EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 8 )

Updated On: 31-Jul-2026

Allen, a professional pen tester, was hired by XpertTech Solutions to perform an attack simulation on the organization’s network resources. To perform the attack, he took advantage of the NetBIOS API and targeted the NetBIOS service. By enumerating NetBIOS, he found that port 139 was open and could see the resources that could be accessed or viewed on a remote system. He came across many NetBIOS codes during enumeration. Identify the NetBIOS code used for obtaining the messenger service running for the logged-in user?

  1. <00>
  2. <20>
  3. <03>
  4. <1B>

Answer(s): C

Explanation:

C is correct because the NetBIOS code <03> specifically identifies the Messenger service which is responsible for sending messages to the logged-in users on a machine.
The NetBIOS codes are structured to represent different services and resources within a network. The <03> code denotes the Messenger service, allowing enumeration of user sessions and the ability to send messages to those users. This is critical for penetration testers like Allen as it provides insights into user activity and system interactions within the network, potentially revealing vulnerabilities.
Option A (<00>) represents the "Workstation Service" and is used for browsing and identifying devices on the network. It does not relate to user messaging.
Option B (<20>) pertains to the "File Sharing Service" for the file system on a server. Although important for file access, it does not provide information regarding user messaging functionalities.
Option D (<1B>) indicates the "Domain Master Browser," which facilitates the browsing process within a domain. This code, while essential for network navigation, does not correlate with user message retrieval.
Understanding these distinctions is vital in identifying active network services and evaluating potential attack vectors, reinforcing the role of precise NetBIOS code recognition in ethical hacking methodologies.
References:
https://learn.microsoft.com/en-us/windows/win32/api/netbios/ https://www.secplicity.org/netbios-service-enumeration-guide/ https://portswigger.net/web-security/netbios-enumeration


Reference:

References:
https://learn.microsoft.com/en-us/windows/win32/api/netbios/ https://www.secplicity.org/netbios-service-enumeration-guide/ https://portswigger.net/web-security/netbios-enumeration



Don, a student, came across a gaming app in a third-party app store and installed it. Subsequently, all the legitimate apps in his smartphone were replaced by deceptive applications that appeared legitimate. He also received many advertisements on his smartphone after installing the app.
What is the attack performed on Don in the above scenario?

  1. SIM card attack
  2. Clickjacking
  3. SMS phishing attack
  4. Agent Smith attack

Answer(s): D

Explanation:

D is correct as it illustrates an Agent Smith attack, where an installed malicious application impersonates legitimate apps to take over a device.
The behavior exhibited by Don—replacement of legitimate applications with deceptive ones after the installation of a third-party gaming app—is characteristic of an Agent Smith attack. This type of attack often leverages a malware-infected application to modify existing applications on the device, allowing malicious operations while deceiving the user into believing they are interacting with legitimate software. The surge in ads following app installation further corroborates the malicious intent, indicative of adware functionalities typically seen in Agent Smith attacks.
Evaluation of Other Options:

A: SIM Card Attack: This form typically involves cloning or manipulating the SIM card for unauthorized access to mobile services. Since the scenario describes app modifications rather than mobile network manipulations, this option is not applicable.
B: Clickjacking: This attack involves tricking users into clicking on something different from what they believe they are clicking on, often through disguised content.
While potentially relevant in a broader context of user interactions, it does not directly correlate with the replacement of applications or the resulting ad behavior demonstrated by Don.
C: SMS Phishing Attack: This attack focuses on manipulating users into providing sensitive information via deceptive SMS messages. In Don's case, there is no mention of phishing or information theft via SMS, making this option irrelevant.
In conclusion, the characteristics of the scenario align most closely with the behaviors associated with an Agent Smith attack, as it significantly impacts the integrity of installed applications through malicious interference.
References:
https://www.csoonline.com/article/3299836/understanding-agent-smith-how-the-avast-backdoor-makes-its-way-into-apps.html https://www.zdnet.com/article/what-is-the-agent-smith-malware-and-why-is-it-so-dangerous/ https://www.forbes.com/sites/bernardmarr/2019/07/15/how-agent-smith-malware-infected-25-million-android-devices/?sh=5973d6384f35


