eCPPTv2 practice questions

Q: Is this eCPPTv2 practice test free?

Yes. All 30 eCPPTv2 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real eCPPTv2 exam cost?

The official price is $450. Cyber VK sells the same official eCPPTv2 voucher for $234.99 — a saving of $215.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real eCPPTv2 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

During the information gathering phase of a penetration test, which of the following techniques is considered PASSIVE reconnaissance?

Accepted Answer

Passive reconnaissance gathers information without directly interacting with target systems, so consulting public WHOIS data and social media does not touch the target's infrastructure. The other options all send packets to or query the target's own servers, making them active.

Question 2

During the information gathering phase of a penetration test, which type of reconnaissance involves interacting directly with the target system, such as performing a port scan or banner grabbing?

Accepted Answer

Active reconnaissance sends packets to or directly interacts with the target (e.g., port scanning, banner grabbing), whereas passive reconnaissance gathers data without touching the target.

Question 3

Which Nmap option set would you use to perform a TCP connect scan while also attempting service and version detection?

Accepted Answer

The -sT flag performs a full TCP connect scan and -sV enables service/version detection. -sS is a SYN scan, -sU is UDP, and -sN is a null scan, none of which match the requested behavior.

Question 4

Which Google dork would most effectively locate exposed directory listings on a target domain during passive information gathering?

Accepted Answer

The 'intitle:"index of"' operator matches the default title of Apache/Nginx directory listing pages, revealing exposed directories on the specified site.

Question 5

In Metasploit, what is the primary difference between a 'staged' payload (e.g., windows/meterpreter/reverse_tcp) and a 'stageless' payload (e.g., windows/meterpreter_reverse_tcp)?

Accepted Answer

A staged payload transmits a minimal stager first, which then pulls down the remaining payload stages over the network, whereas a stageless payload contains the full payload in a single delivery. This makes stageless payloads larger but more reliable when a second connection back is unreliable.

Question 6

You perform a DNS zone transfer against ns1.target.com but receive only the SOA record and a 'transfer failed' message. The most accurate conclusion is that:

Accepted Answer

A properly secured DNS server only permits AXFR (full zone transfers) from whitelisted secondary servers, so an unauthorized client receives a refusal rather than the full zone.

Question 7

You have gained a low-privilege Meterpreter shell on a Windows host. Which post-exploitation technique allows you to route traffic from your attacking machine through the compromised host to reach an internal subnet that is otherwise unreachable?

Accepted Answer

Pivoting uses the compromised host as a gateway; the autoroute module adds routes through the session and a SOCKS proxy lets external tools reach the internal subnet. The other options relate to credential dumping, persistence/stability, or remote access rather than network routing.

Question 8

Which Nmap flag performs a TCP SYN (half-open) scan?

Accepted Answer

The -sS flag performs a SYN scan that never completes the TCP three-way handshake, making it stealthier and faster than the full-connect -sT scan.

Question 9

A web application reflects the 'name' GET parameter directly into the HTML response without any encoding. Injecting executes in the victim's browser only while the crafted link is being visited. Which vulnerability class does this describe?

Accepted Answer

Reflected XSS occurs when input is immediately echoed back in the server's response and requires the victim to follow a crafted request, exactly as described. Stored XSS persists on the server, DOM-based XSS executes entirely client-side via the DOM, and CSRF forges state-changing requests rather than injecting script.

Question 10

An attacker on a switched LAN wants to intercept traffic between a victim host and the gateway. Which technique poisons the victim's cache to redirect its traffic through the attacker?

Accepted Answer

ARP spoofing sends forged ARP replies that associate the attacker's MAC with the gateway's IP in the victim's ARP cache, placing the attacker in a man-in-the-middle position.

Question 11

While testing a login form, entering ' OR '1'='1'-- in the username field bypasses authentication. To confirm and exploit a UNION-based SQL injection to extract data, which prerequisite must you first determine?

Accepted Answer

A UNION-based injection requires the injected SELECT to return the same number of columns with compatible data types as the original query, typically found using ORDER BY or UNION SELECT NULL enumeration. The other items are irrelevant to constructing a valid UNION statement.

Question 12

During an internal test you receive an Nmap result showing a port as 'filtered'. Which statement best describes what this state indicates?

Accepted Answer

'Filtered' means packet filtering (firewall, ACL, or host rule) prevents probes from reaching the port, so Nmap cannot tell whether it is open or closed because it receives no response or an ICMP unreachable.

Question 13

In the context of buffer overflow exploitation, what is the primary purpose of a NOP sled (e.g., a series of \x90 bytes) placed before the shellcode?

Accepted Answer

A NOP sled is a block of no-operation instructions that lets execution 'slide' down to the shellcode even if the jump lands somewhere within the sled, compensating for imprecise return addresses. It does not encode shellcode, manipulate SEH, or exist solely for alignment.

Question 14

Which web vulnerability allows an attacker to inject client-side scripts that execute in another user's browser?

Accepted Answer

Cross-Site Scripting injects malicious scripts that are rendered and executed in victims' browsers, unlike SQLi which targets the database or CSRF which forces unwanted requests.

Question 15

You capture WPA2-PSK traffic and want to crack the passphrase offline. Which specific piece of captured data is REQUIRED for the dictionary attack to succeed?

Accepted Answer

Cracking WPA2-PSK requires capturing the full 4-way handshake, which contains the values needed to verify guessed passphrases against the PMK/PTK derivation. IV collection applies to WEP, WPS PINs are a separate attack, and a lone deauth frame is insufficient.

Question 16

A login form returns different responses for the inputs ' OR '1'='1 and ' AND '1'='2, but no data is displayed on the page. Which SQL injection technique is most appropriate to extract data?

Accepted Answer

When the application reveals no data or errors but responds differently to true/false conditions, boolean-based blind injection infers data one bit at a time from those behavioral differences.

Question 17

During a network penetration test you perform ARP spoofing to position yourself between a victim host and the gateway. What is the fundamental reason this attack succeeds on a typical switched LAN?

Accepted Answer

ARP has no authentication and hosts will accept and cache gratuitous/unsolicited ARP replies, letting an attacker poison the mapping between IP and MAC addresses. Switches do not broadcast unicast frames by default, and the other options are unrelated to why ARP poisoning works.

Question 18

A PHP application includes files via include($_GET['page']) with no sanitization, and the server has allow_url_include disabled. Which technique could still lead to remote code execution?

Accepted Answer

With allow_url_include off, remote inclusion fails, but an attacker can inject PHP code into a log file (e.g., via the User-Agent) and then include that local log through the LFI to achieve code execution.

Question 19

Which frequency band and characteristic distinguishes a rogue access point conducting an 'Evil Twin' attack from a legitimate corporate AP?

Accepted Answer

An Evil Twin impersonates a trusted network by cloning its SSID (and often BSSID), typically with a stronger signal so nearby clients prefer it and connect. It is not defined by a specific band, a hidden SSID, or mandatory open encryption.

Question 20

In the Metasploit Framework, which command is used to search for available exploit modules?

Accepted Answer

The 'search' command queries the module database by keyword, platform, or CVE, while 'use' selects a module and 'show options' displays its configurable parameters.

eCPPTv2 — eCPPTv2 Certified Professional Penetration Tester Exam Voucher | Buy Online Practice Test

Free Practice Test

eCPPTv2 practice test — common questions