312-50 — EC-Council Certified Ethical Hacker (CEH v13)
EC-Council

EC-Council Certified Ethical Hacker (CEH v13) (312-50) Practice Questions

★★★★★★ 4.7 75 verified reviews
180 questions
✓ Online quiz simulator
▶ Start Free Practice Exam

Sample Questions (18 of 180 shown)

Q1
Bob is acknowledged as a hacker of repute and is popular among visitors of "underground" sites. Bob is willing to share his knowledge with those who are willing to learn, and many have expressed their interest in learning from him. However, this knowledge has a risk associated with it, as it can be used for malevolent attacks as well. In this context, what would be the most effective method to bridge the knowledge gap between the "black" hats or crackers and the "white" hats or computer security professionals?
  1. Educate everyone with books, articles, and training on risk analysis, vulnerabilities, and safeguards
  2. Hire more computer security monitoring personnel to monitor computer systems and networks
  3. Make obtaining either a computer security certification or accreditation easier to achieve so more individuals feel that they are a part of something larger than life
  4. Train more National Guard and reservists in the art of computer security to help out in times of emergency or crises
✓ Correct Answer: A
CEH holds that the best way to close the gap between black hats and white hats is broad education — teaching everyone about risks, vulnerabilities, and countermeasures — so that knowledge of hacking techniques is paired with understanding of how to defend systems. Monitoring staff, easier certifications, or reservist training address narrower needs and do not close the fundamental knowledge gap.
Q2
You are working as a Security Analyst in a company XYZ that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. While monitoring the data, you find a high number of outbound connections. You see that IPs owned by XYZ (internal) and private IPs are communicating to a single public IP. After further analysis, you find out that this public IP is a blacklisted IP, and the internal communicating devices are compromised. What kind of attack does the above scenario depict?
  1. Botnet attack
  2. Spear phishing attack
  3. Advanced persistent threat
  4. Rootkit attack
✓ Correct Answer: A
Many internal/private hosts simultaneously beaconing out to one blacklisted public IP is the classic signature of a botnet — a network of compromised "zombie" machines controlled from a command-and-control server. Spear phishing is a delivery technique, an APT is a long-term targeted campaign, and a rootkit hides on a single host; none describe many hosts phoning one external controller.
Q3
What does a firewall check to prevent particular ports and applications from getting packets into an organization?
  1. Transport layer port numbers and application layer headers
  2. Presentation layer headers and the session layer port numbers
  3. Network layer headers and the session layer port numbers
  4. Application layer port numbers and the transport layer headers
✓ Correct Answer: A
Firewalls filter traffic using transport-layer port numbers (TCP/UDP) and, for application-aware/next-generation firewalls, application-layer headers/content to decide which ports and applications may pass. Ports live at the transport layer, not the session or presentation layers, and IP (network-layer) headers alone do not identify applications.
Q4
Harry, a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection. What is the APT lifecycle phase that Harry is currently executing?
  1. Preparation
  2. Cleanup
  3. Persistence
  4. Initial intrusion
✓ Correct Answer: D
The APT lifecycle is: preparation → initial intrusion → expansion → persistence → search and exfiltration → cleanup. Using spear-phishing and public-server exploits to get malware onto a system and establish an outbound connection is the initial intrusion (entry) phase. Preparation precedes it; persistence and cleanup come later.
Q5
Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon review, he finds that user data has been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs. What type of malware did the attacker use to bypass the company's application whitelisting?
  1. Phishing malware
  2. Zero-day malware
  3. File-less malware
  4. Logic bomb malware
✓ Correct Answer: C
File-less malware operates in memory and abuses legitimate, already-whitelisted tools (PowerShell, WMI, rundll32, etc.) rather than dropping a malicious file to disk, so signature-based AV and application whitelisting find nothing. "Phishing malware" is a delivery method, a logic bomb triggers on a condition, and a zero-day exploits an unknown vulnerability — none specifically explain evading whitelisting and AV with no file artifacts.
Q6
An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events does not match up. What is the most likely cause?
  1. The network devices are not all synchronized
  2. Proper chain of custody was not observed while collecting the logs
  3. The attacker altered or erased events from the logs
  4. The security breach was a false positive
✓ Correct Answer: A
Log correlation requires consistent timestamps. If devices' clocks drift or time zones/NTP are misconfigured, events appear out of order across sources even though each device logged correctly. Chain-of-custody lapses affect admissibility, tampering would usually remove entries, and a false positive would not explain sequence mismatches across many devices.
Q7
You are the Network Admin, and you get a complaint that some of the websites are no longer accessible. You try to ping the servers and find them to be reachable. Then you type the IP address in the browser and find it accessible. But they are not accessible when you try using the URL. What may be the problem?
  1. Traffic is blocked on UDP port 53
  2. Traffic is blocked on TCP port 80
  3. Traffic is blocked on TCP port 54
  4. Traffic is blocked on UDP port 80
✓ Correct Answer: A
Name resolution uses DNS over UDP port 53. If DNS queries/responses are blocked, URLs cannot be resolved to IP addresses, yet sites remain reachable when the IP address is entered directly and ping (ICMP) still works. Web traffic on TCP 80 working via IP proves the block is specific to DNS.
Q8
This TCP flag instructs the sending system to transmit all buffered data immediately.
  1. SYN
  2. RST
  3. PSH
  4. URG
  5. FIN
✓ Correct Answer: C
The PSH (Push) flag tells the receiving TCP stack to pass buffered data to the application immediately without waiting for the buffer to fill. SYN synchronizes sequence numbers (connection start), RST aborts a connection, URG marks urgent data, and FIN signals the end of transmission.
Q9
Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer. How can Fred accomplish this?
  1. Fred can accomplish this by sending an IP packet with the RST/SYN bit and the source address of his computer
