EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 3 )

Updated On: 31-Jul-2026

Which of the following Google advanced search operators helps an attacker in gathering information about websites that are similar to a specified target URL?

  1. [inurl:]
  2. [info:]
  3. [site:]
  4. [related:]

Answer(s): D

Explanation:

D is correct because the [related:] operator specifically identifies websites that are similar to a targeted URL, facilitating an attacker’s reconnaissance phase in gathering intelligence on potential vulnerabilities.
The [related:] operator allows users to discover sites that Google recognizes as having similar content or context, which can be crucial for understanding competing entities, associated resources, or potential application weaknesses. This targeted search enhances an attacker's ability to map the threat landscape surrounding the primary target, thereby informing their strategies.
Evaluation of other options:

A: [inurl:] : This operator focuses on finding specific terms within the URL of web pages, which is useful for identifying specific resources or endpoints on a website but does not help in discovering similar websites.
B: [info:] : This operator provides information about a particular site, such as a summary of the page, cache, and links, but does not inherently reveal related or similar sites, thus lacking in comparative breadth.
C: [site:] : This operator restricts results to a specific domain, which aids in narrowing down the search to a particular site’s content without offering insight into other similar websites, limiting its utility for comparative analysis.
By utilizing the [related:] operator effectively, ethical hackers can enhance their intelligence-gathering processes, enabling a more informed penetration testing or vulnerability assessment approach.
References:
https://www.google.com/advanced_search https://support.google.com/websearch/answer/35198 https://ahrefs.com/blog/google-search-operators/


Reference:

References:
https://www.google.com/advanced_search https://support.google.com/websearch/answer/35198 https://ahrefs.com/blog/google-search-operators/



You are a penetration tester working to test the user awareness of the employees of the client XYZ. You harvested two employees’ emails from some public sources and are creating a client-side backdoor to send it to the employees via email.
Which stage of the cyber kill chain are you at?

  1. Reconnaissance
  2. Weaponization
  3. Command and control
  4. Exploitation

Answer(s): B

Explanation:

B is correct because the process of creating a client-side backdoor after harvesting employees' emails involves preparing a payload to be delivered to the target.
Justification for Correct Answer:
During the Weaponization stage, an attacker combines an exploit with a payload, such as a backdoor, to be delivered to the victim. Harvesting emails demonstrates active preparation by building a suitable delivery mechanism, indicating that the attacker is at the stage of weaponization.
Evaluation of Other Options:

A: Reconnaissance : This stage involves gathering information about the target and potential vulnerabilities.
While email harvesting falls under reconnaissance, the act of creating a backdoor indicates progress beyond mere information gathering.
C: Command and Control : This stage pertains to establishing a communication channel between the attacker and the compromised system. Since the action here is about creating the payload and not about enabling remote control, this stage does not apply.
D: Exploitation : This stage entails exploiting a vulnerability to execute the payload. This option misrepresents the context, as you have not yet deployed the backdoor; you are still in the preparatory phase of weaponization.
References:
https://www.cisecurity.org/white-papers/cyber-kill-chain/ https://www.sans.org/white-papers/36557/ https://www.nist.gov/itl/publications/malware-detecting-attack-and-defense-strategies-cyber-kill-chain-approach


Reference:

References:
https://www.cisecurity.org/white-papers/cyber-kill-chain/ https://www.sans.org/white-papers/36557/ https://www.nist.gov/itl/publications/malware-detecting-attack-and-defense-strategies-cyber-kill-chain-approach



While performing an Nmap scan against a host, Paola determines the existence of a firewall. In an attempt to determine whether the firewall is stateful or stateless, which of the following options would be best to use?