Reference:

References:
https://www.csoonline.com/article/3299836/understanding-agent-smith-how-the-avast-backdoor-makes-its-way-into-apps.html https://www.zdnet.com/article/what-is-the-agent-smith-malware-and-why-is-it-so-dangerous/ https://www.forbes.com/sites/bernardmarr/2019/07/15/how-agent-smith-malware-infected-25-million-android-devices/?sh=5973d6384f35



Samuel, a security administrator, is assessing the configuration of a web server. He noticed that the server permits SSLv2 connections, and the same private key certificate is used on a different server that allows SSLv2 connections. This vulnerability makes the web server vulnerable to attacks as the SSLv2 server can leak key information.
Which of the following attacks can be performed by exploiting the above vulnerability?

  1. Padding oracle attack
  2. DROWN attack
  3. DUHK attack
  4. Side-channel attack

Answer(s): B

Explanation:

B is correct because the DROWN attack specifically targets servers that allow SSLv2 connections, exploiting the vulnerabilities associated with using outdated cryptographic protocols.
The DROWN (Decrypting RSA with Obsolete and Weakened eNcryption) attack leverages the fact that SSLv2 is cryptographically broken; specifically, it allows an attacker to exploit a legacy server that still supports SSLv2 to decrypt traffic from a more secure TLS-encrypted connection.
When SSLv2 is enabled on a server, even if it implements stronger security measures on other protocols, the weak encryption can act as a sufficient entry point for attackers to derive sensitive information such as session keys. This threat is particularly relevant if the same SSL certificate is shared across multiple services, as a successful exploit against one server could compromise others.
In contrast, the following options are incorrect:

A: Padding oracle attack: This attack targets encryption schemes that provide side-channel information allowing an attacker to manipulate padding bytes in encrypted data. It is generally not associated with SSLv2 or its specific vulnerabilities.
C: DUHK attack: This attack exploits weakly generated keys in certain contexts, typically involving poorly seeded random number generators. It does not directly exploit SSLv2 vulnerabilities but rather focuses on key generation weaknesses.
D: Side-channel attack: While a valid attack methodology, it refers broadly to extracting information from a system based on indirect observations (e.g., timing or power consumption), rather than specifically exploiting SSLv2 or cipher vulnerabilities.
For further information, consult these resources:
1. https://drownattack.com/ 2. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6293526/
3. https://www.openssl.org/blog/blog/2016/02/25/drown/



Clark, a professional hacker, was hired by an organization to gather sensitive information about its competitors surreptitiously. Clark gathers the server IP address of the target organization using Whois footprinting. Further, he entered the server IP address as an input to an online tool to retrieve information such as the network range of the target organization and to identify the network topology and operating system used in the network.
What is the online tool employed by Clark in the above scenario?

  1. DuckDuckGo
  2. AOL
  3. ARIN
  4. Baidu

Answer(s): C

Explanation:

C is the correct answer because ARIN (American Registry for Internet Numbers) is a regional Internet registry that provides information on IP address allocation, including network range and ownership details.
ARIN allows users to perform queries on IP addresses, offering insights on network topology and the organization associated with a given IP. This level of detail is critical for competitive intelligence in network environments.
Evaluation of Other Options:

A: DuckDuckGo : While it is a search engine focused on privacy, it does not provide specific information about IP addresses, network ranges, or organizational details. DuckDuckGo is primarily useful for general searches and does not cater to specialized requirements of footprinting.
B: AOL : AOL was widely recognized as an internet service provider and web portal but does not function as a tool for gathering technical details about network infrastructures. Its legacy services do not include network analysis or IP information lookup.
D: Baidu : Similar to DuckDuckGo, Baidu is a search engine primarily targeted at Chinese users. It lacks functionalities related to IP address querying and network intelligence and focuses more on general web content.
References:
https://www.arin.net https://whois.arin.net/ui/ https://www.iana.org/


Reference:

References:
https://www.arin.net https://whois.arin.net/ui/ https://www.iana.org/



You are a penetration tester and are about to perform a scan on a specific server. The agreement that you signed with the client contains the following specific condition for the scan: “The attacker must scan every port on the server several times using a set of spoofed source IP addresses.” Suppose that you are using Nmap to perform this scan.
What flag will you use to satisfy this requirement?