  2. He can send an IP packet with the SYN bit and the source address of his computer
  3. Fred can send an IP packet with the ACK bit set to zero and the source address of the switch
  4. Fred can send an IP packet to the switch with the ACK bit and the source address of his machine
✓ Correct Answer: D
A bare SYN announces a NEW connection, while a packet carrying only the ACK flag looks like a continuation of an EXISTING session. Stateful devices that track connections treat such an ACK as belonging to an already-established session, so an attacker spoofing the ACK (with the source address of the machine the device supposedly already talks to) makes the switch believe the session exists — a classic session-hijacking/ACK-spoofing trick.
Q10
You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture in terms of server placement?
  1. All three servers need to be placed internally
  2. A web server facing the Internet, an application server on the internal network, a database server on the internal network
  3. A web server and the database server facing the Internet, an application server on the internal network
  4. All three servers need to face the Internet so that they can communicate with themselves
✓ Correct Answer: B
The standard three-tier design exposes only the web/presentation tier to the Internet and keeps the application (logic) and database tiers on the internal network. This minimizes the attack surface: a compromise of the public web server does not directly expose the data or business logic, which is the principle behind DMZ segmentation.
Q11
Elliot is in the process of exploiting a web application that uses SQL as a back-end database. He's determined that the application is vulnerable to SQL injection, and has introduced conditional timing delays into injected queries to determine whether they are successful. What type of SQL injection is Elliot most likely performing?
  1. Error-based SQL injection
  2. Blind SQL injection
  3. Union-based SQL injection
  4. NoSQL injection
✓ Correct Answer: B
In blind SQL injection the application does not return query results or database errors, so the attacker infers true/false answers indirectly — e.g., by injecting conditional time delays (WAITFOR DELAY / SLEEP) and observing response times. Error-based relies on verbose DB errors, UNION merges result sets, and NoSQL injection targets non-relational stores.
Q12
BitLocker encryption has been implemented for all Windows-based computers in an organization. You are concerned that someone might lose their cryptographic key. Therefore, a mechanism was implemented to recover the keys from Active Directory. What is this mechanism called in cryptography?
  1. Key archival
  2. Key escrow
  3. Certificate rollover
  4. Key renewal
✓ Correct Answer: B
Key escrow is the practice of depositing copies of private keys with a trusted third party (here, an escrow/recovery agent reachable through Active Directory) so keys can be recovered if the owner loses them. Key archival is the related storage/backup of keys; rollover and renewal refer to replacing/re-issuing keys or certificates on schedule.
Q13
What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?
  1. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead
  2. Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail
  3. Symmetric encryption allows the server to securely transmit the session keys out-of-band
  4. Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography
✓ Correct Answer: A
Hybrid cryptosystems use asymmetric cryptography to authenticate and exchange/negotiate keys, then use fast symmetric encryption for bulk data — which lets constrained devices (phones, IoT) benefit from strong security with symmetric processing. (Option D also describes the classic rationale for hybrid crypto, but the keyed advantage for CEH here is that the combination enables low-power devices to use efficient symmetric encryption.)
Q14
Morris, an attacker, wanted to check whether the target AP is in a locked state. He attempted using different utilities to identify WPS-enabled APs in the target wireless network. Ultimately, he succeeded with one special command-line utility. Which of the following command-line utilities allowed Morris to discover the WPS-enabled APs?
  1. wash
  2. macof
  3. net view
  4. ntptrace
✓ Correct Answer: A
wash is a command-line utility (part of the Reaver suite) that scans for wireless access points with Wi-Fi Protected Setup (WPS) enabled and reports whether they are locked. macof floods a switch with random MACs, net view lists Windows shares, and ntptrace traces NTP servers.
Q15
The configuration allows a wired or wireless network interface controller to pass all traffic it receives to the Central Processing Unit (CPU), rather than passing only the frames that the controller is intended to receive. Which of the following is being described?
  1. Port forwarding
  2. WEM
  3. Promiscuous mode
  4. Multi-cast mode
✓ Correct Answer: C
In promiscuous mode a NIC accepts and passes to the CPU every frame it observes on the segment, not just frames addressed to its own MAC — the prerequisite for packet sniffing. Port forwarding redirects traffic at a NAT/firewall, multicast mode concerns group traffic delivery, and WEM is unrelated.
Q16
Which tier in the N-tier application architecture is responsible for moving and processing data between the tiers?
  1. Presentation tier
  2. Application Layer
  3. Logic tier
  4. Data tier
✓ Correct Answer: C
In N-tier architecture the logic (application/business) tier contains the business rules and moves and processes data between the presentation tier and the data tier. The presentation tier handles the UI, and the data tier stores and serves data.
Q17
What is GINA?
  1. Graphical Identification and Authentication DLL
  2. GUI Installed Network Application CLASS
  3. Global Internet National Authority (G-USA)
  4. Gateway Interface Network Application
✓ Correct Answer: A
GINA (Graphical Identification aNd Authentication) is the Windows DLL (msgina.dll) that implements the interactive logon UI and authentication sequence (Ctrl+Alt+Del handling, credential collection). It was replaced by Credential Providers in Windows Vista, but remains a classic CEH exam item.
Q18
When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's computer to update the router configuration. What type of an alert is this?
  1. True positive
  2. False negative
  3. False positive
  4. True negative
✓ Correct Answer: C
The IDS flagged benign, legitimate administrative activity as an attack: a true condition that was not an attack, but the sensor reported one — a false positive. A true positive would be a correctly detected real attack; a false negative is a missed real attack (the most dangerous state); a true negative is correctly ignoring benign traffic.

