EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 14 )

Updated On: 31-Jul-2026

What would be the fastest way to perform content enumeration on a given web server by using the Gobuster tool?

  1. Performing content enumeration using the bruteforce mode and 10 threads
  2. Performing content enumeration using the bruteforce mode and random file extensions
  3. Skipping SSL certificate verification
  4. Performing content enumeration using a wordlist

Answer(s): D

Explanation:

D is correct because utilizing a targeted wordlist maximizes efficiency in content enumeration by aligning requests with the most likely resource identifiers on a web server.
Content enumeration aims to systematically identify resources, such as directories and files, housed within a web server. The implementation of a specific wordlist tailored to the target can significantly reduce enumeration time by reducing the number of requests to only the potential valid endpoints. This contrasts with the brute force approach which indiscriminately checks all combinations based on character length, leading to an increased number of requests and thus extended enumeration time.
Evaluation of Options:

A: Bruteforce mode with 10 threads: While increasing threads improves speed, relying solely on brute force can lead to checking irrelevant endpoints, making it less efficient compared to a focused wordlist approach.
B: Bruteforce with random file extensions: This method risks producing a larger quantity of false positives or negatives. It introduces unnecessary complexity and inefficiency compared to a well-curated wordlist that accurately reflects common files or directories specific to the server technology in use.
C: Skipping SSL certificate verification: Although this could expedite requests by avoiding SSL handshake checks, it does not inherently improve content enumeration speed as irrelevant requests still persist. It can also obscure results from SSL-secured endpoints that may be part of legitimate content but not accessible without due verification.
In conclusion, leveraging a strategically selected wordlist allows for targeted, efficient enumeration of content with the least number of unnecessary requests, thereby optimizing the task's performance.
References:
https://github.com/OJ/gobuster https://www.cylab.cmu.edu/_files/pdfs/No%202_Weiker_Mg042921.pdf https://cheatsheetseries.owasp.org/cheatsheets/Directory_Listing_Cheat_Sheet.html


Reference:

References:
https://github.com/OJ/gobuster https://www.cylab.cmu.edu/_files/pdfs/No%202_Weiker_Mg042921.pdf https://cheatsheetseries.owasp.org/cheatsheets/Directory_Listing_Cheat_Sheet.html



When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration.
What type of an alert is this?

  1. False negative
  2. True negative
  3. True positive
  4. False positive

Answer(s): C

Explanation:

C is correct because the alert accurately reflects a legitimate access event to the external router by an authorized administrator.
In the context of Intrusion Detection Systems (IDS), a true positive denotes an event where the system correctly identifies a legitimate action as suspicious. Here, the alert indicates that an authorized action— updating the router configuration—was logged, signifying no misidentification by the IDS. This aligns perfectly with the principles of IDS functionality, where accurate detection is paramount for network security management.
Evaluation of Other Options:

A: False Negative - This occurs when an intrusion is present, but the IDS fails to identify it. In this instance, since the IDS did log the access, it could not be classified as a false negative.
B: True Negative - A true negative occurs when the IDS accurately identifies benign activity as non-threatening. Since the access in question is a benign and authorized activity but logged as a potential threat, it does not fit this definition.
D: False Positive - This is when the IDS incorrectly flags legitimate activity as an intrusion. As the action was valid and conducted by an authorized user, categorizing it as a false positive would be erroneous.
Utilizing accurate IDS alerts is essential to ensure network integrity and responsiveness to actual threats.
https://www.blackhat.com/docs/asia-16/blackhat-asia-16-Practical-Considerations-for-Intrusion-Detection-Systems-wp.pdf https://www.sans.org/white-papers/35473/ https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/193499-ids-analyzing-alarm-logs.html



Garry is a network administrator in an organization. He uses SNMP to manage networked devices from a remote location. To manage nodes in the network, he uses MIB, which contains formal descriptions of all network objects managed by SNMP. He accesses the contents of MIB by using a web browser either by entering the IP address and Lseries.mib or by entering the DNS library name and Lseries.mib. He is currently retrieving information from an MIB that contains object types for workstations and server services.
Which of the following types of MIB is accessed by Garry in the above scenario?