  1. The -g flag
  2. The -A flag
  3. The -f flag
  4. The -D flag

Answer(s): D

Explanation:

D is the correct answer because the -D flag in Nmap is used for decoy scanning, allowing the user to spoof multiple source IP addresses.
The requirement to scan every port while utilizing spoofed source IPs aligns perfectly with the function of the -D flag. This approach increases anonymity and mitigates the chances of detection, as Nmap will appear to originate from multiple hosts, complicating the attribution of the scanning activity to any single source. By effectively utilizing decoy hosts, penetration testers can gather information with minimal risk of alerting the target to their presence.
Evaluating the other options:

A: The -g flag is used to set the source port for the scan, which does not fulfill the requirement for source IP address spoofing. B. The -A flag enables OS detection and version detection, scripting, and traceroute, but it does not pertain to the manipulation of source IP addresses nor helps in scanning every port. C. The -f flag is intended for fragmenting packets, which provides evasion tactics against some intrusion detection systems but doesn't achieve the goal of spoofing source IPs.
Each of these flags serves distinct purposes that do not correspond to the client's explicit order to use spoofed IPs for scanning.
References:
https://nmap.org/book/man.html https://medium.com/@davidake/understanding-nmap-s-decoy-options-ec7cdbe1af98 https://www.cybrary.it/course/nmap/


Reference:

References:
https://nmap.org/book/man.html https://medium.com/@davidake/understanding-nmap-s-decoy-options-ec7cdbe1af98 https://www.cybrary.it/course/nmap/



Jude, a pen tester, examined a network from a hacker’s perspective to identify exploits and vulnerabilities accessible to the outside world by using devices such as firewalls, routers, and servers. In this process, he also estimated the threat of network security attacks and determined the level of security of the corporate network.
What is the type of vulnerability assessment that Jude performed on the organization?

  1. Application assessment
  2. External assessment
  3. Passive assessment
  4. Host-based assessment

Answer(s): B

Explanation:

B is correct because Jude conducted an external assessment, focusing on vulnerabilities exposed to outside threats.
In his role as a pen tester, Jude specifically analyzed the network's perimeter to identify exploitable vulnerabilities accessible from the internet. An external assessment evaluates potential attacks from a hacker's perspective without inside knowledge of the network, making it suitable for examining publicly accessible services, like web servers, firewalls, and routers. The goal is to ascertain the resilience of the network against external threats, which aligns precisely with Jude's actions.
Evaluation of Incorrect Options:

A: Application Assessment : This involves examining specific applications for vulnerabilities, such as web or mobile apps. Jude's focus was on network infrastructure rather than individual applications, disqualifying this option.
C: Passive Assessment : This type of assessment gathers information without direct interaction with the target systems. Jude actively examined the network, making a passive approach incompatible with his methodology.
D: Host-based Assessment : This type targets individual machines in a network to find vulnerabilities at the host level. Jude's examination was broader, focusing on the entire network perimeter rather than assessing singular hosts.
For further authoritative reference and insight into the subject, please consult the following sources:
https://www.eccouncil.org https://www.cybrary.it https://www.nist.gov/publications/guide-conducting-vulnerability-assessments



Widespread fraud at Enron, WorldCom, and Tyco led to the creation of a law that was designed to improve the accuracy and accountability of corporate disclosures. It covers accounting firms and third parties that provide financial services to some organizations and came into effect in 2002. This law is known by what acronym?

