Free CEH v13 312-50 Practice Questions & Answers 2026 Part2

Question #1

Which of the following is the BEST way to defend against network sniffing?

A. Using encryption protocols to secure network communications

B. Register all machines MAC Address in a Centralized Database

C. Use Static IP Address

D. Restrict Physical Access to Server Rooms hosting Critical Servers

View answer

Correct Answer: A

Question #2

In Seattle, Washington, ethical hacker Mia Chen is hired by Pacific Trust Bank to test the security of their corporate network, which stores sensitive customer financial data. During her penetration test, Mia conducts a thorough reconnaissance, targeting a server that appears to host a critical database of transaction records. As she interacts with the server, she notices it responds promptly to her queries but occasionally returns error messages that seem inconsistent with a production system's behavior, such as unexpected protocol responses.Suspicious that this server might be a decoy designed to monitor her actions, Mia applies a technique to detect inconsistencies that may reveal the system as a honeypot.Which technique is Mia most likely using to determine if the server at Pacific Trust Bank is a honeypot?

A. nalyzing Response Time

B. ingerprinting the Running Service

C. nalyzing MAC Address

D. nalyzing System Configuration and Metadata

View answer

Correct Answer: B

Question #3

Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company application is 50%. Security staff has taken some measures and implemented the necessary controls. After that, another security risk assessment was performed showing that risk has decreased to 10%. The risk threshold for the application is 20%. Which of the following risk decisions will be the best for the project in terms of its successful continuation with the most business profit?

A. Accept the risk

B. Introduce more controls to bring risk to 0%

C. Mitigate the risk

D. Avoid the risk

View answer

Correct Answer: A

Question #4

As the cybersecurity lead for an international news agency, you are alerted by your threat intelligence team that confidential communications between journalists and whistleblowers have been posted to an online activist forum. Further forensic analysis reveals that no financial transactions were tampered with and no ransomware was deployed. However, the agency's internal systems were accessed and selectively leaked emails were published alongside a manifesto accusing the organization of biased reporting. The attackers also posted on social media claiming responsibility and justifying their actions as a fight against misinformation.Based on this behavior, what category of hacker are you most likely dealing with?

A. hite Hat hackers

B. acktivists

C. lack Hat hackers

D. cript Kiddies

View answer

Correct Answer: B

Question #5

What does the –oX flag do in an Nmap scan?

A. Perform an eXpress scan

B. Output the results in truncated format to the screen

C. Output the results in XML format to a file

D. Perform an Xmas scan

View answer

Correct Answer: C

Question #6

Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company application is 50%. Security staff has taken some measures and implemented the necessary controls. After that, another security risk assessment was performed showing that risk has decreased to 10%. The risk threshold for the application is 20%. Which of the following risk decisions will be the best for the project in terms of its successful continuation with the most business profit?

A. Accept the risk

B. Introduce more controls to bring risk to 0%

C. Mitigate the risk

D. Avoid the risk

View answer

Correct Answer: A

Question #7

The collection of potentially actionable, overt, and publicly available information is known as

A. Open-source intelligence

B. Real intelligence

C. Social intelligence

D. Human intelligence

View answer

Correct Answer: A

Question #8

When purchasing a biometric system, one of the considerations that should be reviewed is the processing speed. Which of the following best describes what it is meant by processing?

A. The amount of time and resources that are necessary to maintain a biometric system

B. How long it takes to setup individual user accounts

C. The amount of time it takes to be either accepted or rejected from when an individual provides identification and authentication information

D. The amount of time it takes to convert biometric data into a template on a smart card

View answer

Correct Answer: C

Question #9

Hackers often raise the trust level of a phishing message by modeling the email to look similar to the internal email used by the target company. This includes using logos, formatting, and names of the target company. The phishing message will often use the name of the company CEO, President, or Managers. The time a hacker spends performing research to locate this information about a company is known as?

A. Exploration

B. Investigation

C. Reconnaissance

D. Enumeration

View answer

Correct Answer: C

Question #10

When purchasing a biometric system, one of the considerations that should be reviewed is the processing speed. Which of the following best describes what it is meant by processing?

