EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 2 )

Updated On: 31-Jul-2026

In this form of encryption algorithm, every individual block contains 64-bit data, and three keys are used, where each key consists of 56 bits.
Which is this encryption algorithm?

  1. IDEA
  2. Triple Data Encryption Standard
  3. AES
  4. MD5 encryption algorithm

Answer(s): B

Explanation:

B is correct because Triple Data Encryption Standard (3DES) uses a 64-bit block size and applies the Data Encryption Standard (DES) algorithm three times with three different 56-bit keys, ultimately enhancing security.
The structure of 3DES comprises the iterative application of DES, where each encryption and decryption operates over 64-bit blocks of data. Unlike the original DES, which is vulnerable to brute-force attacks due to its shorter key length, 3DES effectively mitigates this risk through a compounded keying approach. As such, the utilization of three 56-bit keys results in a significantly increased effective key length, providing heightened security for sensitive data transmission.
Evaluating the incorrect options:

A: IDEA (International Data Encryption Algorithm) employs a 64-bit block size as well but operates using a different key structure involving 128-bit keys and is not based on triple applications of a standard like DES. C. AES (Advanced Encryption Standard) uses a block size of 128 bits and key lengths of 128, 192, or 256 bits, making it incompatible with the requirements of the question regarding block and key sizes. D. MD5 encryption algorithm is primarily a hashing function, not a block cipher. It produces a hash value of 128 bits and does not utilize block encryption methodology with keys, rendering it irrelevant to the context of encryption criteria presented in the question.
For further reading and validation, these references can be consulted:
https://www.milagrosoft.com/what-is-triple-des-3des/ https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptographic-standards-and-guidelines#triple-data-encryption-standard-3des



John is investigating web-application firewall logs and observers that someone is attempting to inject the following:

What type of attack is this?

  1. SQL injection
  2. Buffer overflow
  3. CSRF
  4. XSS

Answer(s): B

Explanation:

B: Buffer overflow
A buffer overflow attack occurs when:
A program writes more data into a buffer than it can hold
This overwrites adjacent memory, potentially allowing attackers to:
Crash the program
Execute arbitrary code
Gain unauthorized access



John, a professional hacker, performs a network attack on a renowned organization and gains unauthorized access to the target network. He remains in the network without being detected for a long time and obtains sensitive information without sabotaging the organization.
Which of the following attack techniques is used by John?

  1. Insider threat
  2. Diversion theft
  3. Spear-phishing sites
  4. Advanced persistent threat

Answer(s): D

Explanation:

D is correct because John's behavior exemplifies characteristics of an Advanced Persistent Threat (APT), involving prolonged unauthorized access aimed at data exfiltration without immediate detection.
The reasoning behind classifying this scenario as an APT is as follows:
1. Persistent Access : APTs are defined by their ability to maintain long-term access to networks, which aligns with John's undetected presence. 2. Deliberate Data Theft : The intention is not to disrupt but to steal sensitive data, characteristic of
APTs which often target intellectual property or confidential information. 3. Subtle Operations : APT scenarios often involve stealth tactics that enable hackers to blend in with normal network traffic, further explaining John's ability to evade detection.
Critique of Other Options :

A: Insider Threat : An insider threat involves individuals within an organization utilizing their access for malicious intent. Since John gains unauthorized access externally, this classification is inappropriate.
B: Diversion Theft : This technique implies an immediate, often disruptive theft of data or assets, typically using deception to distract from the theft. John's methodical approach does not fit this description, as he did not engage in immediate theft or diversion tactics.
C: Spear-Phishing Sites : While spear-phishing involves targeted attacks often used to gain initial access, John's continued presence and data retrieval do not rely on this technique but rather demonstrate a sustained infiltration consistent with APTs.
In summary, John's actions exemplify stealthy, prolonged access and data exfiltration strategy typical of an Advanced Persistent Threat, as opposed to the other mentioned techniques.
References:
https://www.ciso.com/advanced-persistent-threats-apts-what-you-need-to-know/ https://www.cio.com/article/243330/what-is-an-advanced-persistent-threat-apts-explained.html https://www.csoonline.com/article/2701152/what-is-an-advanced-persistent-threat-apts.html


Reference:

References:
https://www.ciso.com/advanced-persistent-threats-apts-what-you-need-to-know/ https://www.cio.com/article/243330/what-is-an-advanced-persistent-threat-apts-explained.html https://www.csoonline.com/article/2701152/what-is-an-advanced-persistent-threat-apts.html



You are attempting to run an Nmap port scan on a web server.
Which of the following commands would result in a scan of common ports with the least amount of noise in order to evade IDS?

