EC-COUNCIL 312-50V13 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50V13 Online Questions & Answers

• Question 1:

  There have been concerns in your network that the wireless network component is not sufficiently secure. You perform a vulnerability scan of the wireless network and find that it is using an old encryption protocol that was designed to mimic wired encryption, what encryption protocol is being used?

  A. WEP
  B. RADIUS
  C. WPA
  D. WPA3
  A. WEP

  ---

  Explanation

  Wired Equivalent Privacy (WEP) may be a security protocol, laid out in the IEEE wireless local area network (Wi-Fi) standard, 802.11b, that's designed to supply a wireless local area network (WLAN) with A level of security and privacy like what's usually expected of a wired LAN. A wired local area network (LAN) is usually protected by physical security mechanisms (controlled access to a building, for example) that are effective for a controlled physical environment, but could also be ineffective for WLANs because radio waves aren't necessarily bound by the walls containing the network. WEP seeks to determine similar protection thereto offered by the wired network's physical security measures by encrypting data transmitted over the WLAN. encoding protects the vulnerable wireless link between clients and access points; once this measure has been taken, other typical LAN security mechanisms like password protection, end-to-end encryption, virtual private networks (VPNs), and authentication are often put in situ to make sure privacy.

  A research group from the University of California at Berkeley recently published a report citing "major security flaws" in WEP that left WLANs using the protocol susceptible to attacks (called wireless equivalent privacy attacks). within the course of the group's examination of the technology, they were ready to intercept and modify transmissions and gain access to restricted networks. The Wireless Ethernet Compatibility Alliance (WECA) claims that WEP - which is included in many networking products - was never intended to be the only security mechanism for a WLAN, and that, in conjunction with traditional security practices, it's very effective.

• Question 2:

  Gavin owns a white-hat firm and is performing a website security audit. He begins with a scan looking for misconfigurations and outdated software versions. Which tool is he most likely using?

  A. Nikto
  B. Nmap
  C. Metasploit
  D. Armitage
  A. Nikto

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  Nikto is an open-source web server scanner that:

  Checks for common vulnerabilities

  Detects outdated software versions

  Flags insecure configurations and files

  It is widely used for quick and comprehensive web vulnerability assessments.

  From CEH v13 Courseware:

  Module 10: Web Application Hacking # Web Vulnerability Scanning Tools

  Nikto Project Page - https://cirt.net/Nikto2

• Question 3:

  The following is an entry captured by a network IDS. You are assigned the task of analyzing this entry.

  You notice the value 0x90, which is the most common NOOP instruction for the Intel processor.

  You also notice "/bin/sh" in the ASCII part of the output.

  As an analyst, what would you conclude about the attack?

  

  A. The buffer overflow attack has been neutralized by the IDS
  B. The attacker is creating a directory on the compromised machine
  C. The attacker is attempting a buffer overflow attack and has succeeded
  D. The attacker is attempting an exploit that launches a command-line shell
  D. The attacker is attempting an exploit that launches a command-line shell

  ---

  Explanation

  Key observations in the packet capture:

  Repeated 0x90 values indicate a NOP sled (No Operation instructions), commonly used in buffer overflow payloads to guide execution to the malicious shellcode.

  The presence of "/bin/sh" in ASCII indicates that the attacker intends to launch a shell (command-line access) on the victim's system once the overflow is successful.

  The payload likely contains shellcode that spawns a shell, giving the attacker command-line access.

  From CEH v13 Official Courseware:

  Module 6: Malware Threats

  Module 9: Denial-of-Service

  Module 5: Vulnerability Analysis

  CEH v13 Study Guide states:

  "A buffer overflow exploit typically involves injecting a NOP sled followed by shellcode. The string '/bin/sh' is a tell-tale sign of shell-spawning code that aims to give the attacker command access."

  Incorrect Options:

  A: There's no evidence the IDS blocked the attack-only that it logged it.

  B: Creating a directory would not involve a NOP sled or spawn a shell.

  C: We cannot confirm success; only the intent and method are clear.

  CEH v13 Study Guide - Module 6: Buffer Overflow AnalysisSnort IDS Rule Analysis # Buffer Overflow Patterns and Shellcode Detection

• Question 4:

  Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session 10 to the target employee. The session ID links the target employee to Boneys account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boneys account. What is the attack performed by Boney in the above scenario?

  A. Session donation attack
  B. Session fixation attack
  C. Forbidden attack
  D. CRIME attack
  A. Session donation attack

  ---

  Explanation

  In a session donation attack, the attacker donates their own session ID to the target user. In this attack, the attacker first obtains a valid session ID by logging into a service and later feeds the same session ID to the target user. This session ID links a target user to the attacker's account page without disclosing any information to the victim. When the target user clicks on the link and enters the details (username, password, payment details, etc.) in a form, the entered details are linked to the attacker's account.

  To initiate this attack, the attacker can send their session ID using techniques such as cross-site cooking, an MITM attack, and session fixation. A session donation attack involves the following steps.

• Question 5:

  What is the correct order of the five phases of ethical hacking?

  A. Gaining Access # Maintaining Access # Covering Tracks # Reconnaissance # Scanning
  B. Maintaining Access # Covering Tracks # Reconnaissance # Scanning # Gaining Access
  C. Reconnaissance # Scanning # Gaining Access # Maintaining Access # Covering Tracks
  D. Scanning # Reconnaissance # Gaining Access # Covering Tracks # Maintaining Access
  C. Reconnaissance # Scanning # Gaining Access # Maintaining Access # Covering Tracks

  ---

  Explanation

  CEH v13 defines the five phases of ethical hacking as a structured methodology that mirrors real-world attack progression:

  Reconnaissance - Information gathering

  Scanning - Identifying live hosts, ports, and vulnerabilities

  Gaining Access - Exploiting vulnerabilities

  Maintaining Access - Establishing persistence

  Covering Tracks - Removing evidence

  Option C matches this exact sequence. CEH v13 emphasizes that understanding this order is critical for both attackers and defenders, as it enables systematic testing and effective mitigation strategies.