You've viewed 3 of 180 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The EC-Council 312-50 exam, officially titled Certified Ethical Hacker (CEH v13), validates your ability to think and act like an attacker while assessing a target system's security within a lawful, authorized scope. Delivered through the ECC Exam Center or Pearson VUE, the knowledge exam is a 125-question, four-hour multiple-choice test whose passing threshold is set per exam form between 60% and 85%, with the questions distributed across the nine weighted domains of the CEH blueprint.

CEH suits penetration testers, security analysts, auditors, and network administrators who need to probe and harden enterprise infrastructure. Candidates who complete official EC-Council training are automatically eligible, while self-study applicants must document two years of information-security experience and clear an eligibility application. Comfort with TCP/IP, Linux and Windows command lines, and core security concepts is the practical prerequisite.

The blueprint leans heavily on hands-on attack phases — Network and Perimeter Hacking (24%) and Reconnaissance Techniques (17%) dominate, followed by System Hacking (15%) and Web Application Hacking (14%), with the remaining weight spread across the information-security overview, wireless, mobile/IoT/OT, cloud, and cryptography domains. Expect scenario items on Nmap flags, banner grabbing, password cracking, privilege escalation, sniffing and ARP/DNS poisoning, IDS evasion, and SQL-injection technique identification rather than pure tool-menu trivia.

To rehearse that exact mix, our 312-50 practice set is weighted to the blueprint — heaviest on network and perimeter hacking, reconnaissance, system hacking, and web-application attacks. Each online practice question ships with a detailed answer explanation that walks through the correct option and the distractor failure modes, while the downloadable PDF packages the same bank for offline review during commutes or in places without stable internet.

