EC-Council 312-50v13 Practice Exams
Last updated on Oct 24,2026- Exam Code: 312-50v13
- Exam Name: Certified Ethical Hacker Exam (CEHv13)
- Certification Provider: EC-Council
- Latest update: Oct 24,2026
As an IT Security Analyst, you’ve been asked to review the security measures of an e-commerce website that relies on a SQL database for storing sensitive customer data. Recently, an anonymous tip has alerted you to a possible threat: a seasoned hacker who specializes in SQL Injection attacks may be targeting your system. The site already employs input validation measures to prevent basic injection attacks, and it blocks any user inputs containing suspicious patterns. However, this hacker is known to use advanced SQL Injection techniques.
Given this situation, which of the following strategies would the hacker most likely adopt to bypass your security measures?
- A . The hacker could deploy an ‘out-of-band’ SQL Injection attack, extracting data via a different communication channel, such as DNS or HTTP requests
- B . The hacker may resort to a DDoS attack instead, attempting to crash the server and thus render the e commerce site unavailable
- C . The hacker may try to use SQL commands which are less known and less likely to be blocked by your system’s security
- D . The hacker might employ a blind’ SQL Injection attack, taking advantage of the application’s true or false responses to extract data bit by bit
Scenario: Joe turns on his home computer to access personal online banking. When he enters the URL www.bank.com. the website is displayed, but it prompts him to re-enter his credentials as if he has never visited the site before. When he examines the website URL closer, he finds that the site is not secure and the web address appears different.
What type of attack he is experiencing?
- A . Dos attack
- B . DHCP spoofing
- C . ARP cache poisoning
- D . DNS hijacking
Which of the following describes the characteristics of a Boot Sector Virus?
- A . Modifies directory table entries so that directory entries point to the virus code instead of the actual program.
- B . Moves the MBR to another location on the RAM and copies itself to the original location of the MBR.
- C . Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR.
- D . Overwrites the original MBR and only executes the new virus code.
Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions.
Which of the following master components is explained in the above scenario?
- A . Kube-controller-manager
- B . Kube-scheduler
- C . Kube-apiserver
- D . Etcd cluster
Geena, a cloud architect, uses a master component in the Kubernetes cluster architecture that scans newly generated pods and allocates a node to them. This component can also assign nodes based on factors such as the overall resource requirement, data locality, software/hardware/policy restrictions, and internal workload interventions.
Which of the following master components is explained in the above scenario?
- A . Kube-controller-manager
- B . Kube-scheduler
- C . Kube-apiserver
- D . Etcd cluster
On performing a risk assessment, you need to determine the potential impacts when some of the critical business processes of the company interrupt its service.
What is the name of the process by which you can determine those critical businesses?
- A . Emergency Plan Response (EPR)
- B . Business Impact Analysis (BIA)
- C . Risk Mitigation
- D . Disaster Recovery Planning (DRP)
MX record priority increases as the number increases. (True/False.)
- A . True
- B . False
Which of the following allows attackers to draw a map or outline the target organization’s network infrastructure to know about the actual environment that they are going to hack.
- A . Enumeration
- B . Vulnerability analysis
- C . Malware analysis
- D . Scanning networks
You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine.
What Wireshark filter will show the connections from the snort machine to kiwi syslog machine?
- A . tcp.srcport= = 514 && ip.src= = 192.168.0.99
- B . tcp.srcport= = 514 && ip.src= = 192.168.150
- C . tcp.dstport= = 514 && ip.dst= = 192.168.0.99
- D . tcp.dstport= = 514 && ip.dst= = 192.168.0.150
An ethical hacker is hired to evaluate the defenses of an organization’s database system which is known to employ a signature-based IDS. The hacker knows that some SQL Injection evasion techniques may allow him to bypass the system’s signatures. During the operation, he successfully retrieved a list of usernames from the database without triggering an alarm by employing an advanced evasion technique.
Which of the following could he have used?
- A . Utilizing the char encoding function to convert hexadecimal and decimal values into characters that pass-through SQL engine parsing
- B . Using the URL encoding method to replace characters with their ASCII codes in hexadecimal form
- C . Implementing sophisticated matches such as “OR ‘john’ = john" in place of classical matches like "OR 1-1"
- D . Manipulating white spaces in SQL queries to bypass signature detection