Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-50v13

EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 4 )

Updated On: 12-May-2026
Page 4 of 105
PDF with 862 Questions

Harry, a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection.

What is the APT lifecycle phase that Harry is currently executing?

  1. Initial intrusion
  2. Persistence
  3. Cleanup
  4. Preparation

Answer(s): A

Explanation:

Harry is currently in the Initial intrusion phase, as he is actively breaching defenses via spear-phishing and exploiting public-facing servers to deploy malware and establish access. APT lifecycle phases: Initial intrusion (or initial access) involves penetrating defenses and gaining foothold. B) Persistence would involve actions to maintain access after initial intrusion, not described here. C) Cleanup refers to removing traces and cover tracks, which is not indicated. D) Preparation is prior to attack execution, including planning, reconnaissance, and tool development; the actual breach and deployment described occur during initial intrusion, not preparation. Thus A is correct.



Robin, a professional hacker, targeted an organization's network to sniff all the traffic. During this process, Robin plugged in a rogue switch to an unused port in the LAN with a priority lower than any other switch in the network so that he could make it a root bridge that will later allow him to sniff all the traffic in the network.

What is the attack performed by Robin in the above scenario?

  1. ARP spoofing attack
  2. STP attack
  3. DNS poisoning attack
  4. VLAN hopping attack

Answer(s): B

Explanation:

Robin’s action targets spanning tree protocol behavior by introducing a rogue switch and attempting to become the root bridge, enabling traffic sniffing across the LAN. This is a STP attack.
A) ARP spoofing attack
Not correct: ARP spoofing manipulates IP-to-MAC mappings to intercept traffic on a host level, not by altering STP topology or root bridge election.
B) STP attack
Correct: For STP, a rogue device advertised or placed to influence root bridge election causes the topology to funnel traffic through the attacker’s device, enabling sniffing.
C) DNS poisoning attack
Not correct: DNS poisoning corrupts name-to-IP mappings at the resolver level, unrelated to STP or root bridge manipulation.
D) VLAN hopping attack
Not correct: VLAN hopping aims to cross VLAN boundaries, typically via double tagging or misconfigurations, not by becoming the STP root bridge.



An attacker utilizes a Wi-Fi Pineapple to run an access point with a legitimate-looking SSID for a nearby business in order to capture the wireless password.

What kind of attack is this?

  1. MAC spoofing attack
  2. War driving attack
  3. Phishing attack
  4. Evil-twin attack

Answer(s): D

Explanation:

The correct answer is D) Evil-twin attack. An attacker deploys a rogue AP with a legitimate-sounding SSID to capture credentials, matching the definition of an evil twin in wireless security. A) MAC spoofing attack involves deceiving devices by falsifying MAC addresses, not creating a rogue AP. B) War driving is the passive scanning and mapping of wireless networks from a moving vehicle, not credential harvesting via a deceptive AP. C) Phishing attack targets users via deceptive communications; it is not specifically a wireless rogue AP scenario. Evil-twin directly describes the rogue AP impersonation tactic used here.



CyberTech Inc. recently experienced SQL injection attacks on its official website. The company appointed Bob, a security professional, to build and incorporate defensive strategies against such attacks. Bob adopted a practice whereby only a list of entities such as the data type, range, size, and value, which have been approved for secured access, is accepted.

What is the defensive technique employed by Bob in the above scenario?

  1. Whitelist validation
  2. Output encoding
  3. Blacklist validation
  4. Enforce least privileges

Answer(s): A

Explanation:

A) Whitelist validation is correct because Bob restricts input to an approved set of data types, ranges, sizes, and values, ensuring only known good values are accepted, which mitigates SQL injection by rejecting anything not on the whitelist.
B) Output encoding mitigates injection at output time, not by restricting inputs; it does not prevent crafting malicious input from being accepted.
C) Blacklist validation blocks known bad patterns, but cannot cover all possible payloads, making it less robust than a whitelist approach.
D) Enforce least privileges deals with access rights, not input validation or input-side defenses against SQL injection.



