EC-Council Certified Ethical Hacker v13 312-50v13 Exam Questions in PDF

Free EC-Council 312-50v13 Dumps Questions (page: 10)

Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API.

Which of the following tools is used by Wilson in the above scenario?

  1. Factiva
  2. ZoomInfo
  3. Netcraft
  4. Infoga

Answer(s): D

Explanation:

Wilson uses Infoga, a tool designed to enumerate information about email addresses from public sources, including sender identities, mail servers, IPs, and related metadata, and it can check if an address was compromised via haveibeenpwned.
A) Factiva is a business news and information aggregator, not focused on email reconnaissance.
B) ZoomInfo provides corporate contact and demographic data, not email-header reconnaissance or Have I Been Pwned checks.
C) Netcraft specializes in web server and hosting information, not comprehensive email metadata gathering or breach checks.
D) Infoga specializes in gathering email-related information from multiple sources and integrates breach lookups.



David is a security professional working in an organization, and he is implementing a vulnerability management program in the organization to evaluate and control the risks and vulnerabilities in its IT infrastructure. He is currently executing the process of applying fixes on vulnerable systems to reduce the impact and severity of vulnerabilities.

Which phase of the vulnerability-management life cycle is David currently in?

  1. Remediation
  2. Verification
  3. Risk assessment
  4. Vulnerability scan

Answer(s): A

Explanation:

Implementing fixes to reduce impact and severity corresponds to the Remediation phase of vulnerability management.
A) Remediation — Correct: applying patches or compensating controls to fix identified vulnerabilities.
B) Verification — Incorrect: focuses on validating that remediation actions were effective, usually after remediation.
C) Risk assessment — Incorrect: involves identifying and prioritizing risks before or during vulnerability analysis, not the act of applying fixes.
D) Vulnerability scan — Incorrect: is the discovery phase where vulnerabilities are identified, not the remediation step.



Alice, a professional hacker, targeted an organization's cloud services. She infiltrated the target's MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization.

Which of the following cloud attacks did Alice perform in the above scenario?

  1. Cloud cryptojacking
  2. Man-in-the-cloud (MITC) attack
  3. Cloud hopper attack
  4. Cloudborne attack

Answer(s): C

Explanation:

Alice performed a cloud-hopper attack by compromising an MSP to access target customer data and pivot into the target organization, leveraging the MSP as the foothold. A) Cloud cryptojacking involves illegal cryptomining on victims’ systems, not data exfiltration via MSPs. B) Man-in-the-cloud (MITC) refers to credential interception on cloud services through cloud account manipulation, not MSP compromise for customer data exfiltration. D) Cloudborne attack is not a standard ECCouncil term for this scenario. C) Cloud hopper attack correctly describes leveraging an MSP to access multiple customers’ cloud environments and exfiltrate data to launch further attacks.



Judy created a forum. One day, she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden behind those images:



What issue occurred for the users who clicked on the image?

  1. This php file silently executes the code and grabs the user's session cookie and session ID.
  2. The code redirects the user to another site.
  3. The code injects a new cookie to the browser.
  4. The code is a virus that is attempting to gather the user's username and password.

Answer(s): A

Explanation:

The code hidden behind images indicates a PHP-based session hijacking payload that silently executes to steal the user’s session cookie and session ID, enabling session fixation or impersonation.
A) This php file silently executes the code and grabs the user's session cookie and session ID.
B) The code redirects the user to another site. - No redirection described; focus is on credential/session data theft.
C) The code injects a new cookie to the browser. - Stealing existing session data, not just adding a cookie.
D) The code is a virus that is attempting to gather the user's username and password. - Focus is on session data, not direct credential collection.



Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs.

Which two SQL injection types would give her the results she is looking for?

  1. Out of band and boolean-based
  2. Union-based and error-based
  3. Time-based and union-based
  4. Time-based and boolean-based

Answer(s): B

Explanation:

Boolean-based and union-based injections together can test true/false responses and reveal data structure, aligning with the goal of verifying true/false outcomes and leveraging query results across multiple rows. A) Out of band and boolean-based is incorrect because out-of-band focuses on data exfiltration via external channels, not immediate true/false evaluation. C) Time-based and union-based pairs time-based delays with data retrieval, not specifically targeting true/false response testing. D) Time-based and boolean-based combines timing to infer truth values but misses the broader data return aspect provided by union-based queries.



