EC-Council 312-50 Practice Exam
EC-Council Certified Ethical Hacker (CEH) v13 312-50
The EC-Council Certified Ethical Hacker (CEH) v13 312-50 exam validates knowledge of how attackers work and how to defend against them. It covers nine domains: information security and ethical hacking overview, reconnaissance techniques, system hacking phases and attack techniques, network and perimeter hacking, web application hacking, wireless network hacking, mobile platform, IoT and OT hacking, cloud computing, and cryptography, with network and perimeter hacking the largest. This practice exam mirrors the real exam's single-answer multiple-choice questions on recognizing techniques, choosing tools and selecting countermeasures.
Question bank updated : questions, answers, explanations and chapters.
Certification Overview
- Exam name: CEH v13
- Vendor: EC-Council
- Exam code: 312-50
- Duration: 240 minutes
- Total questions: about 125
- Official passing score: 60% to 85%, set per exam form (source)
- Our practice exam pass mark: 70%
Who Should Take This Exam?
Ethical Hacker, Penetration Tester, Security Analyst, Security Engineer, Network Security Engineer, SOC Analyst, Security Auditor, Vulnerability Analyst, Information Security Officer
Prerequisites
Attend official EC-Council training, or show at least two years of work experience in information security and submit an eligibility application with a non-refundable fee.
Topics Covered
- Information Security and Ethical Hacking Overview
- Reconnaissance Techniques
- System Hacking Phases and Attack Techniques
- Network and Perimeter Hacking
- Web Application Hacking
- Wireless Network Hacking
- Mobile Platform, IoT, and OT Hacking
- Cloud Computing
- Cryptography
Question Types
- Multiple Choice (Single Answer)
CEH v13 Practice Questions
Our question bank contains 1000+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With full access, you get unlimited practice exams with randomised questions from our full question bank.
Information Security and Ethical Hacking Overview
A threat analyst studying a phishing campaign finds that the attacker paired a remote access trojan with a malicious document to build a deliverable file before sending anything to the target. Which Cyber Kill Chain stage does this activity describe?
- A. Delivery
- B. Reconnaissance
- C. Weaponization Correct answer
- D. Installation
Option C is correct because Weaponization is the stage where the attacker couples an exploit or payload, here a remote access trojan, with a deliverable such as a malicious document, and it happens before anything reaches the target. Delivery (A) is the later step of transmitting that file, Reconnaissance (B) is gathering information about the target, and Installation (D) is the payload being placed on the victim system after delivery.
Which element of information security ensures that a sender cannot later deny having sent a digitally signed message?
- A. Integrity
- B. Availability
- C. Confidentiality
- D. Non-repudiation Correct answer
Option D is correct because non-repudiation uses mechanisms such as digital signatures to bind a message to its sender, so the sender cannot credibly deny sending it. Integrity only shows the content was not altered, confidentiality limits who can read it, and availability keeps systems accessible.
In the Diamond Model of intrusion analysis, which feature describes the malware and tools an adversary uses against a target?
- A. Adversary
- B. Infrastructure
- C. Victim
- D. Capability Correct answer
Option D is correct because in the Diamond Model the capability feature covers the malware, exploits and tools the adversary uses. The adversary is the actor, the infrastructure is the delivery and command channel, and the victim is the target.
Reconnaissance Techniques
During footprinting, a penetration tester opens a connection to a web server's service port and reads the response header, which discloses the server software and its version. Which technique is this?
- A. Passive OS fingerprinting
- B. DNS zone transfer
- C. Port knocking
- D. Banner grabbing Correct answer
Option D is correct because banner grabbing connects to a service port and reads the greeting or header it returns, which often names the software and version. Passive OS fingerprinting sniffs traffic, a zone transfer copies DNS records, and port knocking opens a hidden port with a packet sequence.
A tester on a Windows network wants to read the NetBIOS name table of a remote host when only its IP address is known. Which built-in utility supports this?
- A. nbtstat Correct answer
- B. net view
- C. netstat
- D. nslookup
Option A is correct because nbtstat -A <IP> queries a remote host and prints its NetBIOS name table. Net view lists shared resources, netstat shows local connections, and nslookup queries DNS rather than NetBIOS.
While probing a network protected by a packet filter, a tester splits each probe into several small IP fragments so that the filter cannot match the TCP header inside a single packet. Which evasion technique is this?
