2. Unmapped detections can leave important adversary techniques without coverage.
  3. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  4. A control focused on only one objective can leave the other security objectives exposed.
Practice →
0340
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a global-enterprise mock CEH scenario (ENT-MOCK-M01-340), which risk is most directly associated with "vulnerability"?

View answer choices
  1. An exploitable weakness can enable unauthorized access, disruption, or data exposure.
  2. Defenders who monitor only the final stage miss earlier opportunities to interrupt an intrusion.
  3. A control focused on only one objective can leave the other security objectives exposed.
  4. Unmapped detections can leave important adversary techniques without coverage.
Practice →
0341
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During an authorized retail-company assessment (RET-LAB-M01-341), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Map each asset and threat to confidentiality, integrity, and availability requirements.
  2. Place preventive and detective controls across multiple stages of the chain.
  3. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  4. Validate, prioritize, and remediate weaknesses according to risk.
Practice →
0342
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During a hospital incident-response exercise (HLT-SOC-M01-342), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Validate, prioritize, and remediate weaknesses according to risk.
  2. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  3. Place preventive and detective controls across multiple stages of the chain.
  4. Map each asset and threat to confidentiality, integrity, and availability requirements.
Practice →
0343
Module 1 · Foundation Domain 1 · Background vulnerability Unanswered

During a university cyber-range engagement (EDU-RANGE-M01-343), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  2. Validate, prioritize, and remediate weaknesses according to risk.
  3. Map each asset and threat to confidentiality, integrity, and availability requirements.
  4. Place preventive and detective controls across multiple stages of the chain.
Practice →
0344
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a financial-services purple-team test (FIN-PT-M01-344), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Place preventive and detective controls across multiple stages of the chain.
  2. Map each asset and threat to confidentiality, integrity, and availability requirements.
  3. Validate, prioritize, and remediate weaknesses according to risk.
  4. Map controls and detections to relevant ATT&CK techniques and validate coverage.
Practice →
0345
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a cloud startup security audit (CLD-AUDIT-M01-345), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Map each asset and threat to confidentiality, integrity, and availability requirements.
  2. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  3. Place preventive and detective controls across multiple stages of the chain.
  4. Validate, prioritize, and remediate weaknesses according to risk.
Practice →
0346
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During a government risk-validation project (GOV-RISK-M01-346), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Place preventive and detective controls across multiple stages of the chain.
  2. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  3. Validate, prioritize, and remediate weaknesses according to risk.
  4. Map each asset and threat to confidentiality, integrity, and availability requirements.
Practice →
0347
Module 1 · Applied Domain 1 · Background vulnerability Unanswered

During an e-commerce application review (ECOM-WEB-M01-347), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Map each asset and threat to confidentiality, integrity, and availability requirements.
  2. Validate, prioritize, and remediate weaknesses according to risk.
  3. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  4. Place preventive and detective controls across multiple stages of the chain.
Practice →
0348
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a manufacturing and OT security review (MFG-OT-M01-348), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Place preventive and detective controls across multiple stages of the chain.
  2. Map each asset and threat to confidentiality, integrity, and availability requirements.
  3. Validate, prioritize, and remediate weaknesses according to risk.
  4. Map controls and detections to relevant ATT&CK techniques and validate coverage.
Practice →
0349
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a mobile-services penetration test (MOB-TEST-M01-349), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Map each asset and threat to confidentiality, integrity, and availability requirements.
  2. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  3. Place preventive and detective controls across multiple stages of the chain.
  4. Validate, prioritize, and remediate weaknesses according to risk.
Practice →
0350
Module 1 · Advanced Domain 1 · Background vulnerability Unanswered

During a global-enterprise mock CEH scenario (ENT-MOCK-M01-350), which action most directly controls the risk related to "vulnerability"?

View answer choices
  1. Map controls and detections to relevant ATT&CK techniques and validate coverage.
  2. Validate, prioritize, and remediate weaknesses according to risk.
  3. Map each asset and threat to confidentiality, integrity, and availability requirements.
  4. Place preventive and detective controls across multiple stages of the chain.
Practice →