Jason, an attacker, targeted an organization to perform an attack on its Internet-facing web server with the intention of gaining access to backend servers, which are protected by a firewall. In this process, he used a URL https://xyz.com/feed.php?url=externalsite.com/feed/to to obtain a remote feed and altered the URL input to the local host to view all the local resources on the target server.

What is the type of attack Jason performed in the above scenario?

  1. Web server misconfiguration
  2. Server-side request forgery (SSRF) attack
  3. Web cache poisoning attack
  4. Website defacement

Answer(s): B

Explanation:

Jason performed a Server-Side Request Forgery (SSRF) attack by coercing the server to make requests to internal or unintended resources via manipulated input, exposing internal resources through the feed URL. A) Web server misconfiguration refers to improper server setup, not input-driven requests. C) Web cache poisoning involves injecting malicious content into a cache, not triggering server-side requests. D) Website defacement changes site content, not growing access to internal resources via the backend.



George is a security professional working for iTech Solutions. He was tasked with securely transferring sensitive data of the organization between industrial systems. In this process, he used a short-range communication protocol based on the IEEE 203.15.4 standard. This protocol is used in devices that transfer data infrequently at a low rate in a restricted area, within a range of 10-100 m.

What is the short-range wireless communication technology George employed in the above scenario?

  1. LPWAN
  2. MQTT
  3. NB-IoT
  4. Zigbee

Answer(s): D

Explanation:

George used Zigbee, which aligns with IEEE 802.15.4 for low-rate, short-range, energy-efficient wireless networking in restricted areas (typically 10-100 m) suitable for infrequent data transfer in industrial environments.
A) LPWAN is designed for long-range, low-power wide-area networks, not 10-100 m indoor industrial short-range.
B) MQTT is a messaging protocol, not a wireless physical layer or standard for short-range device communication.
C) NB-IoT is a cellular LPWAN technology aimed at broad-area coverage, not confined 10-100 m industrial scenarios.
D) Zigbee correctly uses IEEE 802.15.4 for low-rate, short-range mesh networking.



Eric, a cloud security engineer, implements a technique for securing the cloud resources used by his organization. This technique assumes by default that a user attempting to access the network is not an authentic entity and verifies every incoming connection before allowing access to the network. Using this technique, he also imposed conditions such that employees can access only the resources required for their role.

What is the technique employed by Eric to secure cloud resources?

  1. Demilitarized zone
  2. Zero trust network
  3. Serverless computing
  4. Container technology

Answer(s): B

Explanation:

Zero trust network is correct because it requires continuous verification of every user and device before granting access, and enforces least-privilege access based on role, aligning with Eric’s default-deny and verify-every-connection approach. A) Demilitarized zone is a network segment that acts as a buffer, not a verification framework. C) Serverless computing is a cloud execution model, not a access-control paradigm. D) Container technology isolates applications but does not by itself implement zero-trust authentication and authorization policies.



Share your comments for EC-Council 312-50v13 exam with other users:

A
AI Tutor Explanation
4/25/2026 1:42:20 PM

Question 104:

  • Correct answer: D) Multi-Terabyte (TB) Range

  • Brief explanation:
- clustering keys organize data into micro-partitions to improve pruning when queries filter on those columns. - The performance benefit is most significant for very large tables; for small tables the overhead of maintaining clustering outweighs gains. - Therefore, as a best practice, define clustering keys on tables at the TB scale.

C
Community Helper
4/25/2026 2:03:10 AM

Q23: Fabric Admin is correct. Because Domain admin cannot create domains. Only Fabric Admin can among the given options. Q51: Wrapping @pipeline.parameter.param1 inside {} will return a string. But question requires the expression to return Int, so correct answer should be @pipeline.parameter.param1 (no {})

A
AI Tutor Explanation
4/23/2026 3:07:03 PM

Question 62:

  • Correct answer: D (per the page)

  • Note: The explanation text on the page describes option B (use ZDX score and Analyze Score to trigger the Y Engine analysis), indicating a mismatch between the stated answer and the rationale.

  • Key concept: For fast root-cause analysis, leverage telemetry and auto-correlated insights:
- Use the user’s ZDX score for AWS and run Analyze Score to activate the Y Engine, which correlates metrics across network, client, and application to pinpoint the issue quickly.
  • Why the other options are less effective:
- A: Only checks for outages; doesn’t provide actionable root-cause analysis. - C: Deep Trace helps visibility but is manual and time-consuming. - D: Packet capture is invasive and slow; not the quickest path to root cause.

