EC-Council Certified Ethical Hacker (CEH v13) (312-50) practice questions

Exam overview 312-50

Sample questions 18 of 180 shown

1. Q1

   Bob is acknowledged as a hacker of repute and is popular among visitors of "underground" sites. Bob is willing to share his knowledge with those who are willing to learn, and many have expressed their interest in learning from him. However, this knowledge has a risk associated with it, as it can be used for malevolent attacks as well. In this context, what would be the most effective method to bridge the knowledge gap between the "black" hats or crackers and the "white" hats or computer security professionals?

   1. Educate everyone with books, articles, and training on risk analysis, vulnerabilities, and safeguards
   2. Hire more computer security monitoring personnel to monitor computer systems and networks
   3. Make obtaining either a computer security certification or accreditation easier to achieve so more individuals feel that they are a part of something larger than life
   4. Train more National Guard and reservists in the art of computer security to help out in times of emergency or crises

   CEH holds that the best way to close the gap between black hats and white hats is broad education — teaching everyone about risks, vulnerabilities, and countermeasures — so that knowledge of hacking techniques is paired with understanding of how to defend systems. Monitoring staff, easier certifications, or reservist training address narrower needs and do not close the fundamental knowledge gap.
2. Q2

   You are working as a Security Analyst in a company XYZ that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. While monitoring the data, you find a high number of outbound connections. You see that IPs owned by XYZ (internal) and private IPs are communicating to a single public IP. After further analysis, you find out that this public IP is a blacklisted IP, and the internal communicating devices are compromised. What kind of attack does the above scenario depict?

   1. Botnet attack
   2. Spear phishing attack
   3. Advanced persistent threat
   4. Rootkit attack

   Many internal/private hosts simultaneously beaconing out to one blacklisted public IP is the classic signature of a botnet — a network of compromised "zombie" machines controlled from a command-and-control server. Spear phishing is a delivery technique, an APT is a long-term targeted campaign, and a rootkit hides on a single host; none describe many hosts phoning one external controller.
3. Q3

   What does a firewall check to prevent particular ports and applications from getting packets into an organization?

   1. Transport layer port numbers and application layer headers
   2. Presentation layer headers and the session layer port numbers
   3. Network layer headers and the session layer port numbers
   4. Application layer port numbers and the transport layer headers

   Firewalls filter traffic using transport-layer port numbers (TCP/UDP) and, for application-aware/next-generation firewalls, application-layer headers/content to decide which ports and applications may pass. Ports live at the transport layer, not the session or presentation layers, and IP (network-layer) headers alone do not identify applications.
4. Q4

   Harry, a professional hacker, targets the IT infrastructure of an organization. After preparing for the attack, he attempts to enter the target network using techniques such as sending spear-phishing emails and exploiting vulnerabilities on publicly available servers. Using these techniques, he successfully deployed malware on the target system to establish an outbound connection. What is the APT lifecycle phase that Harry is currently executing?

   1. Preparation
   2. Cleanup
   3. Persistence
   4. Initial intrusion

   The APT lifecycle is: preparation → initial intrusion → expansion → persistence → search and exfiltration → cleanup. Using spear-phishing and public-server exploits to get malware onto a system and establish an outbound connection is the initial intrusion (entry) phase. Preparation precedes it; persistence and cleanup come later.
5. Q5

   Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon review, he finds that user data has been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs. What type of malware did the attacker use to bypass the company's application whitelisting?

   1. Phishing malware
   2. Zero-day malware
   3. File-less malware
   4. Logic bomb malware

   File-less malware operates in memory and abuses legitimate, already-whitelisted tools (PowerShell, WMI, rundll32, etc.) rather than dropping a malicious file to disk, so signature-based AV and application whitelisting find nothing. "Phishing malware" is a delivery method, a logic bomb triggers on a condition, and a zero-day exploits an unknown vulnerability — none specifically explain evading whitelisting and AV with no file artifacts.
6. Q6

   An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events does not match up. What is the most likely cause?

