EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 8 )

Updated On: 12-May-2026

Allen, a professional pen tester, was hired by XpertTech Solutions to perform an attack simulation on the organization's network resources. To perform the attack, he took advantage of the NetBIOS API and targeted the NetBIOS service. By enumerating NetBIOS, he found that port 139 was open and could see the resources that could be accessed or viewed on a remote system. He came across many NetBIOS codes during enumeration.

Identify the NetBIOS code used for obtaining the messenger service running for the logged-in user?

  1. <00>
  2. <20>
  3. <03>
  4. <1B>

Answer(s): C

Explanation:

The NetBIOS code <03> corresponds to the Messenger service listing for the logged-in user, which is the service used to obtain the messenger session and related messaging resources.
A) <00> indicates the name query or workgroup/browser services, not the Messenger service.
B) <20> is the file/time stamp or create/priority class for certain NetBIOS name types, not the Messenger service.
D) <1B> is the NetBIOS remote machine name session service, not specifically the Messenger service for the logged-in user.



Don, a student, came across a gaming app in a third-party app store and installed it. Subsequently, all the legitimate apps in his smartphone were replaced by deceptive applications that appeared legitimate. He also received many advertisements on his smartphone after installing the app.

What is the attack performed on Don in the above scenario?

  1. SIM card attack
  2. Clickjacking
  3. SMS phishing attack
  4. Agent Smith attack

Answer(s): D

Explanation:

Don’s device was compromised by a malicious agent masquerading as legitimate apps, replacing legitimate apps and delivering intrusive ads, which aligns with the Agent Smith attack dynamics on Android devices. A) SIM card attack targets telecommunications SIM control, not app integrity. B) Clickjacking deceives users into clicking hidden UI elements, not replacing apps or injecting apps. C) SMS phishing uses text messages to harvest credentials, not app replacement. D) Agent Smith specifically describes malware that clones and swaps apps to intercept functionality and display ads, fitting the scenario.



Samuel, a security administrator, is assessing the configuration of a web server. He noticed that the server permits SSLv2 connections, and the same private key certificate is used on a different server that allows SSLv2 connections. This vulnerability makes the web server vulnerable to attacks as the SSLv2 server can leak key information.

Which of the following attacks can be performed by exploiting the above vulnerability?

  1. Padding oracle attack
  2. DROWN attack
  3. DUHK attack
  4. Side-channel attack

Answer(s): B

Explanation:

The correct answer is B) DROWN attack because DROWN exploits servers that support SSLv2 and share the same private key with other servers, allowing an attacker to recover TLS session keys from modern connections by leveraging weaknesses in SSLv2. Padding oracle attack (A) targets decryption with padding flaws in certain protocols, not specifically SSLv2 key reuse. DUHK (C) is a side-channel/OTP-based attack against hardware devices generating RSA keys, not about SSLv2 or key reuse across servers. Side-channel attack (D) is a broad category; while related to cryptographic weaknesses, it does not specifically describe exploitation via SSLv2 and shared private keys as in DROWN.



Clark, a professional hacker, was hired by an organization to gather sensitive information about its competitors surreptitiously. Clark gathers the server IP address of the target organization using Whois footprinting. Further, he entered the server IP address as an input to an online tool to retrieve information such as the network range of the target organization and to identify the network topology and operating system used in the network.

What is the online tool employed by Clark in the above scenario?

  1. DuckDuckGo
  2. AOL
  3. ARIN
  4. Baidu

Answer(s): C

Explanation:

A) ARIN
ARIN is the American Registry for Internet Numbers, which can provide network range, ASN, and organizational details when given an IP, aligning with footprinting and OS/topology hints via whois-derived data.
B) DuckDuckGo does not expose network topology or OS data from an IP; it is a search engine for general queries, not a specialized network registry.
C) ARIN is correct
D) Baidu is a Chinese search engine with no built-in network registry capabilities for identifying target network topology or OS from an IP address.



