EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 12 )

Updated On: 12-May-2026

You are a penetration tester tasked with testing the wireless network of your client Brakeme SA. You are attempting to break into the wireless network with the SSID "Brakeme-Internal." You realize that this network uses WPA3 encryption.

Which of the following vulnerabilities is the promising to exploit?

  1. Cross-site request forgery
  2. Dragonblood
  3. Key reinstallation attack
  4. AP misconfiguration

Answer(s): B

Explanation:

WPA3-specific vulnerability Dragonblood enables practical attacks against WPA3 networks, including reduced security features and downgrade paths, making it the promising route here.
A) Cross-site request forgery is a web application vulnerability, not a wireless WPA3 cryptographic flaw.
B) Dragonblood directly targets WPA3 and its handshake implementations, enabling circumvention of some protections.
C) Key reinstallation attack (KRACK) targets WPA2, not WPA3; it’s not applicable to WPA3 handshake flaws.
D) AP misconfiguration is a general issue but does not describe a known WPA3-specific vulnerability like Dragonblood.



What is the common name for a vulnerability disclosure program opened by companies in platforms such as HackerOne?

  1. White-hat hacking program
  2. Bug bounty program
  3. Ethical hacking program
  4. Vulnerability hunting program

Answer(s): B

Explanation:

A bug bounty program is a vulnerability disclosure initiative where researchers report security flaws in exchange for rewards.
A) White-hat hacking program — not a formal disclosure program with rewards; general term for ethical hacking, not platform-driven disclosure.
C) Ethical hacking program — broader concept; does not specifically describe platform-led disclosure with bounties.
D) Vulnerability hunting program — not the established industry term for crowdsourced disclosure with rewards.



A DDoS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete.

Which attack is being described here?

  1. Desynchronization
  2. Slowloris attack
  3. Session splicing
  4. Phlashing

Answer(s): B

Explanation:

A) Slowloris attack is correct because it exhausts server resources by opening many partial HTTP requests and keeping connections open, forcing the server to wait for each to complete and tying up threads/processes.
B) Desynchronization is about mismatched state between client and server, not about slow, partial requests tying resources.
C) Session splicing is a past technique to bypass IDS by combining fragments but not specifically about exhausting web servers with partial HTTP keep-alives.
D) Phlashing refers to firmware or hardware destruction via power/firmware tampering, not an application-layer DoS.



Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network.

Which of the following host discovery techniques must he use to perform the given task?

  1. UDP scan
  2. ARP ping scan
  3. ACK flag probe scan
  4. TCP Maimon scan

Answer(s): C

Explanation:

A) ARP ping scan
B) UDP scan
C) ACK flag probe scan
D) TCP Maimon scan
The correct answer is C) ACK flag probe scan because ACK probes are used to discover hosts behind restrictive firewalls by eliciting RST or no response patterns that indicate active hosts without completing a TCP handshake, useful in stealthy host discovery. ARP ping scan (A) operates only on Layer 2 within the same broadcast domain, not across routed networks. UDP scan (B) can be blocked by UDP filtering and may not reliably indicate hosts behind a firewall. TCP Maimon scan (D) is not a valid standard scan type in common tool nomenclature.



Abel, a cloud architect, uses container technology to deploy applications/software including all its dependencies, such as libraries and configuration files, binaries, and other resources that run independently from other processes in the cloud environment. For the containerization of applications, he follows the five-tier container technology architecture. Currently, Abel is verifying and validating image contents, signing images, and sending them to the registries.

Which of the following tiers of the container technology architecture is Abel currently working in?

  1. Tier-1: Developer machines
  2. Tier-2: Testing and accreditation systems
  3. Tier-3: Registries
  4. Tier-4: Orchestrators

Answer(s): C

Explanation:

Abel is working in the Registries tier because he is verifying and validating image contents, signing images, and sending them to registries, which centers on image integrity and distribution storage repositories.
A) Tier-1: Developer machines are where developers build and initially assemble images, not where signing and publishing to registries occur.
B) Tier-2: Testing and accreditation systems involve validation and compliance testing, not the act of signing and pushing to registries.
D) Tier-4: Orchestrators manage deployment, scaling, and lifecycle, not the imaging/signing process.



Henry is a cyber security specialist hired by BlackEye ­ Cyber Security Solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unicornscan tool to discover the OS of the target system. As a result, he obtained a TTL value, which indicates that the target system is running a Windows OS.

Identify the TTL value Henry obtained, which indicates that the target OS is Windows.

  1. 128
  2. 255
  3. 64
  4. 138

Answer(s): A

Explanation:

Windows typically uses a TTL of 128 in many scan results, which is why 128 (A) indicates Windows. 255 (B) is common for some Linux/Unix or modern network devices but not a standard Windows default. 64 (C) is often associated with certain macOS or BSD environments, and some network appliances; it does not reliably indicate Windows. 138 (D) is not a standard initial TTL value used by common operating systems. Therefore, A correctly aligns with the common Windows TTL convention observed by fingerprinting tools like Unicornscan.



Daniel is a professional hacker who is attempting to perform an SQL injection attack on a target website, www.moviescope.com. During this process, he encountered an IDS that detects SQL injection attempts based on predefined signatures. To evade any comparison statement, he attempted placing characters such as "'or `1'=`1'" in any basic injection statement such as "or 1=1."

Identify the evasion technique used by Daniel in the above scenario.

  1. Char encoding
  2. IP fragmentation
  3. Variation
  4. Null byte

Answer(s): C

Explanation:

A short summary: Variation is used to bypass signature-based IDS by altering the injection payload with different syntax to avoid exact signature matches.
A) Char encoding is not the method described; it involves encoding characters (e.g., %27) to bypass input validation, not altering statement structure with variations.
B) IP fragmentation is a network-layer evasion technique, not related to altering SQL payload semantics to evade IDS signatures.
C) Variation correctly describes changing the payload format (e.g., "'or `1'=`1'") to avoid exact signature matches while preserving logic.
D) Null byte involves appending a null character to terminate strings, not the use of alternate logical operators seen here.



SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application.

Which of the following SQLi types leverages a database server's ability to make DNS requests to pass data to an attacker?

  1. In-band SQLi
  2. Union-based SQLi
  3. Out-of-band SQLi
  4. Time-based blind SQLi

Answer(s): C

Explanation:

A) Out-of-band SQLi leverage a database server’s ability to make DNS requests to exfiltrate data to an attacker, using an external channel independent of the application's direct responses, which matches the described technique. B) Union-based SQLi relies on combining results from the original query with a crafted UNION SELECT, not DNS-based data exfiltration. C) In-band SQLi uses the same channel (the application's response) for data retrieval, not DNS exfiltration. D) Time-based blind SQLi infers data by response timing, not via DNS interactions. Incorrect options fail to describe cross-network data exfiltration via DNS requests.



Viewing page 12 of 105
Viewing questions 89 - 96 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!