312-50v13 practice examsIn development
Certified Ethical Hacker v13
EC-Council's CEH certification validates skills in understanding and using hacking tools and techniques to assess the security posture of systems. Version 13 incorporates AI-driven ethical hacking, covering modern attack surfaces including cloud, IoT, and AI-powered threats.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Introduction to Ethical Hacking | 6% |
| Footprinting and Reconnaissance | 6% |
| Scanning Networks | 5% |
| Enumeration | 5% |
| Vulnerability Analysis | 5% |
| System Hacking | 7% |
| Malware Threats | 5% |
| Sniffing | 5% |
| Social Engineering | 5% |
| Denial-of-Service | 4% |
| Session Hijacking | 4% |
| Evading IDS, Firewalls, and Honeypots | 4% |
| Hacking Web Servers | 5% |
| Hacking Web Applications | 8% |
| SQL Injection | 5% |
| Hacking Wireless Networks | 5% |
| Hacking Mobile Platforms | 5% |
| IoT and OT Hacking | 4% |
| Cloud Computing | 5% |
| Cryptography | 5% |
Two sample questions
1. An attacker discovers that a web application uses JWT tokens for authentication. The attacker modifies the JWT header to use 'alg: none' and removes the signature. If accepted, what vulnerability is this?
- SQL injection
- XSS
- JWT algorithm confusion / none algorithm vulnerability — correct
- CSRF
Why: The JWT 'none' algorithm vulnerability occurs when a server accepts tokens with no signature verification. The attacker changes the algorithm to 'none', modifies the payload (e.g., changing user role to admin), and strips the signature. Vulnerable libraries accept this as valid.
2. An attacker sends a crafted request that makes the server fetch data from an internal microservice at 'http://internal-api:8080/admin'. What vulnerability is this?
- Remote file inclusion loading external scripts into the application through manipulated include paths
- XML External Entity injection processing malicious XML to access internal files and services on the server
- Open redirect manipulating URL parameters to redirect users from the legitimate site to a malicious one
- Server-Side Request Forgery making the server issue requests to internal resources on the attacker's behalf — correct
Why: SSRF (Server-Side Request Forgery) exploits server-side request functionality to make the server access internal resources. The attacker leverages the server's network position to reach internal services not directly accessible from the internet.
The real 312-50v13 exam
| Length | 240 minutes |
|---|---|
| Questions | 125 multiple-choice questions |
| Pass mark | 60-85% (scaled scoring based on difficulty) |
| Price | $1,199 USD (exam voucher) |
| Recommended before you sit it | 2 years of information security experience recommended, or official EC-Council training |
| Valid for | 3 years |
Exam facts as published by EC-Council; always check the vendor’s page before you book.
Study 312-50v13 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.