You are a penetration tester and are about to perform a scan on a specific server. The agreement that you signed with the client contains the following specific condition for the scan: "The attacker must scan every port on the server several times using a set of spoofed source IP addresses." Suppose that you are using Nmap to perform this scan.

What flag will you use to satisfy this requirement?

  1. The -g flag
  2. The -A flag
  3. The -f flag
  4. The -D flag

Answer(s): D

Explanation:

Using -D enables decoy spoofed source IP addresses to be included in scans, satisfying multiple-sourced port probing without revealing the true scanner. This aligns with the requirement to scan every port multiple times from spoofed addresses.
A) -g sets the source port, not multiple spoofed addresses; it does not address decoys or repeated port scans.
B) -A enables OS/service detection and more aggressive probing, not decoy usage.
C) -f fragments packets to evade some IDS, but does not implement decoy sources.
D) -D decoy option explicitly adds spoofed hosts to mask the scanner and simulate multiple origins.



Jude, a pen tester, examined a network from a hacker's perspective to identify exploits and vulnerabilities accessible to the outside world by using devices such as firewalls, routers, and servers. In this process, he also estimated the threat of network security attacks and determined the level of security of the corporate network.

What is the type of vulnerability assessment that Jude performed on the organization?

  1. Application assessment
  2. External assessment
  3. Passive assessment
  4. Host-based assessment

Answer(s): B

Explanation:

A) External assessment is correct because Jude emulated an attacker from outside the network, evaluating exposed external surfaces such as firewalls, routers, and servers to identify exploitable external vulnerabilities and gauge overall perimeter security.
B) External assessment focuses on outward-facing assets and threat exposure, aligning with the described hacker’s perspective and the goal of assessing external attack surface.
C) Passive assessment would involve monitoring without active probing or exploiting vulnerabilities, which is not indicated here as Jude used devices to identify exploitable weaknesses.
D) Host-based assessment targets individual hosts for internal weaknesses, not the external network boundary, which is the focus of Jude’s activity.



Widespread fraud at Enron, WorldCom, and Tyco led to the creation of a law that was designed to improve the accuracy and accountability of corporate disclosures. It covers accounting firms and third parties that provide financial services to some organizations and came into effect in 2002. This law is known by what acronym?

  1. SOX
  2. FedRAMP
  3. HIPAA
  4. PCI DSS

Answer(s): A

Explanation:

The correct answer is A) SOX. The Sarbanes-Oxley Act (SOX) was enacted in 2002 to improve corporate governance, financial disclosures, and accountability, addressing abuses disclosed in Enron, WorldCom, and Tyco. It extends oversight to accounting firms and third-party financial services providers. B) FedRAMP applies to cloud service provider security authorizations, not corporate disclosure laws. C) HIPAA governs health information privacy and security, not corporate fraud disclosures. D) PCI DSS covers payment card data security, not corporate financial reporting or governance.



Abel, a security professional, conducts penetration testing in his client organization to check for any security loopholes. He launched an attack on the DHCP servers by broadcasting forged DHCP requests and leased all the DHCP addresses available in the DHCP scope until the server could not issue any more IP addresses. This led to a DoS attack, and as a result, legitimate employees were unable to access the client's network.

Which of the following attacks did Abel perform in the above scenario?

  1. Rogue DHCP server attack
  2. VLAN hopping
  3. STP attack
  4. DHCP starvation

Answer(s): D

Explanation:

Abel conducted a DHCP starvation attack by exhausting the DHCP server’s address pool using forged requests, causing a DoS and preventing legitimate clients from obtaining IPs.
A) Rogue DHCP server attack is incorrect because the scenario describes exhausting addresses, not deploying a rogue server to misassign IPs.
B) VLAN hopping is irrelevant; it involves traversing VLAN boundaries, not exhausting DHCP scope.
C) STP attack targets switch path selection, not DHCP address allocation.
D) DHCP starvation accurately describes flooding the DHCP server’s pool to deny service to legitimate hosts.



Viewing page 8 of 105
Viewing questions 36 - 40 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!