Free CEH v13 312-50 Practice Questions & Answers 2026 Part1

Question #1

What is a “Collision attack” in cryptography?

A. Collision attacks try to get the public key

B. Collision attacks try to break the hash into three parts to get the plaintext value

C. Collision attacks try to break the hash into two parts, with the same bytes in each part to get the private key

D. Collision attacks try to find two inputs producing the same hash

View answer

Correct Answer: D

Question #2

The “Gray-box testing” methodology enforces what kind of restriction?

A. Only the external operation of a system is accessible to the tester

B. The internal operation of a system in only partly accessible to the tester

C. Only the internal operation of a system is known to the tester

D. The internal operation of a system is completely known to the tester

View answer

Correct Answer: B

Question #3

An attacker has installed a RAT on a host. The attacker wants to ensure that when a user attempts to go to "www.MyPersonalBank.com", the user is directed to a phishing site.Which file does the attacker need to modify?

A. Boot

B. Sudoers

C. Networks

D. Hosts

View answer

Correct Answer: D

Question #4

“____________is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on thepremises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up afraudulent web site and luring people there.” Fill in the blank with appropriate choice.

A. Evil Twin Attack

B. Sinkhole Attack

C. Collision Attack

D. Signal Jamming Attack

View answer

Correct Answer: A

Question #5

The establishment of a TCP connection involves a negotiation called three-way handshake. What type of message does the client send to the server in order to begin this negotiation?

A. ACK

B. SYN

C. RST

D. SYN-ACK

View answer

Correct Answer: B

Question #6

A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server. Based on this information, what should be one of your key recommendations to the bank?

A. Place a front-end web server in a demilitarized zone that only handles external web traffic

B. Require all employees to change their anti-virus program with a new one

C. Move the financial data to another server on the same IP subnet

D. Issue new certificates to the web servers from the root certificate authority

View answer

Correct Answer: A

Question #7

What two conditions must a digital signature meet?

A. Has to be the same number of characters as a physical signature and must be unique

B. Has to be unforgeable, and has to be authentic

C. Must be unique and have special characters

D. Has to be legible and neat

View answer

Correct Answer: B

Question #8

Steve, a scientist who works in a governmental security agency, developed a technological solution to identify people based on walking patterns and implemented this approach to a physical control access.A camera captures people walking and identifies the individuals using Steve’s approach.After that, people must approximate their RFID badges. Both the identifications are required to open the door. In this case, we can say:

A. Although the approach has two phases, it actually implements just one authentication factor

B. The solution implements the two authentication factors: physical object and physical characteristic

C. The solution will have a high level of false positives

D. Biological motion cannot be used to identify people

View answer

Correct Answer: B

Question #9

During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.What is this type of DNS configuration commonly called?

A. DynDNS

B. DNS Scheme

C. DNSSEC

D. Split DNS

View answer

Correct Answer: D

Question #10

Scenario:1. Victim opens the attacker’s web site.2. Attacker sets up a web site which contains interesting and attractive content like ‘Do you want to make$1000 in a day?’.3. Victim clicks to the interesting and attractive content URL.4. Attacker creates a transparent ‘iframe’ in front of the URL which the victim attempts to click, so the victim thinks that he/she clicks on the ‘Do you want to make $1000 in a day?’ URL but actually he/she clicks on the content or URL that exists in the transparent 'iframe' which is setup by the attacker.What is the name of the attack which is mentioned in the scenario?

A. Session Fixation

B. HTML Injection

C. HTTP Parameter Pollution

D. Clickjacking Attack

View answer

Correct Answer: D

Question #11

Why is a penetration test considered to be more thorough than vulnerability scan?

A. Vulnerability scans only do host discovery and port scanning by default

B. A penetration test actively exploits vulnerabilities in the targeted infrastructure, while a vulnerability scan does not typically involve active exploitation

C. It is not – a penetration test is often performed by an automated tool, while a vulnerability scan requiresactive engagement

D. The tools used by penetration testers tend to have much more comprehensive vulnerability databases

View answer

Correct Answer: B

Question #12

Email is transmitted across the Internet using the Simple Mail Transport Protocol. SMTP does not encrypt email, leaving the information in the message vulnerable to being read by an unauthorized person. SMTP can upgrade a connection between two mail servers to use TLS. Email transmitted by SMTP over TLS is encrypted. What is the name of the command used by SMTP to transmit email over TLS?

