CEH v13 (312-50) Practice Exam – Part 4/7 – 21 Questions with Answers
Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 4/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Chapters:
00:00 Intro
00:15 Question 1 of 21
01:46 Question 2 of 21
03:00 Question 3 of 21
04:14 Question 4 of 21
05:05 Question 5 of 21
06:20 Question 6 of 21
07:12 Question 7 of 21
08:53 Question 8 of 21
10:02 Question 9 of 21
11:38 Question 10 of 21
13:16 Question 11 of 21
14:03 Question 12 of 21
15:08 Question 13 of 21
16:21 Question 14 of 21
17:20 Question 15 of 21
19:00 Question 16 of 21
20:08 Question 17 of 21
21:39 Question 18 of 21
23:46 Question 19 of 21
24:30 Question 20 of 21
25:32 Question 21 of 21
What you will practice
- As a cybersecurity professional in XYZ Corporation, you've been assigned to investigate an anomaly in the sys…
- As a cybersecurity consultant, you are helping a small startup strengthen its information security awareness…
- As a security analyst, you're investigating an incident where an attacker was able to gain access to your net…
- A company's customer data stored in a cloud environment has been exposed due to an unknown vulnerability. Whi…
- As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The co…
- Which of the following best describes the role of a penetration tester? Correct answer
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. As a cybersecurity professional in XYZ Corporation, you've been assigned to investigate an anomaly in the system logs that suggest possible unauthorized activities. The system administrators detected repeated failed login attempts on a cri…
Answer: B. Conduct real-time monitoring of the server, scrutinize the logs for unusual patterns, and identify the nature of the activities to devise an immediate countermeasure.
The correct initial action is real-time monitoring to understand the threat before acting. This prevents premature actions like disconnecting the server, which could destroy evidence needed for a proper investigation.
Q2. As a cybersecurity consultant, you are helping a small startup strengthen its information security awareness. During an internal audit, an employee reports finding a USB drive labeled "Employee Salary Info 2024" in the company parking lot…
Answer: C. Tempting the victim to engage with a malicious device using curiosity.
This is a classic baiting attack, exploiting the victim's curiosity. The 'Employee Salary Info' label is designed to trigger an emotional response, leading to the malicious act of plugging in the device.
Q3. As a security analyst, you're investigating an incident where an attacker was able to gain access to your network. Upon initial examination of the log files, you noticed a large number of TCP SYN packets sent to various ports on the networ…
Answer: C. The attacker has used a SYN scan, also known as half-open scanning, which involves sending SYN packets and waiting for SYN/ACK responses.
The attack is a SYN scan because it sends SYN packets to initiate a connection but does not complete the handshake, allowing it to scan for open ports without logging a full connection attempt.
Q4. A company's customer data stored in a cloud environment has been exposed due to an unknown vulnerability. Which of the following types of attack most likely led to this incident? Correct answer
Answer: A. Exploitation of misconfigured security groups
Misconfigured security groups are a primary cause of data breaches in cloud environments, as they can accidentally expose storage buckets or virtual machines to the public internet.
Q5. As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The company has been facing persistent cyber threats and as a precautionary measure, you are tasked to conduct a thorough network vulner…
Answer: B. Stealth Scan (SYN Scan)
A SYN scan is the ideal choice because it's a half-open connection that doesn't complete the TCP handshake, making it stealthy and less likely to trigger traditional IDS signatures.
Q6. Which of the following best describes the role of a penetration tester? Correct answer
Answer: A. A security professional hired to identify and exploit vulnerabilities with permission
This correctly defines a penetration tester as an authorized professional who mimics an attack to find vulnerabilities, which distinguishes them from malicious hackers.
Q7. During an internal security audit, the cybersecurity team at a large healthcare organization detects abnormal patterns in DNS resolution behavior on the corporate internal network. Several employees report that when they attempt to visit l…
Answer: C. Intranet DNS poisoning via local spoofed responses.
This is intranet DNS poisoning because the attack is happening internally with rogue DNS responses, confirmed by the faster spoofed replies and ARP spoofing on the local network.
Q8. During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the f…
Answer: A. Gaining physical access by assuming the identity of a trusted internal staff.
This question perfectly tests social engineering tactics, specifically physical impersonation, a core red teaming skill. The wrong options are weaker because they describe different attack vectors like dumpster diving and phishing.
Q9. As a cybersecurity analyst for a leading multinational company, you have unearthed evidence suggesting a breach. Analysis indicates that sophisticated steganography techniques are in play, allowing the hacker to exfiltrate data by cleverly…
Answer: D. Engage a specialized steganalysis tool to scrutinize questionable files, decode the obscured data, and reveal the hacker's exfiltration methodology.
This directly tests steganalysis knowledge for detecting data exfiltration, a key forensic skill. The trap is that network-based tools can't detect hidden data within files.