A. The amount of time and resources that are necessary to maintain a biometric system

B. How long it takes to setup individual user accounts

C. The amount of time it takes to be either accepted or rejected from when an individual provides identification and authentication information

D. The amount of time it takes to convert biometric data into a template on a smart card

View answer

Correct Answer: C

Question #11

Internet Protocol Security IPsec is actually a suite pf protocols. Each protocol within the suite provides different functionality. Collective IPsec does everything except.

A. Protect the payload and the headers

B. Encrypt

C. Work at the Data Link Layer

D. Authenticate

View answer

Correct Answer: C

Question #12

Which of the following is the least-likely physical characteristic to be used in biometric control that supports a large company?

A. Iris patterns

B. Voice

C. Height and Weight

D. Fingerprints

View answer

Correct Answer: C

Question #13

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named “nc.” The FTP server’s access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server’s software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port.What kind of vulnerability must be present to make this remote attack possible?

A. File system permissions

B. Privilege escalation

C. Directory traversal

D. Brute force login

View answer

Correct Answer: A

Question #14

Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

A. tcptrace

B. Nessus

C. OpenVAS

D. tcptraceroute

View answer

Correct Answer: A

Question #15

Scenario:1. Victim opens the attacker’s web site.2. Attacker sets up a web site which contains interesting and attractive content like ‘Do you want to make$1000 in a day?’.3. Victim clicks to the interesting and attractive content URL.4. Attacker creates a transparent ‘iframe’ in front of the URL which the victim attempts to click, so the victim thinks that he/she clicks on the ‘Do you want to make $1000 in a day?’ URL but actually he/she clicks on the content or URL that exists in the transparent 'iframe' which is setup by the attacker.What is the name of the attack which is mentioned in the scenario?

A. Session Fixation

B. HTML Injection

C. HTTP Parameter Pollution

D. Clickjacking Attack

View answer

Correct Answer: D

Question #16

An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML code to embed a malicious applet in all HTTP connections.When users accessed any page, the applet ran and exploited many machines. Which one of the following tools the hacker probably used to inject HTML code?

A. Wireshark

B. Ettercap

C. Aircrack-ng

D. Tcpdump

View answer

Correct Answer: B

Question #17

What does a firewall check to prevent particular ports and applications from getting packets into an organization?

A. Transport layer port numbers and application layer headers

B. Presentation layer headers and the session layer port numbers

C. Network layer headers and the session layer port numbers

D. Application layer port numbers and the transport layer headers

View answer

Correct Answer: A

Question #18

Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?

A. Use the built-in Windows Update tool

B. Use a scan tool like Nessus

C. Check MITRE

D. Create a disk image of a clean Windows installation

View answer

Correct Answer: B

Question #19

Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer?

A. Use the built-in Windows Update tool

B. Use a scan tool like Nessus

C. Check MITRE

D. Create a disk image of a clean Windows installation

View answer

Correct Answer: B

Question #20

During a security assessment for an e-commerce company in Boston, Massachusetts, your team conducts a reconnaissance phase to identify potential entry points into the organization ' s communication infrastructure.You focus on gathering details about the systems responsible for handling incoming email traffic, avoiding active network probing, and relying on passive DNS data collection. Given this objective, which DNS record type should you query to extract information about the target's mail server configuration?

A. OA

B. XT

C. S

D. X

View answer

Correct Answer: D

Question #21

Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN standards on a Linux platform?

A. Kismet

B. Abel

C. Netstumbler

D. Nessus

View answer

Correct Answer: A

Question #22

Which of the following is a low-tech way of gaining unauthorized access to systems?

A. Social Engineering

B. Eavesdropping

C. Scanning

D. Sniffing

View answer

Correct Answer: A

Question #23

____________is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks.

A. DNSSEC

B. Resource records

C. Resource transfer

D. Zone transfer

View answer

Correct Answer: A

Question #24

Although FTP traffic is not encrypted by default, which layer 3 protocol would allow for end-to-end encryption of the connection?

