Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-50v13

EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 13 )

Updated On: 12-May-2026
Page 13 of 105
PDF with 862 Questions

Attacker Rony installed a rogue access point within an organization's perimeter and attempted to intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack.

What is the type of vulnerability assessment performed by Johnson in the above scenario?

  1. Wireless network assessment
  2. Application assessment
  3. Host-based assessment
  4. Distributed assessment

Answer(s): A

Explanation:

A) A wireless network assessment is correct because the rogue access point and traffic aimed at cracking authentication indicate focusing on wireless controls, access mechanisms, and related vulnerabilities within the wireless domain.
B) Application assessment is incorrect since the scenario centers on wireless access and network-level weaknesses, not application-layer flaws or insecure software.
C) Host-based assessment is incorrect because the focus is on the wireless network itself and its access point, not individual hosts, services, or host configurations.
D) Distributed assessment is incorrect since there is no mention of a coordinated, multi-system assessment framework; the emphasis is on the single wireless entry point and its impact.



In this attack, an adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages. When the victim reinstalls the key, associated parameters such as the incremental transmit packet number and receive packet number are reset to their initial values.

What is this attack called?

  1. Evil twin
  2. Chop chop attack
  3. Wardriving
  4. KRACK

Answer(s): D

Explanation:

The attack is KRACK because it targets the WPA2 four-way handshake to reinstall a key and reset replay counters, enabling packet replay and decryption of data by manipulating handshake messages.
A) Evil twin is incorrect as it describes a rogue AP deception, not specifically the WPA2 handshake replay attack.
B) Chop chop attack is incorrect; it refers to a vulnerability in fragment reassembly in certain routers, not the WPA2 key reinstall/replay in handshakes.
C) Wardriving is incorrect; it is locating wireless networks by vehicle movement, unrelated to handshake exploitation.
D) KRACK is correct; it exploits the WPA2 handshake to reinstall a key and reset sequence numbers, enabling various cryptographic attacks.


Reference:

https://www.krackattacks.com/



After an audit, the auditors inform you that there is a critical finding that you must tackle immediately. You read the audit report, and the problem is the service running on port 389.

Which service is this and how can you tackle the problem?

  1. The service is NTP, and you have to change it from UDP to TCP in order to encrypt it.
  2. The service is LDAP, and you must change it to 636, which is LDAPS.
  3. The findings do not require immediate actions and are only suggestions.
  4. The service is SMTP, and you must change it to SMIME, which is an encrypted way to send emails.

Answer(s): B

Explanation:

Port 389 is LDAP (Lightweight Directory Access Protocol), commonly exposed for directory services; LDAPS uses port 636 for encrypted LDAP over TLS, so moving to 636 mitigates the risk by encrypting traffic.
A) NTP uses port 123, not 389; changing UDP to TCP does not apply for LDAP.
C) The prompt states a critical finding requiring immediate action, not merely suggestions.
D) SMTP uses port 25 with optional SMTPS, not 389, and SMIME is for email encryption, not a protocol replacement on port 389.



Mike, a security engineer, was recently hired by BigFox Ltd. The company recently experienced disastrous DoS attacks. The management had instructed Mike to build defensive strategies for the company's IT infrastructure to thwart DoS/DDoS attacks. Mike deployed some countermeasures to handle jamming and scrambling attacks.

What is the countermeasure Mike applied to defend against jamming and scrambling attacks?

  1. Allow the transmission of all types of addressed packets at the ISP level
  2. Disable TCP SYN cookie protection
  3. Allow the usage of functions such as gets and strcpy
  4. Implement cognitive radios in the physical layer

Answer(s): D

Explanation:

J) Implement cognitive radios in the physical layer is correct because cognitive radios enable dynamic spectrum access, spectrum sensing, and agile frequency hopping to detect and mitigate jamming and scrambling attacks at the physical layer. A) Allowing all packet types at the ISP level does not address jamming or scrambling and can worsen DoS via amplification of traffic. B) Disabling TCP SYN cookies increases susceptibility to DoS via SYN flood. C) Using gets/strcpy is unsafe and irrelevant to mitigating jamming; it increases risk of buffer overflows. D) Implement cognitive radios correctly strengthens resilience against spectrum-based interference and scrambling techniques.



You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic.

If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?

  1. You should check your ARP table and see if there is one IP address with two different MAC addresses.
  2. You should scan the network using Nmap to check the MAC addresses of all the hosts and look for
    duplicates.
  3. You should use netstat to check for any suspicious connections with another IP address within the LAN.
  4. You cannot identify such an attack and must use a VPN to protect your traffic.

Answer(s): B

Explanation:

Using ARP table inconsistencies can indicate spoofing, but only scanning for MAC address anomalies with network discovery helps verify ARP spoofing across hosts. ARP spoofing typically involves mapping one IP to a forged MAC; Nmap can reveal duplicate or unexpected MAC/IP pairs on the LAN, signaling ARP manipulation.
A) ARP table alone may show a duplicate IP, but spoofing can be distributed; not comprehensive for all hosts. B) Nmap scan identifies MAC/IP inconsistencies and unusual ARP-related fingerprints across the network. C) netstat shows active connections, not direct ARP spoofing indicators on the LAN. D) VPN affects traffic confidentiality, not detection of ARP spoofing.



Lewis, a professional hacker, targeted the IoT cameras and devices used by a target venture-capital firm. He used an information-gathering tool to collect information about the IoT devices connected to a network, open ports and services, and the attack surface area. Using this tool, he also generated statistical reports on broad usage patterns and trends. This tool helped Lewis continually monitor every reachable server and device on the Internet, further allowing him to exploit these devices in the network.

Which of the following tools was employed by Lewis in the above scenario?

  1. NeuVector
  2. Lacework
  3. Censys
  4. Wapiti

Answer(s): C

Explanation:

C) Censys provides internet-wide asset discovery, collects data on hosts, open ports, services, and attack surface, and generates usage and trend reports, enabling continuous monitoring of reachable devices. A) NeuVector is a container security platform focused on runtime security, not internet-wide asset discovery. B) Lacework is a cloud security platform for workload and compliance, not primarily an internet-wide scan and inventory tool. D) Wapiti is a web vulnerability scanner for testing web applications, not IoT asset enumeration or network-wide monitoring.



Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered.

John decided to perform a TCP SYN ping scan on the target network.

Which of the following Nmap commands must John use to perform the TCP SYN ping scan?

  1. nmap -sn -PO < target IP address >
  2. nmap -sn -PS < target IP address >
  3. nmap -sn -PA < target IP address >
  4. nmap -sn -PP < target IP address >

Answer(s): B



Ricardo has discovered the username for an application in his target's environment. As he has a limited amount of time, he decides to attempt to use a list of common passwords he found on the Internet. He compiles them into a list and then feeds that list as an argument into his password-cracking application.

What type of attack is Ricardo performing?

  1. Brute force
  2. Known plaintext
  3. Dictionary
  4. Password spraying

Answer(s): C

Explanation:

Using a list of common passwords as input to a cracking tool is a dictionary attack, where a precompiled set of likely passwords is tested against the target credential.
A) Brute force is incorrect because brute force exhaustively tests all possible passwords, not a predefined list.
B) Known plaintext is incorrect because it involves deriving keys from known pairs of plaintext and ciphertext, not password lists.
D) Password spraying is incorrect because it attempts a small number of passwords across many accounts, not a large dictionary against a single credential.



Viewing page 13 of 105
Viewing questions 97 - 104 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!