A. OPPORTUNISTICTLS

B. UPGRADETLS

C. FORCETLS

D. STARTTLS

View answer

Correct Answer: D

Question #13

To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bankweb site 10.20.20.1 using https. Which of the following firewall rules meets this requirement?

A. if (source matches 10

B. if (source matches 10

C. if (source matches 10

D. if (source matches 10

View answer

Correct Answer: A

Question #14

____________is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.

A. DNSSEC

B. Resource records

C. Resource transfer

D. Zone transfer

View answer

Correct Answer: A

Question #15

Which of the following describes the characteristics of a Boot Sector Virus?

A. Modifies directory table entries so that directory entries point to the virus code instead of the actual program

B. Moves the MBR to another location on the RAM and copies itself to the original location of the MBR

C. Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR

D. Overwrites the original MBR and only executes the new virus code

View answer

Correct Answer: C

Question #16

What is the known plaintext attack used against DES which gives the result that encrypting plaintext with one DES key followed by encrypting it with a second DES key is no more secure than using a single key?

A. Man-in-the-middle attack

B. Meet-in-the-middle attack

C. Replay attack

D. Traffic analysis attack

View answer

Correct Answer: B

Question #17

Jim’s company regularly performs backups of their critical servers. But the company cannot afford to send backup tapes to an off-site vendor for long-term storage and archiving. Instead, Jim’s company keeps the backup tapes in a safe in the office. Jim’s company is audited each year, and the results from this year’s audit show a risk because backup tapes are not stored off-site. The Manager of Information Technology has a plan to take the backup tapes home with him and wants to know what two things he can do to secure the backup tapes while in transit?

A. Encrypt the backup tapes and transport them in a lock box

B. Degauss the backup tapes and transport them in a lock box

C. Hash the backup tapes and transport them in a lock box

D. Encrypt the backup tapes and use a courier to transport them

View answer

Correct Answer: A

Question #18

Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. The time a hacker spends performing research to locate this information about a company is known as?

A. Exploration

B. Investigation

C. Reconnaissance

D. Enumeration

View answer

Correct Answer: C

Question #19

By using a smart card and pin, you are using a two-factor authentication that satisfies

A. Something you are and something you remember

B. Something you have and something you know

C. Something you know and something you are

D. Something you have and something you are

View answer

Correct Answer: B

Question #20

Which technique is commonly used by attackers to evade firewall detection?

A. sing encrypted communication channels

B. ocial engineering employees

C. poofing source IP addresses to appear trusted

D. sing open-source operating systems

View answer

Correct Answer: A

Question #21

Which of the following incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an organization?

A. Preparation phase

B. Containment phase

C. Identification phase

D. Recovery phase

View answer

Correct Answer: A

Question #22

Shellshock allowed an unauthorized user to gain access to a server. It affected many Internet-facing services, which OS did it not directly affect?

A. Linux

B. Unix

C. OS X

D. Windows

View answer

Correct Answer: D

Question #23

During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network.What is this type of DNS configuration commonly called?

A. DynDNS

B. DNS Scheme

C. DNSSEC

D. Split DNS

View answer

Correct Answer: D

Question #24

What term describes the amount of risk that remains after the vulnerabilities are classified and the countermeasures have been deployed?

A. Residual risk

B. Impact risk

C. Deferred risk

D. Inherent risk

View answer

Correct Answer: A

Question #25

By using a smart card and pin, you are using a two-factor authentication that satisfies

A. Something you are and something you remember

B. Something you have and something you know

C. Something you know and something you are

D. Something you have and something you are

View answer

Correct Answer: B

Question #26

You are the Network Admin, and you get a complaint that some of the websites are no longer accessible. You try to ping the servers and find them to be reachable. Then you type the IP address and then you try on the browser, and find it to be accessible. But they are not accessible when you try using the URL.What may be the problem?