  1. -sA
  2. -sX
  3. -sT
  4. -sF

Answer(s): A

Explanation:

Option A, using the command -sA , is correct because it performs an ACK scan, which is effective in determining whether a firewall is stateful or stateless by analyzing the responses to potentially unsolicited packets.
Justification for Option A:
The -sA (ACK scan) option specifically sends TCP ACK packets to the target. In a stateful firewall scenario,
the firewall tracks the connection state. If the firewall replies with a reset (RST), it is likely stateful as it has recognized a previous connection state. Conversely, if there is no response or an ICMP unreachable message is returned, the firewall may be stateless.
Evaluation of Other Options:
Option B: -sX (Xmas scan) The XMAS scan sends packets with the FIN, PSH, and URG flags set, which can be effective in identifying open ports but is less reliable for distinguishing between stateful and stateless firewalls. Firewalls may treat the unusual flag combination differently, making it a less precise method for this analysis. Option C: -sT (TCP connect scan)
The TCP connect scan establishes a full TCP connection by completing the three-way handshake.
While it can reveal open ports, it does not differentiate between the nature of the firewall protocols, as it exposes the scanning host and may even alert the firewall to the scan. Option D: -sF (FIN scan) The FIN scan sends packets with only the FIN flag set, which can elicit responses from open and closed ports; however, like the XMAS scan, it does not provide explicit insights into whether the firewall is stateful or stateless.
In summary, -sA is the most effective method as it directly elicits responses pertinent to the connection state management of the firewall, which the other options fail to do efficiently.
Authoritative References:
Nmap Network Scanning Nmap Documentation Understanding Firewalls



A newly joined employee, Janet, has been allocated an existing system used by a previous employee. Before issuing the system to Janet, it was assessed by Martin, the administrator. Martin found that there were possibilities of compromise through user directories, registries, and other system parameters. He also identified vulnerabilities such as native configuration tables, incorrect registry or file permissions, and software configuration errors.
What is the type of vulnerability assessment performed by Martin?

  1. Database assessment
  2. Host-based assessment
  3. Credentialed assessment
  4. Distributed assessment

Answer(s): B

Explanation:

Correct Answer: B. Host-based assessment.
The vulnerability assessment performed by Martin is classified as a host-based assessment because it concentrates on evaluating a specific system’s vulnerabilities, such as user directories, registries, and file configurations on the host itself. This assessment encompasses the identification of risks inherent to the system's local configurations, file permissions, and installed software, which is distinctive of a host-based approach focusing on a single machine's security posture.
Reasoning: In a host-based assessment, vulnerabilities are identified at the level of individual machines rather than across an entire network or application. Martin's evaluation of user directories and registry settings directly aligns with this focus, aiming to secure the end-point system prior to handover to a new employee. The intent is to mitigate risks associated with residual data and configuration errors left by the previous user, thereby enhancing the security integrity of the system before deployment.
Critical Evaluation of Other Options:

A: Database assessment This option focuses specifically on identifying vulnerabilities within databases, such as SQL injection faults or misconfigured access controls. Since Martin's assessment revolved around the operating system and configurations rather than database vulnerabilities, this option is not relevant.
C: Credentialed assessment While this approach simulates an internal threat by utilizing valid credentials to assess vulnerabilities, it does not solely concentrate on the host’s specific configurations and vulnerabilities. Martin's evaluation is broader, targeting various system parameters, making this classification inadequate.
D: Distributed assessment This method analyzes multiple systems in a networked environment, typically assessing inter-system vulnerabilities and communication channels. Since Martin's evaluation is concentrated on a single system, this classification is inappropriate for the situation described.
Authoritative References:
https://www.cyber.gov.au/acsc/view-all-content/publications/vulnerability-assessment https://www.nist.gov/publications/vulnerability-assessment-fundamentals-directive https://www.cisa.gov/uscert/ncas/tips/ST04-005



Jane, an ethical hacker, is testing a target organization’s web server and website to identify security loopholes. In this process, she copied the entire website and its content on a local drive to view the complete profile of the site’s directory structure, file structure, external links, images, web pages, and so on. This information helps Jane map the website’s directories and gain valuable information.
What is the attack technique employed by Jane in the above scenario?

