CEH v13 (312-50) Practice Exam – Part 3/7 – 21 Questions with Answers
Practice for the CEH v13 (312-50) exam with 21 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 3/7 in the CertPunch CEH v13 (312-50) practice exam series.
Topics covered: reconnaissance, vulnerability analysis, web security, malware concepts, cryptography, and defensive controls.
More practice: certpunch.com
Chapters:
00:00 Intro
00:15 Question 1 of 21
01:37 Question 2 of 21
02:38 Question 3 of 21
05:05 Question 4 of 21
06:00 Question 5 of 21
07:28 Question 6 of 21
08:30 Question 7 of 21
10:43 Question 8 of 21
11:36 Question 9 of 21
12:35 Question 10 of 21
14:28 Question 11 of 21
16:10 Question 12 of 21
17:43 Question 13 of 21
18:38 Question 14 of 21
19:58 Question 15 of 21
21:34 Question 16 of 21
23:19 Question 17 of 21
24:18 Question 18 of 21
25:36 Question 19 of 21
26:47 Question 20 of 21
27:54 Question 21 of 21
What you will practice
- A red team operator is conducting reconnaissance on a financial organization's infrastructure. While probing…
- During a pentest of a Kubernetes cluster, you find a pod running with 'privileged: true' and the 'hostPID: tr…
- A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS)…
- An attacker successfully executes a 'Side-channel attack' by analyzing the electromagnetic emissions of a spe…
- A multinational company is planning to integrate an IoT-based environmental control system for its manufactur…
- A cybersecurity analyst notices that a large number of plaintext-ciphertext pairs were used in an attempted a…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A red team operator is conducting reconnaissance on a financial organization's infrastructure. While probing UDP port 123, they send NTP queries and receive a list of internal IP addresses and connected hostnames. The organization is unawa…
Answer: D. The NTP daemon is configured to accept queries from external sources without restriction.
This is correct because unrestricted NTP queries leak internal hostnames. The trap is misinterpreting firewall misconfigurations as DNS issues.
Q2. During a pentest of a Kubernetes cluster, you find a pod running with 'privileged: true' and the 'hostPID: true' flag. Which technique is most effective for escaping to the underlying node?
Answer: C. Accessing the host's /proc directory to inject code into a host process.
The 'hostPID: true' flag allows a privileged pod to access the host's /proc directory, enabling process injection onto the node. This is a direct path to root escape, whereas brute-forcing certificates is less reliable and scanning NodePorts doesn't grant host access.
Q3. A cybersecurity firm has deployed a comprehensive defense system, including Intrusion Detection Systems (IDS), firewalls, and honeypots, to protect its network from malicious activities. Despite these measures, the security team has notice…
Answer: C. Covert Channel Communication Exploiting Unused IP Header Fields to Conceal Malicious Traffic and Evade Detection by Security Devices
Covert channels hide malicious traffic within protocol fields, making it invisible to traditional IDS and firewall inspection. This is more challenging to detect than polymorphic malware or protocol fragmentation, which are more easily flagged by signature-based systems.
Q4. An attacker successfully executes a 'Side-channel attack' by analyzing the electromagnetic emissions of a specialized IoT hardware device while it processes RSA keys. What is this specific technique? Correct answer
Answer: A. TEMPEST / Analysis of emanations
TEMPEST involves analyzing electromagnetic emanations to extract data, which is a classic side-channel technique. The other options are unrelated—session hijacking, social engineering, and brute force exploit different attack vectors entirely.
Q5. A multinational company is planning to integrate an IoT-based environmental control system for its manufacturing units worldwide. They engage a cybersecurity team to ensure that the new system remains secure from any potential threats. The…
Answer: A. The APT group will exploit zero-day vulnerabilities present in the IoT device firmware.
APT groups commonly exploit zero-day vulnerabilities in IoT firmware since patches are unavailable, giving them direct system access. Credential theft or MITM attacks require initial compromises, which zero-days bypass entirely.
Q6. A cybersecurity analyst notices that a large number of plaintext-ciphertext pairs were used in an attempted attack against a block cipher. The attacker applied statistical analysis to XOR combinations of specific plaintext and ciphertext b…
Answer: D. Deriving linear patterns from cipher behavior
Linear cryptanalysis is correct because it exploits statistical relationships between plaintext and ciphertext bits to find the key. The other options describe different attacks like brute force or differential cryptanalysis.
Q7. You're a security analyst conducting a foot printing exercise for a new client to uncover as much information as possible without direct interaction. Your preliminary investigation using search engines and public databases has provided a s…
Answer: D. Google Hacking can help identify weaknesses in the client's website code.
Google Hacking finds exposed code vulnerabilities. It can't map internal networks reliably or access the deep web directly, making it less suitable for those tasks.
Q8. An attacker intercepts a Bluetooth Low Energy (BLE) connection and performs a 'GATT Replay Attack'. Which of the following would have prevented this?
Answer: D. Implementing 'Link Layer' encryption and using sequence numbers or timestamps.
Link Layer encryption and sequence numbers or timestamps prevent a GATT Replay Attack by making each transmission unique and ensuring data integrity, which is the correct defense.
Q9. A senior executive receives a personalized email with a subject line that reads "Annual Performance Review 2024." The email contains a downloadable PDF that installs a backdoor when opened. The email appears to come from the CEO and includ…
Answer: B. Whaling attack aimed at high-ranking personnel
A whaling attack targets high-ranking executives with highly personalized and convincing emails, as seen in this scenario where the email impersonates the CEO.