- A. Source port manipulation
- B. IP address decoying
- C. Packet fragmentation Correct answer
- D. Idle scan
Option C is correct because packet fragmentation splits probes into small IP fragments so a filter that inspects headers per packet cannot match the TCP header. Decoys, source port tricks and idle scans hide or spoof the origin instead of splitting the probe.
System Hacking Phases and Attack Techniques
An analyst installs agents on a group of servers so that each one reports its own configuration settings, installed patches and local account policies to a central console. Which type of vulnerability assessment is this?
- A. Application assessment
- B. Network-based assessment
- C. Wireless network assessment
- D. Host-based assessment Correct answer
Option D is correct because a host-based assessment relies on agents or local access on each server to report its configuration, patch level and local account policies. A network-based assessment (B) examines exposed services across the network from outside the hosts, an application assessment (A) targets web or software flaws, and a wireless assessment (C) looks at wireless networks and access points.
Incident responders find no new executables on disk, but memory analysis shows malicious code running inside a trusted system process that was started by a scheduled WMI event subscription calling built-in scripting tools. Which category of malware best matches these findings?
- A. Fileless malware Correct answer
- B. Polymorphic virus
- C. Boot sector virus
- D. Kernel-mode rootkit
Option A is correct because fileless malware leaves no new executable on disk and runs in memory inside trusted processes, often launched through built-in tools such as WMI event subscriptions and scripting hosts. A polymorphic virus (B) changes its own code signature but is still a file, a boot sector virus (C) infects the disk's boot area, and a kernel-mode rootkit (D) hides itself by loading as a driver rather than being triggered through WMI scripting.
Network and Perimeter Hacking
A switch begins forwarding unicast traffic out of every port after an attacker sends thousands of frames carrying random source MAC addresses. Which attack is this?
- A. MAC address flooding Correct answer
- B. DHCP starvation
- C. ARP poisoning
- D. VLAN hopping
Option A is correct because MAC address flooding fills the switch's CAM table with frames carrying random source MACs, so the switch falls back to forwarding unicast traffic out of all ports like a hub. DHCP starvation (B) exhausts the address pool of a DHCP server, ARP poisoning (C) forges ARP replies to redirect specific traffic, and VLAN hopping (D) lets traffic cross into another VLAN.
An attacker emails a victim a link that carries a session ID the attacker chose in advance. The application keeps the same ID after the victim signs in, and the attacker then presents it to the application. Which attack is this?
- A. Man-in-the-browser attack
- B. Session prediction
- C. Session fixation Correct answer
- D. Session sidejacking
Option C is correct because in session fixation the attacker sets a known session ID for the victim and the application fails to issue a new ID after login, so the attacker can reuse it. Session prediction (B) guesses IDs from weak generation, sidejacking (D) steals an ID by sniffing a cookie in transit, and a man-in-the-browser attack (A) uses malware inside the victim's browser.
Web Application Hacking
A tester retrieves an XML document that lists the operations, message formats and endpoints of a SOAP web service before assessing it. Which document is this?
- A. UDDI registry entry
- B. XSD schema
- C. WSDL file Correct answer
- D. WADL file
Option C is correct because a WSDL file is the XML document that describes a SOAP web service's operations, message formats and endpoints. A UDDI entry (A) is a registry listing of service providers, an XSD schema (B) defines the structure of XML data but not the operations, and a WADL file (D) describes RESTful services rather than SOAP.
A web team must stop other sites from framing its pages to counter clickjacking, yet its own portal embeds those pages in frames on the same origin. Which response header setting meets both needs?
- A. X-Frame-Options: DENY
- B. X-Frame-Options: SAMEORIGIN Correct answer
- C. Content-Security-Policy: frame-src 'self'
- D. X-Content-Type-Options: nosniff
Option B is correct because X-Frame-Options: SAMEORIGIN allows a page to be framed only by pages from the same origin, which blocks other sites from framing it while letting the team's own portal do so. DENY (A) blocks all framing including the portal, frame-src 'self' (C) controls which sources a page may embed rather than who may frame it, and nosniff (D) concerns MIME-type sniffing, not framing.
Wireless Network Hacking
An attacker within radio range of a Bluetooth phone abuses a weakness in its firmware to set up call forwarding and place outbound calls without the owner noticing. Which Bluetooth attack is this?
- A. Bluesnarfing
- B. BlueSmack
- C. Bluebugging Correct answer
- D. Bluejacking
Option C is correct because bluebugging exploits a Bluetooth device weakness to take control of phone functions such as setting up call forwarding and placing calls without the owner's knowledge. Bluesnarfing (A) steals data like contacts and messages, BlueSmack (B) is a denial-of-service attack using oversized L2CAP packets, and bluejacking (D) just sends unsolicited messages.