  1. LNMIB2.MIB
  2. DHCP.MIB
  3. MIB_II.MIB
  4. WINS.MIB

Answer(s): A

Explanation:

A is correct because LNMIB2.MIB includes definitions relevant to workstation and server services, making it appropriate for Garry's use case in managing network devices via SNMP.
Reasoning for Correct Answer: LNMIB2.MIB specifically encompasses a broader set of definitions pertinent to layer network management, which aligns with Garry's role as a network administrator managing devices linked to workstations and server functionalities. The structured information in LNMIB2 facilitates efficient monitoring and control via SNMP, allowing Garry to retrieve essential data seamlessly.
Critique of Other Options:
B: DHCP.MIB: This MIB concentrates exclusively on the Dynamic Host Configuration Protocol (DHCP), focusing on IP address management and lease data. It does not encompass broader workstation and server services.
C: MIB_II.MIB: While MIB-II provides a wider range of network management information, it primarily addresses basic network interface metrics and doesn't specifically tailor services towards workstation and server service management as LNMIB2.MIB does.
D: WINS.MIB: This MIB is related to Windows Internet Naming Service (WINS), which primarily deals with name resolution in Windows networks, thus being less relevant to the overall management of workstation and server services compared to LNMIB2.MIB.
In conclusion, the specificities of LNMIB2.MIB regarding workstation and server services make it the most appropriate choice for Garry's management task via SNMP.
For further reading:
https://www.ietf.org/rfc/rfc1155.txt https://www.cisco.com/c/en/us/td/docs/net_mgmt/snmp/guide/guide19.html https://www.snmp.com/mibs/mib-II/



Emily, an extrovert obsessed with social media, posts a large amount of private information, photographs, and location tags of recently visited places. Realizing this, James, a professional hacker, targets Emily and her acquaintances, conducts a location search to detect their geolocation by using an automated tool, and gathers information to perform other sophisticated attacks.
What is the tool employed by James in the above scenario?

  1. ophcrack
  2. VisualRoute
  3. Hootsuite
  4. HULK

Answer(s): B

Explanation:

B is correct because VisualRoute is designed for network mapping and geolocation analysis, making it suitable for James's targeted location search.
VisualRoute utilizes traceroute technology combined with IP location databases to provide insights into the geolocations of IP addresses. This enables hackers to efficiently gather information about the whereabouts of individuals and their social connections based on publicly available data, as seen with Emily’s social media posts. The automated collection of location information facilitates further sophisticated attacks, underscoring the effectiveness of this tool in the given context.
Evaluation of other options:

A: ophcrack – This tool is primarily used for cracking Windows passwords using rainbow tables. It does not provide any geolocation capabilities or social media reconnaissance, thus making it irrelevant in this scenario.
C: Hootsuite – Hootsuite is a social media management platform designed to schedule and track social media posts.
While it can analyze social media engagement, it lacks the functionality to conduct geolocation searches or gather user data from public posts automatically, rendering it ineffective for James’s objectives.
D: HULK – HULK (HTTP Unending Load King) is a DoS (Denial of Service) attack tool designed to overload a targeted server with HTTP requests. This tool does not focus on data gathering or geolocation; instead, its purpose is disruptive, making it unsuitable for the context of gathering intelligence on individuals like Emily.
References:
https://www.visualroute.com https://ophcrack.sourceforge.net https://hootsuite.com


Reference:

References:
https://www.visualroute.com https://ophcrack.sourceforge.net https://hootsuite.com



Alice needs to send a confidential document to her coworker, Bryan. Their company has public key infrastructure set up. Therefore, Alice both encrypts the message and digitally signs it. Alice uses _______________ to encrypt the message, and Bryan uses _______________ to confirm the digital signature.