  1. Session hijacking
  2. Website mirroring
  3. Website defacement
  4. Web cache poisoning

Answer(s): B

Explanation:

B is correct because website mirroring involves creating a local copy of a target site, allowing the ethical hacker to analyze its structure and content for vulnerabilities.
Website mirroring is a legitimate technique used in security assessments to deeply analyze web server architectures, file structures, and potential security loopholes. By replicating the website's content, Jane effectively creates a sandbox environment where various attack vectors can be tested without impacting the live system. This initial phase is crucial in the reconnaissance stage of penetration testing, where understanding the site’s layout and configuration can reveal misconfigurations, outdated components, or potential entry points for exploitation.
Evaluation of Other Options:

A: Session hijacking : This technique involves taking control of a user session after authentication. It is not applicable here because Jane is not intercepting or exploiting active user sessions, but rather analyzing static website content.
C: Website defacement : This term refers to the unauthorized alteration of a website’s appearance. Jane's actions do not involve modifying or tampering with existing content but aim to understand the site without altering it in any form.
D: Web cache poisoning : This exploit manipulates the responses stored in a cache to serve malicious content to users. It is not relevant in this scenario, as Jane is not manipulating cache responses but is instead gathering data about the existing structure and setup of the website.
In conclusion, option B accurately characterizes the activity undertaken by Jane, while the other options do not apply to the process of mapping and assessing a website's vulnerabilities comprehensively.
References:
https://www.sans.org/white-papers/25 https://owasp.org/www-community/attacks/Website_Mirroring https://www.csoonline.com/article/3518327/what-is-ethical-hacking.html


Reference:

References:
https://www.sans.org/white-papers/25 https://owasp.org/www-community/attacks/Website_Mirroring https://www.csoonline.com/article/3518327/what-is-ethical-hacking.html



An organization is performing a vulnerability assessment for mitigating threats. James, a pen tester, scanned the organization by building an inventory of the protocols found on the organization’s machines to detect which ports are attached to services such as an email server, a web server, or a database server. After identifying the services, he selected the vulnerabilities on each machine and started executing only the relevant tests.
What is the type of vulnerability assessment solution that James employed in the above scenario?

  1. Service-based solutions
  2. Product-based solutions
  3. Tree-based assessment
  4. Inference-based assessment

Answer(s): D

Explanation:

D is correct as it describes a method of assessment based on inferences drawn from observed data and service behaviors.
In James’ scenario, he methodically evaluated the services running on the organization’s machines, inferring potential vulnerabilities based on the specific protocols detected and their corresponding configurations. This inference-based assessment prioritizes relevant tests that target the identified services, reflecting a strategic approach to vulnerability identification that reduces unnecessary scanning and focuses resources effectively.
Evaluation of Other Options:

A: Service-based solutions refer to assessments that are inherently reliant on established services without necessarily correlating inference-derived insights directly from operational behavior. James’ method involved a deep understanding of the interplay between service configuration and potential vulnerabilities, distinguishing it from merely cataloging services.
B: Product-based solutions imply a standardized evaluation method linked to specific tools or software vendors. In contrast, James utilized a tailored approach centered on the organization’s unique operational protocols, which transcends the generic configurations often observed in product-based assessments.
C: Tree-based assessment involves structured decision-making processes to analyze potential vulnerabilities.
While useful, it lacks the nuanced inference method evident in James’ strategy, where the focus is not on a rigid decision tree but rather a flexible analysis of the operational context surrounding each service.
The reasoning reflects a critical understanding of vulnerability assessment methodologies, highlighting the significance of tailoring approaches to organizational context and the implications of service interactions.
References:
https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/ https://www.csoonline.com/article/3252279/how-to-perform-a-vulnerability-assessment.html https://www.sans.org/white-papers/37412/


Reference:

References:
https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/ https://www.csoonline.com/article/3252279/how-to-perform-a-vulnerability-assessment.html https://www.sans.org/white-papers/37412/



Taylor, a security professional, uses a tool to monitor her company’s website, analyze the website’s traffic, and track the geographical location of the users visiting the company’s website.
Which of the following tools did Taylor employ in the above scenario?