Q10. As a Certified Ethical Hacker, you have been approached by a leading international corporation to assess and enhance their cloud-based security framework. The corporation recently transitioned to a serverless computing architecture for its…
Answer: B. Implementing a function-level permission model and enforcing the principle of least privilege.
This is an excellent question for modern cloud security, testing least privilege in serverless architectures. It correctly identifies that function-level permissions are the most direct countermeasure to the attack described.
Q11. An ethical hacker is conducting a penetration test on a company's network with full knowledge and permission from the organization. What is this type of hacking called? Correct answer
Answer: A. White Hat Hacking
White Hat Hacking is correct because it explicitly involves authorized, ethical penetration testing with permission. Other options imply unauthorized or malicious activity.
Q12. A company implements WPA3 for its internal Wi-Fi. An attacker attempts a 'KRACK' attack (Key Reinstallation Attack). Why is WPA3 more resilient to this than WPA2?
Answer: D. WPA3 uses the Simultaneous Authentication of Equals (SAE) protocol, which is resistant to passive observation and key reinstallation.
WPA3 uses SAE, which is resistant to key reinstallation. Option C is a trap because SAE replaces, not disables, the handshake.
Q13. During an ethical hacking exercise, a security analyst is testing a web application that manages confidential information. The analyst suspects the application may be susceptible to SQL injection attacks. Which of the following payloads wi…
Answer: D. ' AND BENCHMARK(5000000,ENCODE('test','test')); —
The BENCHMARK payload introduces a delay to test time-based vulnerabilities. Option B is a trap because it tests for basic SQL injection, not blind injection.
Q14. An ethical hacker is auditing a hospital's wireless network, which is currently secured with WPA encryption using TKIP. The hacker successfully demonstrates packet-injection and decryption attacks on the network. Which vulnerability in WPA…
Answer: C. Use of weak Initialization Vectors (IV).
TKIP's weak IVs are a known flaw that allows for decryption and packet injection attacks. While WPA2 with AES is secure, WPA with TKIP is vulnerable.
Q15. A critical infrastructure facility has an extensive network of IoT devices integrated with its OT systems. Following a recent surge in cyberattacks on similar facilities globally, the security team received an anonymous email detailing a p…
Answer: D. Employ an intrusion prevention system (IPS) on the network to detect and block any malicious activities.
An IPS can detect and block malicious activity from compromised IoT devices. While other options are good long-term strategies, the immediate action is to block the attack.
Q16. A red team simulation reveals a malware strain that adapts its behavior based on observed user activity and evades detection by altering its code dynamically. The malware exfiltrates data only when the system is idle and uses encrypted cha…
Answer: D. AI-powered malware using machine learning to tailor its execution.
The malware's adaptive behavior and use of machine learning points to AI-powered malware. Polymorphic viruses change signatures, but don't adapt based on user behavior.
Q17. In a comprehensive penetration testing scenario, you are charged with the task of gaining detailed insights into a target organization's network configuration, structure, and security posture. To accomplish this task, you plan to employ a…
Answer: A. The specific usernames and passwords used by the organization's employees.
DNS queries reveal domain mappings, not private credentials like usernames and passwords. Other options are valid DNS data points, making option A the clear incorrect answer.
Q18. At XYZ Corporation, a multinational firm known for its digital services, the cybersecurity team is tasked with ensuring a robust, secure network environment. This responsibility includes maintaining a keen focus on vulnerability assessment…
Answer: D. Swiftly apply a virtual patch to the affected web server using a web application firewall to temporarily safeguard against potential exploits.
A virtual patch via a WAF provides immediate protection against an unpatched zero-day. Shutting down the server is not the 'first' step.
Q19. Which AI-specific threat involves an attacker querying an ML model repeatedly to reconstruct the underlying training data or the model's logic? Correct answer
Answer: A. Model Extraction (or Inversion)
Model Extraction involves repeatedly querying an AI model to steal its underlying data or logic. This is a direct threat to intellectual property.
Q20. As an Ethical Hacker, you've been asked to test an application's vulnerability to SQL injection. In the process, you discover an entry field that appears susceptible. However, the backend database is unknown, and regular SQL injection tech…
Answer: B. Time-Based Blind SQL Injection
Time-based blind SQL injection is right because it uses response delays to infer truths when standard techniques fail. The other options require visible errors or known database structures.
Q21. You've been hired as a Certified Ethical Hacker (CEH) by a large multinational corporation to investigate the unauthorized access of sensitive data from their web application. You discover that the web application uses a custom authorizati…
Answer: C. The attacker captured a valid token before its expiry and used it to gain access.
Capturing a valid token before expiry matches the observed pattern. The other options don't explain the expired token attempts followed by success.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.