EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 16 )

Updated On: 12-May-2026

Which of the following Metasploit post-exploitation modules can be used to escalate privileges on Windows systems?

  1. getsystem
  2. getuid
  3. keylogrecorder
  4. autoroute

Answer(s): A

Explanation:

The getsystem module is designed to escalate privileges on Windows by leveraging token impersonation or service exploits to obtain SYSTEM level access.
A) getsystem — correctly identifies a post-exploitation privilege escalation mechanism for Windows targets.
B) getuid — reports the current user id; it does not perform escalation or privilege gain.
C) keylogrecorder — records keystrokes; unrelated to privilege escalation.
D) autoroute — manipulates routing during pivoting; not used for escalating privileges.



Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed.

What is the port scanning technique used by Sam to discover open ports?

  1. Xmas scan
  2. IDLE/IPID header scan
  3. TCP Maimon scan
  4. ACK flag probe scan

Answer(s): D

Explanation:

A port scan technique that uses FIN/ACK probes and relies on the target’s RST response to indicate a closed port corresponds to the ACK flag probe approach in some classifications, where probing with ACK/FIN-like sequences helps infer state from response behavior.
A) Xmas scan
B) IDLE/IPID header scan
C) TCP Maimon scan
D) ACK flag probe scan



An organization has automated the operation of critical infrastructure from a remote location. For this purpose, all the industrial control systems are connected to the Internet. To empower the manufacturing process, ensure the reliability of industrial networks, and reduce downtime and service disruption, the organization decided to install an OT security tool that further protects against security incidents such as cyber espionage, zero-day attacks, and malware.

Which of the following tools must the organization employ to protect its critical infrastructure?

  1. Robotium
  2. BalenaCloud
  3. Flowmon
  4. IntentFuzzer

Answer(s): C

Explanation:

An OT security tool that protects critical infrastructure from cyber threats, including malware and zero-day attacks, aligns with Flowmon’s capabilities in network monitoring, anomaly detection, and threat visibility for industrial networks.
A) Robotium is a mobile test automation framework, not suited for OT/industrial network protection.
B) BalenaCloud is an IoT device management platform, not primarily an OT network security tool.
C) Flowmon provides network telemetry, flow analytics, and security monitoring for OT environments, addressing cyber threats to industrial systems.
D) IntentFuzzer is a fuzzing tool for software testing, not a defensive OT security solution.



Heather's company has decided to use a new customer relationship management tool. After performing the appropriate research, they decided to purchase a subscription to a cloud-hosted solution. The only administrative task that Heather will need to perform is the management of user accounts. The provider will take care of the hardware, operating system, and software administration including patching and monitoring.

Which of the following is this type of solution?

  1. IaaS
  2. SaaS
  3. PaaS
  4. CaaS

Answer(s): B

Explanation:

A) The correct answer is B because SaaS provides a fully managed cloud application where the provider handles infrastructure, OS, and software maintenance, while the customer manages user access and data.
A) IaaS is incorrect because IaaS transfers hardware and virtualization to the provider, but the customer still manages OS and application stack.
C) PaaS is incorrect since it abstracts hardware and runtime environments, but the customer still focuses on deploying and managing applications rather than end-user software.
D) CaaS is incorrect as a misnominal term; container-focused offerings exist but do not describe a SaaS customer relationship management service.



Juliet, a security researcher in an organization, was tasked with checking for the authenticity of images to be used in the organization's magazines. She used these images as a search query and tracked the original source and details of the images, which included photographs, profile pictures, and memes.

Which of the following footprinting techniques did Rachel use to finish her task?

  1. Google advanced search
  2. Meta search engines
  3. Reverse image search
  4. Advanced image search

Answer(s): C

Explanation:

A concise explanation: Reverse image search is used to find the original source and related details of an image by querying with the image itself, matching visually similar images across the web. This enables verification of authenticity for photographs, profile pictures, and memes. A) Google advanced search focuses on keyword-based queries, not image-based fingerprinting. B) Meta search engines aggregate results from multiple engines but do not perform image-for-image matching. D) Advanced image search is a generic term and typically overlaps with reverse image search, but the standard term for querying with an image to locate sources is “reverse image search.”
A) not appropriate because it uses text queries only
B) not appropriate because it does not perform image-to-image matching
D) not appropriate because the canonical technique is reverse image search



Mary, a penetration tester, has found password hashes in a client system she managed to breach. She needs to use these passwords to continue with the test, but she does not have time to find the passwords that correspond to these hashes.

Which type of attack can she implement in order to continue?

  1. Pass the hash
  2. Internal monologue attack
  3. LLMNR/NBT-NS poisoning
  4. Pass the ticket

Answer(s): A

Explanation:

A) Pass the hash. This technique uses captured NTLM password hashes to authenticate without knowing the plaintext passwords, allowing access to services that accept those hashes. B) Internal monologue attack is not a recognized credential–reuse or authentication method in pentesting. C) LLMNR/NBT-NS poisoning crafts spoofed name resolution to capture credentials, not directly using existing hashes to authenticate. D) Pass the ticket (Kerberos) requires Kerberos tickets, not NTLM hashes, and is not applicable when hashes are the only credential set obtained.


Reference:

https://en.wikipedia.org/wiki/Pass_the_hash



Morris, a professional hacker, performed a vulnerability scan on a target organization by sniffing the traffic on the network to identify the active systems, network services, applications, and vulnerabilities. He also obtained the list of the users who are currently accessing the network.

What is the type of vulnerability assessment that Morris performed on the target organization?

  1. Credentialed assessment
  2. Internal assessment
  3. External assessment
  4. Passive assessment

Answer(s): D

Explanation:

A passive assessment is correct because Morris sniffed network traffic to identify assets and users without directly interacting with or authenticating to the systems, gathering data passively.
B) Internal assessment is wrong since it implies active access from within the network; sniffing alone does not require foothold or authenticated access.
C) External assessment is wrong because it targets external-facing systems from outside the organization; sniffing internal traffic is not necessarily external-facing.
D) Credentialed assessment is wrong since Morris did not use valid credentials to log in or test systems; sniffing traffic does not involve authenticated access.



Which of the following protocols can be used to secure an LDAP service against anonymous queries?

  1. NTLM
  2. RADIUS
  3. WPA
  4. SSO

Answer(s): A

Explanation:

An LDAP service can be secured against anonymous queries by requiring authentication via NTLM, which provides challenge/response authentication within Windows-based environments.
A) NTLM is correct because it supports authenticated access to directory services, preventing anonymous LDAP queries by requiring credentials.
B) RADIUS is a network access protocol, not primarily used to constrain LDAP queries; it handles authentication for network access, not LDAP directory binding directly.
C) WPA is a wireless security protocol, not related to LDAP authorization or binding controls.
D) SSO describes a single sign-on concept or framework, but does not by itself enforce LDAP binding authentication mechanisms.



Viewing page 16 of 105
Viewing questions 121 - 128 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!