FirstTry

Exam objective

CEH

System Hacking

This objective sits in System Hacking Phases and Attack Techniques, which carries 15% of the CEH exam. The questions below are original, written from the official objective title above, and each explanation cites the EC-Council page it rests on.

Objective title verbatim from the official objectives. EC-Council exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

System Hacking Phases and Attack Techniques

A workstation's process log records the entry below, and process 712 is the Local Security Authority Subsystem Service. What is the operator attempting?

User:        NT AUTHORITY\SYSTEMParent:      cmd.exeCommandLine: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 712 C:\Users\Public\o.dmp full
Dumping credential material from process memoryCorrect · your answerCorrect.
Registering a new security support provider DLLAdding a security support provider is done through two Lsa registry keys, not a memory write.
Clearing the Windows security event logLog clearing runs through wevtutil or the event viewer and leaves no dump file behind.
Installing a kernel level keystroke driverA keystroke driver captures input as it is typed and would not target a running process image.

Correct.

Checked against attack.mitre.org, September 2026

Concept

Signing in leaves authentication secrets resident in a privileged process. Writing that process to disk turns a live memory region into a file an operator can carry away and mine at leisure.

Why A

The command writes a full memory image of the authority subsystem to a file. That image holds the material generated and stored when users logged on, which is why the write itself is the objective.

Source

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).... Built-in Windows tools such as comsvcs.dll can also be used: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full…

MITRE ATT&CK, OS Credential Dumping: LSASS Memory (T1003.001), checked September 2026
#credential-dumping#lsass#windows

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

System Hacking Phases and Attack Techniques

Your domain-joined Windows 11 fleet must keep NTLM password hashes and Kerberos ticket-granting tickets out of reach of malware running with administrative rights. Which feature does that?

Sample question 2 of 3

System Hacking Phases and Attack Techniques

After an upgrade to Windows Server 2025, a domain member that had Credential Guard explicitly disabled beforehand is reviewed. What is its state?

Sample question 3 of 3

System Hacking Phases and Attack Techniques

An operator holds a captured password hash and uses it to obtain a valid Kerberos ticket instead of authenticating over NTLM. What is that variation called?

That’s 3 of the full CEH bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in System Hacking Phases and Attack Techniques