EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 3 )

Updated On: 12-May-2026

Which of the following Google advanced search operators helps an attacker in gathering information about websites that are similar to a specified target URL?

  1. [inurl:]
  2. [info:]
  3. [site:]
  4. [related:]

Answer(s): D

Explanation:

A short summary: related: helps identify sites similar to a target URL by listing pages related to that domain.
A) inurl: searches for a string within URLs, not for related sites.
B) info: returns information about a specific URL but does not find similar sites.
C) site: restricts results to a specific site, not similarity mappings.
D) related: returns domains similar to the target, enabling reconnaissance of similar websites.



You are a penetration tester working to test the user awareness of the employees of the client XYZ. You harvested two employees' emails from some public sources and are creating a client-side backdoor to send it to the employees via email.

Which stage of the cyber kill chain are you at?

  1. Reconnaissance
  2. Weaponization
  3. Command and control
  4. Exploitation

Answer(s): B

Explanation:

A client-side backdoor delivered via email constitutes weaponization, where the attacker constructs a weapon (malicious payload) to be delivered to targets using gathered vectors.
A) Reconnaissance is gathering information, not delivering or weaponizing payloads.
C) Command and control is the phase where the attacker maintains communications with compromised hosts, not the payload creation/delivery stage.
D) Exploitation is the stage where the vulnerability is leveraged to execute code on the target; weaponization precedes exploitation by preparing the payload.
Note: Proceeding with unauthorized delivery or backdoors is illegal and unethical; this explanation is for theoretical understanding only.



While performing an Nmap scan against a host, Paola determines the existence of a firewall.

In an attempt to determine whether the firewall is stateful or stateless, which of the following options would be best to use?

  1. -sA
  2. -sX
  3. -sT
  4. -sF

Answer(s): A

Explanation:

A) The -sA (ACK scan) helps infer firewall statefulness by analyzing how the target responds to unsolicited ACK packets, revealing whether filtering is stateful or stateless. B) -sX (Xmas scan) and D) -sF (FIN scan) rely on unusual flags but are not definitive for firewall state tracking; responses can vary by OS and filtering behavior. C) -sT (TCP connect scan) completes a full TCP handshake, which does not differentiate firewall statefulness as it is less likely to be blocked by access control policies. Therefore -sA best indicates stateful vs stateless filtering.



A newly joined employee, Janet, has been allocated an existing system used by a previous employee. Before issuing the system to Janet, it was assessed by Martin, the administrator. Martin found that there were possibilities of compromise through user directories, registries, and other system parameters. He also identified vulnerabilities such as native configuration tables, incorrect registry or file permissions, and software configuration errors.

What is the type of vulnerability assessment performed by Martin?

  1. Database assessment
  2. Host-based assessment
  3. Credentialed assessment
  4. Distributed assessment

Answer(s): B

Explanation:

A) A host-based assessment is correct because it evaluates the security posture of an individual system by examining local configurations, permissions, registry entries, and software settings to identify misconfigurations and vulnerabilities on that specific host.
B) Database assessment is incorrect because it focuses on evaluating database schemas, permissions, and data security, not the host machine’s configuration.
C) Credentialed assessment is incorrect because, while it may involve authenticated access, the scenario emphasizes system hardening and configuration weaknesses rather than credential-based testing.
D) Distributed assessment is incorrect because it involves multiple systems or network segments, whereas the description centers on a single host.



Jane, an ethical hacker, is testing a target organization's web server and website to identify security loopholes. In this process, she copied the entire website and its content on a local drive to view the complete profile of the site's directory structure, file structure, external links, images, web pages, and so on. This information helps Jane map the website's directories and gain valuable information.

What is the attack technique employed by Jane in the above scenario?

  1. Session hijacking
  2. Website mirroring
  3. Website defacement
  4. Web cache poisoning

Answer(s): B

Explanation:

An attacker copying an entire site locally to map structure isWebsite mirroring.
A) Session hijacking: incorrect because it involves stealing or using a valid session token to impersonate a user, not duplicating site content.
B) Website mirroring: correct; reproducing a site locally to analyze directory and link structure is mirroring.
C) Website defacement: incorrect; defacement alters the site’s appearance, not creates a local copy for analysis.
D) Web cache poisoning: incorrect; involves tampering with cached responses to mislead users, not duplicating the site locally.



An organization is performing a vulnerability assessment for mitigating threats. James, a pen tester, scanned the organization by building an inventory of the protocols found on the organization's machines to detect which ports are attached to services such as an email server, a web server, or a database server. After identifying the services, he selected the vulnerabilities on each machine and started executing only the relevant tests.

What is the type of vulnerability assessment solution that James employed in the above scenario?

  1. Service-based solutions
  2. Product-based solutions
  3. Tree-based assessment
  4. Inference-based assessment

Answer(s): D

Explanation:

James used inference-based assessment by deducing potential weaknesses from identified services and then targeting relevant tests, rather than running generic scans. A) Service-based solutions focus on specific services themselves, not the deduction process. B) Product-based solutions refer to vendor-specific tools, which is not indicated here. C) Tree-based assessment is a hierarchical decision model not described in the scenario. D) Inference-based assessment is correct as the tester infers vulnerability exposure from discovered protocols/services and prioritizes tests accordingly.



Taylor, a security professional, uses a tool to monitor her company's website, analyze the website's traffic, and track the geographical location of the users visiting the company's website.

Which of the following tools did Taylor employ in the above scenario?

  1. Webroot
  2. Web-Stat
  3. WebSite-Watcher
  4. WAFW00F

Answer(s): B

Explanation:

Taylor used a tool that monitors website traffic and geolocates visitors, which aligns with Web-Stat’s analytics and visitor-tracking capabilities.
A) Webroot: primarily an endpoint security and antivirus product, not a traffic analytics or geolocation tool.
B) Web-Stat: provides website traffic analysis and visitor location data, matching the scenario.
C) WebSite-Watcher: a website monitoring tool focused on changes and uptime, not traffic analytics or geolocation.
D) WAFW00F: a fingerprinting tool for identifying web application firewalls, not analytics or geolocation.



Becky has been hired by a client from Dubai to perform a penetration test against one of their remote offices. Working from her location in Columbus, Ohio, Becky runs her usual reconnaissance scans to obtain basic information about their network. When analyzing the results of her Whois search, Becky notices that the IP was allocated to a location in Le Havre, France.

Which regional Internet registry should Becky go to for detailed information?

  1. ARIN
  2. LACNIC
  3. APNIC
  4. RIPE

Answer(s): D

Explanation:

Becky should consult RIPE for detailed information because RIPE NCC administers IP address resources in Europe, the Middle East, and parts of Central Asia, including allocations to France. This is consistent with the reported Le Havre location, indicating European regional allocation data.
A) ARIN covers North America, not Europe, so it wouldn’t enumerate European allocations.
B) LACNIC serves Latin America and the Caribbean, not Europe.
C) APNIC covers Asia-Pacific regions, not Europe.
D) RIPE is the correct regional registry for European IP space and related WHOIS data.



Viewing page 3 of 105
Viewing questions 17 - 24 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!