Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 2/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Ethical Hacking v13 (312-50) practice test →
What you will practice
- You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of i…
- While monitoring an IoT network, you notice many devices communicating via MQTT over port 1883. An attacker p…
- During a cloud security assessment, your team discovered that a former employee still had access to critical…
- An AWS administrator finds that an EC2 instance has been compromised. The attacker used the instance to query…
- A developer is using a CI/CD pipeline and accidentally commits a .env file containing API keys to a private G…
- A penetration tester intercepts HTTP requests between a user and a vulnerable web server. The tester observes…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side…
Answer: A. Utilize a proxy tool to intercept and modify the client-side controls before they reach the server.
A proxy tool is the most effective method for bypassing client-side controls, as it intercepts and modifies data before it reaches the server, preventing server-side validation from ever seeing the bypass.
Q2. While monitoring an IoT network, you notice many devices communicating via MQTT over port 1883. An attacker publishes a message to a command topic with the 'Retain' flag enabled. What does this flag achieve?
Answer: C. It ensures any new device subscribing to that topic immediately receives the malicious message.
The 'Retain' flag ensures any new subscriber to a topic receives the last message, allowing an attacker to persist malicious commands that infect new devices without sending new messages.
Q3. During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this…
Answer: A. Enforcing timely user de-provisioning
This question effectively tests identity and access management (IAM) best practices, a fundamental security control. The other options are secondary controls that don't directly solve the access de-provisioning issue.
Q4. An AWS administrator finds that an EC2 instance has been compromised. The attacker used the instance to query 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'. What was the attacker trying to obtain?
Answer: C. Temporary security tokens (Access Key, Secret Key, and Session Token) associated with the instance's IAM role.
The metadata URL returns temporary IAM credentials, allowing the attacker to access AWS resources. The other options are incorrect, as this URL doesn't return root passwords or VPC keys.
Q5. A developer is using a CI/CD pipeline and accidentally commits a .env file containing API keys to a private GitHub repository. Which tool should be integrated into the pipeline to prevent this?
Answer: C. Secret Scanning (e.g., TruffleHog or Gitleaks)
Secret Scanning tools, like TruffleHog, are built specifically to find exposed keys in code. SAST and DAST find code vulnerabilities, not secrets.
Q6. A penetration tester intercepts HTTP requests between a user and a vulnerable web server. The tester observes that the session ID is embedded in the URL, and the web application does not regenerate the session upon login. Which session hij…
Answer: C. Session fixation by pre-setting the token in a URL.
Session fixation works when a non-regenerated session ID is sent via URL. The attacker can predict this ID before the user authenticates.
Q7. A security analyst is investigating a compromised LLM-based customer service agent. The attacker sent a hidden instruction within a website that the LLM was summarizing, causing the bot to exfiltrate the current user's email address. What…
Answer: D. Indirect Prompt Injection
Indirect prompt injection is correct because the attacker manipulated external data the LLM processed, not the direct prompt. The other options involve direct manipulation or evasion techniques not applicable here.
Q8. A cybersecurity team is assessing an organization's network for misconfigurations. During the enumeration process, they use a tool that sends a request to UDP port 161 and receives a large list of software names installed on remote devices…
Answer: A. The SNMP agent allowed anonymous bulk data queries due to default settings.
Anonymous bulk data queries via SNMP's default community string enabled this. The other options describe unrelated vulnerabilities like FTP or registry access.
Q9. In a highly secure online banking environment, customers have reported unauthorized access to their accounts despite robust authentication measures in place. Upon investigation, it is discovered that attackers are employing sophisticated s…
Answer: A. Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User Sessions
Man-in-the-Browser (MitB) is the correct answer because it attacks the browser layer after authentication, making it exceptionally hard for servers to detect and severely compromising real-time transactions. The other options are detectable by network or server-side security controls.
Q10. A corporation has transitioned to a public cloud service. The security team found a critical flaw in the API of the cloud service provider. What is the potential threat they are most likely to face?
Answer: B. Unauthorized access to cloud resources
Unauthorized access to cloud resources is the correct answer, as API flaws are a direct vector for compromising cloud environments. Physical security and data encryption are less likely threats from an API vulnerability.
Q11. During a vulnerability assessment of a Kubernetes cluster, you identify a pod with 'hostNetwork: true' and 'privileged: true'. What is the most significant risk associated with this configuration?
Answer: C. The pod can sniff traffic from the node's network interfaces and potentially escape the container.
This is correct because 'hostNetwork: true' and 'privileged: true' allow the pod to access the host's network, enabling packet sniffing. The trap is confusing network access with isolation or encryption.
Q12. As a cybersecurity professional conducting a network vulnerability assessment for your organization, you discover a potentially critical vulnerability. This vulnerability arises from an outdated software component installed on a critical p…
Answer: A. Implement a strategy of Virtual Patching, providing a protective layer around the vulnerability until the actual patch can be applied.
This is correct because virtual patching mitigates risk without downtime. The trap is reactive monitoring versus proactive protection.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.