Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-50v13

EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 6 )

Updated On: 12-May-2026
Page 6 of 105
PDF with 862 Questions

Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs.

What type of malware did the attacker use to bypass the company's application whitelisting?

  1. File-less malware
  2. Zero-day malware
  3. Phishing malware
  4. Logic bomb malware

Answer(s): A

Explanation:

A) File-less malware is correct because it operates in memory or uses legitimate system tools to evade traditional file-based AV and whitelist controls, enabling data exfiltration without dropping persistent executables. B) Zero-day malware relies on unknown exploits but does not specifically address bypassing application whitelisting; it’s about exploit novelty, not evasion by using in-memory techniques. C) Phishing malware involves deceiving users to install or run software, not bypassing whitelisting via in-memory execution. D) Logic bomb malware executes only when a condition is met within legitimate code; it does not inherently evade application whitelisting or exfiltrate data stealthily.



Dorian is sending a digitally signed email to Poly. With which key is Dorian signing this message and how is Poly validating it?

  1. Dorian is signing the message with his public key, and Poly will verify that the message came from Dorian by using Dorian's private key.
  2. Dorian is signing the message with Poly's private key, and Poly will verify that the message came from Dorian by using Dorian's public key.
  3. Dorian is signing the message with his private key, and Poly will verify that the message came from Dorian by using Dorian's public key.
  4. Dorian is signing the message with Poly's public key, and Poly will verify that the message came from Dorian by using Dorian's public key.

Answer(s): C

Explanation:

D) C is correct: Dorian signs with his private key; Poly verifies with Dorian’s public key to confirm origin and integrity.
A) Incorrect: signing with public key is not possible; public keys are for verification, not signing.
B) Incorrect: signing with Poly’s private key would not prove Dorian’s identity; verification would require Poly’s public key, not Dorian’s.
C) Correct: digital signatures use the sender’s private key for signing and the corresponding public key for verification.
D) Incorrect: Poly’s public key would be used to encrypt or verify, but the signer’s private key is essential for a valid digital signature; this option misattributes key usage.



Scenario: Joe turns on his home computer to access personal online banking. When he enters the URL www.bank.com, the website is displayed, but it prompts him to re-enter his credentials as if he has never visited the site before. When he examines the website URL closer, he finds that the site is not secure and the web address appears different.

What type of attack he is experiencing?

  1. DHCP spoofing
  2. DoS attack
  3. ARP cache poisoning
  4. DNS hijacking

Answer(s): D

Explanation:

A) DNS hijacking is correct because it describes tampering with the domain name resolution to redirect the user to a fraudulent site that imitates the legitimate bank, causing credential prompts and a deceptive URL. The site appearing different and not secure indicates DNS manipulation or host/user redirection.
B) DHCP spoofing is incorrect because it involves fraudulent DHCP responses to assign incorrect IP configuration, not altering website content or credentials redirection at the URL level.
C) ARP cache poisoning is incorrect because it disrupts local network traffic by mapping IPs to wrong MAC addresses, not typically changing secure website URLs or phishing-like credential prompts at the application layer.
D) DoS attack is incorrect because it aims to exhaust resources to disrupt service, not to redirect users or harvest credentials through a counterfeit site.



Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney's account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney's account.

What is the attack performed by Boney in the above scenario?

  1. Forbidden attack
  2. CRIME attack
  3. Session donation attack
  4. Session fixation attack

Answer(s): D

Explanation:

A successful session fixation attack. It exploits a valid session ID created by the attacker or prior login and forces the victim to use it, tying the victim’s session to the attacker's account page and any subsequent inputs (e.g., payment details) to the attacker.
A) Forbidden attack is not a recognized OWASP/attack category. B) CRIME targets TLS compression to leak data, not session linkage. C) Session donation attack is not a standard term in this context. D) Session fixation accurately describes forcing a user to use a known session ID and associating actions with that session.



Kevin, a professional hacker, wants to penetrate CyberTech Inc's network. He employed a technique, using which he encoded packets with Unicode characters. The company's IDS cannot recognize the packets, but the target web server can decode them.

What is the technique used by Kevin to evade the IDS system?

  1. Session splicing
  2. Urgency flag
  3. Obfuscating
  4. Desynchronization

Answer(s): C

Explanation:

The technique is obfuscating (C) because it involves encoding or altering payloads (e.g., via Unicode encoding) to conceal malicious content from IDS while the target server can decode and process it.
A) Session splicing is a method of splitting or rearranging segments across multiple packets to evade IDS, not specifically Unicode encoding. B) Urgency flag refers to TCP flag manipulation to bypass rate limits, not content encoding. D) Desynchronization disrupts protocol state between client and server to confuse IDS, not Unicode-based encoding. C) Obfuscating correctly identifies encoding-based concealment used to evade detection by IDS while enabling the server to decode. Ensure terminology aligns with evasion techniques in the exam context.



Suppose that you test an application for the SQL injection vulnerability. You know that the backend database is based on Microsoft SQL Server. In the login/password form, you enter the following credentials:



Based on the above credentials, which of the following SQL commands are you expecting to be executed by the server, if there is indeed an SQL injection vulnerability?

  1. select * from Users where UserName = `attack' ' or 1=1 -- and UserPassword = `123456'
  2. select * from Users where UserName = `attack' or 1=1 -- and UserPassword = `123456'
  3. select * from Users where UserName = `attack or 1=1 -- and UserPassword = `123456'
  4. select * from Users where UserName = `attack' or 1=1 --' and UserPassword = `123456'

Answer(s): B

Explanation:

An SQL injection payload using or 1=1 typically results in a tautology bypass in the WHERE clause, effectively returning all rows when credentials are concatenated into a single string. B demonstrates correct syntax: the username input becomes attack' or 1=1 --, which renders the query: select * from Users where UserName = 'attack' or 1=1 -- and UserPassword = '123456'. A, C, and D are syntactically invalid or alter the intended logic: A includes misplaced quotes around 1=1; C lacks closing quote for UserName string; D places an extra quote before --, breaking the comment and causing errors or incorrect parsing.



Which of the following commands checks for valid users on an SMTP server?

  1. RCPT
  2. CHK
  3. VRFY
  4. EXPN

Answer(s): C

Explanation:

A user verification request on an SMTP server is validated with VRFY to confirm if an address or mailbox exists on the server.
A) RCPT is used to specify a recipient during the SMTP dialogue but does not confirm existence by itself.
B) CHK is not a standard SMTP command for user verification.
C) VRFY is the correct command to query the server for a listed user.
D) EXPN expands a mailing list to reveal its members, not simply verify a single user.



Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates.

Which of the following protocols is used by Bella?

  1. FTPS
  2. FTP
  3. HTTPS
  4. IP

Answer(s): A

Explanation:

The correct answer is A) FTPS because it adds TLS/SSL encryption to FTP, protecting data in transit and verifying identity with digital certificates, mitigating plaintext exposure and session hijacking. FTP alone (B) transmits in plaintext, so it doesn’t secure credentials or sessions. HTTPS (C) uses HTTP over TLS, suitable for web traffic but not the primary FTP-style file transfer protocol described. IP (D) refers to the Internet Protocol, not an application-layer secure file transfer protocol and does not provide encryption or certificate-based authentication.



Viewing page 6 of 105
Viewing questions 41 - 48 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!