  1. nmap -A - Pn
  2. nmap -sP -p-65535 -T5
  3. nmap -sT -O -T0
  4. nmap -A --host-timeout 99 -T1

Answer(s): C

Explanation:

C is correct because it utilizes a stealthy SYN scan with low timing options to minimize detection by intrusion detection systems (IDS).
The command "nmap -sT -O -T0" combines several advantageous features for evading IDS. The "-sT" flag initiates a TCP connect scan, which is less detectable compared to more aggressive options. The "-O" flag enables OS detection, providing valuable information without triggering extensive logs typical of full scans. Most notably, the "-T0" setting employs an extremely slow timing template, effectively reducing the scan's footprint and likelihood of triggering alerts. This method ensures that the scan is executed quietly, maintaining operational stealth.
In contrast, option A ("nmap -A -Pn") performs aggressive scans, enabling OS and service version detection, which generates significant network traffic and can trigger alarms. The use of "-A" amplifies the risk of detection, rendering this option unsuitable for stealth.
Option B ("nmap -sP -p-65535 -T5") performs a ping scan on all ports at a high speed, making it highly detectable to IDS due to the volume of packets sent in a short duration. The "-T5" setting indicates aggressive timing, which increases the likelihood of alerts being triggered.
Option D ("nmap -A --host-timeout 99 -T1") attempts to limit the host timeout and uses a slow scan option; however, the inclusion of "-A" leads to extensive traffic and identifiable patterns that can arouse suspicion,
invalidating its purpose of minimizing noise.
Given this analysis, the choice of C optimally balances effectiveness and stealth, making it the superior option for evading IDS during a reconnaissance phase.
References:
https://nmap.org/book/nmap-options.html https://nmap.org/book/man/primers/ipv4.html https://www.sans.org/white-papers/38475/


Reference:

References:
https://nmap.org/book/nmap-options.html https://nmap.org/book/man/primers/ipv4.html https://www.sans.org/white-papers/38475/



This wireless security protocol allows 192-bit minimum-strength security protocols and cryptographic tools to protect sensitive data, such as GCMP-256, HMAC-SHA384, and ECDSA using a 384-bit elliptic curve.
Which is this wireless security protocol?

  1. WPA3-Personal
  2. WPA3-Enterprise
  3. WPA2-Enterprise
  4. WPA2-Personal

Answer(s): B

Explanation:

B is correct because WPA3-Enterprise incorporates advanced cryptographic protocols, including GCMP-256 and HMAC-SHA384, designed for robust secure communications.
WPA3-Enterprise provides enhanced security features that utilize 192-bit minimum-strength cryptography and offers modern tools including ECDSA with a 384-bit elliptic curve for key exchange and authentication. These enhancements are critical for enterprise environments where sensitive data transmission is commonplace. WPA3-Enterprise also employs a mechanism known as Improved Forward Secrecy, which resists replay attacks and protects past session data.
In contrast, WPA3-Personal primarily offers security for home networks and does not necessarily implement the full suite of enterprise-grade cryptographic tools and features, making it less suitable for organizations handling sensitive data.
WPA2-Enterprise, while providing secure authentication, lacks the enhanced cryptographic capabilities found in WPA3-Enterprise and cannot match the security posture required by modern standards. WPA2-Personal, similarly, is optimized for basic security suitable for home use and does not provide the level of protection necessary for enterprise applications.
In summary:

A: WPA3-Personal: Lacks enterprise-grade cryptographic tools. C. WPA2-Enterprise: Falls short on newer cryptographic standards and forward secrecy features. D. WPA2-Personal: Offers basic security not suitable for environments needing robust protection.
References:
https://www.wi-fi.org/discover-wi-fi/security https://www.networkworld.com/article/3530256/why-wpa3-wireless-security-matters.html https://www.cio.com/article/244620/how-wpa3-improves-wireless-security.html


Reference:

References:
https://www.wi-fi.org/discover-wi-fi/security https://www.networkworld.com/article/3530256/why-wpa3-wireless-security-matters.html https://www.cio.com/article/244620/how-wpa3-improves-wireless-security.html



What are common files on a web server that can be misconfigured and provide useful information for a hacker such as verbose error messages?

