Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 4/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Ethical Hacking v13 (312-50) practice test →
What you will practice
- As a cybersecurity professional in XYZ Corporation, you've been assigned to investigate an anomaly in the sys…
- As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The co…
- Which of the following best describes the role of a penetration tester? Correct answer
- During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a re…
- As a Certified Ethical Hacker, you have been approached by a leading international corporation to assess and…
- An ethical hacker is conducting a penetration test on a company's network with full knowledge and permission…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. As a cybersecurity professional in XYZ Corporation, you've been assigned to investigate an anomaly in the system logs that suggest possible unauthorized activities. The system administrators detected repeated failed login attempts on a cri…
Answer: B. Conduct real-time monitoring of the server, scrutinize the logs for unusual patterns, and identify the nature of the activities to devise an immediate countermeasure.
The correct initial action is real-time monitoring to understand the threat before acting. This prevents premature actions like disconnecting the server, which could destroy evidence needed for a proper investigation.
Q2. As a newly appointed ethical hacker for XYZ Corporation, you have been assigned your first major task. The company has been facing persistent cyber threats and as a precautionary measure, you are tasked to conduct a thorough network vulner…
Answer: B. Stealth Scan (SYN Scan)
A SYN scan is the ideal choice because it's a half-open connection that doesn't complete the TCP handshake, making it stealthy and less likely to trigger traditional IDS signatures.
Q3. Which of the following best describes the role of a penetration tester? Correct answer
Answer: A. A security professional hired to identify and exploit vulnerabilities with permission
This correctly defines a penetration tester as an authorized professional who mimics an attack to find vulnerabilities, which distinguishes them from malicious hackers.
Q4. During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the f…
Answer: A. Gaining physical access by assuming the identity of a trusted internal staff.
This question perfectly tests social engineering tactics, specifically physical impersonation, a core red teaming skill. The wrong options are weaker because they describe different attack vectors like dumpster diving and phishing.
Q5. As a Certified Ethical Hacker, you have been approached by a leading international corporation to assess and enhance their cloud-based security framework. The corporation recently transitioned to a serverless computing architecture for its…
Answer: B. Implementing a function-level permission model and enforcing the principle of least privilege.
This is an excellent question for modern cloud security, testing least privilege in serverless architectures. It correctly identifies that function-level permissions are the most direct countermeasure to the attack described.
Q6. An ethical hacker is conducting a penetration test on a company's network with full knowledge and permission from the organization. What is this type of hacking called? Correct answer
Answer: A. White Hat Hacking
White Hat Hacking is correct because it explicitly involves authorized, ethical penetration testing with permission. Other options imply unauthorized or malicious activity.
Q7. A company implements WPA3 for its internal Wi-Fi. An attacker attempts a 'KRACK' attack (Key Reinstallation Attack). Why is WPA3 more resilient to this than WPA2?
Answer: D. WPA3 uses the Simultaneous Authentication of Equals (SAE) protocol, which is resistant to passive observation and key reinstallation.
WPA3 uses SAE, which is resistant to key reinstallation. Option C is a trap because SAE replaces, not disables, the handshake.
Q8. During an ethical hacking exercise, a security analyst is testing a web application that manages confidential information. The analyst suspects the application may be susceptible to SQL injection attacks. Which of the following payloads wi…
Answer: D. ' AND BENCHMARK(5000000,ENCODE('test','test')); —
The BENCHMARK payload introduces a delay to test time-based vulnerabilities. Option B is a trap because it tests for basic SQL injection, not blind injection.
Q9. An ethical hacker is auditing a hospital's wireless network, which is currently secured with WPA encryption using TKIP. The hacker successfully demonstrates packet-injection and decryption attacks on the network. Which vulnerability in WPA…
Answer: C. Use of weak Initialization Vectors (IV).
TKIP's weak IVs are a known flaw that allows for decryption and packet injection attacks. While WPA2 with AES is secure, WPA with TKIP is vulnerable.
Q10. A critical infrastructure facility has an extensive network of IoT devices integrated with its OT systems. Following a recent surge in cyberattacks on similar facilities globally, the security team received an anonymous email detailing a p…
Answer: D. Employ an intrusion prevention system (IPS) on the network to detect and block any malicious activities.
An IPS can detect and block malicious activity from compromised IoT devices. While other options are good long-term strategies, the immediate action is to block the attack.
Q11. In a comprehensive penetration testing scenario, you are charged with the task of gaining detailed insights into a target organization's network configuration, structure, and security posture. To accomplish this task, you plan to employ a…
Answer: A. The specific usernames and passwords used by the organization's employees.
DNS queries reveal domain mappings, not private credentials like usernames and passwords. Other options are valid DNS data points, making option A the clear incorrect answer.
Q12. Which AI-specific threat involves an attacker querying an ML model repeatedly to reconstruct the underlying training data or the model's logic? Correct answer
Answer: A. Model Extraction (or Inversion)
Model Extraction involves repeatedly querying an AI model to steal its underlying data or logic. This is a direct threat to intellectual property.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.