ECCouncil 312-50v13 Exam Syllabus Topics:

ECCouncil Certified Ethical Hacker Exam (CEH v13 AI) Sample Questions:

Question #1
A Windows machine shows disabled Windows Defender without admin approval. What phase is this?

A. Defense evasion
B. Persistence
C. Recon
D. Delivery

Question #2
Javier Ruiz from CyberFortress Solutions is tasked with auditing the mobile security practices of Apex Financial Services, a financial firm in Houston, Texas. During a covert penetration test, Javier targets employees ' personal smartphones used to access corporate financial systems. He exploits a vulnerability by installing a malicious app that bypasses access controls, granting him unauthorized entry to sensitive financial data because the devices lack a specific security measure to restrict app access. Based on this vulnerability, which BYOD security guideline is most likely missing in Apex Financial Services ' policy?

A. Review permissions requested by apps before installing them
B. Use encryption mechanisms to store data
C. Set passwords for apps to restrict others from accessing them
D. Enforce automatic device locking or implement biometric authentication

Question #3
A defense contractor in Arlington, Virginia, observes unusual outbound encrypted traffic from an internal engineering workstation. A timeline review reveals that attackers first studied publicly available employee information and technical documentation. Shortly afterward, a specially crafted email attachment was opened, resulting in malicious code executing on the workstation.
The compromised workstation then began communicating with an external server, exchanging commands and transferring proprietary design files. Investigators determine that this communication stage enabled the attackers to remotely interact with the compromised host after the malware had been deployed.
What phase of the Cyber Kill Chain methodology is represented by this stage?

A. Exploitation
B. Installation
C. Command and Control
D. Actions on Objectives

Question #4
As an IT security analyst, you perform network scanning using ICMP Echo Requests. During the scan, several IP addresses do not return Echo Replies, yet other network services remain operational. How should this situation be interpreted?

A. The IP addresses are unused and available for reassignment.
B. The non-responsive IP addresses indicate severe network congestion.
C. The lack of Echo Replies indicates an active security breach.
D. A firewall or security control is likely blocking ICMP Echo Requests.

Question #5
At a government taxation portal in Canberra, Australia, a security assessment revealed that attackers were able to gain unauthorized access to sensitive system-level resources despite no evidence of flaws in the web application logic or exposed administrative interfaces. The intrusion appeared to originate from weaknesses beyond the application layer, allowing deeper access into the server environment.
Further investigation indicated that controls governing access and execution within the server environment were inconsistently applied, enabling unintended privilege escalation and unauthorized interaction with critical infrastructure components.
Determine the primary reason this web server was compromised.

A. Misconfigurations in operating system
B. Use of self-signed certificates or misconfigured SSL certificates
C. Unnecessary default or sample files
D. Improper file and directory permissions

Solutions: