CEH v13 (312-50) Practice Exam – Part 2/7 – 21 Questions with Answers
Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 2/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Chapters:
00:00 Intro
00:15 Question 1 of 21
01:28 Question 2 of 21
03:03 Question 3 of 21
04:05 Question 4 of 21
05:22 Question 5 of 21
06:21 Question 6 of 21
07:26 Question 7 of 21
08:25 Question 8 of 21
10:11 Question 9 of 21
11:51 Question 10 of 21
12:47 Question 11 of 21
13:49 Question 12 of 21
15:02 Question 13 of 21
15:56 Question 14 of 21
17:11 Question 15 of 21
18:22 Question 16 of 21
20:08 Question 17 of 21
22:03 Question 18 of 21
22:59 Question 19 of 21
24:01 Question 20 of 21
25:43 Question 21 of 21
What you will practice
- You are a new member of your company's IT team, and you've been assigned to understand and implement ethical…
- You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of i…
- While monitoring an IoT network, you notice many devices communicating via MQTT over port 1883. An attacker p…
- As a security expert for a prominent tech company, you've noticed an increasing number of attacks on your web…
- During a cloud security assessment, your team discovered that a former employee still had access to critical…
- As a cybersecurity consultant, you have been hired by a multinational corporation to identify potential secur…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are a new member of your company's IT team, and you've been assigned to understand and implement ethical hacking principles to improve the company's cybersecurity posture. Your supervisor highlights the importance of following the five…
Answer: B. Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks
The correct order is Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks. Option A incorrectly starts with Scanning instead of Reconnaissance.
Q2. You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side…
Answer: A. Utilize a proxy tool to intercept and modify the client-side controls before they reach the server.
A proxy tool is the most effective method for bypassing client-side controls, as it intercepts and modifies data before it reaches the server, preventing server-side validation from ever seeing the bypass.
Q3. While monitoring an IoT network, you notice many devices communicating via MQTT over port 1883. An attacker publishes a message to a command topic with the 'Retain' flag enabled. What does this flag achieve?
Answer: C. It ensures any new device subscribing to that topic immediately receives the malicious message.
The 'Retain' flag ensures any new subscriber to a topic receives the last message, allowing an attacker to persist malicious commands that infect new devices without sending new messages.
Q4. As a security expert for a prominent tech company, you've noticed an increasing number of attacks on your web services. You've concluded that the best course of action is to enhance your patch management strategies. Considering the informa…
Answer: B. Implementing an automatic patch management process and using a patch management tool to monitor the patched systems.
Automatic patch management is the most effective strategy as it ensures timely, consistent application of patches across all systems, reducing the window of vulnerability.
Q5. During a cloud security assessment, your team discovered that a former employee still had access to critical resources despite leaving the organization months ago. Which of the following practices could have most effectively prevented this…
Answer: A. Enforcing timely user de-provisioning
This question effectively tests identity and access management (IAM) best practices, a fundamental security control. The other options are secondary controls that don't directly solve the access de-provisioning issue.
Q6. As a cybersecurity consultant, you have been hired by a multinational corporation to identify potential security risks in their network. During the enumeration phase, you utilize LDAP to gather information about the network infrastructure…
Answer: C. The LDAP directory data is protected by Access Control Lists (ACLs).
ACLs restrict access to LDAP directory data, preventing enumeration of protected information. This is a fundamental concept of directory service security.
Q7. An AWS administrator finds that an EC2 instance has been compromised. The attacker used the instance to query 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'. What was the attacker trying to obtain?
Answer: C. Temporary security tokens (Access Key, Secret Key, and Session Token) associated with the instance's IAM role.
The metadata URL returns temporary IAM credentials, allowing the attacker to access AWS resources. The other options are incorrect, as this URL doesn't return root passwords or VPC keys.
Q8. Working as an Information Security Analyst at a technology firm, you've been asked to design training material for employees about the potential dangers of session hijacking. As part of the training, you want to explain how attackers could…
Answer: B. An attacker intercepts network traffic, captures unencrypted session cookies, and uses these to impersonate the user.
Side jacking specifically involves capturing unencrypted session cookies from network traffic. The other options describe firewall exploits, XSS, or credential phishing.
Q9. As a certified ethical hacker, you have been engaged to evaluate the security protocols of a smart city project. This cutting-edge venture incorporates an interconnected system featuring intelligent traffic lights, public Wi-Fi points, and…
Answer: D. Isolate the implicated traffic light from the overarching network for a detailed investigation into its firmware to identify any possible security breaches.
Isolating the device is the critical first step to contain the threat and safely investigate the firmware. Continuing to allow network traffic is dangerous.