A
AI Tutor Explanation
4/23/2026 12:26:21 PM

Question 32:

  • Answer: A (2.4GHz)

  • Why: Lower-frequency signals have longer wavelengths and experience less attenuation when passing through walls and obstacles. Higher frequencies (5GHz, 6GHz) are more easily blocked by walls. NFC operates over very short distances and is not meant to penetrate walls. So 2.4 GHz best penetrates physical objects like walls.

A
AI Tutor Explanation
4/21/2026 8:48:36 AM

Question 3:

  • False is the correct answer (Option B).

Why:
  • In Snowflake, a database is a metadata object that exists within a single Snowflake account. Accounts are isolated—there isn’t one database that lives in multiple accounts.
  • You can access data across accounts via data sharing or database replication, but these create separate database objects in the other accounts (e.g., a database in the consumer account created from a share), not a single shared database across accounts.

So a single database cannot exist in more than one Snowflake account.

A
Anonymous User
4/16/2026 10:54:18 AM

Question 1:

  • Correct answer: Edate = sys.argv[1]
  • Why this is correct:
- When a Databricks Job passes parameters to a notebook, those parameters are supplied to the notebook's Python process as command-line arguments. The first argument after the script name is sys.argv[1], so date = sys.argv[1] captures the passed date value directly.
  • How it compares to other options:
- date = spark.conf.get("date") reads from Spark config, not from job parameters. - input() waits for user input at runtime, which isn’t how job parameters are provided. - date = dbutils.notebooks.getParam("date") would work if the notebook were invoked via dbutils.notebook.run with parameters, not

A
Anonymous User
4/15/2026 4:42:07 AM

Question 528:

  • Correct answer: NSG flow logs for NSG1 (Option B)

  • Why:
- Traffic Analytics uses NSG flow logs to analyze traffic patterns. You must have NSG flow logs enabled for the NSGs you want to monitor. - An Azure Log Analytics workspace is also required to store and query the traffic data. - Network Watcher must be available in the subscription for traffic analytics to function.
  • What to configure (brief steps):
- Ensure Network Watcher is enabled in the East US region (for the subscription/region). - Enable NSG flow logs on NSG1. - Ensure a Log Analytics workspace exists and is accessible (read/write) so Traffic Analytics can store and query logs.
  • Why other options aren’t correct:
- “Diagnostic settings for VM1” or “Diagnostic settings for NSG1” alone don’t guarantee flow logs are captured and sent to Log Analytics, which Traffic Analytics relies on. - “Insights for VM1” is not how Traffic Analytics collects traffic data.

A
Anonymous User
4/15/2026 2:43:53 AM

Question 23:
The correct answer is Domain admin (option B), not Fabric admin.

  • Domain admin provides domain-level management: create domains/subdomains and assign workspaces within those domains, which matches the tasks while following least privilege.
  • Fabric admin is global-level access and is more privileges than needed for this scenario (it would grant broader control across the Fabric environment).

A
Anonymous User
4/14/2026 12:31:34 PM

Question 2:
For question 2, the key concept is the Longest Prefix Match. Routers pick the route whose subnet mask is the most specific (largest prefix length) that still matches the destination IP.
From the options:

  • A) 10.10.10.0/28 ? 10.10.10.0–10.10.10.15
  • B) 10.10.13.0/25 ? 10.10.13.0–10.10.13.127
  • C) 10.10.13.144/28 ? 10.10.13.144–10.10.13.159
  • D) 10.10.13.208/29 ? 10.10.13.208–10.10.13.215

The destination Host A’s IP must fall within 10.10.13.208–10.10.13.215 for the /29 to be the best match. Since /29 is the longest prefix among the matching options, Router1 will use 10.10.13.208/29.
Thus, the correct answer is D.

S
srameh
4/14/2026 10:09:29 AM

Question 3:

  • Correct answer: Phase 4, Post Accreditation

  • Explanation:
- In DITSCAP, the four phases are: - Phase 1: Definition (concept and requirements) - Phase 2: Verification (design and testing) - Phase 3: Validation (fielding and evaluation) - Phase 4: Post Accreditation (ongoing operations and lifecycle management) - The description—continuing operation of an accredited IT system and addressing changing threats throughout its life cycle—fits the Post Accreditation phase, which covers operations, maintenance, monitoring, and reauthorization as threats and environment evolve.

