Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 6/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Ethical Hacking v13 (312-50) practice test →
What you will practice
- A globally-operating bank recently encountered a severe security breach within its Android OS-based mobile ba…
- A company implements WPA3-Enterprise for its wireless network. An attacker attempts a 'Downgrade Attack' to f…
- During a red team engagement targeting a custom web application, a tester observes that the app takes a numer…
- You are conducting a vulnerability assessment in a segmented internal network. When scanning a set of IPs usi…
- A large chemical plant uses operational technology (OT) networks to control its industrial processes. Recentl…
- During a penetration test on a legacy Windows network, you use the nbtstat -A <IP> command on a target system…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A globally-operating bank recently encountered a severe security breach within its Android OS-based mobile banking application. Cybercriminals managed to exploit the bank's Mobile Device Management (MDM) system and successfully carried out…
Answer: C. Establishing and enforcing a rigorous policy that unequivocally mandates the disabling of ADB, except when absolutely necessary and only within strictly regulated environments.
Disabling ADB is the most potent response because it eliminates the attacker's primary attack vector. Other options, while good security practices, do not directly close this specific access point.
Q2. A company implements WPA3-Enterprise for its wireless network. An attacker attempts a 'Downgrade Attack' to force the client to use WPA2. Which WPA3 feature is designed to prevent this? Correct answer
Answer: A. Transition Disable element
The Transition Disable element is specifically designed to prevent downgrade attacks, stopping a client from being forced to revert to the less secure WPA2 protocol.
Q3. During a red team engagement targeting a custom web application, a tester observes that the app takes a numeric id parameter from the URL and dynamically builds SQL queries. Suspecting SQL injection, the tester sends a crafted HTTP GET req…
Answer: A. The attacker executed a second malicious query alongside the first.
The most likely method is executing a second query, as deleting a table like 'users' requires a separate SQL command appended to the original query, not just error exploitation.
Q4. You are conducting a vulnerability assessment in a segmented internal network. When scanning a set of IPs using the nbtscan tool, you discover multiple devices responding with NetBIOS names, but only one of them has the <1B> entry in its r…
Answer: C. It is the domain master browser or Primary Domain Controller (PDC).
This is a strong question for legacy network enumeration, testing knowledge of NetBIOS roles. The <1B> entry is a classic exam cue for identifying the PDC or domain master browser.
Q5. A large chemical plant uses operational technology (OT) networks to control its industrial processes. Recently, security personnel noticed abnormal behavior from critical Programmable Logic Controllers (PLCs), suspecting a stealthy comprom…
Answer: D. Perform detailed inspections of device software for hidden, unauthorized modifications.
This question accurately tests OT security incident response, focusing on verifying firmware compromise. The correct answer prioritizes verification before containment, a crucial exam principle.
Q6. During a penetration test on a legacy Windows network, you use the nbtstat -A <IP> command on a target system and retrieve several NetBIOS names, including entries ending with <20> and <03>. However, attempts to list shared folders fail. W…
Answer: C. File and printer sharing is disabled on the target system.
This is a solid question for legacy Windows network assessment, testing understanding of NetBIOS service dependencies. The failure to enumerate shares is a key cue that file sharing is disabled.
Q7. In a recent penetration testing assignment, you were able to breach a server's web service and install a backdoor. Your aim is to maintain access for as long as possible without getting detected. Considering the web server countermeasures…
Answer: A. Install the backdoor on a non-web file referenced in a URL.
Placing the backdoor on a non-web file avoids typical web monitoring tools, increasing stealth. Option C is a trap because updating the file would likely expose the backdoor.
Q8. Your role as a network administrator in a mid-sized company involves protecting the company's web servers from potential security threats. Recently, your company's web server experienced a Distributed Denial of Service (DDoS) attack. In ex…
Answer: B. HTTP flood attack
HTTP floods target the application layer by overwhelming the server with requests. Options A, C, and D are network/transport layer attacks, not application layer.
Q9. A tester evaluates a login form that constructs SQL queries using unsanitized user input. By submitting ' OR '1'='1'; –, the tester gains unauthorized access to the application. What type of SQL injection has occurred?
Answer: D. Tautology-based SQL injection
Tautology-based SQL injection works because the injected condition '1=1' is always true, bypassing authentication. Option B is a trap because it involves UNION queries.
Q10. A red team operator is assessing the resilience of a corporate network's authentication infrastructure. They input valid usernames with specifically structured guesses based on prior intel about naming conventions, such as birthdates or fa…
Answer: B. Strategic pattern-based input using known logic.
Strategic pattern-based input uses logic-based guesses like birthdates or sports teams. Option D is a trap because it lacks the strategic element.
Q11. You are a cybersecurity analyst at a tech startup that provides cloud-based services to its clients. Recently, your team detected suspicious activity on one of your critical servers. After further investigation, you discovered an unauthori…
Answer: C. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network.
Analyzing and documenting attacker activities first ensures informed containment. This prioritizes live threat response over scanning or forensics, avoiding disruption.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.