EC-Council 312-50v13 Practice Exams
Last updated on Oct 24,2026- Exam Code: 312-50v13
- Exam Name: Certified Ethical Hacker Exam (CEHv13)
- Certification Provider: EC-Council
- Latest update: Oct 24,2026
An organization has been experiencing intrusion attempts despite deploying an Intrusion Detection System (IDS) and Firewalls. As a Certified Ethical Hacker, you are asked to reinforce the intrusion detection process and recommend a better rule-based approach. The IDS uses Snort rules and the new recommended tool should be able to complement it. You suggest using YARA rules with an additional tool for rule generation.
Which of the following tools would be the best choice for this purpose and why?
- A . AutoYara – Because it automates the generation of YARA rules from a set of malicious and benign files
- B . yarGen – Because it generates YARA rules from strings identified in malware files while removing
strings that also appear in goodware files - C . YaraRET – Because it helps in reverse engineering Trojans to generate YARA rules
- D . koodous – Because it combines social networking with antivirus signatures and YARA rules to detect malware
Widespread fraud ac Enron. WorldCom, and Tyco led to the creation of a law that was designed to improve the accuracy and accountability of corporate disclosures. It covers accounting firms and third parties that provide financial services to some organizations and came into effect in 2002.
This law is known by what acronym?
- A . Fed RAMP
- B . PCIDSS
- C . SOX
- D . HIPAA
Although FTP traffic is not encrypted by default, which layer 3 protocol would allow for end-to-end encryption of the connection?
- A . SFTP
- B . Ipsec
- C . SSL
- D . FTPS
Bob, your senior colleague, has sent you a mail regarding a deal with one of the clients. You are requested to accept the offer and you oblige. After 2 days, Bab denies that he had ever sent a mail.
What do you want to ““know”” to prove yourself that it was Bob who had send a mail?
- A . Non-Repudiation
- B . Integrity
- C . Authentication
- D . Confidentiality
Matthew, a black hat, has managed to open a meterpreter session to one of the kiosk machines in Evil Corp’s lobby. He checks his current SID, which is S-1-5-21-1223352397-1872883824-861252104-501.
What needs to happen before Matthew has full administrator access?
- A . He must perform privilege escalation.
- B . He needs to disable antivirus protection.
- C . He needs to gain physical access.
- D . He already has admin privileges, as shown by the “501” at the end of the SID.
CompanyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York, you craft a specially formatted email message and send it across the Internet to an employee of CompanyXYZ. The employee of CompanyXYZ is aware of your test.
Your email message looks like this:
From: [email protected]
To: [email protected] Subject: Test message
Date: 4/3/2017 14:37
The employee of CompanyXYZ receives your email message.
This proves that CompanyXYZ’s email gateway doesn’t prevent what?
- A . Email Masquerading
- B . Email Harvesting
- C . Email Phishing
- D . Email Spoofing
These hackers have limited or no training and know how to use only basic techniques or tools.
What kind of hackers are we talking about?
- A . Black-Hat Hackers A
- B . Script Kiddies
- C . White-Hat Hackers
- D . Gray-Hat Hacker
What useful information is gathered during a successful Simple Mail Transfer Protocol (SMTP) enumeration?
- A . The two internal commands VRFY and EXPN provide a confirmation of valid users, email addresses, aliases, and mailing lists.
- B . Reveals the daily outgoing message limits before mailboxes are locked
- C . The internal command RCPT provides a list of ports open to message traffic.
- D . A list of all mail proxy server addresses used by the targeted host
You are trying to break into a highly classified top-secret mainframe computer with highest security system in place at Merclyn Barley Bank located in Los Angeles.
You know that conventional hacking doesn’t work in this case, because organizations such as banks are generally tight and secure when it comes to protecting their systems.
In other words, you are trying to penetrate an otherwise impenetrable system.
How would you proceed?
- A . Look for "zero-day" exploits at various underground hacker websites in Russia and China and buy the necessary exploits from these hackers and target the bank’s network
- B . Try to hang around the local pubs or restaurants near the bank, get talking to a poorly-paid or disgruntled employee, and offer them money if they’ll abuse their access privileges by providing you with sensitive information
- C . Launch DDOS attacks against Merclyn Barley Bank’s routers and firewall systems using 100, 000 or more "zombies" and "bots"
- D . Try to conduct Man-in-the-Middle (MiTM) attack and divert the network traffic going to the Merclyn Barley Bank’s Webserver to that of your machine using DNS Cache Poisoning techniques
if you send a TCP ACK segment to a known closed port on a firewall but it does not respond with an RST.
What do you know about the firewall you are scanning?
- A . There is no firewall in place.
- B . This event does not tell you encrypting about the firewall.
- C . It is a stateful firewall
- D . It Is a non-stateful firewall.