  All other options misplace phases and contradict the CEH methodology.

• Question 6:

  What port number is used by LDAP protocol?

  A. 110
  B. 389
  C. 464
  D. 445
  B. 389

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  LDAP (Lightweight Directory Access Protocol) uses:

  TCP/UDP port 389 for standard LDAP communication.

  TCP/UDP port 636 for secure LDAP over SSL (LDAPS).

  From CEH v13 Courseware:

  Module 3: Scanning Networks # Common Ports and Protocols

  Incorrect Options:

  A: Port 110 = POP3

  C: Port 464 = Kerberos change/set password

  D: Port 445 = SMB over TCP/IP (used for file sharing)

  CEH v13 Study Guide - Module 3: Well-Known Port NumbersIANA - Service Name and Transport Protocol Port Number Registry

• Question 7:

  You are attempting to run an Nmap port scan on a web server. Which of the following commands would result in a scan of common ports with the least amount of noise In order to evade IDS?

  A. nmap -sP- -p-65535-T5
  B. nmap-A-host-time 99-T1
  C. nmap -A -Pn
  D. nmap -sT-O- To
  D. nmap -sT-O- To

  ---

  Explanation

  -A: Perform an aggressive scan which select most of the commonly used options within nmap

  -Pn: Means Don't ping

  -p:scan specific ports

  -sT: TCP Connect scan

  -O: Operating system detection

• Question 8:

  You detect the presence of a kernel-level rootkit embedded deeply within an operating system. Given the critical nature of the infection, which remediation strategy should be followed to effectively remove the rootkit while minimizing long-term risk?

  A. Use specialized rootkit detection tools followed by tailored removal procedures
  B. Deploy high-interaction honeypots to observe attacker behavior
  C. Perform a complete system format and reinstall the operating system from a trusted source
  D. Immediately power down the system and disconnect it from the network
  C. Perform a complete system format and reinstall the operating system from a trusted source

  ---

  Explanation

  The CEH Malware and Rootkit Analysis module emphasizes that kernel-level rootkits compromise the most trusted components of the operating system. Once a kernel is compromised, no tool running on that system can be fully trusted .

  CEH explicitly states that the only reliable remediation for kernel-mode rootkits is:

  Full system wipe

  Reinstallation from a known, trusted source

  Restoration of verified clean data

  Option C is correct and represents CEH best practice.

  Option A may work for user-mode rootkits but is unreliable for kernel-level infections.

  Option B is a research tactic, not remediation.

  Option D is containment, not eradication.

• Question 9:

  which type of virus can change its own code and then cipher itself multiple times as it replicates?

  A. Stealth virus
  B. Tunneling virus
  C. Cavity virus
  D. Encryption virus
  A. Stealth virus

  ---

  Explanation

  A stealth virus may be a sort of virus malware that contains sophisticated means of avoiding detection by antivirus software. After it manages to urge into the now-infected machine a stealth viruses hides itself by continually renaming and moving itself round the disc.

  Like other viruses, a stealth virus can take hold of the many parts of one's PC. When taking control of the PC and performing tasks, antivirus programs can detect it, but a stealth virus sees that coming and can rename then copy itself to a special drive or area on the disc, before the antivirus software. Once moved and renamed a stealth virus will usually replace the detected `infected' file with a clean file that doesn't trigger anti-virus detection. It's a never-ending game of cat and mouse.

  The intelligent architecture of this sort of virus about guarantees it's impossible to completely rid oneself of it once infected. One would need to completely wipe the pc and rebuild it from scratch to completely eradicate the presence of a stealth virus. Using regularly-updated antivirus software can reduce risk, but, as we all know, antivirus software is additionally caught in an endless cycle of finding new threats and protecting against them.

  https://www.techslang.com/definition/what-is-a-stealth-virus/

• Question 10:

  Kate dropped her phone and subsequently encountered an issue with the phone's internal speaker. Thus, she is using the phone's loudspeaker for phone calls and other activities. Bob, an attacker, takes advantage of this vulnerability and secretly exploits the hardware of Kate's phone so that he can monitor the loudspeaker's output from data sources such as voice assistants, multimedia messages, and audio files by using a malicious app to breach speech privacy.

  What is the type of attack Bob performed on Kate in the above scenario?

  A. Man-in-the-disk attack
  B. aLTEr attack
  C. SIM card attack
  D. Spearphone attack
  D. Spearphone attack

  ---

  Explanation

  In CEH v13 Module 17: Mobile and IoT Security, Spearphone is defined as a privacy-intrusion attack that:

  Exploits a smartphone's speaker output, particularly when loudspeaker mode is used.

  Leverages motion sensors (accelerometer, gyroscope) through a malicious app to capture acoustic signals emitted during:

  Phone calls

  Voice assistant interactions

  Media playback

  This enables attackers to extract private speech content without needing microphone access.

  Option Clarification:

  A. Man-in-the-disk: Exploits unprotected external storage in Android.

  B. aLTEr: Exploits LTE protocol weaknesses; unrelated to loudspeaker eavesdropping.

  C. SIM card attack: Targets SIM-level vulnerabilities (e.g., SIMjacker).

  D. Spearphone: Correct - exploits loudspeaker emissions and motion sensors.

  Module 17 - Mobile Device Exploits # Spearphone Attack Vector

  Research: Spearphone: Exploiting Smart Device Sensors via Loudspeaker Audio