A. SFTP

B. Ipsec

C. SSL

D. FTPS

View answer

Correct Answer: B

Question #25

Which of the following tools can be used for passive OS fingerprinting?

A. nmap

B. tcpdump

C. tracert

D. ping

View answer

Correct Answer: B

Question #26

During an internal penetration test within a large corporate environment, the red team gains access to an unrestricted network port in a public-facing meeting room. The tester deploys an automated tool that sends thousands of DHCPDISCOVER requests using randomized spoofed MAC addresses. The DHCP server's lease pool becomes fully depleted, preventing legitimate users from obtaining IP addresses. What type of attack did the penetration tester perform?

A. NS cache poisoning

B. RP spoofing

C. HCP starvation

D. ogue DHCP relay injection

View answer

Correct Answer: C

Question #27

A financial startup in Chicago hires an ethical hacker to evaluate its exposure on hidden networks. The client is particularly concerned that confidential administrative documents might be circulating on .onion sites. To remain passive, the hacker relies on advanced search filters to look for files with headers suggesting management-related content. Which of the following queries would best meet this objective?

A. iletype:docx " credentials "

B. iletype:pdf intitle: " admin access " site:onion

C. iletype:docx intitle: " user accounts " site:onion

D. iletype:pdf intitle: " secure login " site:onion

View answer

Correct Answer: B

Question #28

You are attempting to run an Nmap port scan on a web server. Which of the following commands would result in a scan of common ports with the least amount of noise in order to evade IDS?

A. nmap -A - Pn

B. nmap -sP -p-65535 -T5

C. nmap -sT -O -T0

D. nmap -A --host-timeout 99 -T1

View answer

Correct Answer: C

Question #29

When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration. What type of an alert is this?

A. False negative

B. True negative

C. True positive

D. False positive

View answer

Correct Answer: D

Question #30

What is a “Collision attack” in cryptography?

A. Collision attacks try to get the public key

B. Collision attacks try to break the hash into three parts to get the plaintext value

C. Collision attacks try to break the hash into two parts, with the same bytes in each part to get the private key

D. Collision attacks try to find two inputs producing the same hash

View answer

Correct Answer: D

Question #31

Which system consists of a publicly available set of databases that contain domain name registration contact information?

A. WHOIS

B. CAPTCHA

C. IANA

D. IETF

View answer

Correct Answer: A

Question #32

As part of a controlled red-team engagement, an ethical hacker evaluates the resilience of a corporate campus against radio-frequency disruption. The tester activates a portable multi-antenna signal suppression device from a nearby building.The interference affects wireless communication across several departments within an estimated coverage radius of approximately 120 meters. The disruption persists for slightly over an hour before the device requires recharge. Analysis confirms that multiple frequency bands, including Wi-Fi and cellular standards, were simultaneously impacted.Based on the operational characteristics observed, identify the jamming device most consistent with this activity.

A. CB-1016 Jammer

B. PB-2612H-5G Jammer

C. PB-2920 Jammer

D. CB-4510 Jammer

View answer

Correct Answer: D

Question #33

Which of the following Linux commands will resolve a domain name into IP address?

A. >host-t a hackeddomain

B. >host-t ns hackeddomain

C. >host -t soa hackeddomain

D. >host -t AXFR hackeddomain

View answer

Correct Answer: A

Question #34

The establishment of a TCP connection involves a negotiation called three-way handshake. What type of message does the client send to the server in order to begin this negotiation?

A. ACK

B. SYN

C. RST

D. SYN-ACK

View answer

Correct Answer: B

Question #35

You have successfully comprised a server having an IP address of 10.10.0.5. You would like to enumerate all machines in the same network quickly.What is the best Nmap command you will use?

A. nmap -T4 -q 10

B. nmap -T4 -F 10

C. nmap -T4 -r 10

D. nmap -T4 -O 10

View answer

Correct Answer: B

Question #36

Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of a built-in bounds checking mechanism?Code:#include intmain(){____________char buffer[8];strcpy(buffer, ““11111111111111111111111111111””);} Output: Segmentation fault

A. C#

B. Python

C. Java

D. C++

View answer

Correct Answer: D

Question #37

What is the known plaintext attack used against DES which gives the result that encrypting plaintext with one DES key followed by encrypting it with a second DES key is no more secure than using a single key?