Which 802.11 management frame does an access point transmit at regular intervals to announce its SSID and supported rates?
- A. Reassociation request
- B. Disassociation frame
- C. Probe response
- D. Beacon frame Correct answer
Option D is correct because an access point sends beacon frames at a regular interval to advertise its SSID, supported rates and capabilities. A probe response is sent only when a client asks, and reassociation and disassociation frames handle roaming and leaving a network.
Mobile Platform, IoT, and OT Hacking
An attacker near a parked car jams the key fob's radio signal while recording the code it sends, then replays a recorded code later to unlock the vehicle although each code is meant to work once. Which IoT attack is this?
- A. Side-channel attack
- B. BlueBorne attack
- C. Rolling code attack Correct answer
- D. Sybil attack
Option C is correct because a rolling code attack captures the code sent by a key fob, often by jamming, and replays it later even though each code is meant to be used once. A side-channel attack (A) exploits physical leakage such as power or timing, BlueBorne (B) is a set of Bluetooth vulnerabilities, and a Sybil attack (D) uses many forged identities in a network.
An attacker persuades a carrier to move a victim's number to a new SIM, then collects the one-time codes the victim's bank texts. Which control best protects the account from this vector?
- A. Add a security question, confirm by callback
- B. Lengthen the SMS code, shorten its lifetime
- C. Enable FIDO2 key sign-in, retire SMS codes Correct answer
- D. Enable a handset SIM PIN, set a screen lock
Option C is correct because a SIM swap lets the attacker receive the victim's SMS codes, so the fix is to stop relying on SMS and use a phishing-resistant FIDO2 key that never travels through the carrier. Options A and B still depend on information or codes the attacker can obtain or intercept, and option D protects the physical SIM, not the number that was moved to a new one.
Cloud Computing
A security analyst auditing a Kubernetes cluster looks for the component that stores all cluster state and configuration data, which makes it a high-value target if exposed without authentication. Which component is this?
- A. etcd Correct answer
- B. kubelet
- C. kube-scheduler
- D. kube-proxy
Option A is correct because etcd is the key-value store that holds all Kubernetes cluster state and configuration, so unauthenticated exposure is serious. The kubelet (B) is the node agent that runs pods, kube-scheduler (C) assigns pods to nodes, and kube-proxy (D) handles service networking rules on nodes; none of them is the cluster's data store.
Which NIST essential cloud characteristic lets a consumer provision computing capability such as server time and storage automatically, without human interaction with the provider?
- A. On-demand self-service Correct answer
- B. Measured service
- C. Rapid elasticity
- D. Broad network access
Option A, On-demand self-service, is correct because NIST defines it as a consumer provisioning compute and storage automatically without human interaction with the provider. Measured service is metering and billing of usage, rapid elasticity is scaling capacity up and down, and broad network access is availability over standard network mechanisms.
Cryptography
A cryptanalyst submits pairs of chosen plaintexts that differ in a fixed pattern and studies how that difference propagates into the resulting ciphertext pairs to recover key bits of a block cipher. Which cryptanalysis method is this?
- A. Linear cryptanalysis
- B. Related-key attack
- C. Meet-in-the-middle attack
- D. Differential cryptanalysis Correct answer
Option D is correct because differential cryptanalysis uses chosen plaintext pairs with a fixed difference and tracks how that difference propagates to the ciphertext pairs to recover key bits. Linear cryptanalysis (A) uses linear approximations between plaintext, ciphertext and key bits with known plaintexts, a related-key attack (B) relies on relationships between different keys, and meet-in-the-middle (C) attacks two-stage encryption by matching intermediate values.
A defender wants weak passphrases to cost an attacker far more effort to brute-force before they are used to derive encryption keys. Which technique does this?
- A. Key whitening
- B. Key stretching Correct answer
- C. Key wrapping
- D. Key escrow
Option B is correct because key stretching (PBKDF2, bcrypt, scrypt, Argon2) runs many iterations when deriving a key, so each guess costs an attacker far more work. Key whitening mixes extra key material into a cipher's input and output, key wrapping encrypts one key under another, and key escrow stores a copy of a key with a trusted party; none of these slows down passphrase guessing.
Free Study Guide
Read the free EC-Council 312-50 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.
More EC-Council Practice Exams
Practise with realistic mock exams to prepare for your EC-Council certification.