  1. SOX
  2. FedRAMP
  3. HIPAA
  4. PCI DSS

Answer(s): A

Explanation:

A: SOX is correct because the Sarbanes-Oxley Act was enacted to enhance corporate governance and accountability in financial reporting, directly addressing issues highlighted by the Enron, WorldCom, and Tyco scandals.
The Sarbanes-Oxley Act (SOX) established stringent reforms to improve the accuracy and reliability of corporate disclosures, which are fundamental for maintaining investor confidence and upholding the integrity of financial markets. SOX mandates stricter compliance protocols for publicly traded companies and imposes severe penalties for fraudulent financial activity. This law specifically targets financial statement creation and auditing processes, requiring that internal controls are robust and thoroughly documented, thus elevating the responsibility of both corporate executives and boards of directors.
Evaluation of Other Options:
B: FedRAMP - The Federal Risk and Authorization Management Program is a U.S. government program that provides a standardized approach to security assessment and authorization for cloud products and services. It is unrelated to corporate financial disclosures or accountability, focusing instead on cloud service security.
C: HIPAA - The Health Insurance Portability and Accountability Act is primarily concerned with the protection and confidentiality of medical information.
While it establishes privacy standards for health information, it does not pertain to corporate financial accountability or disclosures in the context highlighted by SOX.
D: PCI DSS - The Payment Card Industry Data Security Standard addresses security measures for card transactions and consumer data protection, focusing specifically on payment systems.
While vital for security within the payment industry, it does not govern corporate transparency or accountability for financial statements.
References:
https://www.congress.gov/bill/107th-congress/house-bill/3763 https://www.investopedia.com/terms/s/sarbanesoxleyact.asp https://www.sec.gov/spotlight/sarbanes-oxley.htm


Reference:

References:
https://www.congress.gov/bill/107th-congress/house-bill/3763 https://www.investopedia.com/terms/s/sarbanesoxleyact.asp https://www.sec.gov/spotlight/sarbanes-oxley.htm



Abel, a security professional, conducts penetration testing in his client organization to check for any security loopholes. He launched an attack on the DHCP servers by broadcasting forged DHCP requests and leased all the DHCP addresses available in the DHCP scope until the server could not issue any more IP addresses. This led to a DoS attack, and as a result, legitimate employees were unable to access the client’s network.
Which of the following attacks did Abel perform in the above scenario?

  1. Rogue DHCP server attack
  2. VLAN hopping
  3. STP attack
  4. DHCP starvation

Answer(s): D

Explanation:

D is correct as Abel performed a DHCP starvation attack, effectively exhausting the available IP addresses in the DHCP server's pool.
In the context of network security, a DHCP starvation attack involves sending a flood of forged DHCP requests, allowing the attacker to lease all available IP addresses within the DHCP scope. This prevents legitimate clients from obtaining an IP address, leading to a Denial of Service (DoS) condition, as seen in this scenario. The impact of such an attack can significantly disrupt network operations, rendering critical services inaccessible to authorized users.
Evaluation of Other Options:

A: Rogue DHCP server attack : This involves introducing an unauthorized DHCP server on the network that offers IP addresses to clients.
While it can lead to similar consequences, it differs fundamentally from the
DHCP starvation method employed by Abel, which specifically focuses on exhausting the IP pool rather than impersonating a legitimate server.
B: VLAN hopping : This refers to a technique where an attacker sends packets from one VLAN to another by exploiting misconfigurations in the network.
While a serious threat, it does not apply to the scenario, as no VLAN-based attacks are involved in the DHCP server compromise described.
C: STP attack : Spanning Tree Protocol (STP) attacks typically seek to disrupt the loop prevention mechanism in switched networks, allowing attackers to intercept traffic. Again, this is not relevant to the DHCP starvation method, which specifically targets IP address allocation rather than traffic management protocols.
In conclusion, the scenario illustrates a specialized attack aimed at disrupting DHCP services, reinforcing the correct identification of the attack as DHCP starvation.
References:
https://www.cisco.com/c/en/us/support/docs/ip/dynamic-host-configuration-protocol-dhcp/45693-dhcp-starvation.html https://www.helpnetsecurity.com/2021/06/17/dhcp-starvation-attack/ https://www.networkworld.com/article/2693381/what-is-dhcp-starvation-and-how-to-prevent-it.html


Reference:

References:
https://www.cisco.com/c/en/us/support/docs/ip/dynamic-host-configuration-protocol-dhcp/45693-dhcp-starvation.html https://www.helpnetsecurity.com/2021/06/17/dhcp-starvation-attack/ https://www.networkworld.com/article/2693381/what-is-dhcp-starvation-and-how-to-prevent-it.html



Viewing page 8 of 133
Viewing questions 36 - 40 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!