EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 2 )

Updated On: 12-May-2026

In this form of encryption algorithm, every individual block contains 64-bit data, and three keys are used, where each key consists of 56 bits. Which is this encryption algorithm?

  1. IDEA
  2. Triple Data Encryption Standard
  3. AES
  4. MD5 encryption algorithm

Answer(s): B

Explanation:

Triple DES uses 64-bit blocks with three 56-bit keys, matching 64-bit data blocks and three 56-bit keys. A) IDEA uses 64-bit blocks with 128-bit key; B) Triple DES is correct because its 3-key variant (or two-key variant) uses three 56-bit keys and 64-bit blocks; C) AES operates on 128-bit blocks with key sizes of 128/192/256 bits, not 56-bit keys; D) MD5 is a hash function, not an encryption algorithm, and does not use block-based symmetric keys.



John is investigating web-application firewall logs and observers that someone is attempting to inject the following:



What type of attack is this?

  1. SQL injection
  2. Buffer overflow
  3. CSRF
  4. XSS

Answer(s): B

Explanation:

A) The input appears to cause a crash or memory mismanagement characteristic of a buffer overflow, which is why B is correct.
B) SQL injection involves modifying database queries with malicious SQL payloads, not general injection into app input that leads to crashes; not applicable here.
C) CSRF exploits authenticated sessions to perform unintended actions, not about injecting payloads to overflow buffers.
D) XSS injects script into web pages for client-side execution, not a generic input causing overflow; not the observed crash-oriented injection.



John, a professional hacker, performs a network attack on a renowned organization and gains unauthorized access to the target network. He remains in the network without being detected for a long time and obtains sensitive information without sabotaging the organization.

Which of the following attack techniques is used by John?

  1. Insider threat
  2. Diversion theft
  3. Spear-phishing sites
  4. Advanced persistent threat

Answer(s): D

Explanation:

The attack is an Advanced persistent threat (APT) because it involves unauthorized access, stealthy presence, long-term persistence, and objective to exfiltrate sensitive data without immediate sabotage.
A) Insider threat is incorrect because it refers to a trusted internal actor, not an external attacker maintaining stealthy access.
B) Diversion theft is incorrect as it implies a distraction-based scam, not sustained, covert network compromise.
C) Spear-phishing sites is incorrect since the scenario describes post-exploitation presence and data access, not initial credential theft via targeted phishing.
D) Correct because APT encapsulates long-term, covert, targeted network intrusions focused on data exfiltration.



You are attempting to run an Nmap port scan on a web server. Which of the following commands would result in a scan of common ports with the least amount of noise in order to evade IDS?

  1. nmap -A - Pn
  2. nmap -sP -p-65535 -T5
  3. nmap -sT -O -T0
  4. nmap -A --host-timeout 99 -T1

Answer(s): C

Explanation:

A concise explanation: C is correct because -sT performs a TCP connect scan, which is less stealthy but standard for basic port discovery; -O enables OS detection, providing more accurate results without aggressive evasion, and -T0 keeps timing slow to reduce noise.
A) -A enables aggressive scans (version, script, OS) and increases noise.
B) -sP (ping sweep) and -p-65535 with -T5 is a noisy, broad sweep unlikely for evasion.
D) -A with --host-timeout and -T1 still activates extensive probing and scripts, increasing detectability.



This wireless security protocol allows 192-bit minimum-strength security protocols and cryptographic tools to protect sensitive data, such as GCMP-256, HMAC-SHA384, and ECDSA using a 384-bit elliptic curve.

Which is this wireless security protocol?

  1. WPA3-Personal
  2. WPA3-Enterprise
  3. WPA2-Enterprise
  4. WPA2-Personal

Answer(s): B

Explanation:

WPA3-Enterprise provides 192-bit minimum-strength security, supporting advanced cryptographic tools like GCMP-256, HMAC-SHA384, and ECDSA with a 384-bit elliptic curve for enterprise-grade protection.
A) WPA3-Personal does not mandate 192-bit security or ECDSA-based enterprise cryptography; it relies on SAE and GCMP-256 for stronger protection than WPA2 but not the enterprise-grade suite described.
C) WPA2-Enterprise uses RSNE with AES-based ciphers but does not require 192-bit minimum-strength or ECDSA-384 by default.
D) WPA2-Personal uses PSK-based protection with AES, lacking the 192-bit minimum-strength and EC-based cryptography requirements.



What are common files on a web server that can be misconfigured and provide useful information for a hacker such as verbose error messages?

  1. httpd.conf
  2. administration.config
  3. php.ini
  4. idq.dll

Answer(s): C

Explanation:

Web servers commonly expose verbose PHP configuration details when misconfigured, making php.ini a source of leaked information (error display, exposed paths, version info) that aids attackers.
A) httpd.conf – misconfigurations here can reveal directory listings or site-level directives but not specifically verbose application-level info like PHP errors.
B) administration.config – not a standard or widely used web server/file; unlikely to hold informative misconfig data.
C) php.ini – correct; controls PHP error reporting and display errors, leaking sensitive data if misconfigured.
D) idq.dll – a nonstandard DLL name; not a typical source of verbose misconfig information on a web server.



Gerard, a disgruntled ex-employee of Sunglass IT Solutions, targets this organization to perform sophisticated attacks and bring down its reputation in the market. To launch the attacks process, he performed DNS footprinting to gather information about DNS servers and to identify the hosts connected in the target network. He used an automated tool that can retrieve information about DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois records. He further exploited this information to launch other sophisticated attacks.

What is the tool employed by Gerard in the above scenario?

  1. Towelroot
  2. Knative
  3. zANTI
  4. Bluto

Answer(s): D

Explanation:

A short-sentence justification: The tool described matches Bluto, which automates DNS footprinting and collection of DNS zone data, domain names, host names, IPs, records, and Whois.
A) Towelroot is an Android root exploit, not related to DNS reconnaissance.
B) Knative is a Kubernetes-based serverless framework, not a DNS enumeration tool.
C) zANTI is a mobile penetration testing toolkit for active network discovery, but not specifically the DNS footprinting automation described.
D) Bluto is the DNS footprinting utility that gathers zone data and related records, aligning with the scenario.



Tony is a penetration tester tasked with performing a penetration test. After gaining initial access to a target system, he finds a list of hashed passwords.

Which of the following tools would not be useful for cracking the hashed passwords?

  1. Hashcat
  2. John the Ripper
  3. THC-Hydra
  4. netcat

Answer(s): D

Explanation:

A) netcat would not be useful for cracking hashed passwords because it is a network utility used for reading and writing data across network connections, not for password cracking.
B) Hashcat is a GPU-accelerated password cracker designed to crack hashed passwords using various attack modes (straight, combinator, brute-force, mask, and rule-based).
C) John the Ripper is a widely used password cracker that supports many hash formats and modes, suitable for offline password cracking.
D) THC-Hydra is a parallelized login cracker focused on network protocols for guessing credentials, not primarily a hash-cracking tool.



Viewing page 2 of 105
Viewing questions 9 - 16 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!