   1. The network devices are not all synchronized
   2. Proper chain of custody was not observed while collecting the logs
   3. The attacker altered or erased events from the logs
   4. The security breach was a false positive

   Log correlation requires consistent timestamps. If devices' clocks drift or time zones/NTP are misconfigured, events appear out of order across sources even though each device logged correctly. Chain-of-custody lapses affect admissibility, tampering would usually remove entries, and a false positive would not explain sequence mismatches across many devices.
7. Q7

   You are the Network Admin, and you get a complaint that some of the websites are no longer accessible. You try to ping the servers and find them to be reachable. Then you type the IP address in the browser and find it accessible. But they are not accessible when you try using the URL. What may be the problem?

   1. Traffic is blocked on UDP port 53
   2. Traffic is blocked on TCP port 80
   3. Traffic is blocked on TCP port 54
   4. Traffic is blocked on UDP port 80

   Name resolution uses DNS over UDP port 53. If DNS queries/responses are blocked, URLs cannot be resolved to IP addresses, yet sites remain reachable when the IP address is entered directly and ping (ICMP) still works. Web traffic on TCP 80 working via IP proves the block is specific to DNS.
8. Q8

   This TCP flag instructs the sending system to transmit all buffered data immediately.

   1. SYN
   2. RST
   3. PSH
   4. URG
   5. FIN

   The PSH (Push) flag tells the receiving TCP stack to pass buffered data to the application immediately without waiting for the buffer to fill. SYN synchronizes sequence numbers (connection start), RST aborts a connection, URG marks urgent data, and FIN signals the end of transmission.
9. Q9

   Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a session with his computer. How can Fred accomplish this?

   1. Fred can accomplish this by sending an IP packet with the RST/SYN bit and the source address of his computer
   2. He can send an IP packet with the SYN bit and the source address of his computer
   3. Fred can send an IP packet with the ACK bit set to zero and the source address of the switch
   4. Fred can send an IP packet to the switch with the ACK bit and the source address of his machine

   A bare SYN announces a NEW connection, while a packet carrying only the ACK flag looks like a continuation of an EXISTING session. Stateful devices that track connections treat such an ACK as belonging to an already-established session, so an attacker spoofing the ACK (with the source address of the machine the device supposedly already talks to) makes the switch believe the session exists — a classic session-hijacking/ACK-spoofing trick.
10. Q10

    You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture in terms of server placement?

    1. All three servers need to be placed internally
    2. A web server facing the Internet, an application server on the internal network, a database server on the internal network
    3. A web server and the database server facing the Internet, an application server on the internal network
    4. All three servers need to face the Internet so that they can communicate with themselves

    The standard three-tier design exposes only the web/presentation tier to the Internet and keeps the application (logic) and database tiers on the internal network. This minimizes the attack surface: a compromise of the public web server does not directly expose the data or business logic, which is the principle behind DMZ segmentation.
11. Q11

    Elliot is in the process of exploiting a web application that uses SQL as a back-end database. He's determined that the application is vulnerable to SQL injection, and has introduced conditional timing delays into injected queries to determine whether they are successful. What type of SQL injection is Elliot most likely performing?

    1. Error-based SQL injection
    2. Blind SQL injection
    3. Union-based SQL injection
    4. NoSQL injection

    In blind SQL injection the application does not return query results or database errors, so the attacker infers true/false answers indirectly — e.g., by injecting conditional time delays (WAITFOR DELAY / SLEEP) and observing response times. Error-based relies on verbose DB errors, UNION merges result sets, and NoSQL injection targets non-relational stores.
12. Q12

    BitLocker encryption has been implemented for all Windows-based computers in an organization. You are concerned that someone might lose their cryptographic key. Therefore, a mechanism was implemented to recover the keys from Active Directory. What is this mechanism called in cryptography?

    1. Key archival
    2. Key escrow
    3. Certificate rollover
    4. Key renewal

    Key escrow is the practice of depositing copies of private keys with a trusted third party (here, an escrow/recovery agent reachable through Active Directory) so keys can be recovered if the owner loses them. Key archival is the related storage/backup of keys; rollover and renewal refer to replacing/re-issuing keys or certificates on schedule.
13. Q13

    What is one of the advantages of using both symmetric and asymmetric cryptography in SSL/TLS?