A. Traffic is Blocked on UDP Port 53

B. Traffic is Blocked on TCP Port 80

C. Traffic is Blocked on TCP Port 54

D. Traffic is Blocked on UDP Port 80

View answer

Correct Answer: A

Question #27

A company’s security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

A. Attempts by attackers to access the user and password information stored in the company’s SQL database

B. Attempts by attackers to access Web sites that trust the Web browser user by stealing the user’s authentication credentials

C. Attempts by attackers to access passwords stored on the user’s computer without the user’s knowledge

D. Attempts by attackers to determine the user’s Web browser usage patterns, including when sites were visited and for how long

View answer

Correct Answer: B

Question #28

What does the –oX flag do in an Nmap scan?

A. Perform an eXpress scan

B. Output the results in truncated format to the screen

C. Output the results in XML format to a file

D. Perform an Xmas scan

View answer

Correct Answer: C

Question #29

env x=’(){ :;};echo exploit’ bash –c ‘cat/etc/passwd’What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?

A. Removes the passwd file

B. Changes all passwords in passwd

C. Add new user to the passwd file

D. Display passwd content to prompt

View answer

Correct Answer: D

Question #30

The configuration allows a wired or wireless network interface controller to pass all traffic it receives to the Central Processing Unit (CPU), rather than passing only the frames that the controller is intended to receive. Which of the following is being described?

A. Multi-cast mode

B. Promiscuous mode

C. WEM

D. Port forwarding

View answer

Correct Answer: B

Question #31

What is the purpose of a demilitarized zone on a network?

A. To scan all traffic coming through the DMZ to the internal network

B. To only provide direct access to the nodes within the DMZ and protect the network behind it

C. To provide a place to put the honeypot

D. To contain the network devices you wish to protect

View answer

Correct Answer: B

Question #32

While using your bank’s online servicing you notice the following string in the URL bar: “http://www.MyPersonalBank.com/account?id=368940911028389&Damount=10980&Camount=21”You observe that if you modify the Damount&Camount values and submit the request, that data on the web page reflect the changes.Which type of vulnerability is present on this site?

A. Cookie Tampering

B. SQL Injection

C. Web Parameter Tampering

D. XSS Reflection

View answer

Correct Answer: C

Question #33

What is the purpose of a demilitarized zone on a network?

A. To scan all traffic coming through the DMZ to the internal network

B. To only provide direct access to the nodes within the DMZ and protect the network behind it

C. To provide a place to put the honeypot

D. To contain the network devices you wish to protect

View answer

Correct Answer: B

Question #34

An attacker is trying to redirect the traffic of a small office. That office is using their own mail server, DNS server and NTP server because of the importance of their job. The attacker gain access to the DNS server and redirect the direction www.google.com to his own IP address. Now when the employees of the office want to go to Google they are being redirected to the attacker machine. What is the name of this kind of attack?

A. MAC Flooding

B. Smurf Attack

C. DNS spoofing

D. ARP Poisoning

View answer

Correct Answer: C

Question #35

To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bankweb site 10.20.20.1 using https. Which of the following firewall rules meets this requirement?

A. if (source matches 10

B. if (source matches 10

C. if (source matches 10

D. if (source matches 10

View answer

Correct Answer: A

Question #36

What two conditions must a digital signature meet?

A. Has to be the same number of characters as a physical signature and must be unique

B. Has to be unforgeable, and has to be authentic

C. Must be unique and have special characters

D. Has to be legible and neat

View answer

Correct Answer: B

Question #37

Email is transmitted across the Internet using the Simple Mail Transport Protocol. SMTP does not encrypt email, leaving the information in the message vulnerable to being read by an unauthorized person. SMTP can upgrade a connection between two mail servers to use TLS. Email transmitted by SMTP over TLS is encrypted. What is the name of the command used by SMTP to transmit email over TLS?

A. OPPORTUNISTICTLS

B. UPGRADETLS

C. FORCETLS

D. STARTTLS

View answer

Correct Answer: D

Question #38

Peter is surfing the internet looking for information about DX Company. Which hacking process is Peter doing?