O
onibokun10
4/13/2026 7:50:14 PM

Question 129:
Correct answer: CNAME

  • A CNAME record creates an alias for a domain, so newapplication.comptia.org will resolve to whatever IP address www.comptia.org resolves to. This ensures both names point to the same resource without duplicating the IP.
  • Why not the others:
- SOA defines authoritative information for a zone. - MX specifies mail exchange servers. - NS designates name servers for a zone.
  • Notes: The alias name (newapplication.comptia.org) should not have other records if you use a CNAME for it, and CNAMEs aren’t used for the zone apex (root) domain. This scenario uses a subdomain, so a CNAME is appropriate.

A
Anonymous User
4/13/2026 6:29:58 PM

Question 1:

  • Correct answer: C

  • Why this is best:
- Uses OS Login with IAM, so SSH access is granted via Google accounts rather than distributing per-user SSH keys. - Granting the compute.osAdminLogin role to a Google group gives admin access to all team members in a centralized, auditable way. - Access is auditable: Cloud Audit Logs show who accessed which VM, satisfying the security requirement to determine who accessed a given instance.
  • How it works:
- Enable OS Login on the project/instances (enable-oslogin metadata). - Add the team’s

A
Anonymous User
4/13/2026 1:00:51 PM

Question 2:

  • Answer: D. Azure Advisor

  • Why: To view security-related recommendations for resources in the Compute and Apps area (including App Service Web Apps and Functions), you use Azure Advisor. Advisor surfaces personalized best-practice recommendations across resources, including security, and shows which resources are affected and the severity.

  • Why not the others:
- Azure Log Analytics is for ad-hoc querying of telemetry, not for viewing security recommendations. - Azure Event Hubs is for streaming telemetry data, not for security recommendations.
  • Quick tip: In the portal, navigate to Azure Advisor and check the Security recommendations for App Services to see actionable items and affe

D
Don
4/11/2026 5:36:42 AM

Recommend using AI for Solutions rather the Answer(s) submitted here

M
Mogae Malapela
4/8/2026 6:37:56 AM

This is very interesting

A
Anon
4/6/2026 5:22:54 PM

Are these the same questions you have to pay for in ExamTopics?

L
LRK
3/22/2026 2:38:08 PM

For Question 7 - while the answer description indicates the correct answer, the option no. mentioned is incorrect. Nice and Comprehensive. Thankyou

R
Rian
3/19/2026 9:12:10 AM

This is very good and accurate. Explanation is very helpful even thou some are not 100% right but good enough to pass.

G
Gerrard
3/18/2026 6:58:37 AM

The DP-900 exam can be tricky if you aren't familiar with Microsoft’s specific cloud terminology. I used the practice questions from free-braindumps.com and found them incredibly helpful. The site breaks down core data concepts and Azure services in a way that actually mirrors the real test. As a resutl I passed my exam.

V
Vineet Kumar
3/6/2026 5:26:16 AM

interesting

J
Joe
1/20/2026 8:25:24 AM

Passed this exam 2 days ago. These questions are in the exam. You are safe to use them.

N
NJ
12/24/2025 10:39:07 AM

Helpful to test your preparedness before giving exam

A
Ashwini
12/17/2025 8:24:45 AM

Really helped

J
Jagadesh
12/16/2025 9:57:10 AM

Good explanation

S
shobha
11/29/2025 2:19:59 AM

very helpful

P
Pandithurai
11/12/2025 12:16:21 PM

Question 1, Ans is - Developer,Standard,Professional Direct and Premier

E
Einstein
11/8/2025 4:13:37 AM

Passed this exam in first appointment. Great resource and valid exam dump.

D
David
10/31/2025 4:06:16 PM

Today I wrote this exam and passed, i totally relay on this practice exam. The questions were very tough, these questions are valid and I encounter the same.

T
Thor
10/21/2025 5:16:29 AM

Anyone used this dump recently?

V
Vladimir
9/25/2025 9:11:14 AM

173 question is A not D

K
khaos
9/21/2025 7:07:26 AM

nice questions

K
Katiso Lehasa
9/15/2025 11:21:52 PM

Thanks for the practice questions they helped me a lot.

E
Einstein
9/2/2025 7:42:00 PM

Passed this exam today. All questions are valid and this is not something you can find in ChatGPT.

V
vito
8/22/2025 4:16:51 AM

i need to pass exam for VMware 2V0-11.25

AI Tutor 👋 I’m here to help!