CompTIA Ethical Hacker Pro Competency Assessment Practice Test
Ethical hacking practice centers on authorized security assessment, responsible handling of sensitive evidence, and clear communication of risk. The available questions use scenarios involving API bearer tokens, packet captures, vulnerability reports, disclosure scope, service banners, system time, software signatures, and excessive user privileges.
Exam overview
About the CompTIA Ethical Hacker Pro Competency Assessment Exam
Assessment work requires more than identifying a weakness: testers must preserve authorization boundaries, limit exposure of credentials and captured data, and provide findings that others can verify and remediate. The question scenarios also touch on security judgment, including prioritizing vulnerabilities in light of exploitability and business impact, strengthening remote access against password theft, and applying least privilege to workstation accounts. Other relevant concepts include the evidentiary value of synchronized timestamps and what a verified digital signature establishes about a vendor package. These tasks call for precise evidence handling, sound control selection, and reports that name affected assets, substantiate severity, and give practical remediation guidance.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A tester is asked to assess an application programming interface (API) that uses bearer tokens. Which practice best limits exposure of those tokens during testing?
Show answer
Correct answer: BBearer tokens can grant access to whoever possesses them. Using approved test credentials and minimizing or protecting token exposure reduces the chance of misuse. Tokens should not be placed in URLs, broadly shared, or disclosed in reports.
A report lists a severe vulnerability but provides no affected asset, evidence, or remediation guidance. What is the most useful improvement?
Show answer
Correct answer: AA useful finding identifies where the issue exists, supports it with relevant evidence, explains its likely impact, and gives practical remediation guidance. The report should be concise and avoid unnecessary sensitive data.
An organization wants to reduce the chance that a stolen employee password alone will allow access to a remote account. Which control is most directly suited to this goal?
Show answer
Correct answer: AMulti-factor authentication requires an additional factor beyond the password, reducing the usefulness of a stolen password by itself. The other choices do not provide an independent authentication factor.
A tester captures a packet trace that may contain authentication tokens. What is the best way to handle the trace after collection?
Show answer
Correct answer: BPacket captures can contain credentials or other sensitive data. Restricting access, protecting storage, and following retention requirements reduce the chance of disclosure.
An organization uses a written vulnerability disclosure program. A researcher reports a weakness in a system that is explicitly outside the program’s stated scope. What should the organization do first?
Show answer
Correct answer: BA disclosure policy does not grant permission to test assets outside its stated scope. The organization should acknowledge the report and establish authorization before any additional testing.
A security team wants to prioritize a vulnerability that is difficult to exploit but affects a critical business service. Which approach is most appropriate?
Show answer
Correct answer: BRisk prioritization should combine technical factors such as exploitability and severity with organizational context, including asset criticality and exposure. A scanner label alone does not capture the full business risk.
A tester is checking whether a network service exposes more information than necessary in its response banners. What is the main security concern?
Show answer
Correct answer: AService banners may reveal product, version, or platform details that aid reconnaissance. Their presence alone does not prove a vulnerability, but minimizing unnecessary disclosure can reduce useful information for attackers.
How to use this practice test
The free practice bank contains 50 questions; each session presents up to 20 questions selected at random. Work through the scenarios by choosing and briefly justifying a control or next action, then use the displayed results to identify which decisions need closer review. Pay particular attention to evidence protection, authorization scope, and remediation quality.
Preparation tips
- For API and packet-capture scenarios, distinguish safe test handling from unnecessary exposure of bearer tokens; consider access restriction, secure storage, and disposal.
- Practice writing vulnerability findings that identify the affected asset, supporting evidence, business impact, and a concrete remediation step.
- Compare risk-prioritization factors such as exploitability and service criticality rather than treating severity labels as the only decision input.
- Review how multifactor authentication reduces reliance on a password alone, and how least privilege limits the impact of compromised accounts.
- Be able to explain why synchronized clocks support event correlation and what successful software-signature verification does—and does not—prove.