EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 11 )

Updated On: 12-May-2026

Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API.

Which of the following tools is used by Wilson in the above scenario?

  1. Factiva
  2. ZoomInfo
  3. Netcraft
  4. Infoga

Answer(s): D

Explanation:

Wilson uses Infoga, a tool designed to enumerate information about email addresses from public sources, including sender identities, mail servers, IPs, and related metadata, and it can check if an address was compromised via haveibeenpwned.
A) Factiva is a business news and information aggregator, not focused on email reconnaissance.
B) ZoomInfo provides corporate contact and demographic data, not email-header reconnaissance or Have I Been Pwned checks.
C) Netcraft specializes in web server and hosting information, not comprehensive email metadata gathering or breach checks.
D) Infoga specializes in gathering email-related information from multiple sources and integrates breach lookups.



David is a security professional working in an organization, and he is implementing a vulnerability management program in the organization to evaluate and control the risks and vulnerabilities in its IT infrastructure. He is currently executing the process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities.

Which phase of the vulnerability-management life cycle is David currently in?

  1. Remediation
  2. Verification
  3. Risk assessment
  4. Vulnerability scan

Answer(s): A

Explanation:

Implementing fixes to reduce impact and severity corresponds to the Remediation phase of vulnerability management.
A) Remediation — Correct: applying patches or compensating controls to fix identified vulnerabilities.
B) Verification — Incorrect: focuses on validating that remediation actions were effective, usually after remediation.
C) Risk assessment — Incorrect: involves identifying and prioritizing risks before or during vulnerability analysis, not the act of applying fixes.
D) Vulnerability scan — Incorrect: is the discovery phase where vulnerabilities are identified, not the remediation step.



Alice, a professional hacker, targeted an organization's cloud services. She infiltrated the target's MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization.

Which of the following cloud attacks did Alice perform in the above scenario?

  1. Cloud cryptojacking
  2. Man-in-the-cloud (MITC) attack
  3. Cloud hopper attack
  4. Cloudborne attack

Answer(s): C

Explanation:

Alice performed a cloud-hopper attack by compromising an MSP to access target customer data and pivot into the target organization, leveraging the MSP as the foothold. A) Cloud cryptojacking involves illegal cryptomining on victims’ systems, not data exfiltration via MSPs. B) Man-in-the-cloud (MITC) refers to credential interception on cloud services through cloud account manipulation, not MSP compromise for customer data exfiltration. D) Cloudborne attack is not a standard ECCouncil term for this scenario. C) Cloud hopper attack correctly describes leveraging an MSP to access multiple customers’ cloud environments and exfiltrate data to launch further attacks.



Judy created a forum. One day, she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden behind those images:



What issue occurred for the users who clicked on the image?

  1. This php file silently executes the code and grabs the user's session cookie and session ID.
  2. The code redirects the user to another site.
  3. The code injects a new cookie to the browser.
  4. The code is a virus that is attempting to gather the user's username and password.

Answer(s): A

Explanation:

The code hidden behind images indicates a PHP-based session hijacking payload that silently executes to steal the user’s session cookie and session ID, enabling session fixation or impersonation.
A) This php file silently executes the code and grabs the user's session cookie and session ID.
B) The code redirects the user to another site. - No redirection described; focus is on credential/session data theft.
C) The code injects a new cookie to the browser. - Stealing existing session data, not just adding a cookie.
D) The code is a virus that is attempting to gather the user's username and password. - Focus is on session data, not direct credential collection.



Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs.

Which two SQL injection types would give her the results she is looking for?

  1. Out of band and boolean-based
  2. Union-based and error-based
  3. Time-based and union-based
  4. Time-based and boolean-based

Answer(s): B

Explanation:

Boolean-based and union-based injections together can test true/false responses and reveal data structure, aligning with the goal of verifying true/false outcomes and leveraging query results across multiple rows. A) Out of band and boolean-based is incorrect because out-of-band focuses on data exfiltration via external channels, not immediate true/false evaluation. C) Time-based and union-based pairs time-based delays with data retrieval, not specifically targeting true/false response testing. D) Time-based and boolean-based combines timing to infer truth values but misses the broader data return aspect provided by union-based queries.



Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php?url=externalsite.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server.

What is the type of attack Jason performed in the above scenario?

  1. Web server misconfiguration
  2. Server-side request forgery (SSRF) attack
  3. Web cache poisoning attack
  4. Website defacement

Answer(s): B

Explanation:

Jason performed a Server-Side Request Forgery (SSRF) attack by coercing the server to make requests to internal or unintended resources via manipulated input, exposing internal resources through the feed URL. A) Web server misconfiguration refers to improper server setup, not input-driven requests. C) Web cache poisoning involves injecting malicious content into a cache, not triggering server-side requests. D) Website defacement changes site content, not growing access to internal resources via the backend.



George is a security professional working for iTech Solutions. He was tasked with securely transferring sensitive data of the organization between industrial systems. In this process, he used a short-range communication protocol based on the IEEE 203.15.4 standard. This protocol is used in devices that transfer data infrequently at a low rate in a restricted area, within a range of 10-100 m.

What is the short-range wireless communication technology George employed in the above scenario?

  1. LPWAN
  2. MQTT
  3. NB-IoT
  4. Zigbee

Answer(s): D

Explanation:

George used Zigbee, which aligns with IEEE 802.15.4 for low-rate, short-range, energy-efficient wireless networking in restricted areas (typically 10-100 m) suitable for infrequent data transfer in industrial environments.
A) LPWAN is designed for long-range, low-power wide-area networks, not 10-100 m indoor industrial short-range.
B) MQTT is a messaging protocol, not a wireless physical layer or standard for short-range device communication.
C) NB-IoT is a cellular LPWAN technology aimed at broad-area coverage, not confined 10-100 m industrial scenarios.
D) Zigbee correctly uses IEEE 802.15.4 for low-rate, short-range mesh networking.



Eric, a cloud security engineer, implements a technique for securing the cloud resources used by his organization. This technique assumes by default that a user attempting to access the network is not an authentic entity and verifies every incoming connection before allowing access to the network. Using this technique, he also imposed conditions such that employees can access only the resources required for their role.

What is the technique employed by Eric to secure cloud resources?

  1. Demilitarized zone
  2. Zero trust network
  3. Serverless computing
  4. Container technology

Answer(s): B

Explanation:

Zero trust network is correct because it requires continuous verification of every user and device before granting access, and enforces least-privilege access based on role, aligning with Eric’s default-deny and verify-every-connection approach. A) Demilitarized zone is a network segment that acts as a buffer, not a verification framework. C) Serverless computing is a cloud execution model, not a access-control paradigm. D) Container technology isolates applications but does not by itself implement zero-trust authentication and authorization policies.



Viewing page 11 of 105
Viewing questions 81 - 88 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!