Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 3/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Ethical Hacking v13 (312-50) practice test →
What you will practice
- A red team operator is conducting reconnaissance on a financial organization's infrastructure. While probing…
- During a pentest of a Kubernetes cluster, you find a pod running with 'privileged: true' and the 'hostPID: tr…
- A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS)…
- An attacker successfully executes a 'Side-channel attack' by analyzing the electromagnetic emissions of a spe…
- A multinational company is planning to integrate an IoT-based environmental control system for its manufactur…
- An attacker intercepts a Bluetooth Low Energy (BLE) connection and performs a 'GATT Replay Attack'. Which of…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A red team operator is conducting reconnaissance on a financial organization's infrastructure. While probing UDP port 123, they send NTP queries and receive a list of internal IP addresses and connected hostnames. The organization is unawa…
Answer: D. The NTP daemon is configured to accept queries from external sources without restriction.
This is correct because unrestricted NTP queries leak internal hostnames. The trap is misinterpreting firewall misconfigurations as DNS issues.
Q2. During a pentest of a Kubernetes cluster, you find a pod running with 'privileged: true' and the 'hostPID: true' flag. Which technique is most effective for escaping to the underlying node?
Answer: C. Accessing the host's /proc directory to inject code into a host process.
The 'hostPID: true' flag allows a privileged pod to access the host's /proc directory, enabling process injection onto the node. This is a direct path to root escape, whereas brute-forcing certificates is less reliable and scanning NodePorts doesn't grant host access.
Q3. A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS), firewalls, and honeypots, to protect its network from malicious activities. Despite these measures, the security team has notice…
Answer: C. Covert Channel Communication Exploiting Unused IP Header Fields to Conceal Malicious Traffic and Evade Detection by Security Devices
Covert channels hide malicious traffic within protocol fields, making it invisible to traditional IDS and firewall inspection. This is more challenging to detect than polymorphic malware or protocol fragmentation, which are more easily flagged by signature-based systems.
Q4. An attacker successfully executes a 'Side-channel attack' by analyzing the electromagnetic emissions of a specialized IoT hardware device while it processes RSA keys. What is this specific technique? Correct answer
Answer: A. TEMPEST / Analysis of emanations
TEMPEST involves analyzing electromagnetic emanations to extract data, which is a classic side-channel technique. The other options are unrelated—session hijacking, social engineering, and brute force exploit different attack vectors entirely.
Q5. A multinational company is planning to integrate an IoT-based environmental control system for its manufacturing units worldwide. They engage a cybersecurity team to ensure that the new system remains secure from any potential threats. The…
Answer: A. The APT group will exploit zero-day vulnerabilities present in the IoT device firmware.
APT groups commonly exploit zero-day vulnerabilities in IoT firmware since patches are unavailable, giving them direct system access. Credential theft or MITM attacks require initial compromises, which zero-days bypass entirely.
Q6. An attacker intercepts a Bluetooth Low Energy (BLE) connection and performs a 'GATT Replay Attack'. Which of the following would have prevented this?
Answer: D. Implementing 'Link Layer' encryption and using sequence numbers or timestamps.
Link Layer encryption and sequence numbers or timestamps prevent a GATT Replay Attack by making each transmission unique and ensuring data integrity, which is the correct defense.
Q7. A senior executive receives a personalized email with a subject line that reads "Annual Performance Review 2024." The email contains a downloadable PDF that installs a backdoor when opened. The email appears to come from the CEO and includ…
Answer: B. Whaling attack aimed at high-ranking personnel
A whaling attack targets high-ranking executives with highly personalized and convincing emails, as seen in this scenario where the email impersonates the CEO.
Q8. In your role as a cybersecurity analyst at a large e-commerce company, you have been tasked with reinforcing the firm's defences against potential Denial-of-Service (DoS) attacks. During a recent review, you noticed several IP addresses ge…
Answer: B. SYN Flood: This attack floods a target with SYN requests in an attempt to consume enough server resources to make the system unresponsive, aligning with the high volume of incomplete TCP handshakes.
A SYN Flood attack is identified by a high volume of incomplete TCP three-way handshakes, which leaves connections in a SYN_RECEIVED state to saturate server resources.
Q9. You have been hired by a government agency to evaluate Android smartphones' resistance against covert surveillance. During your assessment, you want to demonstrate whether attackers could eavesdrop on sensitive conversations conducted thro…
Answer: D. Spearphone attack exploiting accelerometer-based vulnerabilities.
The Spearphone attack exploits accelerometer-based vulnerabilities to eavesdrop on loudspeaker audio without special permissions. The other options focus on unrelated attack vectors like NFC or application manipulation, which are less relevant to this specific sensor-based privacy risk.
Q10. In a Kubernetes environment, what is the purpose of a 'Sidecar Container' from a security perspective when implementing a Service Mesh?
Answer: C. To provide mTLS (mutual TLS) and fine-grained traffic encryption between microservices.
A Sidecar Container provides mTLS and fine-grained encryption between microservices in a Service Mesh. Options A, B, and D describe unrelated functions like logging, performance, or redundancy.
Q11. You work as a network security officer for a large corporation. Recently, you've noticed that certain confidential files are being accessed by unauthorized users within the network. You suspect that a Man-in-the-Middle (MitM) attack is bei…
Answer: D. IP addresses being resolved to multiple MAC addresses.
IPs resolving to multiple MACs indicate a MitM attack, as one IP should map to one MAC. Other options suggest general anomalies but not specific MitM behavior.
Q12. During a routine security audit at a large financial services organization, the IT team detects severe network latency and recurring bandwidth exhaustion across its corporate WAN links. Upon deeper investigation, they discover that several…
Answer: A. An attack where compromised internal devices participate in a botnet and flood external targets with traffic.
The correct answer describes a botnet-based DDoS where compromised internal devices flood external targets. Option B is a misdirection to amplify traffic through DNS, which isn't occurring here.
Q13. While auditing an Azure environment, you find a 'Managed Identity' assigned to a Virtual Machine with 'Contributor' permissions on a Subscription. How can an attacker on that VM exploit this?
Answer: C. By querying the Instance Metadata Service (IMDS) to get a token and then using Azure CLI to manage resources.
An attacker on the VM can query IMDS to get a token and use Azure CLI to manage resources with the 'Contributor' permissions. Option A is invalid as Managed Identity has no password to brute-force.
Q14. A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do ne…
Answer: D. Extract and analyze stream objects using PDFStreamDumper.
PDFStreamDumper directly examines embedded streams where malicious JavaScript hides. Option A is passive, B finds signatures but not code, and C applies to PE files, not PDFs.
Q15. As a cybersecurity professional in a growing organization, you are tasked with conducting comprehensive reconnaissance of your own company's digital presence. In addition to using tools like WHOIS, DNS analysis, and search engines, you are…
Answer: A. Search engines don't index the Deep Web, and there could be non-indexed company information lying there.
Search engines do not index the Deep Web, so information stored there remains hidden. Options B, C, and D are misinformed or irrelevant to passive reconnaissance.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.