Q10. A developer is using a CI/CD pipeline and accidentally commits a .env file containing API keys to a private GitHub repository. Which tool should be integrated into the pipeline to prevent this?
Answer: C. Secret Scanning (e.g., TruffleHog or Gitleaks)
Secret Scanning tools, like TruffleHog, are built specifically to find exposed keys in code. SAST and DAST find code vulnerabilities, not secrets.
Q11. A penetration tester intercepts HTTP requests between a user and a vulnerable web server. The tester observes that the session ID is embedded in the URL, and the web application does not regenerate the session upon login. Which session hij…
Answer: C. Session fixation by pre-setting the token in a URL.
Session fixation works when a non-regenerated session ID is sent via URL. The attacker can predict this ID before the user authenticates.
Q12. You are a security consultant who has been hired to conduct security awareness training at a mid-sized organization. During the session on social engineering, you emphasize the importance of being vigilant against different types of social…
Answer: B. A person gains access to the building by following an employee through a secure door before it closes.
Tailgating is physically following an authorized person into a restricted area. This is a physical security breach, not a digital one.
Q13. A security analyst is investigating a compromised LLM-based customer service agent. The attacker sent a hidden instruction within a website that the LLM was summarizing, causing the bot to exfiltrate the current user's email address. What…
Answer: D. Indirect Prompt Injection
Indirect prompt injection is correct because the attacker manipulated external data the LLM processed, not the direct prompt. The other options involve direct manipulation or evasion techniques not applicable here.
Q14. A cybersecurity team is assessing an organization's network for misconfigurations. During the enumeration process, they use a tool that sends a request to UDP port 161 and receives a large list of software names installed on remote devices…
Answer: A. The SNMP agent allowed anonymous bulk data queries due to default settings.
Anonymous bulk data queries via SNMP's default community string enabled this. The other options describe unrelated vulnerabilities like FTP or registry access.
Q15. During a penetration test, a security analyst encounters a web page that returns identical generic error messages regardless of input. To test for SQL injection, they submit a query that includes AND 1=1 and later AND 1=2, observing a chan…
Answer: C. The analyst is using conditional logic to infer database behavior from page responses.
Conditional logic testing is correct because the analyst inferred database behavior from page differences. The other options describe error-based or time-based techniques.
Q16. In a highly secure online banking environment, customers have reported unauthorized access to their accounts despite robust authentication measures in place. Upon investigation, it is discovered that attackers are employing sophisticated s…
Answer: A. Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User Sessions
Man-in-the-Browser (MitB) is the correct answer because it attacks the browser layer after authentication, making it exceptionally hard for servers to detect and severely compromising real-time transactions. The other options are detectable by network or server-side security controls.
Q17. As a Certified Ethical Hacker, you have been contracted by a leading technology company to test the vulnerabilities in its web application. The application integrates various third-party services and employs multiple APIs. During your adva…
Answer: D. Utilize SSRF (Server-Side Request Forgery) to make unauthorized API calls from the server itself.
SSRF is the correct answer because it abuses server trust to make internal calls, bypassing client-side defenses. The other options are direct and more likely to leave traces, whereas SSRF allows for stealthy, indirect exploitation.
Q18. A corporation has transitioned to a public cloud service. The security team found a critical flaw in the API of the cloud service provider. What is the potential threat they are most likely to face?
Answer: B. Unauthorized access to cloud resources
Unauthorized access to cloud resources is the correct answer, as API flaws are a direct vector for compromising cloud environments. Physical security and data encryption are less likely threats from an API vulnerability.
Q19. During a vulnerability assessment of a Kubernetes cluster, you identify a pod with 'hostNetwork: true' and 'privileged: true'. What is the most significant risk associated with this configuration?
Answer: C. The pod can sniff traffic from the node's network interfaces and potentially escape the container.
This is correct because 'hostNetwork: true' and 'privileged: true' allow the pod to access the host's network, enabling packet sniffing. The trap is confusing network access with isolation or encryption.
Q20. As a cybersecurity professional conducting a network vulnerability assessment for your organization, you discover a potentially critical vulnerability. This vulnerability arises from an outdated software component installed on a critical p…
Answer: A. Implement a strategy of Virtual Patching, providing a protective layer around the vulnerability until the actual patch can be applied.
This is correct because virtual patching mitigates risk without downtime. The trap is reactive monitoring versus proactive protection.
Q21. As part of a security audit, your team evaluates a system flagged by your automated scanner. The tool outputs a vector string with a numerical range of 9.8, indicating a critical severity. However, the client is unsure about the real-world…
Answer: C. It quantifies technical impact and ease of exploitation, guiding structured risk response based on impact and environment.
This is correct because severity scores quantify exploitability and impact. The trap is prioritizing automation over risk-based decisions.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.