Q10. In your role as a cybersecurity analyst at a large e-commerce company, you have been tasked with reinforcing the firm's defences against potential Denial-of-Service (DoS) attacks. During a recent review, you noticed several IP addresses ge…
Answer: B. SYN Flood: This attack floods a target with SYN requests in an attempt to consume enough server resources to make the system unresponsive, aligning with the high volume of incomplete TCP handshakes.
A SYN Flood attack is identified by a high volume of incomplete TCP three-way handshakes, which leaves connections in a SYN_RECEIVED state to saturate server resources.
Q11. You have been hired by a government agency to evaluate Android smartphones' resistance against covert surveillance. During your assessment, you want to demonstrate whether attackers could eavesdrop on sensitive conversations conducted thro…
Answer: D. Spearphone attack exploiting accelerometer-based vulnerabilities.
The Spearphone attack exploits accelerometer-based vulnerabilities to eavesdrop on loudspeaker audio without special permissions. The other options focus on unrelated attack vectors like NFC or application manipulation, which are less relevant to this specific sensor-based privacy risk.
Q12. At DEF Corporation, as you dive deeper into the vulnerability analysis of their multi-tiered web applications, you observe an anomaly. Some encrypted user session tokens appear to be much longer than others, hinting at possible variable en…
Answer: D. Implement uniform encryption strength across all user roles, eliminating disparities in session token lengths.
Implementing uniform encryption strength eliminates variable token lengths, ensuring consistent protection against cryptographic attacks. MFA, key rotation, and logging are good practices but don't directly address the core cryptographic vulnerability.
Q13. In a Kubernetes environment, what is the purpose of a 'Sidecar Container' from a security perspective when implementing a Service Mesh?
Answer: C. To provide mTLS (mutual TLS) and fine-grained traffic encryption between microservices.
A Sidecar Container provides mTLS and fine-grained encryption between microservices in a Service Mesh. Options A, B, and D describe unrelated functions like logging, performance, or redundancy.
Q14. You work as a network security officer for a large corporation. Recently, you've noticed that certain confidential files are being accessed by unauthorized users within the network. You suspect that a Man-in-the-Middle (MitM) attack is bei…
Answer: D. IP addresses being resolved to multiple MAC addresses.
IPs resolving to multiple MACs indicate a MitM attack, as one IP should map to one MAC. Other options suggest general anomalies but not specific MitM behavior.
Q15. A Certified Ethical Hacker (CEH) is investigating a recent attack on a company's web server. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server's document…
Answer: B. Implementing DNSSEC on the DNS server
DNSSEC prevents DNS hijacking by digitally signing records to prevent tampering. Updating software or changing IPs doesn't stop DNS redirection, and LAMP is unrelated.
Q16. During a routine security audit at a large financial services organization, the IT team detects severe network latency and recurring bandwidth exhaustion across its corporate WAN links. Upon deeper investigation, they discover that several…
Answer: A. An attack where compromised internal devices participate in a botnet and flood external targets with traffic.
The correct answer describes a botnet-based DDoS where compromised internal devices flood external targets. Option B is a misdirection to amplify traffic through DNS, which isn't occurring here.
Q17. While auditing an Azure environment, you find a 'Managed Identity' assigned to a Virtual Machine with 'Contributor' permissions on a Subscription. How can an attacker on that VM exploit this?
Answer: C. By querying the Instance Metadata Service (IMDS) to get a token and then using Azure CLI to manage resources.
An attacker on the VM can query IMDS to get a token and use Azure CLI to manage resources with the 'Contributor' permissions. Option A is invalid as Managed Identity has no password to brute-force.
Q18. As a newly appointed network security analyst at a mid-tier company, you have been tasked with assessing the security of the network. As part of this, you need to ensure that your company's network can detect and prevent evasion techniques…
Answer: D. Implementing an anomaly-based IDS that can recognize the irregular traffic patterns caused by packet fragmentation.
Anomaly-based IDS detects irregular patterns from packet fragmentation, unlike signature-based methods. Option B is a poor choice as rejecting all fragments breaks normal network traffic.
Q19. As a certified ethical hacker, you have been tasked to exploit a security vulnerability on an Android device that uses the latest version of the OS. You found that there's an unpatched weakness in the handling of user permissions in the de…
Answer: C. Develop a custom exploit code that uses obfuscation techniques to avoid detection.
A custom obfuscated exploit avoids detection by signature-based antivirus. Option A is weak because Metasploit payloads are well-known and likely detected.
Q20. A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do ne…
Answer: D. Extract and analyze stream objects using PDFStreamDumper.
PDFStreamDumper directly examines embedded streams where malicious JavaScript hides. Option A is passive, B finds signatures but not code, and C applies to PE files, not PDFs.
Q21. As a cybersecurity professional in a growing organization, you are tasked with conducting comprehensive reconnaissance of your own company's digital presence. In addition to using tools like WHOIS, DNS analysis, and search engines, you are…
Answer: A. Search engines don't index the Deep Web, and there could be non-indexed company information lying there.
Search engines do not index the Deep Web, so information stored there remains hidden. Options B, C, and D are misinformed or irrelevant to passive reconnaissance.
More Ethical Hacking v13 (312-50) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.