  1. httpd.conf
  2. administration.config
  3. php.ini
  4. idq.dll

Answer(s): A

Explanation:

Correct Answer: A. httpd.conf
The httpd.conf file is the primary configuration file for Apache HTTP Server, where various settings, including error reporting levels, are defined. Misconfigurations in this file can lead to verbose error messages being displayed, which provide attackers with critical information about the server's environment, installed modules, and potential vulnerabilities. Specifically, settings such as LogLevel and AllowOverride can expose detailed error messages and information about the server's structure.
Evaluation of Other Options:
B: administration.config : This file's name suggests it is for application-specific or custom administration purposes rather than fundamental web server configuration. Misconfigurations here may not relate directly to server-level access or provide exhaustive error detail as seen in httpd.conf.
C: php.ini : While this file configures PHP settings, including error reporting directives, it operates at an application layer rather than affecting server-level configurations. Though critical for PHP application behavior, it does not provide the same comprehensive insights into server settings as httpd.conf.
D: idq.dll : Representing a dynamic link library file for Internet Server Application Programming Interface (ISAPI), this component typically handles specific requests. However, its configuration errors do not directly relate to the comprehensive server configuration management provided by httpd.conf, and it usually doesn’t expose verbose error messages valuable to attackers.
In summary, httpd.conf is pivotal in controlling server behavior and error reporting, making it a prime target for misconfiguration by hackers.
References:
https://httpd.apache.org/docs/2.4/configuring.html https://www.acunetix.com/blog/articles/10-common-website-security-misconfigurations/ https://www.OWASP.org/index.php/Top_10-2017_Top_10


Reference:

References:
https://httpd.apache.org/docs/2.4/configuring.html https://www.acunetix.com/blog/articles/10-common-website-security-misconfigurations/ https://www.OWASP.org/index.php/Top_10-2017_Top_10



Gerard, a disgruntled ex-employee of Sunglass IT Solutions, targets this organization to perform sophisticated attacks and bring down its reputation in the market. To launch the attacks process, he performed DNS footprinting to gather information about DNS servers and to identify the hosts connected in the target network. He used an automated tool that can retrieve information about DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois records. He further exploited this information to launch other sophisticated attacks.
What is the tool employed by Gerard in the above scenario?

  1. Towelroot
  2. Knative
  3. zANTI
  4. Bluto

Answer(s): D

Explanation:

D is correct because Bluto is a tool specifically designed for DNS reconnaissance, enabling attackers to extract detailed information about DNS zones and records of an organization.
Bluto automates the process of DNS footprinting, allowing users to collect critical information such as domain names, IP addresses, and network Whois records, which can be exploited in further attacks. This aligns with Gerard's actions of gathering intelligence before launching sophisticated attacks, thus indicating that Bluto is the appropriate tool in this scenario.
Evaluation of Other Options:

A: Towelroot : This is primarily an Android rooting tool that grants superuser access to the device. It does not focus on DNS reconnaissance or footprinting, making it unsuitable for the described scenario of gathering DNS-related data.
B: Knative : Knative is an open-source platform for building and deploying serverless applications on Kubernetes. It has no relevance to DNS enumeration or automated data retrieval related to network reconnaissance.
C: zANTI : While zANTI is a mobile penetration testing toolkit that includes network scanning features, it is not specifically optimized for extensive DNS zone enumeration like Bluto. Its capabilities are broader but less focused on DNS footprinting.
The distinction in functions among these tools reinforces the appropriateness of Bluto for the sophisticated DNS-based reconnaissance conducted by Gerard.
References:
https://owasp.org/www-project-top-ten/ https://www.cisecurity.org/ https://www.sans.org/white-papers/


Reference:

References:
https://owasp.org/www-project-top-ten/ https://www.cisecurity.org/ https://www.sans.org/white-papers/



Tony is a penetration tester tasked with performing a penetration test. After gaining initial access to a target system, he finds a list of hashed passwords.
Which of the following tools would not be useful for cracking the hashed passwords?

  1. Hashcat
  2. John the Ripper
  3. THC-Hydra
  4. netcat

Answer(s): D

Explanation:

D is correct because netcat is primarily a networking utility, not designed for password cracking.
Evaluation of Options:
Option A: Hashcat
Utility : A powerful GPU-accelerated password recovery tool capable of attacking various hash types efficiently, using techniques such as brute-force and dictionary attacks. Conclusion : Essential for cracking hashed passwords; hence it is a suitable choice.
Option B: John the Ripper
Utility : A renowned open-source password cracking software that supports numerous hash algorithms and is effective in performing both wordlist attacks and brute-force attacks. Conclusion : A fundamental forensic tool for password recovery, making it useful for this scenario.
Option C: THC-Hydra
Utility : A popular brute-force tool used for network authentication services, allowing attackers to automate the process of password guessing across numerous protocols. Conclusion : While primarily employed for online password cracking, it can indirectly assist in recovering or verifying passwords once they are presented.
Option D: Netcat
Utility : A versatile networking tool primarily used for network diagnostics, data transfer, or creating reverse shells. It lacks intrinsic capability to analyze or crack hashed passwords. Conclusion : As it does not perform hashing or password recovery tasks, it is inappropriate for cracking hashes and is the correct answer. References:
https://hashcat.net https://www.openwall.com/john/ https://www.thc.org/thc-hydra/



Viewing page 2 of 133
Viewing questions 9 - 16 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!