  1. Webroot
  2. Web-Stat
  3. WebSite-Watcher
  4. WAFW00F

Answer(s): B

Explanation:

B is correct because Web-Stat specifically provides detailed analytics on website traffic and geographic user location.
Web-Stat is a web analytics tool designed to monitor website traffic, analyze user behavior, and track geographical data of visitors, making it the most appropriate choice for Taylor’s requirements. It aggregates metrics such as unique visits, page views, and user locations, allowing security professionals to understand user engagement and identify potential security threats based on geographic patterns.
Evaluation of Other Options:

A: Webroot : This tool primarily focuses on endpoint security solutions, such as antivirus and malware protection, rather than web traffic analytics.
While it contributes to overall website security, it does not provide the specific traffic monitoring and geographical tracking functionality that Taylor requires.
C: WebSite-Watcher : This tool is designed for monitoring web page changes and alerts users of updates.
While it can track website modifications, it lacks comprehensive traffic analysis and geographic user location tracking capabilities, thus failing to meet Taylor's needs.
D: WAFW00F : This tool is used to identify and fingerprint Web Application Firewalls (WAFs) present on web applications. Its primary function is security assessment rather than traffic analytics, making it unsuitable for the monitoring tasks Taylor is conducting.
In conclusion, Web-Stat stands out as the most relevant option for Taylor's task of analyzing website traffic and visitor geography, while the other options either focus on security measures or niche monitoring activities.
References:
https://www.web-stat.com https://www.webroot.com/en https://www.aigner.com/webwatcher


Reference:

References:
https://www.web-stat.com https://www.webroot.com/en https://www.aigner.com/webwatcher



Becky has been hired by a client from Dubai to perform a penetration test against one of their remote offices. Working from her location in Columbus, Ohio, Becky runs her usual reconnaissance scans to obtain basic information about their network.
When analyzing the results of her Whois search, Becky notices that the IP was allocated to a location in Le Havre, France.
Which regional Internet registry should Becky go to for detailed information?

  1. ARIN
  2. LACNIC
  3. APNIC
  4. RIPE

Answer(s): D

Explanation:

D is correct because Le Havre, France, falls under the jurisdiction of the RIPE NCC, the regional Internet registry for Europe, the Middle East, and parts of Central Asia.
The classification of Internet resources is governed by regional Internet registries (RIRs). RIPE NCC, as the RIR for Europe, manages IP address allocations for that geographic area, meaning that any IP address allocated to a location in France would be registered with RIPE. This makes RIPE the appropriate source for detailed information concerning the allocated IP in question.
Evaluation of Other Options :

A: ARIN (American Registry for Internet Numbers) : This registry primarily serves North America, and therefore would not have jurisdiction over IP allocations in France. Consequently, attempting to look up IP details via ARIN would yield irrelevant results for a European-based allocation.
B: LACNIC (Latin America and Caribbean Network Information Centre) : Like ARIN, LACNIC is focused on the Latin American and Caribbean regions. Since Le Havre is in France, information related to that IP allocation would not be available through LACNIC.
C: APNIC (Asia-Pacific Network Information Centre) : APNIC governs IP addresses for the Asia-Pacific region. Similar to LACNIC and ARIN, APNIC would not provide relevant information for an IP address located in France.
In conclusion, RIPE is the only applicable and authoritative source for investigating the IP address that Becky queried, given its regional focus.
References:
https://www.ripe.net https://www.arin.net https://www.apnic.net


Reference:

References:
https://www.ripe.net https://www.arin.net https://www.apnic.net



Viewing page 3 of 133
Viewing questions 17 - 24 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!