  1. Bryan’s public key; Bryan’s public key
  2. Alice’s public key; Alice’s public key
  3. Bryan’s private key; Alice’s public key
  4. Bryan’s public key; Alice’s public key

Answer(s): D

Explanation:

Option D is correct because Alice encrypts the message using Bryan's public key, which ensures only he can decrypt it, and he confirms the digital signature using Alice’s public key, verifying her authenticity.
Alice employs asymmetric encryption for confidentiality. Utilizing Bryan's public key ensures that only he has the corresponding private key needed to decrypt the message. This maintains confidentiality across insecure mediums, a primary tenet of public key infrastructure (PKI). For signatory verification, Bryan uses Alice’s public key to confirm her digital signature, ensuring that the message originated from her and has not been altered. The digital signature is generated using Alice's private key, which only she possesses.
Critical Evaluation of Other Options:

A: Bryan’s public key; Bryan’s public key This option is incorrect.
While the public key helps with encryption, it does not verify Alice's digital signature. To confirm the signature, Alice's public key must be used.
B: Alice’s public key; Alice’s public key This choice is incorrect as it suggests that Alice uses her own public key for encryption and signature verification. Public keys cannot encrypt messages intended for oneself; they must be exchanged with the intended recipient.
C: Bryan’s private key; Alice’s public key This option misrepresents the role of Bryan's private key. He does not use his private key to decrypt a message intended for him; rather, he uses his own public key to receive messages. Moreover, using Alice's public key for encryption would not be feasible since it would limit decryption to Alice alone.
In summary, the integrity of the process relies on the correct use of public and private keys within the PKI framework.
References:
https://www.cloudflare.com/learning/how-tls-works/how-do-public-key-infrastructure-pki-and-digital-certificates-work/ https://www.tutorialspoint.com/cryptography/what_is_public_key_infrastructure.htm https://www.cio.com/article/303162/public-key-infrastructure-explained.html


Reference:

References:
https://www.cloudflare.com/learning/how-tls-works/how-do-public-key-infrastructure-pki-and-digital-certificates-work/ https://www.tutorialspoint.com/cryptography/what_is_public_key_infrastructure.htm https://www.cio.com/article/303162/public-key-infrastructure-explained.html



What is the file that determines the basic configuration (specifically activities, services, broadcast receivers, etc.) in an Android application?

  1. AndroidManifest.xml
  2. classes.dex
  3. APK.info
  4. resources.asrc

Answer(s): A

Explanation:

A: AndroidManifest.xml is the correct answer as it serves as the essential configuration file for an Android application, delineating its components and permissions.
The AndroidManifest.xml file is pivotal in defining the app's structure and functionality. It specifies crucial elements such as activities, services, broadcast receivers, permissions, and intents, acting as a bridge between the app and the Android system. For instance, activities are declared for the Android system to recognize UI components, while permissions are outlined to secure sensitive user data. By doing this, it aids in ensuring proper app operation, resource allocation, and security compliance, contributing to a cohesive user experience.
In evaluating other options:
B: classes.dex: This file contains the compiled code of the Java classes used within the application but does not provide essential configuration details about app components or permissions, making it unfit for this purpose.
C: APK.info: This term is not commonly recognized within standard Android development practices. It lacks the specificity and detailed functionality that AndroidManifest.xml provides, thereby rendering it non-applicable for core application configurations.
D: resources.asrc: This file pertains to the compiled resources of the application, such as images and strings, and while essential for the user interface, it does not serve the configuration role that AndroidManifest.xml holds.
In conclusion, AndroidManifest.xml is integral to app configuration in Android development, distinguishing its role from that of other file types.
References:
https://developer.android.com/guide/topics/manifest/manifest-intro https://developer.android.com/studio/build/multidex https://developer.android.com/studio/build/gradle-tips


Reference:

References:
https://developer.android.com/guide/topics/manifest/manifest-intro https://developer.android.com/studio/build/multidex https://developer.android.com/studio/build/gradle-tips



Mason, a professional hacker, targets an organization and spreads Emotet malware through malicious script. After infecting the victim's device, Mason further used Emotet to spread the infection across local networks and beyond to compromise as many machines as possible. In this process, he used a tool, which is a self-extracting RAR file, to retrieve information related to network resources such as writable share drives.
What is the tool employed by Mason in the above scenario?