Joe works as an IT administrator in an organization and has recently set up a cloud computing service for the organization. To implement this service, he reached out to a telecom company for providing Internet connectivity and transport services between the organization and the cloud service provider.

In the NIST cloud deployment reference architecture, under which category does the telecom company fall in the above scenario?

  1. Cloud consumer
  2. Cloud broker
  3. Cloud auditor
  4. Cloud carrier

Answer(s): D

Explanation:

The telecom company provides transport and connectivity between the organization and the cloud provider, which aligns with the Cloud carrier role in the NIST reference architecture.
A) Cloud consumer - incorrect because the organization consuming cloud services is the customer, not the transport provider.
B) Cloud broker - incorrect because brokers mediate and facilitate selections between cloud services, not provide transport.
C) Cloud auditor - incorrect because auditors assess compliance and security, not supply connectivity.
D) Cloud carrier - correct because carriers deliver the network transport services required for cloud deployment.



Bobby, an attacker, targeted a user and decided to hijack and intercept all their wireless communications. He installed a fake communication tower between two authentic endpoints to mislead the victim. Bobby used this virtual tower to interrupt the data transmission between the user and real tower, attempting to hijack an active session. Upon receiving the user's request, Bobby manipulated the traffic with the virtual tower and redirected the victim to a malicious website.

What is the attack performed by Bobby in the above scenario?

  1. aLTEr attack
  2. Jamming signal attack
  3. Wardriving
  4. KRACK attack

Answer(s): A

Explanation:

The attack is an aLTEr attack because it creates a rogue access point (fake cellular tower) to intercept, hijack, and manipulate ongoing communications between a user and the legitimate network, enabling session hijacking and redirection to malicious sites.
A) aLTEr attack — correct: rogue base transceiver creates man-in-the-middle position to intercept and alter traffic.
B) Jamming signal attack — incorrect: jamming disrupts communications, not impersonating a tower or manipulating targeted sessions.
C) Wardriving — incorrect: locating wireless networks, not offensive MITM through a fake tower.
D) KRACK attack — incorrect: targets WPA2 cryptographic handshakes to reinstall keys, not rogue tower MITM.



John, a professional hacker, targeted an organization that uses LDAP for accessing distributed directory services. He used an automated tool to anonymously query the LDAP service for sensitive information such as usernames, addresses, departmental details, and server names to launch further attacks on the target organization.

What is the tool employed by John to gather information from the LDAP service?

  1. ike-scan
  2. Zabasearch
  3. JXplorer
  4. EarthExplorer

Answer(s): C

Explanation:

John used JXplorer to enumerate LDAP directory information, which is a Java-based LDAP browser that can query and retrieve user, group, and server details from an LDAP service, aiding reconnaissance for further attacks.
A) ike-scan is a tool for IPsec/IKE scanning and fingerprinting, not LDAP enumeration.
B) Zabasearch is an online people search engine, not an LDAP query tool.
D) EarthExplorer refers to a geospatial tool, not LDAP directory access.



Annie, a cloud security engineer, uses the Docker architecture to employ a client/server model in the application she is working on. She utilizes a component that can process API requests and handle various Docker objects, such as containers, volumes, images, and networks.

What is the component of the Docker architecture used by Annie in the above scenario?

  1. Docker objects
  2. Docker daemon
  3. Docker client
  4. Docker registries

Answer(s): B

Explanation:

The Docker daemon is the component that processes API requests and manages Docker objects (containers, images, volumes, networks) in a client/server architecture.
A) Docker objects are the data structures representing containers, images, volumes, and networks, not the processing service.
B) Docker daemon
C) Docker client is the command-line/REST client that talks to the daemon, not the processing core.
D) Docker registries store and distribute images, not handle API requests or object lifecycle.



Viewing page 4 of 105
Viewing questions 25 - 32 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!