    1. Supporting both types of algorithms allows less-powerful devices such as mobile phones to use symmetric encryption instead
    2. Symmetric algorithms such as AES provide a failsafe when asymmetric methods fail
    3. Symmetric encryption allows the server to securely transmit the session keys out-of-band
    4. Asymmetric cryptography is computationally expensive in comparison. However, it is well-suited to securely negotiate keys for use with symmetric cryptography

    Hybrid cryptosystems use asymmetric cryptography to authenticate and exchange/negotiate keys, then use fast symmetric encryption for bulk data — which lets constrained devices (phones, IoT) benefit from strong security with symmetric processing. (Option D also describes the classic rationale for hybrid crypto, but the keyed advantage for CEH here is that the combination enables low-power devices to use efficient symmetric encryption.)
14. Q14

    Morris, an attacker, wanted to check whether the target AP is in a locked state. He attempted using different utilities to identify WPS-enabled APs in the target wireless network. Ultimately, he succeeded with one special command-line utility. Which of the following command-line utilities allowed Morris to discover the WPS-enabled APs?

    1. wash
    2. macof
    3. net view
    4. ntptrace

    wash is a command-line utility (part of the Reaver suite) that scans for wireless access points with Wi-Fi Protected Setup (WPS) enabled and reports whether they are locked. macof floods a switch with random MACs, net view lists Windows shares, and ntptrace traces NTP servers.
15. Q15

    The configuration allows a wired or wireless network interface controller to pass all traffic it receives to the Central Processing Unit (CPU), rather than passing only the frames that the controller is intended to receive. Which of the following is being described?

    1. Port forwarding
    2. WEM
    3. Promiscuous mode
    4. Multi-cast mode

    In promiscuous mode a NIC accepts and passes to the CPU every frame it observes on the segment, not just frames addressed to its own MAC — the prerequisite for packet sniffing. Port forwarding redirects traffic at a NAT/firewall, multicast mode concerns group traffic delivery, and WEM is unrelated.
16. Q16

    Which tier in the N-tier application architecture is responsible for moving and processing data between the tiers?

    1. Presentation tier
    2. Application Layer
    3. Logic tier
    4. Data tier

    In N-tier architecture the logic (application/business) tier contains the business rules and moves and processes data between the presentation tier and the data tier. The presentation tier handles the UI, and the data tier stores and serves data.
17. Q17

    What is GINA?

    1. Graphical Identification and Authentication DLL
    2. GUI Installed Network Application CLASS
    3. Global Internet National Authority (G-USA)
    4. Gateway Interface Network Application

    GINA (Graphical Identification aNd Authentication) is the Windows DLL (msgina.dll) that implements the interactive logon UI and authentication sequence (Ctrl+Alt+Del handling, credential collection). It was replaced by Credential Providers in Windows Vista, but remains a classic CEH exam item.
18. Q18

    When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator's computer to update the router configuration. What type of an alert is this?

    1. True positive
    2. False negative
    3. False positive
    4. True negative

    The IDS flagged benign, legitimate administrative activity as an attack: a true condition that was not an attack, but the sensor reported one — a false positive. A true positive would be a correctly detected real attack; a false negative is a missed real attack (the most dangerous state); a true negative is correctly ignoring benign traffic.

Answer all 180 questions with instant feedback →

Reader reviews 107 ratings

• The way the 312-50 questions are broken down by domain is great. Let me focus on my weak spots without wasting time.

  ★★★★★★ Olivia H.

• I’ve purchased a few EC-Council exam dumps over the years and this 312-50 one is easily the best quality.

  ★★★★★★ Samuel T.

• Solid 312-50 prep. No complaints. Questions are relevant and the platform works well on both desktop and phone.

  ★★★★★★ Scarlett W.

• The 312-50 question bank is very comprehensive. I went through all 120+ questions and felt completely ready for exam day.

  ★★★★★★ Sebastian M.

• I was preparing for the 312-50 exam while juggling a newborn at home. The flexibility of this platform was a lifesaver.

  ★★★★★★ Cooper D.

• Passed 312-50 with flying colors thanks to these practice exams. The questions are harder than the real thing, which is exactly what you want.

  ★★★★★ Lisa G.

Frequently asked questions

More EC-Council exams