Official Exam Domains & Weighting

To successfully pass the 312-50 (CEH v13) exam, candidates must master the following nine blueprint domains (per the current CEH Exam Blueprint v5.0; weights as published and rounded):
  • Information Security and Ethical Hacking Overview (6%)
Covers information-security fundamentals and the CIA triad, hacker classes and motives, the ethical-hacking phases, relevant laws, and scope/authorization.
  • Reconnaissance Techniques (17%)
Footprinting and OSINT, Google dorking, DNS/WHOIS enumeration, plus network scanning with Nmap flags, banner grabbing, and OS/service fingerprinting.
  • System Hacking Phases and Attack Techniques (15%)
Gaining access, password cracking, privilege escalation, maintaining access with trojans and rootkits, steganography, and covering tracks.
  • Network and Perimeter Hacking (24%)
Sniffing, ARP/DNS poisoning, social engineering, DoS/DDoS, session hijacking, and evading IDS, firewalls, and honeypots.
  • Web Application Hacking (14%)
Web-server and web-application attacks, OWASP-style flaws, and SQL-injection techniques.
  • Wireless Network Hacking (5%)
WEP/WPA/WPA2/WPA3 weaknesses, evil-twin access points, deauthentication, and Bluetooth exploitation.
  • Mobile Platform, IoT, and OT Hacking (10%)
Android/iOS attack vectors, jailbreaking and rooting, IoT firmware issues, and ICS/SCADA/OT threats.
  • Cloud Computing (5%)
Cloud service models, cloud threats, container security, and serverless risks.
  • Cryptography (5%)
Symmetric and asymmetric algorithms, hashing, PKI, SSL/TLS, and cryptanalysis.

What Our Customers Say 75 verified reviews

4.7 ★★★★★★ Based on 75 reviews
★★★★★
These EC-Council exam dumps for 312-50 saved me weeks of study time. The questions cover every domain thoroughly.
— Jessica W.
★★★★★★
Comprehensive coverage for 312-50. Every domain is represented and the question difficulty ramps up nicely.
— Emma J.
★★★★★★
The 312-50 certification opened up a promotion for me at work. These practice questions were a big part of that success.
— Ryan J.
★★★★★★
Detailed, organized, and accurate. Exactly what you want in 312-50 prep material. The explanations deserve special mention.
— Gabriel L.
★★★★★★
The 312-50 practice test is spot-on. The multi-select questions and explanations are exactly what you need for the real exam.
— Emily R.
★★★★★★
The 312-50 question bank is very comprehensive. I went through all 120+ questions and felt completely ready for exam day.
— Sebastian M.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Passing 312-50 on its own earns the Certified Ethical Hacker credential. The separate CEH (Practical) exam — a six-hour, 20-challenge cyber-range test — is optional and only needed if you want to stack toward CEH Master. Our practice bank targets the 312-50 knowledge exam specifically, matching its multiple-choice format and blueprint weighting, so you are not paying for content aimed at the hands-on practical track.

The blueprint is heaviest on Network and Perimeter Hacking (24%), Reconnaissance Techniques (17%), System Hacking (15%), and Web Application Hacking (14%), with Mobile/IoT/OT at 10% and the remaining five domains between 5% and 6%. Our 312-50 practice questions are distributed to mirror those weights, so timed runs surface your weak high-value modules — sniffing, IDS evasion, scanning, and web-application attacks — before exam day.

Yes, but usually inside scenario stems rather than as isolated tool-menu trivia. You will see items asking which Nmap flag performs an idle scan, which tool cracks NTLM hashes offline, or which utility sniffs plaintext HTTP — so know what each tool does and when to reach for it. The practice set uses the same scenario style, and every explanation names the exact concept (the flag, protocol, or phase) the question targets.

The 312-50 knowledge exam is multiple-choice only — there are no performance-based labs or simulator items in that form; the hands-on element lives in the separate CEH (Practical) exam. Our practice product follows the same multiple-choice format with detailed answer explanations, so you train on the exact item type the knowledge exam uses without any misleading "simulator" framing.

The mock exam mirrors the real blueprint both in style and weighting: scenario stems that cast you as an authorized penetration tester, four plausible distractors, and question volume spread across the nine domains in blueprint proportion. Difficulty tracks the live test's emphasis on identifying the right tool, phase, or countermeasure, and a timed run reproduces the four-hour pacing so nothing about the format surprises you on exam day.

Yes. Every question ships with a detailed answer explanation that walks through the correct choice and explains why each distractor fails, and the full bank is available as a downloadable PDF for offline review on a commute, flight, or anywhere without stable internet. The PDF and the online practice engine share the same questions and explanations, so your progress carries over whichever format you use.

Because EC-Council sets the cut score per exam form rather than at one fixed percentage, the safe strategy is to master the high-weight domains — Network and Perimeter Hacking (24%), Reconnaissance (17%), System Hacking (15%), and Web Application Hacking (14%) — and push well past the low end of the range. Use the practice bank's per-domain scoring to confirm strength across scanning, sniffing, exploitation, and web attacks, then take blueprint-weighted timed runs so a tougher form's higher bar does not catch you out.