EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 17 )

Updated On: 12-May-2026

During the enumeration phase, Lawrence performs banner grabbing to obtain information such as OS details and versions of services running. The service that he enumerated runs directly on TCP port 445.

Which of the following services is enumerated by Lawrence in this scenario?

  1. Remote procedure call (RPC)
  2. Telnet
  3. Server Message Block (SMB)
  4. Network File System (NFS)

Answer(s): C

Explanation:

The correct answer is C) SMB. Banner grabbing on TCP port 445 targets SMB services, which provide file/print sharing and related OS/service details; enumeration often reveals OS, shares, and versions. A) RPC is typically over higher-level ports or RPC endpoints, not specific to port 445 banner grabbing. B) Telnet uses port 23 and is unrelated to SMB banner data. D) NFS usually operates on port 2049 and is separate from SMB banner information. Hence, SMB on port 445 is the service being enumerated in this scenario.



Jane invites her friends Alice and John over for a LAN party. Alice and John access Jane's wireless network without a password. However, Jane has a long, complex password on her router. What attack has likely occurred?

  1. Wardriving
  2. Wireless sniffing
  3. Evil twin
  4. Piggybacking

Answer(s): C

Explanation:

A) Evil twin explanation: An evil twin attack involves an attacker or rogue access point broadcasting a network with the same SSID to capture credentials or traffic. In this scenario, Alice and John access the network without a password, implying they connected through a spoofed AP that mimics Jane’s network, allowing access despite the router’s complex password. B) Wardriving is the act of searching for wireless networks from a roaming vehicle, not about unauthorized access by trusted friends. C) Wireless sniffing refers to passive interception of traffic, not necessarily initial access. D) Piggybacking is casual, authorized-like access by others using a nearby network; it fits when access is allowed, but does not imply replication of the network by a rogue AP, which is characteristic of an evil twin.



Which file is a rich target to discover the structure of a website during web-server footprinting?

  1. domain.txt
  2. Robots.txt
  3. Document root
  4. index.html

Answer(s): B

Explanation:

A rich target to discover website structure during web-server footprinting is robots.txt because it reveals allowed/disallowed paths and crawler behavior, hinting at site structure and sensitive areas to explore.
A) domain.txt is not a standard web-visible file for footprinting and provides no consistent structure data.
B) robots.txt correctly signals crawl directives and can expose directory patterns and hidden paths.
C) Document root is a server concept, not a specific discoverable file; it isn’t a target file.
D) index.html is a common homepage, but it doesn’t necessarily reveal the broader site structure unless analyzed in context.



John, a professional hacker, decided to use DNS to perform data exfiltration on a target network. In this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique, John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server.

What is the technique employed by John to bypass the firewall?

  1. DNSSEC zone walking
  2. DNS cache snooping
  3. DNS enumeration
  4. DNS tunneling method

Answer(s): D

Explanation:

DNS tunneling using data exfiltration over DNS is the technique that bypasses firewall inspection by encapsulating C2 traffic and payloads in DNS queries/responses. It leverages legitimate DNS traffic to covertly transfer data, often evading standard controls and DNSSEC cannot detect opaque payloads within DNS protocol fields. A) DNSSEC zone walking is a method to enumerate zone data, not data exfiltration. B) DNS cache snooping inspects cached records, not covert channels. C) DNS enumeration gathers host/service info, not tunneling. D) DNS tunneling correctly describes covert data transfer via DNS to bypass firewall controls.



There have been concerns in your network that the wireless network component is not sufficiently secure. You

perform a vulnerability scan of the wireless network and find that it is using an old encryption protocol that was designed to mimic wired encryption.

What encryption protocol is being used?

  1. RADIUS
  2. WPA
  3. WEP
  4. WPA3

Answer(s): C

Explanation:

WEP is the insecure protocol designed to mimic wired encryption and is known to be vulnerable due to RC4 usage and weak IVs.
A) RADIUS is an authentication protocol, not an encryption protocol for wireless data.
B) WPA improved over WEP by TKIP; not the old mimic-wired-encryption design.
D) WPA3 is the latest secure standard with SAE; not the old vulnerable protocol described.



You are a cybersecurity specialist at CloudTech Inc., a company providing cloud-based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud service. To comply with regulatory requirements, the client insists on maintaining full control over the encryption keys even when the data is at rest on the cloud. Which of the following practices should you implement to meet this requirement?

  1. Encrypt data client-side before uploading to the cloud and retain control of the encryption keys.
  2. Use the cloud service provider's encryption services but store keys on-premises.
  3. Rely on Secure Sockets Layer (SSL) encryption for data at rest.
  4. Use the cloud service provider's default encryption and key management services.

Answer(s): A

Explanation:

Client-side encryption ensures data is encrypted before it leaves the client and keys remain under client control, satisfying the requirement of full control over keys at rest in the cloud.
A) Client-side encryption with key control ensures data is encrypted before transmission and storage; keys never leave the client.
B) Storing CSP-encrypted data but keys on-premises partially mitigates risk but not true end-to-end control within the cloud’s storage, and may complicate key lifecycle management.
C) SSL protects data in transit, not at rest; it does not address key management for data at rest.
D) CSP default encryption and key management abstracts control away from the client, failing the requirement of full client-held keys.



In an advanced persistent threat scenario, an adversary follows a detailed set of procedures in the cyber kill chain. During one such instance, the adversary has successfully gained access to a corporate network and now attempts to obfuscate malicious traffic within legitimate network traffic. Which of the following actions would most likely be part of the adversary's current procedures?

  1. Employing data staging techniques to collect and aggregate sensitive data.
  2. Initiating DNS tunneling to communicate with the command-and-control server.
  3. Establishing a command-and-control server to communicate with compromised systems.
  4. Conducting internal reconnaissance using PowerShell scripts.

Answer(s): B

Explanation:

A) Employing data staging techniques to collect and aggregate sensitive data is typically part of post-exploitation data exfiltration, not obfuscation of traffic within legitimate traffic.
B) Initiating DNS tunneling to communicate with the command-and-control server is a classic traffic obfuscation technique that blends C2 chatter with normal DNS traffic, exploiting query/qu ery patterns to evade detection.
C) Establishing a command-and-control server to communicate with compromised systems is foundational C2 setup, not specifically obfuscation within legitimate traffic.
D) Conducting internal reconnaissance using PowerShell scripts is an early-stage discovery activity, not traffic obfuscation.



As a part of an ethical hacking exercise, an attacker is probing a target network that is suspected to employ various honeypot systems for security. The attacker needs to detect and bypass these honeypots without alerting the target. The attacker decides to utilize a suite of techniques. Which of the following techniques would NOT assist in detecting a honeypot?

  1. Implementing a brute force attack to verify system vulnerability
  2. Probing system services and observing the three-way handshake
  3. Using honeypot detection tools like Send-Safe Honeypot Hunter
  4. Analyzing the MAC address to detect instances running on VMware

Answer(s): A

Explanation:

A) Brute forcing to verify vulnerability would not help detect honeypots; it is a generic attack method and reveals nothing about honeypot characteristics or deception mechanisms, and may trigger alerts. B) Probing services and observing the three-way handshake can reveal anomalous responses or fingerprinting traits typical of honeypots. C) Honeypot detection tools like Send-Safe Honeypot Hunter are designed to identify honeypot behavior. D) Analyzing MAC addresses for VMware or virtualization markers can indicate virtualized honeypots.



Viewing page 17 of 105
Viewing questions 129 - 136 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!