EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 9 )

Updated On: 12-May-2026

This form of encryption algorithm is a symmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits. Which among the following is this encryption algorithm?

  1. HMAC encryption algorithm
  2. Twofish encryption algorithm
  3. IDEA
  4. Blowfish encryption algorithm

Answer(s): B

Explanation:

Twofish is a symmetric key block cipher with a 128-bit block size and supports keys up to 256 bits, matching the described algorithm. A) HMAC is not a block cipher but a message authentication code; it uses hash functions. C) IDEA uses 64-bit blocks and 128-bit keys, not 128/256 combination described. D) Blowfish has 64-bit blocks, with key sizes up to 448 bits, not 128-bit blocks. Therefore, Only Twofish fits the specified block size and maximal key length within symmetric block ciphers.



Jude, a pen tester working in Keiltech Ltd., performs sophisticated security testing on his company's network infrastructure to identify security loopholes. In this process, he started to circumvent the network protection tools and firewalls used in the company. He employed a technique that can create forged TCP sessions by

carrying out multiple SYN, ACK, and RST or FIN packets. Further, this process allowed Jude to execute DDoS attacks that can exhaust the network resources.

What is the attack technique used by Jude for finding loopholes in the above scenario?

  1. Spoofed session flood attack
  2. UDP flood attack
  3. Peer-to-peer attack
  4. Ping-of-death attack

Answer(s): A

Explanation:

A) The technique described matches spoofed session flood attack, where forged TCP sessions are created using crafted SYN/ACK/RST-FIN packets to exhaust resources and bypass protections. This aligns with session spoofing to establish illegitimate connections and conduct DDoS. B) UDP flood attack uses UDP packets without TCP session mechanics and does not involve forged TCP handshakes. C) Peer-to-peer attack targets P2P networks rather than TCP session forgery for DDoS. D) Ping-of-death is an older attack that floods with oversized ICMP packets, not forged TCP sessions.



Jim, a professional hacker, targeted an organization that is operating critical industrial infrastructure. Jim used Nmap to scan open ports and running services on systems connected to the organization's OT network. He used an Nmap command to identify Ethernet/IP devices connected to the Internet and further gathered information such as the vendor name, product code and name, device name, and IP address.

Which of the following Nmap commands helped Jim retrieve the required information?

  1. nmap -Pn -sT --scan-delay 1s --max-parallelism 1 -p < Port List > < Target IP >
  2. nmap -Pn -sU -p 44818 --script enip-info < Target IP >
  3. nmap -Pn -sT -p 46824 < Target IP >
  4. nmap -Pn -sT -p 102 --script s7-info < Target IP >

Answer(s): B

Explanation:

Nmap -Pn -sU -p 44818 --script enip-info <Target IP> returns information about Ethernet/IP devices, including vendor, product, device name, and IP, fitting the IoT/OT asset discovery use case with the enip-info NSE script over UDP (port 44818). A) uses TCP connect scans and broad port list, not specific to Ethernet/IP discovery. C) scans a single TCP port without a relevant NSE script. D) uses s7-info, which targets Siemens S7 protocols, not Ethernet/IP device metadata. Therefore B correctly leverages the enip-info script to enumerate Ethernet/IP device metadata.



While testing a web application in development, you notice that the web server does not properly ignore the "dot dot slash" (../) character string and instead returns the file listing of a folder higher up in the folder structure of the server.

What kind of attack is possible in this scenario?

  1. Cross-site scripting
  2. SQL injection
  3. Denial of service
  4. Directory traversal

Answer(s): D

Explanation:

Directory traversal
D) Directory traversal exploits improper input validation that allows accessing files outside the web root by using path traversal sequences like ../, leading to unauthorized file listings or data exposure.
A) Cross-site scripting is about injecting scripts into web pages viewed by others, not about file path access.
B) SQL injection targets untrusted input in SQL queries, not filesystem paths.
C) Denial of service is about overwhelming a service to degrade availability, not specifically about accessing higher-level directories.
Thus, the correct classification is directory traversal due to improper handling of path inputs.



Richard, an attacker, aimed to hack IoT devices connected to a target network. In this process, Richard recorded the frequency required to share information between connected devices. After obtaining the frequency, he captured the original data when commands were initiated by the connected devices. Once the original data were collected, he used free tools such as URH to segregate the command sequence. Subsequently, he started injecting the segregated command sequence on the same frequency into the IoT

network, which repeats the captured signals of the devices.

What is the type of attack performed by Richard in the above scenario?

  1. Cryptanalysis attack
  2. Reconnaissance attack
  3. Side-channel attack
  4. Replay attack

Answer(s): D

Explanation:

The attack is a replay attack because captured legitimate commands are recorded and later retransmitted to impersonate the original devices, exploiting the same frequency to fool the IoT network.
A) Cryptanalysis attack is incorrect because it targets breaking cryptographic algorithms or keys, not replaying captured signals.
B) Reconnaissance attack is incorrect as it involves information gathering to plan an intrusion, not capturing and replaying commands.
C) Side-channel attack is incorrect since it leverages unintended information leakage (timing, power, electromagnetic emissions) rather than capturing and reusing valid command sequences.



Which of the following allows attackers to draw a map or outline the target organization's network infrastructure to know about the actual environment that they are going to hack?

  1. Vulnerability analysis
  2. Malware analysis
  3. Scanning networks
  4. Enumeration

Answer(s): C

Explanation:

The correct answer is C) Scanning networks because it involves probing an environment to discover live hosts, open ports, services, and network topology, effectively mapping the target’s infrastructure prior to exploitation. A) Vulnerability analysis focuses on identifying known weaknesses in systems after scoping, not initial infrastructure mapping. B) Malware analysis examines malicious code to understand behavior, not network reconnaissance. D) Enumeration is a later phase that builds on scanning by extracting user accounts, shares, and detailed system information, but it follows discovery, not the initial mapping step. Therefore scanning networks best fits outlining the target environment.



Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?

  1. Use the built-in Windows Update tool
  2. Use a scan tool like Nessus
  3. Check MITRE.org for the latest list of CVE findings
  4. Create a disk image of a clean Windows installation

Answer(s): B

Explanation:

A) Use Nessus to scan for vulnerabilities on the Windows host, which is a dedicated vulnerability scanner that identifies known weaknesses across the system and network.
B) Use built-in Windows Update is incorrect because updates patch vulnerabilities but do not actively enumerate or identify vulnerabilities on a live system.
C) Check MITRE.org for CVEs is not an active assessment method; it provides advisories but does not assess the specific host for vulnerabilities.
D) Create a disk image of a clean Windows installation is for baseline capture, not vulnerability discovery on the target system.



Susan, a software developer, wants her web API to update other applications with the latest information. For this purpose, she uses a user-defined HTTP callback or push APIs that are raised based on trigger events; when invoked, this feature supplies data to other applications so that users can instantly receive real-time information.

Which of the following techniques is employed by Susan?

  1. Web shells
  2. Webhooks
  3. REST API
  4. SOAP API

Answer(s): B

Explanation:

A webhook is a user-defined HTTP callback that is triggered by events to push data to external systems in real time, matching Susan’s description.
A) Web shells are unauthorized backdoors used to maintain remote access, not event-driven data delivery.
B) Webhooks enable push-based, event-driven updates between apps.
C) REST API is a general architectural style for exposing resources, not specifically push-driven event callbacks.
D) SOAP API is a protocol for exchanging structured information; it is not defined as a callback mechanism for real-time pushes.



Viewing page 9 of 105
Viewing questions 65 - 72 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!