CEH v13 Lateral Movement Practice Questions 2026

Moving across a network: pass-the-hash, Kerberoasting, DCSync, pivoting techniques, and detection on enterprise networks. Exam focus: pass-the-hash, pass-the-ticket, Kerberoasting, and DCSync are the headline techniques — be ready to order a multi-hop path through an AD environment and name the evidence each hop leaves in the logs.

⚠️ Important Disclaimer: These practice questions are original study material created by CEHStudy for educational purposes. They are NOT EC-Council exam questions and do NOT replicate the actual exam. CEHStudy is not affiliated with or endorsed by EC-Council.

Question 1: Lateral movement is:

A) Deploying a web application firewall B) Using an initial foothold to move sideways across the network toward higher-value systems C) Encrypting data before exfiltration D) Scanning a target from many external IPs at once

Answer: B — After initial access, attackers pivot host-to-host (reusing stolen credentials) to reach domain controllers, file servers, and crown-jewel data.

Question 2: A Pass-the-Hash (PtH) attack authenticates using:

A) Plain-text credentials captured over the network B) Kerberos tickets replayed between services C) A stolen NTLM/NT hash directly, without first cracking the password D) Multi-factor authentication codes intercepted by SMS

Answer: C — Many SMB logins accept the hash itself — so a dumped NTLM value is as good as the password for authenticating elsewhere.

Question 3: Pass-the-Ticket differs from Pass-the-Hash because it replays:

A) Stolen Kerberos tickets (TGT or TGS) captured from ticket caches B) NTLM password hashes over SMB C) RDP session cookies only D) Raw passwords typed at a login prompt

Answer: A — Extraction from memory (Mimikatz sekurlsa::tickets) yields valid TGTs/TGSs that authenticate to services until they expire.

Question 4: Mimikatz's primary role in lateral movement is:

A) Applying security patches to domain controllers B) Performing high-speed port scans C) Dumping credentials and tickets from memory (e.g., sekurlsa::logonpasswords) D) Tunneling traffic over DNS

Answer: C — It reads LSASS process memory for NTLM/NTLMv2 hashes, Kerberos tickets, and plaintext — the fuel for PtH/PtT attacks.

Question 5: 'Pivoting' refers to:

A) Encrypting traffic between two branches B) Using a compromised host as a launch point to attack other internal systems that are not directly reachable C) Rebooting a server to apply updates D) Rotating DNS records across providers

Answer: B — The foothold becomes a proxy (SSH tunnels, SOCKS, Proxifier) — reaching segmented networks the attacker can't scan from outside.

Question 6: PSExec and RDP (port 3389) are commonly abused for lateral movement because they:

A) Allow remote process execution and interactive administrator sessions over the network B) Automatically disable firewall rules on all hosts C) Crack NTLM hashes offline at GPU speed D) Capture wireless handshakes from any SSID

Answer: A — With valid (stolen) admin credentials, both give full control of another host — so audit remote-logon behavior and restrict admin paths.

Question 7: SMB (port 445) is a key lateral-movement channel because it:

A) Only serves static web content to browsers B) Blocks administrator traffic by default C) Enables file sharing, named pipes, and remote administration across Windows hosts D) Requires MFA on every connection out of the box

Answer: C — Named pipes over SMB power PsExec, wmic remote execution, and admin$ share copies — a primary PtH/relay target.

Question 8: A Golden Ticket attack grants the attacker:

A) A legitimate one-time service ticket for a single application B) An expired digital certificate renewed automatically C) A forged TGT (using the KRBTGT account hash) providing indefinite access to any service in the domain D) A temporary VPN token valid for 24 hours

Answer: C — Because KDCs trust tickets signed with the KRBTGT key, a forged TGT is valid until that hash is reset — rotate KRBTGT after such incidents.

Question 9: A primary defense against lateral movement is:

A) Hiding all wireless SSIDs B) Least-privilege access, network segmentation, and monitoring for anomalous cross-host logons C) Disabling HTTPS on internal servers D) Lengthening password expiration intervals only

Answer: B — If each host is a locked room (JEA, tiered admin model) and jumps between rooms are alerted, movement stalls quickly.

Question 10: Credential dumping on a Windows host often targets memory because:

A) NTLMv2 hashes are reversible by design B) Secrets like NTLM hashes and Kerberos tickets reside in process memory (LSASS) where they can be read C) The SAM file is world-readable at all times D) Passwords are stored in clear text under %temp%

Answer: B — Modern Windows protects disk copies of secrets — so attackers read LSASS memory instead, driving defenses like Credential Guard and LSA protection.

Related Glossary Terms

Continue Your CEH v13 Prep

Frequently Asked Questions

How many CEH v13 Lateral Movement practice questions are on this page?

This page includes 10 original multiple-choice practice questions for CEH v13 Module 18 (Lateral Movement). Each question includes a detailed explanation of the correct answer and why the other options are wrong. The full CEHStudy question bank covers all 20 modules with 200+ questions — see the practice hub at https://cehstudy.com/ceh-practice-questions/ for every module.

What does CEH v13 Module 18 (Lateral Movement) cover?

Moving across a network: pass-the-hash, Kerberoasting, DCSync, pivoting techniques, and detection on enterprise networks. These are the same topics tested under this module on the EC-Council 312-50 exam. Pair this quiz with our free Module 18 flashcards at https://cehstudy.com/ceh-v13/module-18/ to close any gaps.

Are these real CEH exam questions?

No. Every question on CEHStudy is original study material written for exam preparation. They match the style, difficulty, and domain coverage of the actual CEH v13 exam but are not leaked or reproduced EC-Council questions.

How should I use this Lateral Movement quiz for exam prep?

Answer all 10 questions without peeking at explanations, then click "Show My Score". Review every explanation — especially the ones you missed — and re-test those topics with our free CEH flashcards. Aim for 80% or higher on module quizzes before scheduling the exam.

Where do I find CEH Lateral Movement flashcards?

Our free flashcard app covers all 20 CEH v13 modules including Module 18 (Lateral Movement). Visit the CEH flashcards page at https://cehstudy.com/ or the Module 18 page at https://cehstudy.com/ceh-v13/module-18/. No account or sign-up required.

CEH v13 Module 18: Lateral Movement — Free Practice Questions with Explanations