Practice for the CEH v13 (312-50) exam with 22 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 1/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Ethical Hacking v13 (312-50) practice test →
What you will practice
- Your role as a cybersecurity analyst at XYZ Corporation requires you to perform a thorough security assessmen…
- An attacker uses a 'Side-channel attack' against a cryptographic module by measuring the power consumption du…
- An attacker uses a fileless malware technique that utilizes the 'Regsvr32.exe' utility to download and execut…
- A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing…
- You are a security analyst investigating a network compromise. The infected systems are receiving external in…
- When auditing a CI/CD pipeline, you find that 'Secret Scanning' is disabled. What is the primary risk during…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your role as a cybersecurity analyst at XYZ Corporation requires you to perform a thorough security assessment of the company's online presence. You initiate the process with a passive reconnaissance phase, trying to gather as much informa…
Answer: A. Using a tool like Nmap to scan the company's public IP range.
Nmap is an active reconnaissance tool that directly interacts with the target. Passive reconnaissance involves gathering information without direct system interaction.
Q2. An attacker uses a 'Side-channel attack' against a cryptographic module by measuring the power consumption during encryption. What is this specific technique called?
Answer: C. Differential Power Analysis (DPA)
Differential Power Analysis is the specific technique of analyzing power consumption to find cryptographic keys. This is a classic side-channel attack method.
Q3. An attacker uses a fileless malware technique that utilizes the 'Regsvr32.exe' utility to download and execute a remote COM scriptlet (SCT file). Which of the following best describes this technique?
Answer: C. Squiblydoo
Squiblydoo is the precise term for using Regsvr32.exe to execute remote SCT files. The other options describe distinct fileless malware techniques.
Q4. A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hid…
Answer: B. Because BITS packets appear identical to normal Windows update traffic.
BITS is the correct answer because its traffic mimics legitimate Windows updates, allowing it to blend in and evade detection by firewalls. The other options are incorrect because BITS does not use encrypted DNS, exclusively HTTP, or IP fragmentation.
Q5. You are a security analyst investigating a network compromise. The infected systems are receiving external instructions, masking the control traffic using widely allowed protocols like HTTP and DNS. The payloads are stealthy and modify sys…
Answer: D. Use behavioral analytics to monitor for irregular outbound requests and abnormal application behavior.
Behavioral analytics is the correct answer because it detects anomalies in process activity and network requests, which is necessary for fileless malware that evades signature-based detection. The other options are ineffective against this sophisticated threat.
Q6. When auditing a CI/CD pipeline, you find that 'Secret Scanning' is disabled. What is the primary risk during the 'Build' phase? Correct answer
Answer: A. Hardcoded API keys or credentials might be pushed to the container image or public repo.
This is correct because disabled secret scanning risks exposing credentials during build. The trap is technical issues, not misconfigurations like GPL licensing.
Q7. A penetration tester is analyzing a mobile application. They find that the app uses a hardcoded API key to communicate with a Firebase backend. In the context of CEH v13, what is the most effective tool to automate the discovery of such se…
Answer: C. MobSF (Mobile Security Framework)
MobSF automates APK analysis for hardcoded secrets and vulnerabilities, making it the ideal tool for this scenario. Wireshark and Nmap are network-focused, while John the Ripper is for password cracking, not secret discovery.
Q8. In your role as a cybersecurity specialist for a growing tech company, you are tasked with performing a regular network scan to check for any potential vulnerabilities. Your manager has specifically asked you to use a NULL scan for this ro…
Answer: A. The target machine responds with a TCP RST packet.
A TCP RST packet means the port is closed. The RST resets the connection, indicating no service is listening on that specific port.
Q9. An attacker uses 'Certutil.exe' with the '-urlcache' flag to download a malicious binary. How should a modern EDR be configured to detect this 'Living off the Land' behavior?
Answer: D. Monitor for parent-child process anomalies and network connections initiated by system binaries like certutil.
Monitoring parent-child process anomalies is the best detection method. Blocking or renaming system binaries breaks legitimate functionality and is not a practical solution.
Q10. An attacker uses a fileless malware technique that leverages 'mshta.exe' to execute a malicious HTA script stored in a remote server's registry key. Why is this technique highly effective in 2026? Correct answer
Answer: A. It bypasses disk-based signature scanning by running in memory.
Fileless malware using 'mshta.exe' runs in memory, bypassing disk-based signature scanning. Option B describes encryption, not evasion; C and D are unrelated to this specific technique.
Q11. Which of the following describes a 'Poisoning Attack' against a machine learning model used for malware detection? Correct answer
Answer: A. Modifying the training dataset to include samples that misclassify specific malware as 'Benign'.
A poisoning attack corrupts the training data to misclassify malware as benign. Option B is a denial-of-service attempt, not a poisoning attack that manipulates model logic.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.