A. Man-in-the-middle attack

B. Meet-in-the-middle attack

C. Replay attack

D. Traffic analysis attack

View answer

Correct Answer: B

Question #38

Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?

A. tcpsplice

B. Burp

C. Hydra

D. Whisker

View answer

Correct Answer: D

Question #39

Which type of security feature stops vehicles from crashing through the doors of a building?

A. Bollards

B. Receptionist

C. Mantrap

D. Turnstile

View answer

Correct Answer: A

Question #40

Which type of security feature stops vehicles from crashing through the doors of a building?

A. Bollards

B. Receptionist

C. Mantrap

D. Turnstile

View answer

Correct Answer: A

Question #41

What kind of detection techniques is being used in antivirus software that identifies malware by collecting data from multiple protected systems and instead of analyzing files locally it’s made on the provider’s environment?

A. Behavioral based

B. Heuristics based

C. Honeypot based

D. Cloud based

View answer

Correct Answer: D

Question #42

What is the minimum number of network connections in a multihomed firewall?

A. 3

B. 5

C. 4

D. 2

View answer

Correct Answer: A

Question #43

In the field of cryptanalysis, what is meant by a “rubber-hose” attack?

A. Forcing the targeted keystream through a hardware-accelerated device such as an ASIC

B. A backdoor placed into a cryptographic algorithm by its creator

C. Extraction of cryptographic secrets through coercion or torture

D. Attempting to decrypt ciphertext by making logical assumptions about the contents of the original plaintext

View answer

Correct Answer: C

Question #44

Which of the following is assured by the use of a hash?

A. Authentication

B. Confidentiality

C. Availability

D. Integrity

View answer

Correct Answer: D

Question #45

Which of the following incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an organization?

A. Preparation phase

B. Containment phase

C. Identification phase

D. Recovery phase

View answer

Correct Answer: A

Question #46

A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server. Based on this information, what should be one of your key recommendations to the bank?

A. Place a front-end web server in a demilitarized zone that only handles external web traffic

B. Require all employees to change their anti-virus program with a new one

C. Move the financial data to another server on the same IP subnet

D. Issue new certificates to the web servers from the root certificate authority

View answer

Correct Answer: A

Question #47

What is correct about digital signatures?

A. A digital signature cannot be moved from one signed document to another because it is the hash of the original document encrypted with the private key of the signing party

B. Digital signatures may be used in different documents of the same type

C. A digital signature cannot be moved from one signed document to another because it is a plain hash of the document content

D. Digital signatures are issued once for each user and can be used everywhere until they expire

View answer

Correct Answer: A

Question #48

What is not a PCI compliance recommendation?

A. Use a firewall between the public network and the payment card data

B. Use encryption to protect all transmission of card holder data over any public network

C. Rotate employees handling credit card transactions on a yearly basis to different departments

D. Limit access to card holder data to as few individuals as possible

View answer

Correct Answer: C

Question #49

Your company performs penetration tests and security assessments for small and medium-sized business in the local area. During a routine security assessment, you discover information that suggests your client is involved with human trafficking.What should you do?

A. Confront the client in a respectful manner and ask her about the data

B. Copy the data to removable media and keep it in case you need it

C. Ignore the data and continue the assessment until completed as agreed

D. Immediately stop work and contact the proper legal authorities

View answer

Correct Answer: D

Question #50

Which Intrusion Detection System is best applicable for large environments where critical assets on the network need extra scrutiny and is ideal for observing sensitive network segments?

A. Honeypots

B. Firewalls

C. Network-based intrusion detection system (NIDS)

D. Host-based intrusion detection system (HIDS)

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CEH v13 312-50 Practice Questions & Answers 2026 Part2 | Certified Ethical Hacker

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CEH v13 312-50 Practice Questions & Answers 2026 Part2 | Certified Ethical Hacker

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now