A. Scanning

B. Footprinting

C. Enumeration

D. System Hacking

View answer

Correct Answer: B

Question #39

Bob received this text message on his mobile phone: “Hello, this is Scott Smelby from the Yahoo Bank. Kindly contact me for a vital transaction on: scottsmelby@yahoo.com”. Which statement below is true?

A. This is a scam as everybody can get a @yahoo address, not the Yahoo customer service employees

B. This is a scam because Bob does not know Scott

C. Bob should write to scottmelby@yahoo

D. This is probably a legitimate message as it comes from a respectable organization

View answer

Correct Answer: A

Question #40

When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration. What type of an alert is this?

A. False negative

B. True negative

C. True positive

D. False positive

View answer

Correct Answer: D

Question #41

PGP, SSL, and IKE are all examples of which type of cryptography?

A. Digest

B. Secret Key

C. Public Key

D. Hash Algorithm

View answer

Correct Answer: C

Question #42

Todd has been asked by the security officer to purchase a counter-based authentication system. Which of the following best describes this type of system?

A. A biometric system that bases authentication decisions on behavioral attributes

B. A biometric system that bases authentication decisions on physical attributes

C. An authentication system that creates one-time passwords that are encrypted with secret keys

D. An authentication system that uses passphrases that are converted into virtual passwords

View answer

Correct Answer: C

Question #43

A hacker is an intelligent individual with excellent computer skills and the ability to explore a computer’s software and hardware without the owner’s permission. Their intention can either be to simply gain knowledge or to illegally make changes.Which of the following class of hacker refers to an individual who works both offensively and defensively at various times?

A. White Hat

B. Suicide Hacker

C. Gray Hat

D. Black Hat

View answer

Correct Answer: C

Question #44

An attacker attaches a rogue router in a network. He wants to redirect traffic to a LAN attached to his router as part of a man-in-the-middle attack. What measure on behalf of the legitimate admin can mitigate this attack?

A. Make sure that legitimate network routers are configured to run routing protocols with authentication

B. Disable all routing protocols and only use static routes

C. Only using OSPFv3 will mitigate this risk

D. Redirection of the traffic cannot happen unless the admin allows it explicitly

View answer

Correct Answer: A

Question #45

The collection of potentially actionable, overt, and publicly available information is known as

A. Open-source intelligence

B. Real intelligence

C. Social intelligence

D. Human intelligence

View answer

Correct Answer: A

Question #46

Shellshock allowed an unauthorized user to gain access to a server. It affected many Internet-facing services, which OS did it not directly affect?

A. Linux

B. Unix

C. OS X

D. Windows

View answer

Correct Answer: D

Question #47

A penetration tester is conducting a port scan on a specific host. The tester found several ports opened that were confusing in concluding the Operating System (OS) version installed. Considering that NMAP result below, which of the following is likely to be installed on the target machine by the OS? Starting NMAP 5.21 at 2011-03-15 11:06 NMAP scan report for 172.16.40.65 Host is up (1.00s latency). Not shown: 993 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http 139/tcp open netbios-ssn 515/tcp open 631/tcp open ipp 9100/tcp open MAC Address: 00:00:48:0D:EE:8

A. The host is likely a Linux machine

B. The host is likely a printer

C. The host is likely a router

D. The host is likely a Windows machine

View answer

Correct Answer: B

Question #48

An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?

A. He will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer

B. He will activate OSPF on the spoofed root bridge

C. He will repeat this action so that it escalates to a DoS attack

D. He will repeat the same attack against all L2 switches of the network

View answer

Correct Answer: A

Question #49

What is the way to decide how a packet will move from an untrusted outside host to a protected inside that is behind a firewall, which permits the hacker to determine which ports are open and if the packets can pass through the packet-filtering of the firewall?

A. Session hijacking

B. Firewalking

C. Man-in-the middle attack

D. Network sniffing

View answer

Correct Answer: B

Question #50

Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?

A. Macro virus

B. Stealth/Tunneling virus

C. Cavity virus

D. Polymorphic virus

View answer

Correct Answer: B

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CEH v13 312-50 Practice Questions & Answers 2026 Part1 | Certified Ethical Hacker

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CEH v13 312-50 Practice Questions & Answers 2026 Part1 | Certified Ethical Hacker

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now