  1. NetPass.exe
  2. Outlook scraper
  3. WebBrowserPassView
  4. Credential enumerator

Answer(s): D

Explanation:

The correct option is D: Credential enumerator, as it is specifically designed to retrieve information about network resources, including writable shares.
Reasoning for Correct Answer (D)
Credential enumerators are malicious tools that scan networks to identify and retrieve sensitive information, such as user credentials from various sources, including shared drives. In this case, Mason employs a self-extracting RAR file containing a credential enumerator to gather data useful for expanding his attack lateral movement through the victim’s network. Its functionality directly aligns with the objectives outlined in the scenario—compromising as many machines as possible by leveraging acquired credentials.
Critical Evaluation of Incorrect Options

A: NetPass.exe : This tool is designed to recover passwords from various network protocols, specifically from Windows systems.
While it can recover credentials, it does not focus on enumerating network shares or resources, which is pivotal for this scenario.
B: Outlook scraper : This tool extracts email information from Outlook. Its utility is limited to email data, making it unsuitable for the task of identifying writable share drives, which requires a broader network scanning capability.
C: WebBrowserPassView : This tool retrieves stored passwords from various web browsers. Similar to Outlook scraper, it targets specific application data rather than network resources, thus failing to align with Mason's need to spread infections across local networks.
In summary, only the credential enumerator effectively facilitates the retrieval of network-related information needed to propagate the infection, making it the most appropriate choice in this context.
References:
https://www.eccouncil.org https://www.csoonline.com/article/3252976/understanding-emotet-the-maze-of-a-digital-malignancy.html https://www.cybintsolutions.com/what-is-a-credential-enumerator/#:~:text=A%20credential%20enumerator%20is%20a,access%20to%20various%20network%20resour


Reference:

References:
https://www.eccouncil.org https://www.csoonline.com/article/3252976/understanding-emotet-the-maze-of-a-digital-malignancy.html https://www.cybintsolutions.com/what-is-a-credential-enumerator/#:~:text=A%20credential%20enumerator%20is%20a,access%20to%20various%20network%20resour



Which of the following Bluetooth hacking techniques refers to the theft of information from a wireless device through Bluetooth?

  1. Bluesmacking
  2. Bluesnarfing
  3. Bluejacking
  4. Bluebugging

Answer(s): B

Explanation:

B: Bluesnarfing is correct because it involves unauthorized access to data on Bluetooth-enabled devices, allowing attackers to extract information such as contacts, messages, and files.
Reasoning: Bluesnarfing exploits vulnerabilities in Bluetooth connections, particularly when devices are set to discoverable mode or lack adequate security controls. Unlike other methods, Bluesnarfing directly targets the information stored on a device without requiring user interaction, making it a significant threat to data confidentiality.
Critical Evaluation of Other Options:

A: Bluesmacking: This technique involves sending a denial-of-service attack to Bluetooth devices, causing them to crash or reboot. It does not pertain to data theft, which is the crux of the question. C. Bluejacking: This method enables sending unsolicited messages to Bluetooth-enabled devices.
While it involves interaction, it does not access sensitive data, focusing instead on messaging with little to no risk of information theft. D. Bluebugging: This technique allows attackers to take control of a Bluetooth-enabled device, potentially leading to data access, but it primarily focuses on control rather than direct data theft.
To summarize, Bluesnarfing precisely describes the act of extracting data from Bluetooth devices, while the other techniques either do not focus on theft or facilitate other forms of attack.
References:
https://www.kaspersky.com/resource-center/threats/bluesnarfing https://www.mcafee.com/en-us/security-awareness/understanding-bluetooth-hacks.html https://www.csoonline.com/article/3296082/what-is-bluetooth-hacking-and-what-you-should-know-about-it.html


Reference:

References:
https://www.kaspersky.com/resource-center/threats/bluesnarfing https://www.mcafee.com/en-us/security-awareness/understanding-bluetooth-hacks.html https://www.csoonline.com/article/3296082/what-is-bluetooth-hacking-and-what-you-should-know-about-it.html



Viewing page 14 of 133
Viewing questions 66 - 70 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!